From: "Tanislav, Cosmin" <Cosmin.Tanislav@analog.com>
To: Kees Cook <keescook@chromium.org>, Lars-Peter Clausen <lars@metafoo.de>
Cc: "Hennerich, Michael" <Michael.Hennerich@analog.com>,
Jonathan Cameron <jic23@kernel.org>,
"linux-iio@vger.kernel.org" <linux-iio@vger.kernel.org>,
Linus Walleij <linus.walleij@linaro.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"linux-hardening@vger.kernel.org"
<linux-hardening@vger.kernel.org>
Subject: RE: [PATCH v2] iio: addac: Do not reference negative array offsets
Date: Thu, 6 Jan 2022 06:31:55 +0000 [thread overview]
Message-ID: <b87576f4e44e459bba4d3bd3c0b38693@analog.com> (raw)
In-Reply-To: <20220105180214.2435001-1-keescook@chromium.org>
Reviewed-by: Cosmin Tanislav <cosmin.tanislav@analog.com>
Put "iio: addac: ad74413r:" in patch title, maybe?
> -----Original Message-----
> From: Kees Cook <keescook@chromium.org>
> Sent: Wednesday, January 5, 2022 8:02 PM
> To: Lars-Peter Clausen <lars@metafoo.de>
> Cc: Kees Cook <keescook@chromium.org>; Hennerich, Michael
> <Michael.Hennerich@analog.com>; Tanislav, Cosmin
> <Cosmin.Tanislav@analog.com>; Jonathan Cameron <jic23@kernel.org>;
> linux-iio@vger.kernel.org; Linus Walleij <linus.walleij@linaro.org>; linux-
> kernel@vger.kernel.org; linux-hardening@vger.kernel.org
> Subject: [PATCH v2] iio: addac: Do not reference negative array offsets
>
> [External]
>
> Instead of aiming rx_buf at an invalid array-boundary-crossing location,
> just skip the first increment. Fixes this warning seen when building
> with -Warray-bounds:
>
> drivers/iio/addac/ad74413r.c: In function 'ad74413r_update_scan_mode':
> drivers/iio/addac/ad74413r.c:843:22: warning: array subscript -4 is below
> array bounds of 'u8[16]' { aka 'unsigned char[16]'} [-Warray-bounds]
> 843 | u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 *
> AD74413R_FRAME_SIZE];
> |
> ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> drivers/iio/addac/ad74413r.c:84:20: note: while referencing 'rx_buf'
> 84 | u8 rx_buf[AD74413R_FRAME_SIZE *
> AD74413R_CHANNEL_MAX];
> | ^~~~~~
>
> Cc: Lars-Peter Clausen <lars@metafoo.de>
> Cc: Michael Hennerich <Michael.Hennerich@analog.com>
> Cc: Cosmin Tanislav <cosmin.tanislav@analog.com>
> Cc: Jonathan Cameron <jic23@kernel.org>
> Cc: linux-iio@vger.kernel.org
> Fixes: fea251b6a5db ("iio: addac: add AD74413R driver")
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> v1:
> https://urldefense.com/v3/__https://lore.kernel.org/lkml/20211215232321.
> 2069314-1-
> keescook@chromium.org/__;!!A3Ni8CS0y2Y!vadcwdERjyNVz3vFIp5m5S2ms
> oFHro8aKzH9ulwPevCKHpev6D53gibZrv5U9mPHGcoB$
> v2:
> - use "xfer" for checking "first through the loop"
> ---
> drivers/iio/addac/ad74413r.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/iio/addac/ad74413r.c b/drivers/iio/addac/ad74413r.c
> index 5271073bb74e..aba9a643a4ca 100644
> --- a/drivers/iio/addac/ad74413r.c
> +++ b/drivers/iio/addac/ad74413r.c
> @@ -840,7 +840,7 @@ static int ad74413r_update_scan_mode(struct iio_dev
> *indio_dev,
> {
> struct ad74413r_state *st = iio_priv(indio_dev);
> struct spi_transfer *xfer = st->adc_samples_xfer;
> - u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 *
> AD74413R_FRAME_SIZE];
> + u8 *rx_buf = st->adc_samples_buf.rx_buf;
> u8 *tx_buf = st->adc_samples_tx_buf;
> unsigned int channel;
> int ret = -EINVAL;
> @@ -894,9 +894,10 @@ static int ad74413r_update_scan_mode(struct
> iio_dev *indio_dev,
>
> spi_message_add_tail(xfer, &st->adc_samples_msg);
>
> - xfer++;
> tx_buf += AD74413R_FRAME_SIZE;
> - rx_buf += AD74413R_FRAME_SIZE;
> + if (xfer != st->adc_samples_xfer)
> + rx_buf += AD74413R_FRAME_SIZE;
> + xfer++;
> }
>
> xfer->rx_buf = rx_buf;
> --
> 2.30.2
next prev parent reply other threads:[~2022-01-06 6:32 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-05 18:02 [PATCH v2] iio: addac: Do not reference negative array offsets Kees Cook
2022-01-06 6:31 ` Tanislav, Cosmin [this message]
2022-01-15 18:12 ` Jonathan Cameron
2022-01-15 18:37 ` Jonathan Cameron
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=b87576f4e44e459bba4d3bd3c0b38693@analog.com \
--to=cosmin.tanislav@analog.com \
--cc=Michael.Hennerich@analog.com \
--cc=jic23@kernel.org \
--cc=keescook@chromium.org \
--cc=lars@metafoo.de \
--cc=linus.walleij@linaro.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-iio@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).