mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-15 19:56:03 +00:00
6bdc3023d6
itg3200_read_all_channels() takes `__be16 *buf' as a parameter and
fills the i2c_msg destination as `(char *)&buf'. Since `buf' is the
parameter (a pointer), `&buf' is the address of the local pointer
slot on the stack of itg3200_read_all_channels(), not the address
of the caller's scan buffer. The (char *) cast hides the type
mismatch.
i2c_transfer() therefore writes ITG3200_SCAN_ELEMENTS * sizeof(s16)
= 8 bytes into the parameter's stack slot, which is discarded when
the function returns. The caller's scan buffer in
itg3200_trigger_handler() is never written to, so
iio_push_to_buffers_with_timestamp() pushes uninitialised stack
contents to userspace via /dev/iio:deviceX every scan -- both a
functional bug (no actual gyroscope or temperature data is
delivered through the triggered buffer) and an information leak.
The non-buffered read_raw() path is unaffected: it goes through
itg3200_read_reg_s16() which uses `&out' on a local s16 value,
where that is correct.
Drop the spurious `&' so the i2c read writes into the caller's
buffer.
Fixes:
|
History
|
|
|---|---|---|
| .. | ||
| adis16080.c | ||
| adis16130.c | ||
| adis16136.c | ||
| adis16260.c | ||
| adxrs290.c | ||
| adxrs450.c | ||
| bmg160.h | ||
| bmg160_core.c | ||
| bmg160_i2c.c | ||
| bmg160_spi.c | ||
| fxas21002c.h | ||
| fxas21002c_core.c | ||
| fxas21002c_i2c.c | ||
| fxas21002c_spi.c | ||
| hid-sensor-gyro-3d.c | ||
| itg3200_buffer.c | ||
| itg3200_core.c | ||
| Kconfig | ||
| Makefile | ||
| mpu3050-core.c | ||
| mpu3050-i2c.c | ||
| mpu3050.h | ||
| ssp_gyro_sensor.c | ||
| st_gyro.h | ||
| st_gyro_buffer.c | ||
| st_gyro_core.c | ||
| st_gyro_i2c.c | ||
| st_gyro_spi.c | ||