linux-kernel - [PATCH 11/15] iio: ti_am335x_adc: Print error and handle short FIFO events

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 18 Jul 2013 23:21:22 +0100
From:	Zubair Lutfullah <zubair.lutfullah@...il.com>
To:	jic23@....ac.uk
Cc:	gregkh@...uxfoundation.org, linux-iio@...r.kernel.org,
	linux-kernel@...r.kernel.org, koen@...inion.thruhere.net
Subject: [PATCH 11/15] iio: ti_am335x_adc: Print error and handle short FIFO events

From: Russ Dill <Russ.Dill@...com>

In the case that the FIFO threshold handler gets called when the
FIFO has not actually reached the threshold, the driver will pass
uninitialized memory to the IIO subsystem.
In the past, this would occur due to bugs in the driver, those bugs
have been fixed. However, it is still a good idea to close this just
in case additional bugs in hardware or software exist.

Signed-off-by: Russ Dill <Russ.Dill@...com>
Signed-off-by: Zubair Lutfullah <zubair.lutfullah@...il.com>
---
 drivers/iio/adc/ti_am335x_adc.c |    7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index 6957011..1b0af2a 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -203,6 +203,13 @@ static void tiadc_poll_handler(struct work_struct *work_s)
 	u32 *inputbuffer;
 
 	fifo1count = tiadc_readl(adc_dev, REG_FIFO1CNT);
+	if (fifo1count * sizeof(u32) <
+				buffer->access->get_bytes_per_datum(buffer)) {
+		dev_err(adc_dev->mfd_tscadc->dev, "%s: Short FIFO event\n",
+								__func__);
+		goto out;
+	}
+
 	inputbuffer = kmalloc((fifo1count + 1) * sizeof(u32), GFP_KERNEL);
 	if (inputbuffer == NULL)
 		return;
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/