[PATCH 3.19.y-ckt 02/47] iio: adis_buffer: Fix out-of-bounds memory access

From	Kamal Mostafa <kamal@canonical.com>
Newsgroups	linux.kernel
Subject	[PATCH 3.19.y-ckt 02/47] iio: adis_buffer: Fix out-of-bounds memory access
Date	2016-02-10 00:10 +0100
Message-ID	<r0pzY-2nu-17@gated-at.bofh.it> (permalink)
References	<r0pgC-21e-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

3.19.8-ckt15 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Lars-Peter Clausen <lars@metafoo.de>

commit d590faf9e8f8509a0a0aa79c38e87fcc6b913248 upstream.

The SPI tx and rx buffers are both supposed to be scan_bytes amount of
bytes large and a common allocation is used to allocate both buffers. This
puts the beginning of the tx buffer scan_bytes bytes after the rx buffer.
The initialization of the tx buffer pointer is done adding scan_bytes to
the beginning of the rx buffer, but since the rx buffer is of type __be16
this will actually add two times as much and the tx buffer ends up pointing
after the allocated buffer.

Fix this by using scan_count, which is scan_bytes / 2, instead of
scan_bytes when initializing the tx buffer pointer.

Fixes: aacff892cbd5 ("staging:iio:adis: Preallocate transfer message")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/iio/imu/adis_buffer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/imu/adis_buffer.c b/drivers/iio/imu/adis_buffer.c
index cb32b59..36607d5 100644
--- a/drivers/iio/imu/adis_buffer.c
+++ b/drivers/iio/imu/adis_buffer.c
@@ -43,7 +43,7 @@ int adis_update_scan_mode(struct iio_dev *indio_dev,
 		return -ENOMEM;
 
 	rx = adis->buffer;
-	tx = rx + indio_dev->scan_bytes;
+	tx = rx + scan_count;
 
 	spi_message_init(&adis->msg);
 
-- 
1.9.1

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[3.19.y-ckt stable] Linux 3.19.8-ckt15 stable review Kamal Mostafa <kamal@canonical.com> - 2016-02-09 23:50 +0100
  [PATCH 3.19.y-ckt 47/47] KEYS: Fix keyring ref leak in join_session_keyring() Kamal Mostafa <kamal@canonical.com> - 2016-02-09 23:50 +0100
  [PATCH 3.19.y-ckt 41/47] perf hists: Fix HISTC_MEM_DCACHELINE width setting Kamal Mostafa <kamal@canonical.com> - 2016-02-09 23:50 +0100
  [PATCH 3.19.y-ckt 11/47] cdc-acm:exclude Samsung phone 04e8:685d Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 10/47] usb: cdc-acm: send zero packet for intel 7260 modem Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 17/47] ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 35/47] ALSA: dummy: Disable switching timer backend via sysfs Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 34/47] seccomp: always propagate NO_NEW_PRIVS on tsync Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 19/47] USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 23/47] ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 16/47] USB: serial: option: Adding support for Telit LE922 Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 36/47] drm/vmwgfx: respect 'nomodeset' Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 24/47] ALSA: bebob: Use a signed return type for get_formation_index Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 12/47] usb: hub: do not clear BOS field during reset device Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 09/47] usb: cdc-acm: handle unlinked urb in acm read callback Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 30/47] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 21/47] USB: option: fix Cinterion AHxx enumeration Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 28/47] powerpc/eeh: Fix PE location code Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 15/47] USB: serial: visor: fix crash on detecting device without write_urbs Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 32/47] staging/speakup: Use tty_ldisc_ref() for paste kworker Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 22/47] ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 14/47] USB: visor: fix null-deref at probe Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 26/47] arm64: mm: avoid calling apply_to_page_range on empty range Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 27/47] x86/mm: Fix types used in pgprot cacheability flags translations Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 20/47] arm64: kernel: fix architected PMU registers unconditional access Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 08/47] ACPI / PCI / hotplug: unlock in error path in acpiphp_enable_slot() Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 29/47] SCSI: fix crashes in sd and sr runtime PM Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 25/47] arm64: errata: Add -mpc-relative-literal-loads to build flags Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 07/47] ACPI: Revert "ACPI / video: Add Dell Inspiron 5737 to the blacklist" Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100
  [PATCH 3.19.y-ckt 03/47] KVM: PPC: Fix emulation of H_SET_DABR/X on POWER8 Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100
  [PATCH 3.19.y-ckt 06/47] powerpc: Simplify module TOC handling Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100
  [PATCH 3.19.y-ckt 04/47] KVM: PPC: Fix ONE_REG AltiVec support Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100
  [PATCH 3.19.y-ckt 02/47] iio: adis_buffer: Fix out-of-bounds memory access Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100

csiph-web