lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <310975db928bbd57411da9ff18746df8836fe642.camel@gmail.com>
Date: Fri, 09 May 2025 13:47:41 +0100
From: Nuno Sá <noname.nuno@...il.com>
To: Antoniu Miclaus <antoniu.miclaus@...log.com>, jic23@...nel.org, 
	linux-iio@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] iio: adc: ad4851: fix ad4858 chan pointer handling

On Fri, 2025-05-09 at 13:16 +0300, Antoniu Miclaus wrote:
> The pointer returned from ad4851_parse_channels_common() is incremented
> internally as each channel is populated. In ad4858_parse_channels(),
> the same pointer was further incremented while setting ext_scan_type
> fields for each channel. This resulted in indio_dev->channels being set
> to a pointer past the end of the allocated array, potentially causing
> memory corruption or undefined behavior.
> 
> Fix this by iterating over the channels using an explicit index instead
> of incrementing the pointer. This preserves the original base pointer
> and ensures all channel metadata is set correctly.
> 
> Fixes: 6250803fe2ec ("iio: adc: ad4851: add ad485x driver")
> Signed-off-by: Antoniu Miclaus <antoniu.miclaus@...log.com>
> ---

LGTM

Reviewed-by: Nuno Sá <nuno.sa@...log.com>

>  drivers/iio/adc/ad4851.c | 14 +++++++-------
>  1 file changed, 7 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/iio/adc/ad4851.c b/drivers/iio/adc/ad4851.c
> index 98ebc853db79..f1d2e2896f2a 100644
> --- a/drivers/iio/adc/ad4851.c
> +++ b/drivers/iio/adc/ad4851.c
> @@ -1034,7 +1034,7 @@ static int ad4858_parse_channels(struct iio_dev
> *indio_dev)
>  	struct device *dev = &st->spi->dev;
>  	struct iio_chan_spec *ad4851_channels;
>  	const struct iio_chan_spec ad4851_chan = AD4858_IIO_CHANNEL;
> -	int ret;
> +	int ret, i = 0;
>  
>  	ret = ad4851_parse_channels_common(indio_dev, &ad4851_channels,
>  					   ad4851_chan);
> @@ -1042,15 +1042,15 @@ static int ad4858_parse_channels(struct iio_dev
> *indio_dev)
>  		return ret;
>  
>  	device_for_each_child_node_scoped(dev, child) {
> -		ad4851_channels->has_ext_scan_type = 1;
> +		ad4851_channels[i].has_ext_scan_type = 1;
>  		if (fwnode_property_read_bool(child, "bipolar")) {
> -			ad4851_channels->ext_scan_type =
> ad4851_scan_type_20_b;
> -			ad4851_channels->num_ext_scan_type =
> ARRAY_SIZE(ad4851_scan_type_20_b);
> +			ad4851_channels[i].ext_scan_type =
> ad4851_scan_type_20_b;
> +			ad4851_channels[i].num_ext_scan_type =
> ARRAY_SIZE(ad4851_scan_type_20_b);
>  		} else {
> -			ad4851_channels->ext_scan_type =
> ad4851_scan_type_20_u;
> -			ad4851_channels->num_ext_scan_type =
> ARRAY_SIZE(ad4851_scan_type_20_u);
> +			ad4851_channels[i].ext_scan_type =
> ad4851_scan_type_20_u;
> +			ad4851_channels[i].num_ext_scan_type =
> ARRAY_SIZE(ad4851_scan_type_20_u);
>  		}
> -		ad4851_channels++;
> +		i++;
>  	}
>  
>  	indio_dev->channels = ad4851_channels;

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ