kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/drivers/iio/dac
History
Miaoqian Lin 978d28136c iio: dac: ad3552r-hs: fix out-of-bound write in ad3552r_hs_write_data_source 
When simple_write_to_buffer() succeeds, it returns the number of bytes
actually copied to the buffer. The code incorrectly uses 'count'
as the index for null termination instead of the actual bytes copied.
If count exceeds the buffer size, this leads to out-of-bounds write.
Add a check for the count and use the return value as the index.

The bug was validated using a demo module that mirrors the original
code and was tested under QEMU.

Pattern of the bug:
- A fixed 64-byte stack buffer is filled using count.
- If count > 64, the code still does buf[count] = '\0', causing an
- out-of-bounds write on the stack.

Steps for reproduce:
- Opens the device node.
- Writes 128 bytes of A to it.
- This overflows the 64-byte stack buffer and KASAN reports the OOB.

Found via static analysis. This is similar to the
commit da9374819e ("iio: backend: fix out-of-bound write")

Fixes: b1c5d68ea6 ("iio: dac: ad3552r-hs: add support for internal ramp")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
History 2026-01-11 13:25:15 +00:00
..
ad3530r.c iio: dac: Convert to common field_prep() helper 2025-11-24 14:15:47 -05:00
ad3552r-common.c iio: dac: ad3552r-hs: add debugfs reg access 2025-04-22 19:09:53 +01:00
ad3552r-hs.c iio: dac: ad3552r-hs: fix out-of-bound write in ad3552r_hs_write_data_source 2026-01-11 13:25:15 +00:00
ad3552r-hs.h iio: dac: adi-axi-dac: add bus mode setup 2025-02-08 15:10:11 +00:00
ad3552r.c iio: dac: ad3552r: use = { } instead of memset() 2025-06-26 19:32:56 +01:00
ad3552r.h iio: dac: ad3552r-hs: add debugfs reg access 2025-04-22 19:09:53 +01:00
ad5064.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
ad5360.c iio: dac: ad5360: use int type to store negative error codes 2025-09-01 20:43:36 +01:00
ad5380.c iio: dac: Drop unnecessary -ENOMEM messages 2025-08-25 12:32:48 +01:00
ad5421.c iio: dac: ad5421: use int type to store negative error codes 2025-09-01 20:43:43 +01:00
ad5446-i2c.c iio: dac: ad5446: Separate I2C/SPI into different drivers 2025-11-09 16:15:13 +00:00
ad5446-spi.c iio: dac: ad5446: Add AD5542 to the spi id table 2025-11-09 16:32:29 +00:00
ad5446.c iio: dac: ad5446: Fix coding style issues 2025-11-09 16:31:22 +00:00
ad5446.h iio: dac: ad5446: Refactor header inclusion 2025-11-09 16:30:47 +00:00
ad5449.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
ad5504.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
ad5592r-base.c treewide: rename GPIO set callbacks back to their original names 2025-08-07 10:07:06 +02:00
ad5592r-base.h iio: dac: ad5592r: Fix alignment for DMA safety 2022-06-14 11:53:16 +01:00
ad5592r.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
ad5593r.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
ad5624r.h iio: dac: ad5624r: Drop docs of missing members 2024-12-28 14:28:13 +00:00
ad5624r_spi.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
ad5686-spi.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
ad5686.c iio: dac: ad5686: add AD5695R to ad5686_chip_info_tbl 2025-12-21 11:14:10 +00:00
ad5686.h iio: dac: ad5686: use devm_regulator_get_enable_read_voltage() 2024-12-07 17:47:35 +00:00
ad5696-i2c.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
ad5755.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
ad5758.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
ad5761.c iio: dac: ad5761: remove bits_per_word = 8 2025-05-21 14:20:30 +01:00
ad5764.c iio: dac: Drop unnecessary -ENOMEM messages 2025-08-25 12:32:48 +01:00
ad5766.c iio: dac: ad5766: remove bits_per_word = 8 2025-05-21 14:20:30 +01:00
ad5770r.c iio: dac: ad5770r: make ad5770r_rng_tbl const 2025-07-06 10:37:53 +01:00
ad5791.c iio: dac: ad5791: drop unused member of struct ad5791_state 2025-08-16 14:42:02 +01:00
ad7293.c iio: dac: ad7293: add adc reference configuration 2025-05-21 14:20:29 +01:00
ad7303.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
ad8460.c iio: dac: ad8460: Stop using iio_device_claim_direct_scoped() 2025-02-17 13:03:24 +00:00
ad8801.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
ad9739a.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
adi-axi-dac.c This is the usual collection of primarily clk driver updates. The big part of 2025-07-31 13:36:27 -07:00
cio-dac.c 1st set of IIO new device support, features and cleanups for the 6.4 cycle. 2023-04-12 09:45:34 +02:00
dpot-dac.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
ds4424.c iio: dac: Drop unnecessary -ENOMEM messages 2025-08-25 12:32:48 +01:00
Kconfig iio: dac: ad5446: Separate I2C/SPI into different drivers 2025-11-09 16:15:13 +00:00
lpc18xx_dac.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
ltc1660.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
ltc2632.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
ltc2664.c iioc: dac: ltc2664: Fix span variable usage in ltc2664_channel_config() 2024-10-06 16:31:46 +01:00
ltc2688.c iio: dac: ltc2688: use the auto lock API 2025-10-19 11:59:18 +01:00
m62332.c iio: dac: m62332: Get platform data via dev_get_platdata() 2024-09-30 09:21:00 +01:00
Makefile iio: dac: ad5446: Separate I2C/SPI into different drivers 2025-11-09 16:15:13 +00:00
max517.c iio: Remove single use of macro definition for driver name 2025-06-09 07:45:36 +01:00
max5522.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
max5821.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
mcp4725.c iio: Remove single use of macro definition for driver name 2025-06-09 07:45:36 +01:00
mcp4728.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
mcp4821.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
mcp4922.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
rohm-bd79703.c iio: dac: bd79703: convert to use maple tree register cache 2025-06-26 19:32:52 +01:00
stm32-dac-core.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
stm32-dac-core.h iio: stm32: Adopt SPDX identifier 2018-01-08 16:03:41 +01:00
stm32-dac.c iio: dac: Remove redundant pm_runtime_mark_last_busy() calls 2025-08-30 20:50:21 +01:00
ti-dac082s085.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
ti-dac5571.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
ti-dac7311.c iio: dac: Drop unnecessary -ENOMEM messages 2025-08-25 12:32:48 +01:00
ti-dac7612.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
vf610_dac.c iio: dac: vf610: Simplify with devm_clk_get_enabled() 2025-07-14 19:20:54 +01:00