diff options
| author | Bryam Vargas <hexlabsecurity@proton.me> | 2026-06-16 20:56:15 -0500 |
|---|---|---|
| committer | Jonathan Cameron <jic23@kernel.org> | 2026-06-30 00:15:55 +0100 |
| commit | 2f8225b91eb478ca2e9aec8aaef4d229765bcebe (patch) | |
| tree | 0a085a1ab2032447ee9aadd9ed2ea84d60e1216f | |
| parent | d2a44111379c44011517795bf2b48aed79502fc8 (diff) | |
| download | linux-next-2f8225b91eb478ca2e9aec8aaef4d229765bcebe.tar.gz linux-next-2f8225b91eb478ca2e9aec8aaef4d229765bcebe.zip | |
iio: accel: fxls8962af: clamp the device-reported FIFO sample count
fxls8962af_fifo_flush() transfers the sample count the device reports in
BUF_STATUS into an on-stack buffer sized for FXLS8962AF_FIFO_LENGTH (32)
samples, but the count is a 6-bit field (0..63) that is only checked for
zero. A device, or an attacker on the I2C/SPI bus, reporting 33..63
overflows the buffer by up to 186 bytes: a stack out-of-bounds write.
Clamp the count to FXLS8962AF_FIFO_LENGTH before the transfer, mirroring
the clamp already applied in fxls8962af_set_watermark(). Conforming
hardware reports at most that many samples and is unaffected.
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
| -rw-r--r-- | drivers/iio/accel/fxls8962af-core.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/iio/accel/fxls8962af-core.c b/drivers/iio/accel/fxls8962af-core.c index 8763e91c63d2..1ecffbf41f64 100644 --- a/drivers/iio/accel/fxls8962af-core.c +++ b/drivers/iio/accel/fxls8962af-core.c @@ -970,6 +970,8 @@ static int fxls8962af_fifo_flush(struct iio_dev *indio_dev) if (!count) return 0; + count = min(count, FXLS8962AF_FIFO_LENGTH); + data->old_timestamp = data->timestamp; data->timestamp = iio_get_time_ns(indio_dev); |