[PATCH] iio: accel: adxl367: clamp FIFO sample count
"Shengzhuo Wei" <[email protected]>
| Newsgroups | org.kernel.vger.linux-iio |
|---|---|
| Message-ID | <[email protected]> |
The FIFO entry count is a 10-bit device-reported value and can therefore
be as large as 1023. fifo_buf[], however, only has room for
ADXL367_FIFO_SIZE (512) entries.
After rounding the count down to a multiple of fifo_set_size,
adxl367_push_fifo_data() uses it directly as the length of a bulk FIFO
read. If the reported count exceeds ADXL367_FIFO_SIZE, this can
overflow fifo_buf.
Clamp the reported entry count to the size of fifo_buf before rounding
it down.
Fixes: cbab791c5e2a ("iio: accel: add ADXL367 driver")
Cc: [email protected]
Assisted-by: GLM:5.2
Signed-off-by: Shengzhuo Wei <[email protected]>
---
drivers/iio/accel/adxl367.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/iio/accel/adxl367.c b/drivers/iio/accel/adxl367.c
index 8c3de11a10a37d228f8758b688156e3ee958c4e9..c82f6c8e5a0d8f4a66ea6c97b78c3838f6138502 100644
--- a/drivers/iio/accel/adxl367.c
+++ b/drivers/iio/accel/adxl367.c
@@ -787,6 +787,7 @@ static bool adxl367_push_fifo_data(struct iio_dev *indio_dev, u8 status,
if (!FIELD_GET(ADXL367_STATUS_FIFO_FULL_MASK, status))
return false;
+ fifo_entries = min(fifo_entries, ADXL367_FIFO_SIZE);
fifo_entries -= fifo_entries % st->fifo_set_size;
ret = st->ops->read_fifo(st->context, st->fifo_buf, fifo_entries);
---
base-commit: 848acc8ffe1b7cd5f1bf427b93069becfebc2c9d
change-id: 20260809-adxl367-fifo-clamp-50f2110e03f8
Best regards,
--
Shengzhuo Wei <[email protected]>