NoaSoftware
/
TencentOS-kernel
forked from TencentOS/TencentOS-kernel
0
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
TencentOS-kernel/drivers
History
Jonathan Cameron 922c93c6a4 iio:gyro:itg3200: Fix timestamp alignment and prevent data leak. 
commit 10ab7cfd5522f0041028556dac864a003e158556 upstream.

One of a class of bugs pointed out by Lars in a recent review.
iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
to the size of the timestamp (8 bytes).  This is not guaranteed in
this driver which uses a 16 byte array of smaller elements on the stack.
This is fixed by using an explicit c structure. As there are no
holes in the structure, there is no possiblity of data leakage
in this case.

The explicit alignment of ts is not strictly necessary but potentially
makes the code slightly less fragile.  It also removes the possibility
of this being cut and paste into another driver where the alignment
isn't already true.

Fixes: 36e0371e7764 ("iio:itg3200: Use iio_push_to_buffers_with_timestamp()")
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200722155103.979802-6-jic23@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2021-03-16 16:40:05 +08:00
..
accessibility
…
acpi ACPI: EC: PM: Drop ec_no_wakeup check from acpi_ec_dispatch_gpe() 2021-03-16 16:39:58 +08:00
amba
…
android binder: Remove bogus warning on failed same-process transaction 2021-03-16 16:38:35 +08:00
ata ata: sata_nv: Fix retrieving of active qcs 2021-03-16 16:39:39 +08:00
atm atm: eni: fix the missed pci_disable_device() for eni_init_one() 2021-03-16 16:37:33 +08:00
auxdisplay
…
base PM: runtime: Remove link state checks in rpm_get/put_supplier() 2021-03-16 16:39:58 +08:00
bcma
…
block nbd: make the config put is called before the notifying the waiter 2021-03-16 16:39:53 +08:00
bluetooth Bluetooth: btusb: Fix memleak in btusb_mtk_submit_wmt_recv_urb 2021-03-16 16:39:23 +08:00
bus bus/fsl_mc: Do not rely on caller to provide non NULL mc_io 2021-03-16 16:39:49 +08:00
cdrom
…
char ipmi_si: Fix wrong return value in try_smi_init() 2021-03-16 16:38:45 +08:00
clk clk: ti: clockdomain: fix static checker warning 2021-03-16 16:39:50 +08:00
clocksource clocksource/drivers/timer-gx6605s: Fixup counter reload 2021-03-16 16:37:44 +08:00
connector
…
counter
…
cpufreq acpi-cpufreq: Honor _PSD table setting on new AMD CPUs 2021-03-16 16:39:58 +08:00
cpuidle cpuidle: Fixup IRQ state 2021-03-16 16:35:25 +08:00
crypto chelsio/chtls: fix tls record info to user 2021-03-16 16:39:30 +08:00
dax dax: Fix alloc_dax_region() compile warning 2021-03-16 16:36:36 +08:00
dca
…
devfreq PM / devfreq: tegra30: Fix integer overflow on CPU's freq max out 2021-03-16 16:36:35 +08:00
dio
…
dma dmaengine: dma-jz4780: Fix race in jz4780_dma_tx_status 2021-03-16 16:40:04 +08:00
dma-buf dmabuf: fix NULL pointer dereference in dma_buf_release() 2021-03-16 16:37:40 +08:00
edac EDAC/ti: Fix handling of platform_get_irq() error 2021-03-16 16:38:22 +08:00
eisa
…
extcon extcon: ptn5150: Fix usage of atomic GPIO with sleeping GPIO chips 2021-03-16 16:39:55 +08:00
firewire
…
firmware firmware: arm_scmi: Add missing Rx size re-initialisation 2021-03-16 16:39:39 +08:00
fpga fpga: dfl: fix bug in port reset handshake 2021-03-16 16:32:23 +08:00
fsi
…
gnss gnss: sirf: fix error return code in sirf_probe() 2021-03-16 16:29:47 +08:00
gpio gpio: aspeed: fix ast2600 bank properties 2021-03-16 16:37:49 +08:00
gpu drm/i915: Force VT'd workarounds when running as a guest OS 2021-03-16 16:40:03 +08:00
greybus
…
hid HID: wacom: Avoid entering wacom_wac_pen_report for pad / battery 2021-03-16 16:40:03 +08:00
hsi
…
hv Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload 2021-03-16 16:36:17 +08:00
hwmon hwmon: (pmbus/max34440) Fix status register reads for MAX344{51,60,61} 2021-03-16 16:38:27 +08:00
hwspinlock
…
hwtracing coresight: Make sysfs functional on topologies with per core sink 2021-03-16 16:39:47 +08:00
i2c i2c: core: Restore acpi_walk_dep_device_list() getting called after registering the ACPI i2c devs 2021-03-16 16:39:11 +08:00
i3c i3c: master: Fix error return in cdns_i3c_master_probe() 2021-03-16 16:38:56 +08:00
ide
…
idle
…
iio iio:gyro:itg3200: Fix timestamp alignment and prevent data leak. 2021-03-16 16:40:05 +08:00
infiniband RDMA/qedr: Fix memory leak in iWARP CM 2021-03-16 16:39:39 +08:00
input Input: sun4i-ps2 - fix handling of platform_get_irq() error 2021-03-16 16:39:05 +08:00
interconnect
…
iommu iommu/vt-d: Fix lockdep splat in iommu_flush_dev_iotlb() 2021-03-16 16:38:01 +08:00
ipack ipack: tpci200: fix error return code in tpci200_register() 2021-03-16 16:28:19 +08:00
irqchip irqchip/stm32-exti: Avoid losing interrupts due to clearing pending bits by mistake 2021-03-16 16:35:14 +08:00
isdn
…
leds leds: bcm6328, bcm6358: use devres LED registering function 2021-03-16 16:39:56 +08:00
lightnvm lightnvm: fix out-of-bounds write to array devices->info[] 2021-03-16 16:39:10 +08:00
macintosh macintosh/via-macii: Access autopoll_devs when inside lock 2021-03-16 16:33:39 +08:00
mailbox mailbox: avoid timer start from callback 2021-03-16 16:38:59 +08:00
mcb
…
md md/raid5: fix oops during stripe resizing 2021-03-16 16:39:54 +08:00
media media: uvcvideo: Fix uvc_ctrl_fixup_xu_info() not having any effect 2021-03-16 16:39:56 +08:00
memory memory: emif: Remove bogus debugfs error handling 2021-03-16 16:39:52 +08:00
memstick memstick: Skip allocating card when removing host 2021-03-16 16:37:44 +08:00
message scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove() 2021-03-16 16:39:58 +08:00
mfd mfd: sm501: Fix leaks in probe() 2021-03-16 16:38:44 +08:00
misc misc: rtsx: do not setting OC_POWER_DOWN reg in rtsx_pci_init_ocp() 2021-03-16 16:39:36 +08:00
mmc mmc: sdhci-acpi: AMDI0040: Set SDHCI_QUIRK2_PRESET_VALUE_BROKEN 2021-03-16 16:39:54 +08:00
mtd mtd: spinand: gigadevice: Add QE Bit 2021-03-16 16:38:55 +08:00
mux
…
net bnxt_en: Log unknown link speed appropriately. 2021-03-16 16:39:50 +08:00
nfc NFC: st95hf: Fix memleak in st95hf_in_send_cmd 2021-03-16 16:35:54 +08:00
ntb NTB: hw: amd: fix an issue about leak system resources 2021-03-16 16:39:10 +08:00
nubus
…
nvdimm libnvdimm/security: ensure sysfs poll thread woke up and fetch updated attr 2021-03-16 16:34:18 +08:00
nvme nvme-rdma: fix crash when connect rejected 2021-03-16 16:39:54 +08:00
nvmem nvmem: core: fix possibly memleak when use nvmem_cell_info_to_nvmem_cell() 2021-03-16 16:38:43 +08:00
of of: of_mdio: Correct loop scanning logic 2021-03-16 16:31:51 +08:00
opp opp: Prevent memory leak in dev_pm_opp_attach_genpd() 2021-03-16 16:39:19 +08:00
oprofile
…
parisc parisc: mask out enable and reserved bits from sba imask 2021-03-16 16:33:54 +08:00
parport
…
pci PCI/ACPI: Whitelist hotplug ports for D3 if power managed by ACPI 2021-03-16 16:39:57 +08:00
pcmcia
…
perf drivers/perf: thunderx2_pmu: Fix memory resource error handling 2021-03-16 16:38:23 +08:00
phy phy: marvell: comphy: Convert internal SMCC firmware return codes to errno 2021-03-16 16:39:36 +08:00
pinctrl pinctrl: mcp23s08: Fix mcp23x17 precious range 2021-03-16 16:38:38 +08:00
platform platform/x86: mlx-platform: Remove PSU EEPROM configuration 2021-03-16 16:38:46 +08:00
pnp
…
power power: supply: test_power: add missing newlines when printing parameters by sysfs 2021-03-16 16:39:49 +08:00
powercap
…
pps
…
ps3
…
ptp
…
pwm pwm: img: Fix null pointer access in probe 2021-03-16 16:39:01 +08:00
rapidio rapidio: fix the missed put_device() for rio_mport_add_riodev 2021-03-16 16:38:59 +08:00
ras
…
regulator regulator: resolve supply after creating regulator 2021-03-16 16:38:29 +08:00
remoteproc remoteproc: qcom_q6v5_mss: Validate modem blob firmware size before load 2021-03-16 16:34:10 +08:00
reset
…
rpmsg rpmsg: glink: Use complete_all for open states 2021-03-16 16:39:50 +08:00
rtc rtc: ds1374: fix possible race condition 2021-03-16 16:37:01 +08:00
s390 s390/qeth: don't let HW override the configured port role 2021-03-16 16:39:26 +08:00
sbus
…
scsi scsi: qla2xxx: Fix crash on session cleanup with unload 2021-03-16 16:39:58 +08:00
sfi
…
sh
…
siox
…
slimbus slimbus: qcom-ngd-ctrl: disable ngd in qmi server down callback 2021-03-16 16:38:42 +08:00
soc soc: fsl: qbman: Fix return value on success 2021-03-16 16:39:09 +08:00
soundwire soundwire: bus: disable pm_runtime in sdw_slave_delete 2021-03-16 16:36:55 +08:00
spi spi: sprd: Release DMA channel also on probe deferral 2021-03-16 16:39:55 +08:00
spmi
…
ssb
…
staging net: wilc1000: clean up resource in error path of init mon interface 2021-03-16 16:38:40 +08:00
target scsi: target: tcmu: Fix warning: 'page' may be used uninitialized 2021-03-16 16:38:45 +08:00
tc
…
tee
…
thermal thermal: rcar_thermal: Handle probe error gracefully 2021-03-16 16:37:03 +08:00
thunderbolt
…
tty vt: keyboard, extend func_buf_lock to readers 2021-03-16 16:40:03 +08:00
uio uio: free uio id after uio file node is freed 2021-03-16 16:39:47 +08:00
usb usb: host: fsl-mph-dr-of: check return of dma_set_mask() 2021-03-16 16:40:03 +08:00
vfio vfio iommu type1: Fix memory leak in vfio_iommu_type1_pin_pages 2021-03-16 16:39:03 +08:00
vhost vhost: Use vhost_get_used_size() in vhost_vring_set_addr() 2021-03-16 16:37:54 +08:00
video video: fbdev: pvr2fb: initialize variables 2021-03-16 16:39:42 +08:00
virt drivers/virt/fsl_hypervisor: Fix error handling path 2021-03-16 16:38:36 +08:00
virtio virtio_ring: Avoid loop when vq is broken in virtqueue_poll 2021-03-16 16:34:34 +08:00
visorbus
…
vlynq
…
vme
…
w1 w1: mxc_w1: Fix timeout resolution problem leading to bus error 2021-03-16 16:39:58 +08:00
watchdog drivers: watchdog: rdc321x_wdt: Fix race condition bugs 2021-03-16 16:39:51 +08:00
xen xen/events: block rogue events for some time 2021-03-16 16:39:38 +08:00
zorro
…
Kconfig
…
Makefile
…