[PATCH v2 1/2] iio: accel: adxl380: reject out-of-range FIFO entry count
"Shengzhuo Wei" <[email protected]>
| Newsgroups | org.kernel.vger.linux-iio,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
The FIFO entry count is a 9-bit device-reported value, so it can be as large as 511, but fifo_buf[] only has room for ADXL380_FIFO_SAMPLES (315) entries. adxl380_irq_handler() uses the reported count directly as the length of a bulk FIFO read, so a count above ADXL380_FIFO_SAMPLES overflows fifo_buf, a heap out-of-bounds write of up to 392 bytes into adjacent memory. Rather than clamp the count and silently drop the excess, abort the read: a count beyond the FIFO size means the device is returning garbage, so the data cannot be trusted. The message is ratelimited because a stuck device can raise the watermark IRQ repeatedly. Assisted-by: GLM:5.2 Signed-off-by: Shengzhuo Wei <[email protected]> --- drivers/iio/accel/adxl380.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/iio/accel/adxl380.c b/drivers/iio/accel/adxl380.c index 7dca5523091fc4c6a3c3bf7e388d5d0d507bee19..8518ee23e114901ee02933e91b8bdf8d7c83008c 100644 --- a/drivers/iio/accel/adxl380.c +++ b/drivers/iio/accel/adxl380.c @@ -966,6 +966,13 @@ static irqreturn_t adxl380_irq_handler(int irq, void *p) if (ret) return IRQ_HANDLED; + if (fifo_entries > ADXL380_FIFO_SAMPLES) { + dev_err_ratelimited(st->dev, + "FIFO entry count %u exceeds FIFO size %lu\n", + fifo_entries, ADXL380_FIFO_SAMPLES); + return IRQ_HANDLED; + } + fifo_entries = rounddown(fifo_entries, st->fifo_set_size); ret = regmap_noinc_read(st->regmap, ADXL380_FIFO_DATA, &st->fifo_buf, sizeof(*st->fifo_buf) * fifo_entries); -- 2.47.3