From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B63B346D08D for ; Fri, 7 Aug 2026 10:20:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.54 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786098037; cv=none; b=WYPpyy9t3njFDfibNcWZop8QGME3JSIvEBn6lr5W3p7QWckXJGsTgW2wDXHW1q2xXOnhmky24uK1G2n/BGBEccW7ALBHQrpu48PsQw6o0IGM0gwjAtQBysELEnQWb6fj2OpR/ROr4sWTG1LA/IpbGUtTz4YHtroHda6BmUOa+nU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786098037; c=relaxed/simple; bh=zHvxZJ1HTzk1ABYWJzT5MESmqHko3h8ghIIuYn8l+1M=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=SMFO663jrQn7R83PAvyMAuFKrBc+hal8dUTb5e9IcRLa+JzyMJoluU3CoUzjrfwWNfAXH2FpE90Bwx5SDRTUvVrWCqIzf+ujfTXa6fIMr+E1B2nHEwQRy4X6Nq0WOJMlPnVg3ZC/J6l5keiDazBXqIxcpcuU9vu1FwpsKncUlng= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=HAJWHKMa; arc=none smtp.client-ip=209.85.128.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="HAJWHKMa" Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-4955de8797cso21953845e9.3 for ; Fri, 07 Aug 2026 03:20:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786098034; x=1786702834; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=sV2OJp2pqrql39Us6FANqWDFNjIhbcgZdjPsmWI3EPI=; b=HAJWHKMa3rSzC/Vk/ht5i4iIELdy5gGyNe1N9DslCCXf1mcK217OmdunYNZJeNVcuP wR86TLji3UuoHjRor7j4Dgg49eBm5aXcekBUXVhZXWb7tsyLuO+TguNzlhxEhuqz0vsS rCq2GY1268xt94wWESbyNOjsvcS+417Mp+DlmVz7PV3GtnWBhoOJGjETINutuMde9oUV BkEEmks+dEaiMkXk26EZ7eOEvDlLsB4xADToEgxtdGR8H9e2KY23rhzty+fyyjpB5efH 7pOoKYyyH8N+8dkk+Jtnk38Fii2+YDyj7DLYYwwOfIw2M4Y1GJsQtD9IdppAuhYdlAIr UuvA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786098034; x=1786702834; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=sV2OJp2pqrql39Us6FANqWDFNjIhbcgZdjPsmWI3EPI=; b=ZaaFYpZvwd+ISeAkAK54BhURB7kbyiplP+VumfdNXL3GTkHhz4sQsdZ/mkL2xukMdg jgOg2hpUaviBDFrms3ix1gLs5r9fHnrzIzcqTiCxF5zM4EAI6ZT4cvCmUvRyectcSJSc TgNcV3IbPHh1PwKfsjKKUNIHomntHN3nxlhO7tPukl+Y65/UVZRDx8TpRQxwaavp1tGg yYMMVp6DaBOYIp9AgnGuVLGOwJNvon4VWMZZPSTrFW2IBZPR9yYKfIhSPfCFV5f/EnoA MxvJGgRvoyHA4t6Q1PGBgkbwbWOr0BIEjaXszsBIdObKSmZNR5AiA6JRABxE22DcOvS+ bo8w== X-Forwarded-Encrypted: i=1; AHgh+RpiRlMZrQjf/erm9lgA1i20Jpm85jnk7eglHiascWyaW3i0KEwqVk4CzT+6nJN3gBFvznfyMrVBh9sLJwk=@vger.kernel.org X-Gm-Message-State: AOJu0YzMHQiaMpdLd8SyYqjLFYQ/eKToCYfveTA2vJDmbvwE2u+1USyz vEiJeopAp1xM4J1+og92rFYjWOlIKNthO7HG5iy/lThdBUGCaWs6y/Nb X-Gm-Gg: AR+sD1137L+FRLEmmiayzHxg6HbNSIOOTSzG2wSHoynVlYsbxRIn+vThq8c0Vw3NbYE huiaZ9UpIVh77hUUzGm7oZ/xBJLr0pmfUu6hLIv8+9tWfU/Obx2+VBCRFR/XowQQVfnRS+2y98X 0UUfKp4QMh20kHbEkkNHGaK1pqllIMU2lB+6TKscx3iksvxZQbev4stpCj7omXk63ClpBTxpiK2 U3aWmYxogpTxI6/JivLF3VmwY2FllNRdg5w3SjqGZLJy0+26udwtK0l0vwcZkuYP7hfTzbbXAQy Bmpct6OGLGZuSM3uEWBpkh7pRuJDCFI3tY7KfLwm/z/XOC4oT85rhXmGn0TqjlFW/G8c5Zcazy1 pItvOJ6c395F3a86csqy0VPyfwewhcJ1b/J4lhFEtreAij9NA0Nm2GXVaiIvmRoGSyooakV4Wxk l4zFnrpPGjogN53bshL4zt82UqQisQtIDenzIEx2GJggekriEgr7FPaZmPNqizRXuSXSuABdLa5 gZx+fDcF6lEWxGB9lW5gvXVMNdR+JAfGzUh0NWyh5xqXLClikQAex2Kqj1XO0U5zXMa+Ws+EyO7 UA9yhnT+urq46A0/lSfw7A3XupDx+mi8WFaItwfC7N4BWH2X1hB5GLiLM+aILahP5VWDdbEno0A GVYsV99Ni+lH2dEiDKUs7DmE3mFXWrVzFa1q1T2N0ADGFbaLFcrk9QqZUkbh7LRMvWLKD0yI= X-Received: by 2002:a05:600c:6612:b0:495:4811:7998 with SMTP id 5b1f17b1804b1-4995e0ebf84mr44035485e9.17.1786098013509; Fri, 07 Aug 2026 03:20:13 -0700 (PDT) Received: from localhost (90-182-112-124.rcp.o2.cz. [90.182.112.124]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4995e9f9424sm22957005e9.8.2026.08.07.03.20.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 07 Aug 2026 03:20:13 -0700 (PDT) Date: Fri, 7 Aug 2026 12:20:11 +0200 From: Joshua Crofts To: "Shengzhuo Wei" Cc: "Jonathan Cameron" , "David Lechner" , Nuno =?ISO-8859-1?Q?S=E1?= , "Andy Shevchenko" , "Sean Nyekjaer" , , , Subject: Re: [PATCH] iio: accel: fxls8962af: clamp FIFO sample count Message-ID: <20260807122011.0000086d@gmail.com> In-Reply-To: <20260806-fxls8962af-fifo-v1-1-bd9d27047fee@cherr.cc> References: <20260806-fxls8962af-fifo-v1-1-bd9d27047fee@cherr.cc> X-Mailer: Claws Mail 4.4.0 (GTK 3.24.51; x86_64-w64-mingw32) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Thu, 06 Aug 2026 05:14:53 +0800 "Shengzhuo Wei" wrote: > fxls8962af_fifo_flush() copies the number of samples the device reports > in its FIFO status register into an on-stack buffer > > u16 buffer[FXLS8962AF_FIFO_LENGTH * 3]; > > which is sized for at most FXLS8962AF_FIFO_LENGTH (32) samples. The > sample count is read from the BUF_STATUS register and only masked to its > 6 valid bits: > > count = reg & FXLS8962AF_BUF_STATUS_BUF_CNT; > > so it can be 0..63, while the buffer holds 32. The only other limit, > the watermark, is applied on the write path (fxls8962af_set_watermark) > but not here on the read path. count samples are then transferred into > buffer[]: > > fxls8962af_fifo_transfer(data, buffer, count); > > fxls8962af_fifo_transfer() reads count * 6 bytes through regmap, so a > malfunctioning, malicious or counterfeit accelerometer (or an attacker > tampering with the I2C/SPI bus) that reports up to 63 samples writes up > to 378 bytes into the 192-byte buffer: a stack out-of-bounds write of up > to 186 bytes that clobbers the stack canary, saved registers and the > return address. > > Clamp count to FXLS8962AF_FIFO_LENGTH, the number of samples buffer[] is > sized for, before the transfer, mirroring the watermark clamp already > done in fxls8962af_set_watermark(). A well-formed flush reports at most > FXLS8962AF_FIFO_LENGTH samples, so legitimate devices are unaffected. > > Fixes: 79e3a5bdd9ef ("iio: accel: fxls8962af: add hw buffered sampling") > Cc: stable@vger.kernel.org > Assisted-by: GLM:5.2 > Signed-off-by: Shengzhuo Wei > --- Makes sense. Reviewed-by: Joshua Crofts -- Kind regards, Joshua Crofts