Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Lars-Peter Clausen b9af25917d iio: adis_buffer: Fix out-of-bounds memory access ... commit d590faf9e8 upstream. The SPI tx and rx buffers are both supposed to be scan_bytes amount of bytes large and a common allocation is used to allocate both buffers. This puts the beginning of the tx buffer scan_bytes bytes after the rx buffer. The initialization of the tx buffer pointer is done adding scan_bytes to the beginning of the rx buffer, but since the rx buffer is of type __be16 this will actually add two times as much and the tx buffer ends up pointing after the allocated buffer. Fix this by using scan_count, which is scan_bytes / 2, instead of scan_bytes when initializing the tx buffer pointer. Fixes: aacff892cb ("staging:iio:adis: Preallocate transfer message") Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> Signed-off-by: Jonathan Cameron <jic23@kernel.org> Signed-off-by: Luis Henriques <luis.henriques@canonical.com>		History 2016-02-16 19:50:01 +00:00
..
inv_mpu6050	iio: inv-mpu: Specify the expected format/precision for write channels	2015-08-10 09:54:06 +01:00
adis.c	iio:imu: Add support for the ADIS16480 and similar IMUs	2012-11-20 21:28:51 +00:00
adis16400.h	iio: adis16400: Fix burst transfer for adis16448	2015-06-11 11:24:57 +01:00
adis16400_buffer.c	iio: adis16400: Fix burst transfer for adis16448	2015-06-11 11:24:57 +01:00
adis16400_core.c	iio: adis16400: Fix adis16448 gyroscope scale	2015-09-28 10:21:36 +01:00
adis16480.c	iio: adis16480: Fix scale factors	2015-09-28 10:21:37 +01:00
adis_buffer.c	iio: adis_buffer: Fix out-of-bounds memory access	2016-02-16 19:50:01 +00:00
adis_trigger.c	iio: imu: Use iio_trigger_get for indio_dev->trig assignment	2015-04-13 16:48:58 +01:00
Kconfig	iio: imu: mpu6050: Move config entry into IMU menu	2014-02-08 12:27:30 +00:00
Makefile	iio: Add a comment to about alphabetical order to Kconfigs and Makefiles	2013-08-03 18:40:36 +01:00