[PATCH] STAGING:iio:light: V2 fix out of bounds reg_cache[] access

[PATCH] STAGING:iio:light: V2 fix out of bounds reg_cache[] access

[Grant Grundler]

V2 Fix out-of-bounds reference to reg_cache[]

Simple fix is to just not cache REG_TEST (offset 8).
Cache doesn't help REG_TEST anyway since we write all 8 bits exactly once
(at resume/init time).

Also fix an "off-by-one" allocation of reg_cache[] array size that
was in the original code before I touched it.

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Grant Grundler <grundler@chromium.org>

----
Thanks again to Dan Carpenter for spotting the out-of-bounds array reference.
V2 preserves "don't touch reg_cache[] on error" behavior.

diff --git a/drivers/staging/iio/light/isl29018.c b/drivers/staging/iio/light/isl29018.c
index 0f97734..b24d28c 100644
--- a/drivers/staging/iio/light/isl29018.c
+++ b/drivers/staging/iio/light/isl29018.c
@@ -51,7 +51,7 @@
 
 #define ISL29018_REG_ADD_DATA_LSB	0x02
 #define ISL29018_REG_ADD_DATA_MSB	0x03
-#define ISL29018_MAX_REGS		ISL29018_REG_ADD_DATA_MSB
+#define ISL29018_MAX_REGS		(ISL29018_REG_ADD_DATA_MSB+1)
 
 #define ISL29018_REG_TEST		0x08
 #define ISL29018_TEST_SHIFT		0
@@ -71,22 +71,27 @@ struct isl29018_chip {
 static int isl29018_write_data(struct i2c_client *client, u8 reg,
 			u8 val, u8 mask, u8 shift)
 {
-	u8 regval;
-	int ret = 0;
+	u8 regval = val;
+	int ret;
 	struct isl29018_chip *chip = i2c_get_clientdata(client);
 
-	regval = chip->reg_cache[reg];
-	regval &= ~mask;
-	regval |= val << shift;
+	/* don't cache or mask REG_TEST */
+	if (reg < ISL29018_MAX_REGS) {
+		regval = chip->reg_cache[reg];
+		regval &= ~mask;
+		regval |= val << shift;
+	}
 
 	ret = i2c_smbus_write_byte_data(client, reg, regval);
-	if (ret) {
+	if (ret)
 		dev_err(&client->dev, "Write to device fails status %x\n", ret);
-		return ret;
+	else {
+		/* don't update cache on err */
+		if (reg < ISL29018_MAX_REGS)
+			chip->reg_cache[reg] = regval;
 	}
-	chip->reg_cache[reg] = regval;
 
-	return 0;
+	return ret;
 }
 
 static int isl29018_set_range(struct i2c_client *client, unsigned long range,

Re: [PATCH] STAGING:iio:light: V2 fix out of bounds reg_cache[] access

[Jonathan Cameron]

On 08/31/11 00:55, Grant Grundler wrote:
> V2 Fix out-of-bounds reference to reg_cache[]
> 
> Simple fix is to just not cache REG_TEST (offset 8).
> Cache doesn't help REG_TEST anyway since we write all 8 bits exactly once
> (at resume/init time).
> 
> Also fix an "off-by-one" allocation of reg_cache[] array size that
> was in the original code before I touched it.
> 
Looks good to me. Thanks.
> Reported-by: Dan Carpenter <error27@gmail.com>
> Signed-off-by: Grant Grundler <grundler@chromium.org>
Acked-by: Jonathan Cameron <jic23@cam.ac.uk>
> 
> ----
> Thanks again to Dan Carpenter for spotting the out-of-bounds array reference.
> V2 preserves "don't touch reg_cache[] on error" behavior.
> 
> diff --git a/drivers/staging/iio/light/isl29018.c b/drivers/staging/iio/light/isl29018.c
> index 0f97734..b24d28c 100644
> --- a/drivers/staging/iio/light/isl29018.c
> +++ b/drivers/staging/iio/light/isl29018.c
> @@ -51,7 +51,7 @@
>  
>  #define ISL29018_REG_ADD_DATA_LSB	0x02
>  #define ISL29018_REG_ADD_DATA_MSB	0x03
> -#define ISL29018_MAX_REGS		ISL29018_REG_ADD_DATA_MSB
> +#define ISL29018_MAX_REGS		(ISL29018_REG_ADD_DATA_MSB+1)
>  
>  #define ISL29018_REG_TEST		0x08
>  #define ISL29018_TEST_SHIFT		0
> @@ -71,22 +71,27 @@ struct isl29018_chip {
>  static int isl29018_write_data(struct i2c_client *client, u8 reg,
>  			u8 val, u8 mask, u8 shift)
>  {
> -	u8 regval;
> -	int ret = 0;
> +	u8 regval = val;
> +	int ret;
>  	struct isl29018_chip *chip = i2c_get_clientdata(client);
>  
> -	regval = chip->reg_cache[reg];
> -	regval &= ~mask;
> -	regval |= val << shift;
> +	/* don't cache or mask REG_TEST */
> +	if (reg < ISL29018_MAX_REGS) {
> +		regval = chip->reg_cache[reg];
> +		regval &= ~mask;
> +		regval |= val << shift;
> +	}
>  
>  	ret = i2c_smbus_write_byte_data(client, reg, regval);
> -	if (ret) {
> +	if (ret)
>  		dev_err(&client->dev, "Write to device fails status %x\n", ret);
> -		return ret;
> +	else {
> +		/* don't update cache on err */
> +		if (reg < ISL29018_MAX_REGS)
> +			chip->reg_cache[reg] = regval;
>  	}
> -	chip->reg_cache[reg] = regval;
>  
> -	return 0;
> +	return ret;
>  }
>  
>  static int isl29018_set_range(struct i2c_client *client, unsigned long range,

Re: [PATCH] STAGING:iio:light: V2 fix out of bounds reg_cache[] access

[Greg KH]

On Tue, Aug 30, 2011 at 04:55:46PM -0700, Grant Grundler wrote:
> V2 Fix out-of-bounds reference to reg_cache[]
> 
> Simple fix is to just not cache REG_TEST (offset 8).
> Cache doesn't help REG_TEST anyway since we write all 8 bits exactly once
> (at resume/init time).
> 
> Also fix an "off-by-one" allocation of reg_cache[] array size that
> was in the original code before I touched it.
> 
> Reported-by: Dan Carpenter <error27@gmail.com>
> Signed-off-by: Grant Grundler <grundler@chromium.org>
> Acked-by: Jonathan Cameron <jic23@cam.ac.uk>

Jonathan, this no longer applies after your other patches, so could you
queue this up in your tree and resend it in a format that applies?

thanks,

greg k-h

[PATCH] [PATCH] staging:iio:light: V3 fix out of bounds reg_cache[] access

[Jonathan Cameron]

V3 is a straightforward forward port to teh current tree of V2.

Simple fix is to just not cache REG_TEST (offset 8).
Cache doesn't help REG_TEST anyway since we write all 8 bits exactly once
(at resume/init time).

Also fix an "off-by-one" allocation of reg_cache[] array size that
was in the original code before I touched it.

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Grant Grundler <grundler@chromium.org>
Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
---
 drivers/staging/iio/light/isl29018.c |   23 ++++++++++++++---------
 1 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/drivers/staging/iio/light/isl29018.c b/drivers/staging/iio/light/isl29018.c
index f31e8c2..3e9a06c 100644
--- a/drivers/staging/iio/light/isl29018.c
+++ b/drivers/staging/iio/light/isl29018.c
@@ -51,7 +51,7 @@
 
 #define ISL29018_REG_ADD_DATA_LSB	0x02
 #define ISL29018_REG_ADD_DATA_MSB	0x03
-#define ISL29018_MAX_REGS		ISL29018_REG_ADD_DATA_MSB
+#define ISL29018_MAX_REGS		(ISL29018_REG_ADD_DATA_MSB+1)
 
 #define ISL29018_REG_TEST		0x08
 #define ISL29018_TEST_SHIFT		0
@@ -70,22 +70,27 @@ struct isl29018_chip {
 static int isl29018_write_data(struct i2c_client *client, u8 reg,
 			u8 val, u8 mask, u8 shift)
 {
-	u8 regval;
-	int ret = 0;
+	u8 regval = val;
+	int ret;
 	struct isl29018_chip *chip = iio_priv(i2c_get_clientdata(client));
 
-	regval = chip->reg_cache[reg];
-	regval &= ~mask;
-	regval |= val << shift;
+	/* don't cache or mask REG_TEST */
+	if (reg < ISL29018_MAX_REGS) {
+		regval = chip->reg_cache[reg];
+		regval &= ~mask;
+		regval |= val << shift;
+	}
 
 	ret = i2c_smbus_write_byte_data(client, reg, regval);
 	if (ret) {
 		dev_err(&client->dev, "Write to device fails status %x\n", ret);
-		return ret;
+	} else {
+		/* don't update cache on err */
+		if (reg < ISL29018_MAX_REGS)
+			chip->reg_cache[reg] = regval;
 	}
-	chip->reg_cache[reg] = regval;
 
-	return 0;
+	return ret;
 }
 
 static int isl29018_set_range(struct i2c_client *client, unsigned long range,
-- 
1.7.3.4

Re: [PATCH] [PATCH] staging:iio:light: V3 fix out of bounds reg_cache[] access

[Jonathan Cameron]

Grant, please take a quick look at this and check I didn't mess anything up.
Looks like a trivial context change was the issue, but best to be sure!
> V3 is a straightforward forward port to teh current tree of V2.
> 
> Simple fix is to just not cache REG_TEST (offset 8).
> Cache doesn't help REG_TEST anyway since we write all 8 bits exactly once
> (at resume/init time).
> 
> Also fix an "off-by-one" allocation of reg_cache[] array size that
> was in the original code before I touched it.
> 
> Reported-by: Dan Carpenter <error27@gmail.com>
> Signed-off-by: Grant Grundler <grundler@chromium.org>
> Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
> ---
>  drivers/staging/iio/light/isl29018.c |   23 ++++++++++++++---------
>  1 files changed, 14 insertions(+), 9 deletions(-)
> 
> diff --git a/drivers/staging/iio/light/isl29018.c b/drivers/staging/iio/light/isl29018.c
> index f31e8c2..3e9a06c 100644
> --- a/drivers/staging/iio/light/isl29018.c
> +++ b/drivers/staging/iio/light/isl29018.c
> @@ -51,7 +51,7 @@
>  
>  #define ISL29018_REG_ADD_DATA_LSB	0x02
>  #define ISL29018_REG_ADD_DATA_MSB	0x03
> -#define ISL29018_MAX_REGS		ISL29018_REG_ADD_DATA_MSB
> +#define ISL29018_MAX_REGS		(ISL29018_REG_ADD_DATA_MSB+1)
>  
>  #define ISL29018_REG_TEST		0x08
>  #define ISL29018_TEST_SHIFT		0
> @@ -70,22 +70,27 @@ struct isl29018_chip {
>  static int isl29018_write_data(struct i2c_client *client, u8 reg,
>  			u8 val, u8 mask, u8 shift)
>  {
> -	u8 regval;
> -	int ret = 0;
> +	u8 regval = val;
> +	int ret;
>  	struct isl29018_chip *chip = iio_priv(i2c_get_clientdata(client));
>  
> -	regval = chip->reg_cache[reg];
> -	regval &= ~mask;
> -	regval |= val << shift;
> +	/* don't cache or mask REG_TEST */
> +	if (reg < ISL29018_MAX_REGS) {
> +		regval = chip->reg_cache[reg];
> +		regval &= ~mask;
> +		regval |= val << shift;
> +	}
>  
>  	ret = i2c_smbus_write_byte_data(client, reg, regval);
>  	if (ret) {
>  		dev_err(&client->dev, "Write to device fails status %x\n", ret);
> -		return ret;
> +	} else {
> +		/* don't update cache on err */
> +		if (reg < ISL29018_MAX_REGS)
> +			chip->reg_cache[reg] = regval;
>  	}
> -	chip->reg_cache[reg] = regval;
>  
> -	return 0;
> +	return ret;
>  }
>  
>  static int isl29018_set_range(struct i2c_client *client, unsigned long range,

Re: [PATCH] [PATCH] staging:iio:light: V3 fix out of bounds reg_cache[] access

[Grant Grundler]

On Fri, Sep 9, 2011 at 1:54 AM, Jonathan Cameron <jic23@cam.ac.uk> wrote:
> Grant, please take a quick look at this and check I didn't mess anything =
up.

Jonathan,
LGTM. I'm at LPC2011 now and don't have time to "compile test" this.
I'm pretty sure it's correct.

> Looks like a trivial context change was the issue, but best to be sure!

Agreed - thanks for fixing this up and reposting! :)

grant

>> V3 is a straightforward forward port to teh current tree of V2.
>>
>> Simple fix is to just not cache REG_TEST (offset 8).
>> Cache doesn't help REG_TEST anyway since we write all 8 bits exactly onc=
e
>> (at resume/init time).
>>
>> Also fix an "off-by-one" allocation of reg_cache[] array size that
>> was in the original code before I touched it.
>>
>> Reported-by: Dan Carpenter <error27@gmail.com>
>> Signed-off-by: Grant Grundler <grundler@chromium.org>
>> Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
>> ---
>> =C2=A0drivers/staging/iio/light/isl29018.c | =C2=A0 23 ++++++++++++++---=
------
>> =C2=A01 files changed, 14 insertions(+), 9 deletions(-)
>>
>> diff --git a/drivers/staging/iio/light/isl29018.c b/drivers/staging/iio/=
light/isl29018.c
>> index f31e8c2..3e9a06c 100644
>> --- a/drivers/staging/iio/light/isl29018.c
>> +++ b/drivers/staging/iio/light/isl29018.c
>> @@ -51,7 +51,7 @@
>>
>> =C2=A0#define ISL29018_REG_ADD_DATA_LSB =C2=A0 =C2=A00x02
>> =C2=A0#define ISL29018_REG_ADD_DATA_MSB =C2=A0 =C2=A00x03
>> -#define ISL29018_MAX_REGS =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0ISL2=
9018_REG_ADD_DATA_MSB
>> +#define ISL29018_MAX_REGS =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0(ISL=
29018_REG_ADD_DATA_MSB+1)
>>
>> =C2=A0#define ISL29018_REG_TEST =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A00x08
>> =C2=A0#define ISL29018_TEST_SHIFT =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A00
>> @@ -70,22 +70,27 @@ struct isl29018_chip {
>> =C2=A0static int isl29018_write_data(struct i2c_client *client, u8 reg,
>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 u8 val, u8 mask, u8 shift)
>> =C2=A0{
>> - =C2=A0 =C2=A0 u8 regval;
>> - =C2=A0 =C2=A0 int ret =3D 0;
>> + =C2=A0 =C2=A0 u8 regval =3D val;
>> + =C2=A0 =C2=A0 int ret;
>> =C2=A0 =C2=A0 =C2=A0 struct isl29018_chip *chip =3D iio_priv(i2c_get_cli=
entdata(client));
>>
>> - =C2=A0 =C2=A0 regval =3D chip->reg_cache[reg];
>> - =C2=A0 =C2=A0 regval &=3D ~mask;
>> - =C2=A0 =C2=A0 regval |=3D val << shift;
>> + =C2=A0 =C2=A0 /* don't cache or mask REG_TEST */
>> + =C2=A0 =C2=A0 if (reg < ISL29018_MAX_REGS) {
>> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 regval =3D chip->reg_cache[r=
eg];
>> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 regval &=3D ~mask;
>> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 regval |=3D val << shift;
>> + =C2=A0 =C2=A0 }
>>
>> =C2=A0 =C2=A0 =C2=A0 ret =3D i2c_smbus_write_byte_data(client, reg, regv=
al);
>> =C2=A0 =C2=A0 =C2=A0 if (ret) {
>> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 dev_err(&client->dev, "=
Write to device fails status %x\n", ret);
>> - =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 return ret;
>> + =C2=A0 =C2=A0 } else {
>> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 /* don't update cache on err=
 */
>> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 if (reg < ISL29018_MAX_REGS)
>> + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
chip->reg_cache[reg] =3D regval;
>> =C2=A0 =C2=A0 =C2=A0 }
>> - =C2=A0 =C2=A0 chip->reg_cache[reg] =3D regval;
>>
>> - =C2=A0 =C2=A0 return 0;
>> + =C2=A0 =C2=A0 return ret;
>> =C2=A0}
>>
>> =C2=A0static int isl29018_set_range(struct i2c_client *client, unsigned =
long range,
>
>

Re: [PATCH] [PATCH] staging:iio:light: V3 fix out of bounds reg_cache[] access

[Jonathan Cameron]

On 09/09/11 16:20, Grant Grundler wrote:
> On Fri, Sep 9, 2011 at 1:54 AM, Jonathan Cameron <jic23@cam.ac.uk> wrote:
>> Grant, please take a quick look at this and check I didn't mess anything up.
> 
> Jonathan,
> LGTM. I'm at LPC2011 now and don't have time to "compile test" this.
> I'm pretty sure it's correct.
That test I can and did do so no worry there ;)
> 
>> Looks like a trivial context change was the issue, but best to be sure!
> 
> Agreed - thanks for fixing this up and reposting! :)
cool.  Greg, please pick this one up.

Thanks,

Jonathan
> grant
> 
>>> V3 is a straightforward forward port to teh current tree of V2.
>>>
>>> Simple fix is to just not cache REG_TEST (offset 8).
>>> Cache doesn't help REG_TEST anyway since we write all 8 bits exactly once
>>> (at resume/init time).
>>>
>>> Also fix an "off-by-one" allocation of reg_cache[] array size that
>>> was in the original code before I touched it.
>>>
>>> Reported-by: Dan Carpenter <error27@gmail.com>
>>> Signed-off-by: Grant Grundler <grundler@chromium.org>
>>> Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
>>> ---
>>>  drivers/staging/iio/light/isl29018.c |   23 ++++++++++++++---------
>>>  1 files changed, 14 insertions(+), 9 deletions(-)
>>>
>>> diff --git a/drivers/staging/iio/light/isl29018.c b/drivers/staging/iio/light/isl29018.c
>>> index f31e8c2..3e9a06c 100644
>>> --- a/drivers/staging/iio/light/isl29018.c
>>> +++ b/drivers/staging/iio/light/isl29018.c
>>> @@ -51,7 +51,7 @@
>>>
>>>  #define ISL29018_REG_ADD_DATA_LSB    0x02
>>>  #define ISL29018_REG_ADD_DATA_MSB    0x03
>>> -#define ISL29018_MAX_REGS            ISL29018_REG_ADD_DATA_MSB
>>> +#define ISL29018_MAX_REGS            (ISL29018_REG_ADD_DATA_MSB+1)
>>>
>>>  #define ISL29018_REG_TEST            0x08
>>>  #define ISL29018_TEST_SHIFT          0
>>> @@ -70,22 +70,27 @@ struct isl29018_chip {
>>>  static int isl29018_write_data(struct i2c_client *client, u8 reg,
>>>                       u8 val, u8 mask, u8 shift)
>>>  {
>>> -     u8 regval;
>>> -     int ret = 0;
>>> +     u8 regval = val;
>>> +     int ret;
>>>       struct isl29018_chip *chip = iio_priv(i2c_get_clientdata(client));
>>>
>>> -     regval = chip->reg_cache[reg];
>>> -     regval &= ~mask;
>>> -     regval |= val << shift;
>>> +     /* don't cache or mask REG_TEST */
>>> +     if (reg < ISL29018_MAX_REGS) {
>>> +             regval = chip->reg_cache[reg];
>>> +             regval &= ~mask;
>>> +             regval |= val << shift;
>>> +     }
>>>
>>>       ret = i2c_smbus_write_byte_data(client, reg, regval);
>>>       if (ret) {
>>>               dev_err(&client->dev, "Write to device fails status %x\n", ret);
>>> -             return ret;
>>> +     } else {
>>> +             /* don't update cache on err */
>>> +             if (reg < ISL29018_MAX_REGS)
>>> +                     chip->reg_cache[reg] = regval;
>>>       }
>>> -     chip->reg_cache[reg] = regval;
>>>
>>> -     return 0;
>>> +     return ret;
>>>  }
>>>
>>>  static int isl29018_set_range(struct i2c_client *client, unsigned long range,
>>
>>
>