public inbox for chrome-platform@lists.linux.dev
 help / color / mirror / Atom feed
* [PATCH] iio: Fix the allocation size for cros_ec_command
@ 2023-06-29 13:24 Yiyuan Guo
  2023-06-30  5:13 ` Tzung-Bi Shih
  2023-06-30  6:31 ` [PATCH v2] iio: cros_ec: " Yiyuan Guo
  0 siblings, 2 replies; 7+ messages in thread
From: Yiyuan Guo @ 2023-06-29 13:24 UTC (permalink / raw)
  To: jic23, lars, bleung, groeck
  Cc: dianders, mazziesaccount, gwendal, linux-iio, chrome-platform,
	yguoaz

The struct cros_ec_command contains several integer fields and a
trailing array. An allocation size neglecting the integer fields can
lead to buffer overrun.

Signed-off-by: Yiyuan Guo <yguoaz@gmail.com>
---
 drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
index 943e9e14d1e9..e4c01f1072bd 100644
--- a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
+++ b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
@@ -253,8 +253,8 @@ int cros_ec_sensors_core_init(struct platform_device *pdev,
 	platform_set_drvdata(pdev, indio_dev);
 
 	state->ec = ec->ec_dev;
-	state->msg = devm_kzalloc(&pdev->dev,
-				max((u16)sizeof(struct ec_params_motion_sense),
+	state->msg = devm_kzalloc(&pdev->dev, sizeof(*state->msg) +
+			max((u16)sizeof(struct ec_params_motion_sense),
 				state->ec->max_response), GFP_KERNEL);
 	if (!state->msg)
 		return -ENOMEM;
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* Re: [PATCH] iio: Fix the allocation size for cros_ec_command
  2023-06-29 13:24 [PATCH] iio: Fix the allocation size for cros_ec_command Yiyuan Guo
@ 2023-06-30  5:13 ` Tzung-Bi Shih
  2023-06-30  6:31 ` [PATCH v2] iio: cros_ec: " Yiyuan Guo
  1 sibling, 0 replies; 7+ messages in thread
From: Tzung-Bi Shih @ 2023-06-30  5:13 UTC (permalink / raw)
  To: Yiyuan Guo
  Cc: jic23, lars, bleung, groeck, dianders, mazziesaccount, gwendal,
	linux-iio, chrome-platform

On Thu, Jun 29, 2023 at 09:24:05PM +0800, Yiyuan Guo wrote:
> The struct cros_ec_command contains several integer fields and a
> trailing array. An allocation size neglecting the integer fields can
> lead to buffer overrun.
> 
> Signed-off-by: Yiyuan Guo <yguoaz@gmail.com>

Better prefix the commit title with "iio: cros_ec:".

With that:
Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>

^ permalink raw reply	[flat|nested] 7+ messages in thread

* [PATCH v2] iio: cros_ec: Fix the allocation size for cros_ec_command
  2023-06-29 13:24 [PATCH] iio: Fix the allocation size for cros_ec_command Yiyuan Guo
  2023-06-30  5:13 ` Tzung-Bi Shih
@ 2023-06-30  6:31 ` Yiyuan Guo
  2023-06-30  7:36   ` Tzung-Bi Shih
  1 sibling, 1 reply; 7+ messages in thread
From: Yiyuan Guo @ 2023-06-30  6:31 UTC (permalink / raw)
  To: tzungbi
  Cc: jic23, lars, bleung, groeck, dianders, mazziesaccount, gwendal,
	linux-iio, chrome-platform, yguoaz

The struct cros_ec_command contains several integer fields and a
trailing array. An allocation size neglecting the integer fields can
lead to buffer overrun.

Signed-off-by: Yiyuan Guo <yguoaz@gmail.com>
---
 drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
index 943e9e14d1e9..e4c01f1072bd 100644
--- a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
+++ b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
@@ -253,8 +253,8 @@ int cros_ec_sensors_core_init(struct platform_device *pdev,
 	platform_set_drvdata(pdev, indio_dev);
 
 	state->ec = ec->ec_dev;
-	state->msg = devm_kzalloc(&pdev->dev,
-				max((u16)sizeof(struct ec_params_motion_sense),
+	state->msg = devm_kzalloc(&pdev->dev, sizeof(*state->msg) +
+			max((u16)sizeof(struct ec_params_motion_sense),
 				state->ec->max_response), GFP_KERNEL);
 	if (!state->msg)
 		return -ENOMEM;
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* Re: [PATCH v2] iio: cros_ec: Fix the allocation size for cros_ec_command
  2023-06-30  6:31 ` [PATCH v2] iio: cros_ec: " Yiyuan Guo
@ 2023-06-30  7:36   ` Tzung-Bi Shih
  2023-06-30  8:31     ` [PATCH v3] " Yiyuan Guo
  0 siblings, 1 reply; 7+ messages in thread
From: Tzung-Bi Shih @ 2023-06-30  7:36 UTC (permalink / raw)
  To: Yiyuan Guo
  Cc: jic23, lars, bleung, groeck, dianders, mazziesaccount, gwendal,
	linux-iio, chrome-platform

On Fri, Jun 30, 2023 at 02:31:32PM +0800, Yiyuan Guo wrote:
> The struct cros_ec_command contains several integer fields and a
> trailing array. An allocation size neglecting the integer fields can
> lead to buffer overrun.
> 
> Signed-off-by: Yiyuan Guo <yguoaz@gmail.com>

You could attach my R-b tag as v2 has no major changes from v1.

> ---

Always a good practice to put changelog here.  Search "changelog" in [1].

[1]: https://www.kernel.org/doc/html/latest/process/submitting-patches.html

> @@ -253,8 +253,8 @@ int cros_ec_sensors_core_init(struct platform_device *pdev,
>  	platform_set_drvdata(pdev, indio_dev);
>  
>  	state->ec = ec->ec_dev;
> -	state->msg = devm_kzalloc(&pdev->dev,
> -				max((u16)sizeof(struct ec_params_motion_sense),
> +	state->msg = devm_kzalloc(&pdev->dev, sizeof(*state->msg) +
> +			max((u16)sizeof(struct ec_params_motion_sense),
>  				state->ec->max_response), GFP_KERNEL);

While looking at the patch again, I found a nit.  Please align the code by
adding an extra tab before "max".

^ permalink raw reply	[flat|nested] 7+ messages in thread

* [PATCH v3] iio: cros_ec: Fix the allocation size for cros_ec_command
  2023-06-30  7:36   ` Tzung-Bi Shih
@ 2023-06-30  8:31     ` Yiyuan Guo
  2023-06-30 14:06       ` Guenter Roeck
  0 siblings, 1 reply; 7+ messages in thread
From: Yiyuan Guo @ 2023-06-30  8:31 UTC (permalink / raw)
  To: tzungbi
  Cc: jic23, lars, bleung, groeck, dianders, mazziesaccount, gwendal,
	linux-iio, chrome-platform, yguoaz

The struct cros_ec_command contains several integer fields and a
trailing array. An allocation size neglecting the integer fields can
lead to buffer overrun.

Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
Signed-off-by: Yiyuan Guo <yguoaz@gmail.com>
---
v2->v3: 
 * Added R-b tag from Tzung-Bi Shih
 * Aligned the code by adding an extra tab before "max"
 * Added a patch changelog
v1->v2: Prefixed the commit title with "iio: cros_ec:"

 drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
index 943e9e14d1e9..b72d39fc2434 100644
--- a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
+++ b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
@@ -253,7 +253,7 @@ int cros_ec_sensors_core_init(struct platform_device *pdev,
 	platform_set_drvdata(pdev, indio_dev);
 
 	state->ec = ec->ec_dev;
-	state->msg = devm_kzalloc(&pdev->dev,
+	state->msg = devm_kzalloc(&pdev->dev, sizeof(*state->msg) +
 				max((u16)sizeof(struct ec_params_motion_sense),
 				state->ec->max_response), GFP_KERNEL);
 	if (!state->msg)
-- 
2.25.1


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* Re: [PATCH v3] iio: cros_ec: Fix the allocation size for cros_ec_command
  2023-06-30  8:31     ` [PATCH v3] " Yiyuan Guo
@ 2023-06-30 14:06       ` Guenter Roeck
  2023-06-30 14:42         ` yguoaz
  0 siblings, 1 reply; 7+ messages in thread
From: Guenter Roeck @ 2023-06-30 14:06 UTC (permalink / raw)
  To: Yiyuan Guo
  Cc: tzungbi, jic23, lars, bleung, groeck, dianders, mazziesaccount,
	gwendal, linux-iio, chrome-platform

On Fri, Jun 30, 2023 at 1:31 AM Yiyuan Guo <yguoaz@gmail.com> wrote:
>
> The struct cros_ec_command contains several integer fields and a
> trailing array. An allocation size neglecting the integer fields can
> lead to buffer overrun.
>
> Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
> Signed-off-by: Yiyuan Guo <yguoaz@gmail.com>

Please _never_ send a patch as reply to a previous one, much less with
a Re: subject.

Guenter

> ---
> v2->v3:
>  * Added R-b tag from Tzung-Bi Shih
>  * Aligned the code by adding an extra tab before "max"
>  * Added a patch changelog
> v1->v2: Prefixed the commit title with "iio: cros_ec:"
>
>  drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
> index 943e9e14d1e9..b72d39fc2434 100644
> --- a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
> +++ b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
> @@ -253,7 +253,7 @@ int cros_ec_sensors_core_init(struct platform_device *pdev,
>         platform_set_drvdata(pdev, indio_dev);
>
>         state->ec = ec->ec_dev;
> -       state->msg = devm_kzalloc(&pdev->dev,
> +       state->msg = devm_kzalloc(&pdev->dev, sizeof(*state->msg) +
>                                 max((u16)sizeof(struct ec_params_motion_sense),
>                                 state->ec->max_response), GFP_KERNEL);
>         if (!state->msg)
> --
> 2.25.1
>

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH v3] iio: cros_ec: Fix the allocation size for cros_ec_command
  2023-06-30 14:06       ` Guenter Roeck
@ 2023-06-30 14:42         ` yguoaz
  0 siblings, 0 replies; 7+ messages in thread
From: yguoaz @ 2023-06-30 14:42 UTC (permalink / raw)
  To: Guenter Roeck
  Cc: tzungbi, jic23, lars, bleung, groeck, dianders, mazziesaccount,
	gwendal, linux-iio, chrome-platform

Got it. I have resent the patch in a separate thread.

Thanks,
Yiyuan

On Fri, Jun 30, 2023 at 10:07 PM Guenter Roeck <groeck@google.com> wrote:
>
> On Fri, Jun 30, 2023 at 1:31 AM Yiyuan Guo <yguoaz@gmail.com> wrote:
> >
> > The struct cros_ec_command contains several integer fields and a
> > trailing array. An allocation size neglecting the integer fields can
> > lead to buffer overrun.
> >
> > Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
> > Signed-off-by: Yiyuan Guo <yguoaz@gmail.com>
>
> Please _never_ send a patch as reply to a previous one, much less with
> a Re: subject.
>
> Guenter
>
> > ---
> > v2->v3:
> >  * Added R-b tag from Tzung-Bi Shih
> >  * Aligned the code by adding an extra tab before "max"
> >  * Added a patch changelog
> > v1->v2: Prefixed the commit title with "iio: cros_ec:"
> >
> >  drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
> > index 943e9e14d1e9..b72d39fc2434 100644
> > --- a/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
> > +++ b/drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c
> > @@ -253,7 +253,7 @@ int cros_ec_sensors_core_init(struct platform_device *pdev,
> >         platform_set_drvdata(pdev, indio_dev);
> >
> >         state->ec = ec->ec_dev;
> > -       state->msg = devm_kzalloc(&pdev->dev,
> > +       state->msg = devm_kzalloc(&pdev->dev, sizeof(*state->msg) +
> >                                 max((u16)sizeof(struct ec_params_motion_sense),
> >                                 state->ec->max_response), GFP_KERNEL);
> >         if (!state->msg)
> > --
> > 2.25.1
> >

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2023-06-30 14:42 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-06-29 13:24 [PATCH] iio: Fix the allocation size for cros_ec_command Yiyuan Guo
2023-06-30  5:13 ` Tzung-Bi Shih
2023-06-30  6:31 ` [PATCH v2] iio: cros_ec: " Yiyuan Guo
2023-06-30  7:36   ` Tzung-Bi Shih
2023-06-30  8:31     ` [PATCH v3] " Yiyuan Guo
2023-06-30 14:06       ` Guenter Roeck
2023-06-30 14:42         ` yguoaz

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox