linux-kernel - Re: [PATCH 1/2] iio: Fix the sorting functionality in iio_gts_build_avail_time

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 29 Apr 2024 09:40:43 +0300
From: Matti Vaittinen <mazziesaccount@...il.com>
To: Matti Vaittinen <matti.vaittinen@...rohmeurope.com>
Cc: Jonathan Cameron <jic23@...nel.org>, Lars-Peter Clausen
 <lars@...afoo.de>, linux-iio@...r.kernel.org, linux-kernel@...r.kernel.org,
 Chenyuan Yang <chenyuan0y@...il.com>
Subject: Re: [PATCH 1/2] iio: Fix the sorting functionality in
 iio_gts_build_avail_time_table

On 4/29/24 09:29, Chenyuan Yang wrote:
> The sorting in iio_gts_build_avail_time_table is not working as intended.
> It could result in an out-of-bounds access when the time is zero.
> 
> Here are more details:
> 
> 1. When the gts->itime_table[i].time_us is zero, e.g., the time
> sequence is `3, 0, 1`, the inner for-loop will not terminate and do
> out-of-bound writes. This is because once `times[j] > new`, the value
> `new` will be added in the current position and the `times[j]` will be
> moved to `j+1` position, which makes the if-condition always hold.
> Meanwhile, idx will be added one, making the loop keep running without
> termination and out-of-bound write.
> 2. If none of the gts->itime_table[i].time_us is zero, the elements
> will just be copied without being sorted as described in the comment
> "Sort times from all tables to one and remove duplicates".
> 
> For more details, please refer to
> https://lore.kernel.org/all/6dd0d822-046c-4dd2-9532-79d7ab96ec05@gmail.com.
> 
> Reported-by: Chenyuan Yang <chenyuan0y@...il.com>
> Suggested-by: Matti Vaittinen <mazziesaccount@...il.com>
> Fixes: 38416c28e168 ("iio: light: Add gain-time-scale helpers")
> Co-developed-by: Chenyuan Yang <chenyuan0y@...il.com>
> Signed-off-by: Chenyuan Yang <chenyuan0y@...il.com>
> Co-developed-by: Matti Vaittinen <mazziesaccount@...il.com>
> Signed-off-by: Matti Vaittinen <mazziesaccount@...il.com> 

Huh. I had never before sent a patch with co-authored tags. Just to 
ensure there is no misunderstandings - I did send this patch mail. I 
added the From: tag as was suggested in:
https://www.kernel.org/doc/html/latest/process/submitting-patches.html

I am afraid mutt picked the email sender from this tag - which does not 
fee like correct thing to do! Sorry! I did not intend to impersonate 
Chenyuan!

Yours,
	-- Matti

-- 
Matti Vaittinen
Linux kernel developer at ROHM Semiconductors
Oulu Finland

~~ When things go utterly wrong vim users can always type :help! ~~