* [PATCH v2] iio: addac: Do not reference negative array offsets
@ 2022-01-05 18:02 Kees Cook
2022-01-06 6:31 ` Tanislav, Cosmin
0 siblings, 1 reply; 4+ messages in thread
From: Kees Cook @ 2022-01-05 18:02 UTC (permalink / raw)
To: Lars-Peter Clausen
Cc: Kees Cook, Michael Hennerich, Cosmin Tanislav, Jonathan Cameron,
linux-iio, Linus Walleij, linux-kernel, linux-hardening
Instead of aiming rx_buf at an invalid array-boundary-crossing location,
just skip the first increment. Fixes this warning seen when building
with -Warray-bounds:
drivers/iio/addac/ad74413r.c: In function 'ad74413r_update_scan_mode':
drivers/iio/addac/ad74413r.c:843:22: warning: array subscript -4 is below array bounds of 'u8[16]' { aka 'unsigned char[16]'} [-Warray-bounds]
843 | u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 * AD74413R_FRAME_SIZE];
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/iio/addac/ad74413r.c:84:20: note: while referencing 'rx_buf'
84 | u8 rx_buf[AD74413R_FRAME_SIZE * AD74413R_CHANNEL_MAX];
| ^~~~~~
Cc: Lars-Peter Clausen <lars@metafoo.de>
Cc: Michael Hennerich <Michael.Hennerich@analog.com>
Cc: Cosmin Tanislav <cosmin.tanislav@analog.com>
Cc: Jonathan Cameron <jic23@kernel.org>
Cc: linux-iio@vger.kernel.org
Fixes: fea251b6a5db ("iio: addac: add AD74413R driver")
Signed-off-by: Kees Cook <keescook@chromium.org>
---
v1: https://lore.kernel.org/lkml/20211215232321.2069314-1-keescook@chromium.org/
v2:
- use "xfer" for checking "first through the loop"
---
drivers/iio/addac/ad74413r.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/iio/addac/ad74413r.c b/drivers/iio/addac/ad74413r.c
index 5271073bb74e..aba9a643a4ca 100644
--- a/drivers/iio/addac/ad74413r.c
+++ b/drivers/iio/addac/ad74413r.c
@@ -840,7 +840,7 @@ static int ad74413r_update_scan_mode(struct iio_dev *indio_dev,
{
struct ad74413r_state *st = iio_priv(indio_dev);
struct spi_transfer *xfer = st->adc_samples_xfer;
- u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 * AD74413R_FRAME_SIZE];
+ u8 *rx_buf = st->adc_samples_buf.rx_buf;
u8 *tx_buf = st->adc_samples_tx_buf;
unsigned int channel;
int ret = -EINVAL;
@@ -894,9 +894,10 @@ static int ad74413r_update_scan_mode(struct iio_dev *indio_dev,
spi_message_add_tail(xfer, &st->adc_samples_msg);
- xfer++;
tx_buf += AD74413R_FRAME_SIZE;
- rx_buf += AD74413R_FRAME_SIZE;
+ if (xfer != st->adc_samples_xfer)
+ rx_buf += AD74413R_FRAME_SIZE;
+ xfer++;
}
xfer->rx_buf = rx_buf;
--
2.30.2
^ permalink raw reply related [flat|nested] 4+ messages in thread* RE: [PATCH v2] iio: addac: Do not reference negative array offsets
2022-01-05 18:02 [PATCH v2] iio: addac: Do not reference negative array offsets Kees Cook
@ 2022-01-06 6:31 ` Tanislav, Cosmin
2022-01-15 18:12 ` Jonathan Cameron
0 siblings, 1 reply; 4+ messages in thread
From: Tanislav, Cosmin @ 2022-01-06 6:31 UTC (permalink / raw)
To: Kees Cook, Lars-Peter Clausen
Cc: Hennerich, Michael, Jonathan Cameron, linux-iio, Linus Walleij,
linux-kernel, linux-hardening
Reviewed-by: Cosmin Tanislav <cosmin.tanislav@analog.com>
Put "iio: addac: ad74413r:" in patch title, maybe?
> -----Original Message-----
> From: Kees Cook <keescook@chromium.org>
> Sent: Wednesday, January 5, 2022 8:02 PM
> To: Lars-Peter Clausen <lars@metafoo.de>
> Cc: Kees Cook <keescook@chromium.org>; Hennerich, Michael
> <Michael.Hennerich@analog.com>; Tanislav, Cosmin
> <Cosmin.Tanislav@analog.com>; Jonathan Cameron <jic23@kernel.org>;
> linux-iio@vger.kernel.org; Linus Walleij <linus.walleij@linaro.org>; linux-
> kernel@vger.kernel.org; linux-hardening@vger.kernel.org
> Subject: [PATCH v2] iio: addac: Do not reference negative array offsets
>
> [External]
>
> Instead of aiming rx_buf at an invalid array-boundary-crossing location,
> just skip the first increment. Fixes this warning seen when building
> with -Warray-bounds:
>
> drivers/iio/addac/ad74413r.c: In function 'ad74413r_update_scan_mode':
> drivers/iio/addac/ad74413r.c:843:22: warning: array subscript -4 is below
> array bounds of 'u8[16]' { aka 'unsigned char[16]'} [-Warray-bounds]
> 843 | u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 *
> AD74413R_FRAME_SIZE];
> |
> ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> drivers/iio/addac/ad74413r.c:84:20: note: while referencing 'rx_buf'
> 84 | u8 rx_buf[AD74413R_FRAME_SIZE *
> AD74413R_CHANNEL_MAX];
> | ^~~~~~
>
> Cc: Lars-Peter Clausen <lars@metafoo.de>
> Cc: Michael Hennerich <Michael.Hennerich@analog.com>
> Cc: Cosmin Tanislav <cosmin.tanislav@analog.com>
> Cc: Jonathan Cameron <jic23@kernel.org>
> Cc: linux-iio@vger.kernel.org
> Fixes: fea251b6a5db ("iio: addac: add AD74413R driver")
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> v1:
> https://urldefense.com/v3/__https://lore.kernel.org/lkml/20211215232321.
> 2069314-1-
> keescook@chromium.org/__;!!A3Ni8CS0y2Y!vadcwdERjyNVz3vFIp5m5S2ms
> oFHro8aKzH9ulwPevCKHpev6D53gibZrv5U9mPHGcoB$
> v2:
> - use "xfer" for checking "first through the loop"
> ---
> drivers/iio/addac/ad74413r.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/iio/addac/ad74413r.c b/drivers/iio/addac/ad74413r.c
> index 5271073bb74e..aba9a643a4ca 100644
> --- a/drivers/iio/addac/ad74413r.c
> +++ b/drivers/iio/addac/ad74413r.c
> @@ -840,7 +840,7 @@ static int ad74413r_update_scan_mode(struct iio_dev
> *indio_dev,
> {
> struct ad74413r_state *st = iio_priv(indio_dev);
> struct spi_transfer *xfer = st->adc_samples_xfer;
> - u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 *
> AD74413R_FRAME_SIZE];
> + u8 *rx_buf = st->adc_samples_buf.rx_buf;
> u8 *tx_buf = st->adc_samples_tx_buf;
> unsigned int channel;
> int ret = -EINVAL;
> @@ -894,9 +894,10 @@ static int ad74413r_update_scan_mode(struct
> iio_dev *indio_dev,
>
> spi_message_add_tail(xfer, &st->adc_samples_msg);
>
> - xfer++;
> tx_buf += AD74413R_FRAME_SIZE;
> - rx_buf += AD74413R_FRAME_SIZE;
> + if (xfer != st->adc_samples_xfer)
> + rx_buf += AD74413R_FRAME_SIZE;
> + xfer++;
> }
>
> xfer->rx_buf = rx_buf;
> --
> 2.30.2
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v2] iio: addac: Do not reference negative array offsets
2022-01-06 6:31 ` Tanislav, Cosmin
@ 2022-01-15 18:12 ` Jonathan Cameron
2022-01-15 18:37 ` Jonathan Cameron
0 siblings, 1 reply; 4+ messages in thread
From: Jonathan Cameron @ 2022-01-15 18:12 UTC (permalink / raw)
To: Tanislav, Cosmin, Lars-Peter Clausen
Cc: Kees Cook, Hennerich, Michael, linux-iio, Linus Walleij,
linux-kernel, linux-hardening
On Thu, 6 Jan 2022 06:31:55 +0000
"Tanislav, Cosmin" <Cosmin.Tanislav@analog.com> wrote:
> Reviewed-by: Cosmin Tanislav <cosmin.tanislav@analog.com>
>
> Put "iio: addac: ad74413r:" in patch title, maybe?
I can fix that up whilst applying.
I'll pick this up after rc1 is out.
Thanks,
Jonathan
>
> > -----Original Message-----
> > From: Kees Cook <keescook@chromium.org>
> > Sent: Wednesday, January 5, 2022 8:02 PM
> > To: Lars-Peter Clausen <lars@metafoo.de>
> > Cc: Kees Cook <keescook@chromium.org>; Hennerich, Michael
> > <Michael.Hennerich@analog.com>; Tanislav, Cosmin
> > <Cosmin.Tanislav@analog.com>; Jonathan Cameron <jic23@kernel.org>;
> > linux-iio@vger.kernel.org; Linus Walleij <linus.walleij@linaro.org>; linux-
> > kernel@vger.kernel.org; linux-hardening@vger.kernel.org
> > Subject: [PATCH v2] iio: addac: Do not reference negative array offsets
> >
> > [External]
> >
> > Instead of aiming rx_buf at an invalid array-boundary-crossing location,
> > just skip the first increment. Fixes this warning seen when building
> > with -Warray-bounds:
> >
> > drivers/iio/addac/ad74413r.c: In function 'ad74413r_update_scan_mode':
> > drivers/iio/addac/ad74413r.c:843:22: warning: array subscript -4 is below
> > array bounds of 'u8[16]' { aka 'unsigned char[16]'} [-Warray-bounds]
> > 843 | u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 *
> > AD74413R_FRAME_SIZE];
> > |
> > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > drivers/iio/addac/ad74413r.c:84:20: note: while referencing 'rx_buf'
> > 84 | u8 rx_buf[AD74413R_FRAME_SIZE *
> > AD74413R_CHANNEL_MAX];
> > | ^~~~~~
> >
> > Cc: Lars-Peter Clausen <lars@metafoo.de>
> > Cc: Michael Hennerich <Michael.Hennerich@analog.com>
> > Cc: Cosmin Tanislav <cosmin.tanislav@analog.com>
> > Cc: Jonathan Cameron <jic23@kernel.org>
> > Cc: linux-iio@vger.kernel.org
> > Fixes: fea251b6a5db ("iio: addac: add AD74413R driver")
> > Signed-off-by: Kees Cook <keescook@chromium.org>
> > ---
> > v1:
> > https://urldefense.com/v3/__https://lore.kernel.org/lkml/20211215232321.
> > 2069314-1-
> > keescook@chromium.org/__;!!A3Ni8CS0y2Y!vadcwdERjyNVz3vFIp5m5S2ms
> > oFHro8aKzH9ulwPevCKHpev6D53gibZrv5U9mPHGcoB$
> > v2:
> > - use "xfer" for checking "first through the loop"
> > ---
> > drivers/iio/addac/ad74413r.c | 7 ++++---
> > 1 file changed, 4 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/iio/addac/ad74413r.c b/drivers/iio/addac/ad74413r.c
> > index 5271073bb74e..aba9a643a4ca 100644
> > --- a/drivers/iio/addac/ad74413r.c
> > +++ b/drivers/iio/addac/ad74413r.c
> > @@ -840,7 +840,7 @@ static int ad74413r_update_scan_mode(struct iio_dev
> > *indio_dev,
> > {
> > struct ad74413r_state *st = iio_priv(indio_dev);
> > struct spi_transfer *xfer = st->adc_samples_xfer;
> > - u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 *
> > AD74413R_FRAME_SIZE];
> > + u8 *rx_buf = st->adc_samples_buf.rx_buf;
> > u8 *tx_buf = st->adc_samples_tx_buf;
> > unsigned int channel;
> > int ret = -EINVAL;
> > @@ -894,9 +894,10 @@ static int ad74413r_update_scan_mode(struct
> > iio_dev *indio_dev,
> >
> > spi_message_add_tail(xfer, &st->adc_samples_msg);
> >
> > - xfer++;
> > tx_buf += AD74413R_FRAME_SIZE;
> > - rx_buf += AD74413R_FRAME_SIZE;
> > + if (xfer != st->adc_samples_xfer)
> > + rx_buf += AD74413R_FRAME_SIZE;
> > + xfer++;
> > }
> >
> > xfer->rx_buf = rx_buf;
> > --
> > 2.30.2
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v2] iio: addac: Do not reference negative array offsets
2022-01-15 18:12 ` Jonathan Cameron
@ 2022-01-15 18:37 ` Jonathan Cameron
0 siblings, 0 replies; 4+ messages in thread
From: Jonathan Cameron @ 2022-01-15 18:37 UTC (permalink / raw)
To: Tanislav, Cosmin, Lars-Peter Clausen
Cc: Kees Cook, Hennerich, Michael, linux-iio, Linus Walleij,
linux-kernel, linux-hardening
On Sat, 15 Jan 2022 18:12:02 +0000
Jonathan Cameron <jic23@kernel.org> wrote:
> On Thu, 6 Jan 2022 06:31:55 +0000
> "Tanislav, Cosmin" <Cosmin.Tanislav@analog.com> wrote:
>
> > Reviewed-by: Cosmin Tanislav <cosmin.tanislav@analog.com>
> >
> > Put "iio: addac: ad74413r:" in patch title, maybe?
> I can fix that up whilst applying.
Ah. I see you already sent it again. Thanks as that's
even easier.
Jonathan
>
> I'll pick this up after rc1 is out.
>
> Thanks,
>
> Jonathan
>
> >
> > > -----Original Message-----
> > > From: Kees Cook <keescook@chromium.org>
> > > Sent: Wednesday, January 5, 2022 8:02 PM
> > > To: Lars-Peter Clausen <lars@metafoo.de>
> > > Cc: Kees Cook <keescook@chromium.org>; Hennerich, Michael
> > > <Michael.Hennerich@analog.com>; Tanislav, Cosmin
> > > <Cosmin.Tanislav@analog.com>; Jonathan Cameron <jic23@kernel.org>;
> > > linux-iio@vger.kernel.org; Linus Walleij <linus.walleij@linaro.org>; linux-
> > > kernel@vger.kernel.org; linux-hardening@vger.kernel.org
> > > Subject: [PATCH v2] iio: addac: Do not reference negative array offsets
> > >
> > > [External]
> > >
> > > Instead of aiming rx_buf at an invalid array-boundary-crossing location,
> > > just skip the first increment. Fixes this warning seen when building
> > > with -Warray-bounds:
> > >
> > > drivers/iio/addac/ad74413r.c: In function 'ad74413r_update_scan_mode':
> > > drivers/iio/addac/ad74413r.c:843:22: warning: array subscript -4 is below
> > > array bounds of 'u8[16]' { aka 'unsigned char[16]'} [-Warray-bounds]
> > > 843 | u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 *
> > > AD74413R_FRAME_SIZE];
> > > |
> > > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > > drivers/iio/addac/ad74413r.c:84:20: note: while referencing 'rx_buf'
> > > 84 | u8 rx_buf[AD74413R_FRAME_SIZE *
> > > AD74413R_CHANNEL_MAX];
> > > | ^~~~~~
> > >
> > > Cc: Lars-Peter Clausen <lars@metafoo.de>
> > > Cc: Michael Hennerich <Michael.Hennerich@analog.com>
> > > Cc: Cosmin Tanislav <cosmin.tanislav@analog.com>
> > > Cc: Jonathan Cameron <jic23@kernel.org>
> > > Cc: linux-iio@vger.kernel.org
> > > Fixes: fea251b6a5db ("iio: addac: add AD74413R driver")
> > > Signed-off-by: Kees Cook <keescook@chromium.org>
> > > ---
> > > v1:
> > > https://urldefense.com/v3/__https://lore.kernel.org/lkml/20211215232321.
> > > 2069314-1-
> > > keescook@chromium.org/__;!!A3Ni8CS0y2Y!vadcwdERjyNVz3vFIp5m5S2ms
> > > oFHro8aKzH9ulwPevCKHpev6D53gibZrv5U9mPHGcoB$
> > > v2:
> > > - use "xfer" for checking "first through the loop"
> > > ---
> > > drivers/iio/addac/ad74413r.c | 7 ++++---
> > > 1 file changed, 4 insertions(+), 3 deletions(-)
> > >
> > > diff --git a/drivers/iio/addac/ad74413r.c b/drivers/iio/addac/ad74413r.c
> > > index 5271073bb74e..aba9a643a4ca 100644
> > > --- a/drivers/iio/addac/ad74413r.c
> > > +++ b/drivers/iio/addac/ad74413r.c
> > > @@ -840,7 +840,7 @@ static int ad74413r_update_scan_mode(struct iio_dev
> > > *indio_dev,
> > > {
> > > struct ad74413r_state *st = iio_priv(indio_dev);
> > > struct spi_transfer *xfer = st->adc_samples_xfer;
> > > - u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 *
> > > AD74413R_FRAME_SIZE];
> > > + u8 *rx_buf = st->adc_samples_buf.rx_buf;
> > > u8 *tx_buf = st->adc_samples_tx_buf;
> > > unsigned int channel;
> > > int ret = -EINVAL;
> > > @@ -894,9 +894,10 @@ static int ad74413r_update_scan_mode(struct
> > > iio_dev *indio_dev,
> > >
> > > spi_message_add_tail(xfer, &st->adc_samples_msg);
> > >
> > > - xfer++;
> > > tx_buf += AD74413R_FRAME_SIZE;
> > > - rx_buf += AD74413R_FRAME_SIZE;
> > > + if (xfer != st->adc_samples_xfer)
> > > + rx_buf += AD74413R_FRAME_SIZE;
> > > + xfer++;
> > > }
> > >
> > > xfer->rx_buf = rx_buf;
> > > --
> > > 2.30.2
> >
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-01-15 18:31 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-05 18:02 [PATCH v2] iio: addac: Do not reference negative array offsets Kees Cook
2022-01-06 6:31 ` Tanislav, Cosmin
2022-01-15 18:12 ` Jonathan Cameron
2022-01-15 18:37 ` Jonathan Cameron
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).