Re: [PATCH] iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup

On Wed,  5 Aug 2026 15:41:27 +0800
Hui Su <[email protected]> wrote:

> The sampling frequency tables store each frequency as an integer part
> and a fractional part in micro units. num_sampling_freq_avail is
> initialized to the number of flattened integer elements because
> read_avail() returns the table as a flat array.
> 
> bmp280_write_sampling_frequency(), however, indexes the same table as a
> two-dimensional array and uses num_sampling_freq_avail as the number of
> rows. This makes the lookup walk past the end of the table when an
> unsupported sampling frequency is written.
> 
> Convert the flattened element count back to the number of rows before
> iterating over the table.
> 
> Fixes: 10b40ffba2f9 ("iio: pressure: bmp280: Add more tunable config parameters for BMP380")
> Cc: [email protected]
> Signed-off-by: Hui Su <[email protected]>
> ---

LGTM

Reviewed-by: Joshua Crofts <[email protected]>

-- 
Kind regards,
Joshua Crofts