diff options
| author | Bryam Vargas <hexlabsecurity@proton.me> | 2026-06-16 20:56:51 -0500 |
|---|---|---|
| committer | Jonathan Cameron <jic23@kernel.org> | 2026-06-30 00:15:54 +0100 |
| commit | d2a44111379c44011517795bf2b48aed79502fc8 (patch) | |
| tree | d17f7a5e25318519e01f38eb6fe7b0d055eeb920 | |
| parent | e8de771d80a3a1ceb28d0fa98492acc10c251713 (diff) | |
| download | linux-stable-d2a44111379c44011517795bf2b48aed79502fc8.tar.gz linux-stable-d2a44111379c44011517795bf2b48aed79502fc8.zip | |
iio: accel: bmc150: clamp the device-reported FIFO frame count
__bmc150_accel_fifo_flush() transfers the frame count the device reports
in FIFO_STATUS into an on-stack buffer sized for BMC150_ACCEL_FIFO_LENGTH
(32) samples, but the count is masked to 7 bits (0..127) and the optional
caller budget does not bound the flush-all path. A device, or an attacker
on the I2C/SPI bus, reporting up to 127 frames overflows the buffer by up
to 570 bytes: a stack out-of-bounds write.
Clamp the count to BMC150_ACCEL_FIFO_LENGTH before the transfer, mirroring
the clamp already applied in bmc150_accel_set_watermark(). Conforming
hardware reports at most that many frames and is unaffected.
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
| -rw-r--r-- | drivers/iio/accel/bmc150-accel-core.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c index 2398eb7e12cd..ecaa4782d847 100644 --- a/drivers/iio/accel/bmc150-accel-core.c +++ b/drivers/iio/accel/bmc150-accel-core.c @@ -988,8 +988,10 @@ static int __bmc150_accel_fifo_flush(struct iio_dev *indio_dev, do_div(sample_period, count); tstamp = data->timestamp - (count - 1) * sample_period; - if (samples && count > samples) - count = samples; + if (samples) + count = min3(count, samples, BMC150_ACCEL_FIFO_LENGTH); + else + count = min(count, BMC150_ACCEL_FIFO_LENGTH); ret = bmc150_accel_fifo_transfer(data, (u8 *)buffer, count); if (ret) |