linux-kernel - Re: [PATCH] iio: adc: ad4851: fix ad4858 chan pointer handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <310975db928bbd57411da9ff18746df8836fe642.camel@gmail.com>
Date: Fri, 09 May 2025 13:47:41 +0100
From: Nuno Sá <noname.nuno@...il.com>
To: Antoniu Miclaus <antoniu.miclaus@...log.com>, jic23@...nel.org, 
	linux-iio@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] iio: adc: ad4851: fix ad4858 chan pointer handling

On Fri, 2025-05-09 at 13:16 +0300, Antoniu Miclaus wrote:
> The pointer returned from ad4851_parse_channels_common() is incremented
> internally as each channel is populated. In ad4858_parse_channels(),
> the same pointer was further incremented while setting ext_scan_type
> fields for each channel. This resulted in indio_dev->channels being set
> to a pointer past the end of the allocated array, potentially causing
> memory corruption or undefined behavior.
> 
> Fix this by iterating over the channels using an explicit index instead
> of incrementing the pointer. This preserves the original base pointer
> and ensures all channel metadata is set correctly.
> 
> Fixes: 6250803fe2ec ("iio: adc: ad4851: add ad485x driver")
> Signed-off-by: Antoniu Miclaus <antoniu.miclaus@...log.com>
> ---

LGTM

Reviewed-by: Nuno Sá <nuno.sa@...log.com>

>  drivers/iio/adc/ad4851.c | 14 +++++++-------
>  1 file changed, 7 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/iio/adc/ad4851.c b/drivers/iio/adc/ad4851.c
> index 98ebc853db79..f1d2e2896f2a 100644
> --- a/drivers/iio/adc/ad4851.c
> +++ b/drivers/iio/adc/ad4851.c
> @@ -1034,7 +1034,7 @@ static int ad4858_parse_channels(struct iio_dev
> *indio_dev)
>  	struct device *dev = &st->spi->dev;
>  	struct iio_chan_spec *ad4851_channels;
>  	const struct iio_chan_spec ad4851_chan = AD4858_IIO_CHANNEL;
> -	int ret;
> +	int ret, i = 0;
>  
>  	ret = ad4851_parse_channels_common(indio_dev, &ad4851_channels,
>  					   ad4851_chan);
> @@ -1042,15 +1042,15 @@ static int ad4858_parse_channels(struct iio_dev
> *indio_dev)
>  		return ret;
>  
>  	device_for_each_child_node_scoped(dev, child) {
> -		ad4851_channels->has_ext_scan_type = 1;
> +		ad4851_channels[i].has_ext_scan_type = 1;
>  		if (fwnode_property_read_bool(child, "bipolar")) {
> -			ad4851_channels->ext_scan_type =
> ad4851_scan_type_20_b;
> -			ad4851_channels->num_ext_scan_type =
> ARRAY_SIZE(ad4851_scan_type_20_b);
> +			ad4851_channels[i].ext_scan_type =
> ad4851_scan_type_20_b;
> +			ad4851_channels[i].num_ext_scan_type =
> ARRAY_SIZE(ad4851_scan_type_20_b);
>  		} else {
> -			ad4851_channels->ext_scan_type =
> ad4851_scan_type_20_u;
> -			ad4851_channels->num_ext_scan_type =
> ARRAY_SIZE(ad4851_scan_type_20_u);
> +			ad4851_channels[i].ext_scan_type =
> ad4851_scan_type_20_u;
> +			ad4851_channels[i].num_ext_scan_type =
> ARRAY_SIZE(ad4851_scan_type_20_u);
>  		}
> -		ad4851_channels++;
> +		i++;
>  	}
>  
>  	indio_dev->channels = ad4851_channels;