iio:light:max44000 Fix timestamp alignment and prevent data leak.
authorJonathan Cameron <Jonathan.Cameron@huawei.com>
Wed, 22 Jul 2020 15:50:45 +0000 (16:50 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 17 Sep 2020 11:55:39 +0000 (13:55 +0200)
commitbe0bc3cf9e607961a11f4ee3a733388a5e4dd148
tree8580efa7411b509b67d8a5acef8ddce5fb7a2269
parent6ae35c1825e85cea3deb4e04d4e690aeda0cd0d7
iio:light:max44000 Fix timestamp alignment and prevent data leak.

commit 523628852a5f5f34a15252b2634d0498d3cfb347 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses a 16 byte array of smaller elements on the stack.
As Lars also noted this anti pattern can involve a leak of data to
userspace and that indeed can happen here.  We close both issues by
moving to a suitable structure in the iio_priv().
This data is allocated with kzalloc so no data can leak appart
from previous readings.

It is necessary to force the alignment of ts to avoid the padding
on x86_32 being different from 64 bit platorms (it alows for
4 bytes aligned 8 byte types.

Fixes: 06ad7ea10e2b ("max44000: Initial triggered buffer support")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/iio/light/max44000.c