[PATCH] iio: accel: adxl380: clamp FIFO sample count
"Shengzhuo Wei" <[email protected]>
| Newsgroups | org.kernel.vger.stable,org.kernel.vger.linux-iio,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
The FIFO entry count is a 9-bit device-reported value and can therefore
be as large as 511. fifo_buf[], however, only has room for
ADXL380_FIFO_SAMPLES (315) entries.
After rounding the count down to a multiple of fifo_set_size,
adxl380_irq_handler() uses it directly as the length of a bulk FIFO
read. If the reported count exceeds ADXL380_FIFO_SAMPLES, this can
overflow fifo_buf.
Clamp the reported entry count to the size of fifo_buf before rounding
it down.
Fixes: df36de13677a ("iio: accel: add ADXL380 driver")
Cc: [email protected]
Assisted-by: GLM:5.2
Signed-off-by: Shengzhuo Wei <[email protected]>
---
drivers/iio/accel/adxl380.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/iio/accel/adxl380.c b/drivers/iio/accel/adxl380.c
index 7dca5523091fc4c6a3c3bf7e388d5d0d507bee19..8a9d82e1d882aa45721013590ecbd86b083a15a6 100644
--- a/drivers/iio/accel/adxl380.c
+++ b/drivers/iio/accel/adxl380.c
@@ -966,6 +966,7 @@ static irqreturn_t adxl380_irq_handler(int irq, void *p)
if (ret)
return IRQ_HANDLED;
+ fifo_entries = min(fifo_entries, ADXL380_FIFO_SAMPLES);
fifo_entries = rounddown(fifo_entries, st->fifo_set_size);
ret = regmap_noinc_read(st->regmap, ADXL380_FIFO_DATA, &st->fifo_buf,
sizeof(*st->fifo_buf) * fifo_entries);
---
base-commit: 848acc8ffe1b7cd5f1bf427b93069becfebc2c9d
change-id: 20260809-adxl380-fifo-clamp-f07a570d96b1
Best regards,
--
Shengzhuo Wei <[email protected]>