Bryam Vargas d2a4411137
iio: accel: bmc150: clamp the device-reported FIFO frame count ...
__bmc150_accel_fifo_flush() transfers the frame count the device reports
in FIFO_STATUS into an on-stack buffer sized for BMC150_ACCEL_FIFO_LENGTH
(32) samples, but the count is masked to 7 bits (0..127) and the optional
caller budget does not bound the flush-all path. A device, or an attacker
on the I2C/SPI bus, reporting up to 127 frames overflows the buffer by up
to 570 bytes: a stack out-of-bounds write.
Clamp the count to BMC150_ACCEL_FIFO_LENGTH before the transfer, mirroring
the clamp already applied in bmc150_accel_set_watermark(). Conforming
hardware reports at most that many frames and is unaffected.
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me >
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com >
Signed-off-by: Jonathan Cameron <jic23@kernel.org >
2026-06-30 00:15:54 +01:00
2026-06-26 17:03:48 -07:00
2026-06-26 13:00:10 -07:00
2026-06-18 08:12:50 -07:00
2026-06-16 08:53:53 -07:00
2026-06-26 10:47:26 -07:00
2026-06-26 16:15:53 -07:00
2026-06-11 14:24:42 -04:00
2026-06-22 12:20:21 -07:00
2026-06-17 11:54:57 -07:00
2026-06-25 09:00:53 -07:00
2026-06-25 12:48:57 -07:00
2026-06-15 13:57:13 +05:30
2026-06-08 21:26:09 +02:00
2026-06-18 20:53:00 -07:00
2026-06-23 14:00:29 +02:00
2026-06-24 12:48:43 -07:00
2026-06-12 13:47:53 -07:00
2026-06-19 10:14:34 -07:00
2026-06-24 12:48:43 -07:00
2026-06-17 10:21:00 +01:00
2026-06-13 13:24:34 -07:00
2026-06-13 11:10:23 +09:00
2026-06-22 12:20:21 -07:00
2026-06-23 10:44:29 +02:00
2026-06-26 17:03:48 -07:00
2026-06-18 20:53:00 -07:00
2026-06-22 08:06:13 -07:00
2026-06-23 08:31:33 -07:00
2026-06-08 21:51:12 -05:00
2026-06-22 12:20:21 -07:00
2026-06-23 17:53:08 +02:00
2026-06-16 23:19:45 +02:00
2026-06-15 15:08:14 +05:30
2026-06-30 00:15:54 +01:00
2026-06-18 08:16:21 -07:00
2026-06-26 22:42:56 -07:00
2026-06-25 12:48:57 -07:00
2026-06-22 08:06:13 -07:00
2026-06-23 16:02:03 -07:00
2026-06-18 14:45:08 -07:00
2026-06-02 21:27:25 +02:00
2026-06-20 21:18:39 -05:00
2026-06-25 09:56:47 -07:00
2026-06-18 17:21:54 -07:00
2026-06-17 11:21:40 -07:00
2026-06-18 14:26:29 -07:00
2026-06-24 12:48:43 -07:00
2026-06-16 13:02:47 +05:30
2026-06-21 12:25:17 -07:00
2026-06-25 12:25:36 -07:00
2026-06-11 20:24:47 +02:00
2026-06-28 07:46:12 -07:00
2026-06-18 16:27:58 -07:00
2026-06-25 09:56:47 -07:00
2026-06-05 17:18:58 +02:00
2026-06-24 07:56:55 -05:00
2026-06-24 12:48:43 -07:00
2026-06-03 20:50:24 +01:00
2026-06-23 15:41:48 -07:00
2026-06-18 15:03:21 -07:00
2026-06-27 11:00:18 -07:00
2026-06-15 21:12:35 +02:00
2026-06-25 09:20:26 -07:00
2026-06-17 11:38:38 +01:00
2026-06-27 13:48:12 -07:00
2026-06-21 13:20:19 -07:00
2026-06-16 05:31:01 +05:30
2026-06-26 11:07:26 -07:00
2026-06-08 21:53:51 -05:00
2026-06-16 05:18:04 +05:30
2026-06-20 23:31:15 -07:00
2026-06-27 11:00:18 -07:00
2026-06-22 07:43:48 -07:00
2026-06-21 13:20:19 -07:00
2026-06-05 17:19:51 +02:00
2026-06-17 11:21:40 -07:00
2026-06-27 12:15:23 -07:00
2026-06-26 11:18:49 -07:00
2026-06-22 12:43:16 -07:00
2026-06-15 21:01:30 -04:00
2026-06-17 11:21:40 -07:00
2026-06-26 13:24:59 -07:00
2026-06-22 12:09:47 -07:00
2026-06-22 11:51:49 -07:00
2026-06-21 10:29:45 -07:00
2026-06-22 12:09:47 -07:00
2026-06-10 02:17:00 -04:00
2026-06-10 14:33:05 -06:00
2026-06-21 13:20:19 -07:00
2026-06-26 15:12:45 +02:00
2026-06-22 12:20:21 -07:00
2026-06-17 11:49:00 -07:00
2026-06-08 21:37:56 +02:00
2026-06-16 08:04:24 +05:30
2026-06-17 11:54:57 -07:00
d2a4411137