[PATCH v2 1/2] iio: accel: adxl380: reject out-of-range FIFO entry count

"Shengzhuo Wei" <[email protected]>
Newsgroups org.kernel.vger.linux-iio,org.kernel.vger.linux-kernel
Message-ID <[email protected]>
The FIFO entry count is a 9-bit device-reported value, so it can be as
large as 511, but fifo_buf[] only has room for ADXL380_FIFO_SAMPLES
(315) entries. adxl380_irq_handler() uses the reported count directly as
the length of a bulk FIFO read, so a count above ADXL380_FIFO_SAMPLES
overflows fifo_buf, a heap out-of-bounds write of up to 392 bytes into
adjacent memory.

Rather than clamp the count and silently drop the excess, abort the
read: a count beyond the FIFO size means the device is returning
garbage, so the data cannot be trusted. The message is ratelimited
because a stuck device can raise the watermark IRQ repeatedly.

Assisted-by: GLM:5.2
Signed-off-by: Shengzhuo Wei <[email protected]>
---
 drivers/iio/accel/adxl380.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/iio/accel/adxl380.c b/drivers/iio/accel/adxl380.c
index 7dca5523091fc4c6a3c3bf7e388d5d0d507bee19..8518ee23e114901ee02933e91b8bdf8d7c83008c 100644
--- a/drivers/iio/accel/adxl380.c
+++ b/drivers/iio/accel/adxl380.c
@@ -966,6 +966,13 @@ static irqreturn_t adxl380_irq_handler(int irq, void  *p)
 	if (ret)
 		return IRQ_HANDLED;
 
+	if (fifo_entries > ADXL380_FIFO_SAMPLES) {
+		dev_err_ratelimited(st->dev,
+				    "FIFO entry count %u exceeds FIFO size %lu\n",
+				    fifo_entries, ADXL380_FIFO_SAMPLES);
+		return IRQ_HANDLED;
+	}
+
 	fifo_entries = rounddown(fifo_entries, st->fifo_set_size);
 	ret = regmap_noinc_read(st->regmap, ADXL380_FIFO_DATA, &st->fifo_buf,
 				sizeof(*st->fifo_buf) * fifo_entries);

-- 
2.47.3
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.