[PATCH v2 2/2] iio: accel: adxl367: reject out-of-range FIFO entry count

The FIFO entry count reported by the device can be as large as 1023
(the low byte plus the low two bits of the high byte), but fifo_buf[]
only has room for ADXL367_FIFO_SIZE (512) entries.
adxl367_push_fifo_data() passes the reported count straight to the FIFO
read, so a count above ADXL367_FIFO_SIZE overflows fifo_buf, a heap
out-of-bounds write of up to 1022 bytes into adjacent memory.

Rather than clamp the count and silently drop the excess, abort the
read: a count beyond the FIFO size means the device is returning
garbage, so the data cannot be trusted. The message is ratelimited
because a stuck device can raise the IRQ repeatedly.

Assisted-by: GLM:5.2
Signed-off-by: Shengzhuo Wei <[email protected]>
---
 drivers/iio/accel/adxl367.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/iio/accel/adxl367.c b/drivers/iio/accel/adxl367.c
index 8c3de11a10a37d228f8758b688156e3ee958c4e9..270d6feede2f60f4274dead7b3974cd04abb14a6 100644
--- a/drivers/iio/accel/adxl367.c
+++ b/drivers/iio/accel/adxl367.c
@@ -787,6 +787,14 @@ static bool adxl367_push_fifo_data(struct iio_dev *indio_dev, u8 status,
 	if (!FIELD_GET(ADXL367_STATUS_FIFO_FULL_MASK, status))
 		return false;
 
+	if (fifo_entries > ADXL367_FIFO_SIZE) {
+		dev_err_ratelimited(st->dev,
+				    "FIFO entry count %u exceeds FIFO size %lu\n",
+				    fifo_entries,
+				    (unsigned long)ADXL367_FIFO_SIZE);
+		return true;
+	}
+
 	fifo_entries -= fifo_entries % st->fifo_set_size;
 
 	ret = st->ops->read_fifo(st->context, st->fifo_buf, fifo_entries);

-- 
2.47.3