Re: [PATCH v2 01/15] iio: adc: ad4134: Sign extend sample data

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] iio: adc: ad4134: info leak via uninitialized sample in ad4134_data_read()
--

commit 56b8f43cabdc9a50d1d532dbfddf01a627e253d4
Author: Marcelo Schmitt <marcelo.schmitt@analog.com>

iio: adc: ad4134: Sign extend sample data

Sign extend ADC sample data for correct delivery of negative ADC input
difference.

> diff --git a/drivers/iio/adc/ad4134.c b/drivers/iio/adc/ad4134.c
> index 0490218bb0e9b..7d40c0521bb3f 100644
> --- a/drivers/iio/adc/ad4134.c
> +++ b/drivers/iio/adc/ad4134.c
> @@ -172,6 +172,7 @@ static int ad4134_data_read(struct ad4134_state *st, unsigned int reg,
>  			    unsigned int *val)
>  {
>  	unsigned int i;
> +	u32 sample;
>  	int ret;
>  
>  	/*

[ ... ]

> @@ -196,8 +197,9 @@ static int ad4134_data_read(struct ad4134_state *st, unsigned int reg,
>  		 * Clock out data from all channels to avoid that.
>  		 */
>  		if (i == AD4134_VREG_CH(reg))
> -			*val = get_unaligned_be24(st->rx_buf);
> +			sample = get_unaligned_be24(st->rx_buf);
>  	}
> +	*val = sign_extend32(sample, AD4134_CHAN_PRECISION_BITS - 1);

[Severity: High]
Does this code leak uninitialized stack memory to userspace?

If a privileged user reads register 0x54 via the IIO debugfs
direct_reg_access file, ad4134_data_read() is invoked with reg=0x54. This is
possible because of a pre-existing off-by-one error in the regmap
configuration (where AD4134_CH_VREG(AD4134_NUM_CHANNELS) evaluates to 0x54)
that allows read access to this virtual register.

Because the loop index 'i' only iterates up to 3, the condition
'i == AD4134_VREG_CH(0x54)' is never met and 'sample' is left uninitialized.
The newly introduced code then unconditionally sign-extends this uninitialized
memory and writes it back to '*val', which is then returned to the user.

>  
>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1789494473.git.marcelo.schmitt@analog.com?part=1