Re: [PATCH v2 2/2] iio: accel: adxl367: reject out-of-range FIFO entry count

On Wed, 12 Aug 2026 11:08:43 +0300
Andy Shevchenko <[email protected]> wrote:

> On Wed, Aug 12, 2026 at 03:58:50PM +0800, Shengzhuo Wei wrote:
> > The FIFO entry count reported by the device can be as large as 1023
> > (the low byte plus the low two bits of the high byte), but fifo_buf[]
> > only has room for ADXL367_FIFO_SIZE (512) entries.
> > adxl367_push_fifo_data() passes the reported count straight to the FIFO
> > read, so a count above ADXL367_FIFO_SIZE overflows fifo_buf, a heap
> > out-of-bounds write of up to 1022 bytes into adjacent memory.
> > 
> > Rather than clamp the count and silently drop the excess, abort the
> > read: a count beyond the FIFO size means the device is returning
> > garbage, so the data cannot be trusted. The message is ratelimited
> > because a stuck device can raise the IRQ repeatedly.  
> 
> Aren't they already were discussed in linux-iio@ mailing list earlier?
> 
> ...
> 
> > +		dev_err_ratelimited(st->dev,
> > +				    "FIFO entry count %u exceeds FIFO size %lu\n",
> > +				    fifo_entries,
> > +				    (unsigned long)ADXL367_FIFO_SIZE);  
> 
> In majority of the explicit castings when printing a message they are wrong or
> unneeded. Use correct format specifiers to begin with.
Even more odd when it's casting the number 512 to a long unsigned.

Applied both patches, this one with:

diff --git a/drivers/iio/accel/adxl367.c b/drivers/iio/accel/adxl367.c
index 67b317eec035..a597fee61105 100644
--- a/drivers/iio/accel/adxl367.c
+++ b/drivers/iio/accel/adxl367.c
@@ -789,9 +789,8 @@ static bool adxl367_push_fifo_data(struct iio_dev *indio_dev, u8 status,
 
        if (fifo_entries > ADXL367_FIFO_SIZE) {
                dev_err_ratelimited(st->dev,
-                                   "FIFO entry count %u exceeds FIFO size %lu\n",
-                                   fifo_entries,
-                                   (unsigned long)ADXL367_FIFO_SIZE);
+                                   "FIFO entry count %u exceeds FIFO size %u\n",
+                                   fifo_entries, ADXL367_FIFO_SIZE);
                return true;
        }
 

tweak

Jonathan

>