lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 30 Jan 2022 14:19:42 +0000 From: Jonathan Cameron <jic23@...nel.org> To: "Tanislav, Cosmin" <Cosmin.Tanislav@...log.com> Cc: Kees Cook <keescook@...omium.org>, Lars-Peter Clausen <lars@...afoo.de>, "Hennerich, Michael" <Michael.Hennerich@...log.com>, "linux-iio@...r.kernel.org" <linux-iio@...r.kernel.org>, Jonathan Cameron <Jonathan.Cameron@...wei.com>, Linus Walleij <linus.walleij@...aro.org>, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "linux-hardening@...r.kernel.org" <linux-hardening@...r.kernel.org> Subject: Re: [PATCH v2] iio: addac: ad74413r: Do not reference negative array offsets On Thu, 13 Jan 2022 21:57:22 +0000 "Tanislav, Cosmin" <Cosmin.Tanislav@...log.com> wrote: > Reviewed-by: Cosmin Tanislav <cosmin.tanislav@...log.com> Applied to the fixes-togreg branch of iio.git. Thanks, Jonathan > > > -----Original Message----- > > From: Kees Cook <keescook@...omium.org> > > Sent: Wednesday, January 12, 2022 10:35 PM > > To: Lars-Peter Clausen <lars@...afoo.de> > > Cc: Kees Cook <keescook@...omium.org>; Hennerich, Michael > > <Michael.Hennerich@...log.com>; Jonathan Cameron <jic23@...nel.org>; > > linux-iio@...r.kernel.org; Tanislav, Cosmin <Cosmin.Tanislav@...log.com>; > > Jonathan Cameron <Jonathan.Cameron@...wei.com>; Linus Walleij > > <linus.walleij@...aro.org>; linux-kernel@...r.kernel.org; linux- > > hardening@...r.kernel.org > > Subject: [PATCH v2] iio: addac: ad74413r: Do not reference negative array > > offsets > > > > [External] > > > > Instead of aiming rx_buf at an invalid array-boundary-crossing location, > > just skip the first increment. Seen when building with -Warray-bounds: > > > > drivers/iio/addac/ad74413r.c: In function 'ad74413r_update_scan_mode': > > drivers/iio/addac/ad74413r.c:843:22: warning: array subscript -4 is below > > array bounds of 'u8[16]' { aka 'unsigned char[16]'} [-Warray-bounds] > > 843 | u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 * > > AD74413R_FRAME_SIZE]; > > | > > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > drivers/iio/addac/ad74413r.c:84:20: note: while referencing 'rx_buf' > > 84 | u8 rx_buf[AD74413R_FRAME_SIZE * > > AD74413R_CHANNEL_MAX]; > > | ^~~~~~ > > > > Cc: Lars-Peter Clausen <lars@...afoo.de> > > Cc: Michael Hennerich <Michael.Hennerich@...log.com> > > Cc: Jonathan Cameron <jic23@...nel.org> > > Cc: linux-iio@...r.kernel.org > > Fixes: fea251b6a5db ("iio: addac: add AD74413R driver") > > Reviewed-by: Cosmin Tanislav <cosmin.tanislav@...log.com> > > Signed-off-by: Kees Cook <keescook@...omium.org> > > --- > > v1: https://urldefense.com/v3/__https://lore.kernel.org/linux- > > hardening/20220105180214.2435001-1- > > keescook@...omium.org/__;!!A3Ni8CS0y2Y!oWs0KcGPANFn- > > L0qJPZgP47AQIYpBXJxg5LHiLDFGa_-SI2DwmSMzjgl3ehyu-8JYPgq$ > > v2: > > - Update commit Subject prefix > > - add Reviewed-by > > --- > > drivers/iio/addac/ad74413r.c | 7 ++++--- > > 1 file changed, 4 insertions(+), 3 deletions(-) > > > > diff --git a/drivers/iio/addac/ad74413r.c b/drivers/iio/addac/ad74413r.c > > index 5271073bb74e..aba9a643a4ca 100644 > > --- a/drivers/iio/addac/ad74413r.c > > +++ b/drivers/iio/addac/ad74413r.c > > @@ -840,7 +840,7 @@ static int ad74413r_update_scan_mode(struct iio_dev > > *indio_dev, > > { > > struct ad74413r_state *st = iio_priv(indio_dev); > > struct spi_transfer *xfer = st->adc_samples_xfer; > > - u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 * > > AD74413R_FRAME_SIZE]; > > + u8 *rx_buf = st->adc_samples_buf.rx_buf; > > u8 *tx_buf = st->adc_samples_tx_buf; > > unsigned int channel; > > int ret = -EINVAL; > > @@ -894,9 +894,10 @@ static int ad74413r_update_scan_mode(struct > > iio_dev *indio_dev, > > > > spi_message_add_tail(xfer, &st->adc_samples_msg); > > > > - xfer++; > > tx_buf += AD74413R_FRAME_SIZE; > > - rx_buf += AD74413R_FRAME_SIZE; > > + if (xfer != st->adc_samples_xfer) > > + rx_buf += AD74413R_FRAME_SIZE; > > + xfer++; > > } > > > > xfer->rx_buf = rx_buf; > > -- > > 2.30.2 >
Powered by blists - more mailing lists