All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v2] iio: addac: ad74413r: Do not reference negative array offsets
@ 2022-01-12 20:34 Kees Cook
  2022-01-13 21:57 ` Tanislav, Cosmin
  0 siblings, 1 reply; 3+ messages in thread
From: Kees Cook @ 2022-01-12 20:34 UTC (permalink / raw)
  To: Lars-Peter Clausen
  Cc: Kees Cook, Michael Hennerich, Jonathan Cameron, linux-iio,
	Cosmin Tanislav, Jonathan Cameron, Linus Walleij, linux-kernel,
	linux-hardening

Instead of aiming rx_buf at an invalid array-boundary-crossing location,
just skip the first increment. Seen when building with -Warray-bounds:

drivers/iio/addac/ad74413r.c: In function 'ad74413r_update_scan_mode':
drivers/iio/addac/ad74413r.c:843:22: warning: array subscript -4 is below array bounds of 'u8[16]' { aka 'unsigned char[16]'} [-Warray-bounds]
  843 |         u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 * AD74413R_FRAME_SIZE];
      |                      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/iio/addac/ad74413r.c:84:20: note: while referencing 'rx_buf'
   84 |                 u8 rx_buf[AD74413R_FRAME_SIZE * AD74413R_CHANNEL_MAX];
      |                    ^~~~~~

Cc: Lars-Peter Clausen <lars@metafoo.de>
Cc: Michael Hennerich <Michael.Hennerich@analog.com>
Cc: Jonathan Cameron <jic23@kernel.org>
Cc: linux-iio@vger.kernel.org
Fixes: fea251b6a5db ("iio: addac: add AD74413R driver")
Reviewed-by: Cosmin Tanislav <cosmin.tanislav@analog.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
---
v1: https://lore.kernel.org/linux-hardening/20220105180214.2435001-1-keescook@chromium.org/
v2:
 - Update commit Subject prefix
 - add Reviewed-by
---
 drivers/iio/addac/ad74413r.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/iio/addac/ad74413r.c b/drivers/iio/addac/ad74413r.c
index 5271073bb74e..aba9a643a4ca 100644
--- a/drivers/iio/addac/ad74413r.c
+++ b/drivers/iio/addac/ad74413r.c
@@ -840,7 +840,7 @@ static int ad74413r_update_scan_mode(struct iio_dev *indio_dev,
 {
 	struct ad74413r_state *st = iio_priv(indio_dev);
 	struct spi_transfer *xfer = st->adc_samples_xfer;
-	u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 * AD74413R_FRAME_SIZE];
+	u8 *rx_buf = st->adc_samples_buf.rx_buf;
 	u8 *tx_buf = st->adc_samples_tx_buf;
 	unsigned int channel;
 	int ret = -EINVAL;
@@ -894,9 +894,10 @@ static int ad74413r_update_scan_mode(struct iio_dev *indio_dev,
 
 		spi_message_add_tail(xfer, &st->adc_samples_msg);
 
-		xfer++;
 		tx_buf += AD74413R_FRAME_SIZE;
-		rx_buf += AD74413R_FRAME_SIZE;
+		if (xfer != st->adc_samples_xfer)
+			rx_buf += AD74413R_FRAME_SIZE;
+		xfer++;
 	}
 
 	xfer->rx_buf = rx_buf;
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 3+ messages in thread
* RE: [PATCH v2] iio: addac: ad74413r: Do not reference negative array offsets
  2022-01-12 20:34 [PATCH v2] iio: addac: ad74413r: Do not reference negative array offsets Kees Cook
@ 2022-01-13 21:57 ` Tanislav, Cosmin
  2022-01-30 14:19   ` Jonathan Cameron
  0 siblings, 1 reply; 3+ messages in thread
From: Tanislav, Cosmin @ 2022-01-13 21:57 UTC (permalink / raw)
  To: Kees Cook, Lars-Peter Clausen
  Cc: Hennerich, Michael, Jonathan Cameron, linux-iio,
	Jonathan Cameron, Linus Walleij, linux-kernel, linux-hardening

Reviewed-by: Cosmin Tanislav <cosmin.tanislav@analog.com>

> -----Original Message-----
> From: Kees Cook <keescook@chromium.org>
> Sent: Wednesday, January 12, 2022 10:35 PM
> To: Lars-Peter Clausen <lars@metafoo.de>
> Cc: Kees Cook <keescook@chromium.org>; Hennerich, Michael
> <Michael.Hennerich@analog.com>; Jonathan Cameron <jic23@kernel.org>;
> linux-iio@vger.kernel.org; Tanislav, Cosmin <Cosmin.Tanislav@analog.com>;
> Jonathan Cameron <Jonathan.Cameron@huawei.com>; Linus Walleij
> <linus.walleij@linaro.org>; linux-kernel@vger.kernel.org; linux-
> hardening@vger.kernel.org
> Subject: [PATCH v2] iio: addac: ad74413r: Do not reference negative array
> offsets
> 
> [External]
> 
> Instead of aiming rx_buf at an invalid array-boundary-crossing location,
> just skip the first increment. Seen when building with -Warray-bounds:
> 
> drivers/iio/addac/ad74413r.c: In function 'ad74413r_update_scan_mode':
> drivers/iio/addac/ad74413r.c:843:22: warning: array subscript -4 is below
> array bounds of 'u8[16]' { aka 'unsigned char[16]'} [-Warray-bounds]
>   843 |         u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 *
> AD74413R_FRAME_SIZE];
>       |
> ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> drivers/iio/addac/ad74413r.c:84:20: note: while referencing 'rx_buf'
>    84 |                 u8 rx_buf[AD74413R_FRAME_SIZE *
> AD74413R_CHANNEL_MAX];
>       |                    ^~~~~~
> 
> Cc: Lars-Peter Clausen <lars@metafoo.de>
> Cc: Michael Hennerich <Michael.Hennerich@analog.com>
> Cc: Jonathan Cameron <jic23@kernel.org>
> Cc: linux-iio@vger.kernel.org
> Fixes: fea251b6a5db ("iio: addac: add AD74413R driver")
> Reviewed-by: Cosmin Tanislav <cosmin.tanislav@analog.com>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> v1: https://urldefense.com/v3/__https://lore.kernel.org/linux-
> hardening/20220105180214.2435001-1-
> keescook@chromium.org/__;!!A3Ni8CS0y2Y!oWs0KcGPANFn-
> L0qJPZgP47AQIYpBXJxg5LHiLDFGa_-SI2DwmSMzjgl3ehyu-8JYPgq$
> v2:
>  - Update commit Subject prefix
>  - add Reviewed-by
> ---
>  drivers/iio/addac/ad74413r.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/iio/addac/ad74413r.c b/drivers/iio/addac/ad74413r.c
> index 5271073bb74e..aba9a643a4ca 100644
> --- a/drivers/iio/addac/ad74413r.c
> +++ b/drivers/iio/addac/ad74413r.c
> @@ -840,7 +840,7 @@ static int ad74413r_update_scan_mode(struct iio_dev
> *indio_dev,
>  {
>  	struct ad74413r_state *st = iio_priv(indio_dev);
>  	struct spi_transfer *xfer = st->adc_samples_xfer;
> -	u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 *
> AD74413R_FRAME_SIZE];
> +	u8 *rx_buf = st->adc_samples_buf.rx_buf;
>  	u8 *tx_buf = st->adc_samples_tx_buf;
>  	unsigned int channel;
>  	int ret = -EINVAL;
> @@ -894,9 +894,10 @@ static int ad74413r_update_scan_mode(struct
> iio_dev *indio_dev,
> 
>  		spi_message_add_tail(xfer, &st->adc_samples_msg);
> 
> -		xfer++;
>  		tx_buf += AD74413R_FRAME_SIZE;
> -		rx_buf += AD74413R_FRAME_SIZE;
> +		if (xfer != st->adc_samples_xfer)
> +			rx_buf += AD74413R_FRAME_SIZE;
> +		xfer++;
>  	}
> 
>  	xfer->rx_buf = rx_buf;
> --
> 2.30.2


^ permalink raw reply	[flat|nested] 3+ messages in thread
* Re: [PATCH v2] iio: addac: ad74413r: Do not reference negative array offsets
  2022-01-13 21:57 ` Tanislav, Cosmin
@ 2022-01-30 14:19   ` Jonathan Cameron
  0 siblings, 0 replies; 3+ messages in thread
From: Jonathan Cameron @ 2022-01-30 14:19 UTC (permalink / raw)
  To: Tanislav, Cosmin
  Cc: Kees Cook, Lars-Peter Clausen, Hennerich, Michael, linux-iio,
	Jonathan Cameron, Linus Walleij, linux-kernel, linux-hardening

On Thu, 13 Jan 2022 21:57:22 +0000
"Tanislav, Cosmin" <Cosmin.Tanislav@analog.com> wrote:

> Reviewed-by: Cosmin Tanislav <cosmin.tanislav@analog.com>

Applied to the fixes-togreg branch of iio.git.

Thanks,

Jonathan

> 
> > -----Original Message-----
> > From: Kees Cook <keescook@chromium.org>
> > Sent: Wednesday, January 12, 2022 10:35 PM
> > To: Lars-Peter Clausen <lars@metafoo.de>
> > Cc: Kees Cook <keescook@chromium.org>; Hennerich, Michael
> > <Michael.Hennerich@analog.com>; Jonathan Cameron <jic23@kernel.org>;
> > linux-iio@vger.kernel.org; Tanislav, Cosmin <Cosmin.Tanislav@analog.com>;
> > Jonathan Cameron <Jonathan.Cameron@huawei.com>; Linus Walleij
> > <linus.walleij@linaro.org>; linux-kernel@vger.kernel.org; linux-
> > hardening@vger.kernel.org
> > Subject: [PATCH v2] iio: addac: ad74413r: Do not reference negative array
> > offsets
> > 
> > [External]
> > 
> > Instead of aiming rx_buf at an invalid array-boundary-crossing location,
> > just skip the first increment. Seen when building with -Warray-bounds:
> > 
> > drivers/iio/addac/ad74413r.c: In function 'ad74413r_update_scan_mode':
> > drivers/iio/addac/ad74413r.c:843:22: warning: array subscript -4 is below
> > array bounds of 'u8[16]' { aka 'unsigned char[16]'} [-Warray-bounds]
> >   843 |         u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 *
> > AD74413R_FRAME_SIZE];
> >       |
> > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > drivers/iio/addac/ad74413r.c:84:20: note: while referencing 'rx_buf'
> >    84 |                 u8 rx_buf[AD74413R_FRAME_SIZE *
> > AD74413R_CHANNEL_MAX];
> >       |                    ^~~~~~
> > 
> > Cc: Lars-Peter Clausen <lars@metafoo.de>
> > Cc: Michael Hennerich <Michael.Hennerich@analog.com>
> > Cc: Jonathan Cameron <jic23@kernel.org>
> > Cc: linux-iio@vger.kernel.org
> > Fixes: fea251b6a5db ("iio: addac: add AD74413R driver")
> > Reviewed-by: Cosmin Tanislav <cosmin.tanislav@analog.com>
> > Signed-off-by: Kees Cook <keescook@chromium.org>
> > ---
> > v1: https://urldefense.com/v3/__https://lore.kernel.org/linux-
> > hardening/20220105180214.2435001-1-
> > keescook@chromium.org/__;!!A3Ni8CS0y2Y!oWs0KcGPANFn-
> > L0qJPZgP47AQIYpBXJxg5LHiLDFGa_-SI2DwmSMzjgl3ehyu-8JYPgq$
> > v2:
> >  - Update commit Subject prefix
> >  - add Reviewed-by
> > ---
> >  drivers/iio/addac/ad74413r.c | 7 ++++---
> >  1 file changed, 4 insertions(+), 3 deletions(-)
> > 
> > diff --git a/drivers/iio/addac/ad74413r.c b/drivers/iio/addac/ad74413r.c
> > index 5271073bb74e..aba9a643a4ca 100644
> > --- a/drivers/iio/addac/ad74413r.c
> > +++ b/drivers/iio/addac/ad74413r.c
> > @@ -840,7 +840,7 @@ static int ad74413r_update_scan_mode(struct iio_dev
> > *indio_dev,
> >  {
> >  	struct ad74413r_state *st = iio_priv(indio_dev);
> >  	struct spi_transfer *xfer = st->adc_samples_xfer;
> > -	u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 *
> > AD74413R_FRAME_SIZE];
> > +	u8 *rx_buf = st->adc_samples_buf.rx_buf;
> >  	u8 *tx_buf = st->adc_samples_tx_buf;
> >  	unsigned int channel;
> >  	int ret = -EINVAL;
> > @@ -894,9 +894,10 @@ static int ad74413r_update_scan_mode(struct
> > iio_dev *indio_dev,
> > 
> >  		spi_message_add_tail(xfer, &st->adc_samples_msg);
> > 
> > -		xfer++;
> >  		tx_buf += AD74413R_FRAME_SIZE;
> > -		rx_buf += AD74413R_FRAME_SIZE;
> > +		if (xfer != st->adc_samples_xfer)
> > +			rx_buf += AD74413R_FRAME_SIZE;
> > +		xfer++;
> >  	}
> > 
> >  	xfer->rx_buf = rx_buf;
> > --
> > 2.30.2  
> 


^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-01-30 14:13 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-12 20:34 [PATCH v2] iio: addac: ad74413r: Do not reference negative array offsets Kees Cook
2022-01-13 21:57 ` Tanislav, Cosmin
2022-01-30 14:19   ` Jonathan Cameron

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.