mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
To: "Jonathan Cameron" <jic23@kernel.org>,
	"Lars-Peter Clausen" <lars@metafoo.de>,
	"Antoni Pokusinski" <apokusinski01@gmail.com>,
	"Francesco Dolcini" <francesco@dolcini.it>,
	"João Paulo Gonçalves" <jpaulo.silvagoncalves@gmail.com>,
	"Christian Eggers" <ceggers@arri.de>
Cc: "Jonathan Cameron" <Jonathan.Cameron@huawei.com>,
	linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org,
	"João Paulo Gonçalves" <joao.goncalves@toradex.com>,
	"Francesco Dolcini" <francesco.dolcini@toradex.com>,
	"Javier Carrasco" <javier.carrasco.cruz@gmail.com>,
	stable@vger.kernel.org
Subject: [PATCH v2 0/2] iio: fix information leaks in triggered buffers
Date: Wed, 04 Dec 2024 00:55:30 +0100	[thread overview]
Message-ID: <20241204-iio_memset_scan_holes-v2-0-3f941592a76d@gmail.com> (raw)

This issue was found after attempting to make the same mistake for
a driver I maintain, which was fortunately spotted by Jonathan [1].

Keeping old sensor values if the channel configuration changes is known
and not considered an issue, which is also mentioned in [1], so it has
not been addressed by this series. That keeps most of the drivers out
of the way because they store the scan element in iio private data,
which is kzalloc() allocated.

This series only addresses cases where uninitialized i.e. unknown data
is pushed to the userspace, either due to holes in structs or
uninitialized struct members/array elements.

While analyzing involved functions, I found and fixed some triviality
(wrong function name) in the documentation of iio_dev_opaque.

Link: https://lore.kernel.org/linux-iio/20241123151634.303aa860@jic23-huawei/ [1]

Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
---
Changes in v2:
- as73211.c: shift channels if no temperature is available and
  initialize chan[3] to zero.
- Link to v1: https://lore.kernel.org/r/20241125-iio_memset_scan_holes-v1-0-0cb6e98d895c@gmail.com

---
Javier Carrasco (2):
      iio: temperature: tmp006: fix information leak in triggered buffer
      iio: light: as73211: fix channel handling in only-color triggered buffer

 drivers/iio/light/as73211.c      | 17 +++++++++++++----
 drivers/iio/temperature/tmp006.c |  2 ++
 2 files changed, 15 insertions(+), 4 deletions(-)
---
base-commit: 1694dea95b02eff1a64c893ffee4626df533b2ab
change-id: 20241123-iio_memset_scan_holes-a673833ef932

Best regards,
-- 
Javier Carrasco <javier.carrasco.cruz@gmail.com>


             reply	other threads:[~2024-12-03 23:55 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-12-03 23:55 Javier Carrasco [this message]
2024-12-03 23:55 ` [PATCH v2 1/2] iio: temperature: tmp006: fix information leak in triggered buffer Javier Carrasco
2024-12-08 16:52   ` Jonathan Cameron
2024-12-03 23:55 ` [PATCH v2 2/2] iio: light: as73211: fix channel handling in only-color " Javier Carrasco
2024-12-04 16:20   ` Christian Eggers
2024-12-08 16:58     ` Jonathan Cameron

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20241204-iio_memset_scan_holes-v2-0-3f941592a76d@gmail.com \
    --to=javier.carrasco.cruz@gmail.com \
    --cc=Jonathan.Cameron@huawei.com \
    --cc=apokusinski01@gmail.com \
    --cc=ceggers@arri.de \
    --cc=francesco.dolcini@toradex.com \
    --cc=francesco@dolcini.it \
    --cc=jic23@kernel.org \
    --cc=joao.goncalves@toradex.com \
    --cc=jpaulo.silvagoncalves@gmail.com \
    --cc=lars@metafoo.de \
    --cc=linux-iio@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®