From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ot1-f51.google.com (mail-ot1-f51.google.com [209.85.210.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D43D432D0E3 for ; Sun, 22 Mar 2026 14:34:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.51 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774190069; cv=none; b=VDTxun4j28vP1u19m4PhSMX1+zMQuOrbPaKsL2Q4afM/+LEo7K4a7cbHVoWIzrP+K0sHtlx6xVsbIwVFodpSLs7KXEC2kNlnEzCRi3btwilgAGPbkGl3lgpI7+2YrTA/fKqsAlZ/LDqqw01YDLbmXGF99EPW7EGJyX4DihREnUA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774190069; c=relaxed/simple; bh=U7KSkfO7CouU1DVjGUDWy4vJlG1h+IQKkVaM4pMQIEc=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=oT3BCNMnKVMwZLEixCp5pWzaXI/RbzBxH2oexgYj8sWZVu/wyI1K4sm+K6UZN/66nVX9ZL8BxKn/R31g7CLIgq7JdyisH1Wk4Xu5+RfJ2sDJjW/YMQSnyzXb7qSWjhcmjhoowqNDmZwC3W1KiAcL9ayg6bWNEBVc3UIW4WZKdEk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=baylibre.com; spf=pass smtp.mailfrom=baylibre.com; dkim=pass (2048-bit key) header.d=baylibre-com.20230601.gappssmtp.com header.i=@baylibre-com.20230601.gappssmtp.com header.b=eJXfjWn/; arc=none smtp.client-ip=209.85.210.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=baylibre.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=baylibre.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=baylibre-com.20230601.gappssmtp.com header.i=@baylibre-com.20230601.gappssmtp.com header.b="eJXfjWn/" Received: by mail-ot1-f51.google.com with SMTP id 46e09a7af769-7d7e5e8c907so1819941a34.0 for ; Sun, 22 Mar 2026 07:34:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=baylibre-com.20230601.gappssmtp.com; s=20230601; t=1774190066; x=1774794866; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=EWy0Djm3zJ1FDFJX6sj4xTqQeSs9XFMQf8coYBnmbE4=; b=eJXfjWn/NIhAlDxms9b45lp1DX/XkAD4hS6W7Yt84L0V4pL/gcnDWimKH0/DJv/YLP /C3LPrDVE3ADCxVfe0NTJMzjyQyWqlrDzeYP9gNWVoz2KxVjvX39SRI1UsyxtlP37AoE 0FZHo5CPbxanKGqV+4KB4x0Vo7drH4jfuU/6LNbeI5rT4p9N6fXWpQ5tSbNtzGBayq5c vw/hG5pQQt9VSeP4TRFEN09ExHxU3ydo6xHpCxT8P/bghK8ekawydSgNmO+pjq/+cR+L Qkrmau227i6pMYvol/XZbnzL8NkTyTFx0wAeaQOglFGexkkMtg98EeIEro0/zr9XexzY LqBQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774190066; x=1774794866; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=EWy0Djm3zJ1FDFJX6sj4xTqQeSs9XFMQf8coYBnmbE4=; b=e5fBSGtrxrEzz/lEkmrqLdo4T7lYwBuwKu8wwirXjr50vBlIyRBaCS1mNWrpUVzd5J CkQrl6JNngGA15Ky0sU97J+Xf1GTD5+TtqmRHc5tkvbUr65UUvSL3+uC4pkp3ccrVNDg xmlakBJ4rs1tRLLWa/pLr5ITucDG795r+xR2Esl2+rSv3iTn/w9IJMHVz1lEeh3twWKL ljzk8FaJif+i74dpui/il+ZdPhsouAr+qU1GbJR2DFOcJoEszI7waQGNCtc1hjXmUQOm j5Qn3Qoa4w8BTTUdqF5yHita0ednJeOGyRXPQpPclTK7qkc0XqyjDvCEjtywcDOKrRJq 2SNw== X-Forwarded-Encrypted: i=1; AJvYcCXItjYcSr/kNI9rPferaKoPCZSdfqgSLz14HnPdH4E1HZ5Lf7bhOEWvmmJ9gwN8U61CNmEbfPO1baDLANo=@vger.kernel.org X-Gm-Message-State: AOJu0YwTsj3LKZ6SqMydlPH35PN98cDfLl4EiFyYVu2uwTOsCDFGb/sb nYFjoauxJaYwcM0IoYkdunHtYrBjEOCXivNMKNxJ5WGwkVyYYAJpmTQbZ/j+I3JHlgY= X-Gm-Gg: ATEYQzzQ9olgwJmnbPtS4/Rc/KpqLHrM3V8S0768/XKmrlMGa+bVle94RVopyHt6IGk gAzUEVwBkfAHdcvXMDZCIP442/jTbXTXIl3RJafJI1VTqWel2Zp6KdemSSdi5b5N/6c2d/8F10l iWZ9eZoGUHCR7W198sr3eIKCpnyzxtdMPW/o1mWbWucm/MnQSDrjFqp/VNBj1E6YxR/Cd+TYLZT deQ/C9n/Lr8HfxRS26qSQOG42m2n2rdUWuX2OQYYKGVWgiZXyvcOZaBFzyGUttGcHSgYGYU7uP2 nbYsnF4Xi2PYpwikGQba+TaAPQpS+nkKGTQo9AL1bwGK0Fn1p9S41Tf74Ncs8+24F/UVemt55hW m0jCZVzkJooRRnw2EaVBG6Dp7zn3OdcJPb6wwMG/uwQZrQanu+zFON7iI+hKpahZc9qhgZ9br01 Ltzs7j7YvFJKDC+wztB32FpI0cDYCrbdHFmN023IW3vtvv7RPywj3eunGRv9S+09dQ3VUhObk= X-Received: by 2002:a05:6830:4491:b0:7d7:fc2a:2fab with SMTP id 46e09a7af769-7d7fc2a32f5mr4003877a34.33.1774190065660; Sun, 22 Mar 2026 07:34:25 -0700 (PDT) Received: from ?IPV6:2600:8803:e7e4:500:fb84:df2:aafb:553d? ([2600:8803:e7e4:500:fb84:df2:aafb:553d]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-7d7f8ec22casm5207885a34.21.2026.03.22.07.34.24 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sun, 22 Mar 2026 07:34:25 -0700 (PDT) Message-ID: Date: Sun, 22 Mar 2026 09:34:24 -0500 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2] iio: chemical: mhz19b: bound receive buffer copy To: Pengpeng Hou , linux-iio@vger.kernel.org Cc: Gyeyoung Baek , Jonathan Cameron , =?UTF-8?Q?Nuno_S=C3=A1?= , Andy Shevchenko , linux-kernel@vger.kernel.org References: <20260322031923.58031-1-pengpeng@iscas.ac.cn> <20260322134807.16217-1-pengpeng@iscas.ac.cn> Content-Language: en-US From: David Lechner In-Reply-To: <20260322134807.16217-1-pengpeng@iscas.ac.cn> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 3/22/26 8:48 AM, Pengpeng Hou wrote: > `mhz19b_receive_buf()` appends bytes to the fixed 9-byte command buffer > without first checking that the new chunk fits in the remaining space. > A single receive callback can therefore write past the end of `st->buf` > before the driver sees that the command is complete. > > Drop overlong chunks and reset the partial command state before the > copy. > > Signed-off-by: Pengpeng Hou > --- Please don't make v2 a reply to v1. It makes it hard to see that a new version has been sent. Also, please include a changelog here (below the ---) when sending new revisions so that we know what changed compared to v1. For this patch, you can just reply with the changelog instead of sending a new revision. Also, you received an Acked-by on v1, so you need to explain why you did not keep that tag when you sent v2. > drivers/iio/chemical/mhz19b.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/drivers/iio/chemical/mhz19b.c b/drivers/iio/chemical/mhz19b.c > index 3c64154918b1..fbd7f14483b3 100644 > --- a/drivers/iio/chemical/mhz19b.c > +++ b/drivers/iio/chemical/mhz19b.c > @@ -240,6 +240,12 @@ static size_t mhz19b_receive_buf(struct serdev_device *serdev, > { > struct iio_dev *indio_dev = dev_get_drvdata(&serdev->dev); > struct mhz19b_state *st = iio_priv(indio_dev); > + size_t remaining = sizeof(st->buf) - st->buf_idx; > + > + if (unlikely(len > remaining)) { > + st->buf_idx = 0; > + return len; > + } > > memcpy(st->buf + st->buf_idx, data, len); > st->buf_idx += len;