Re: [PATCH] iio: adc: sun20i-gpadc: support non-contiguous channel lookups

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Missing bounds check on `iiospec->nargs` leads to uninitialized stack memory read
--

commit b20d529d5a2f9f0071b7ae62b25da6250c765297
Author: Michal Piekos <michal.piekos@mmpsystems.pl>

iio: adc: sun20i-gpadc: support non-contiguous channel lookups

This commit adds a fwnode_xlate callback to map a device tree phandle
argument to the registered channel. This allows the driver to support
non-contiguous channel lookups for consumers like iio-hwmon.

> diff --git a/drivers/iio/adc/sun20i-gpadc-iio.c b/drivers/iio/adc/sun20i-gpadc-iio.c
> index 861c14da75add..95f34a3521583 100644
> --- a/drivers/iio/adc/sun20i-gpadc-iio.c
> +++ b/drivers/iio/adc/sun20i-gpadc-iio.c
[ ... ]
> +static int sun20i_gpadc_fwnode_xlate(struct iio_dev *indio_dev,
> +		const struct fwnode_reference_args *iiospec)
> +{
> +	int i;
> +
> +	for (i = 0; i < indio_dev->num_channels; i++)
> +		if (indio_dev->channels[i].channel == iiospec->args[0])

Could this read uninitialized stack memory if the consumer requests a channel
with 0 arguments?

In the IIO core, __fwnode_iio_channel_get() allocates the iiospec structure
on the stack without zero-initializing it. While the Device Tree backend
zero-initializes unused arguments, other backends like Software Nodes
might not.

If iiospec->nargs is 0, this comparison could use a garbage value from the
stack, leading to unpredictable channel selection or probe failure.

Should we verify if (!iiospec->nargs) before accessing iiospec->args[0]?

> +			return i;
> +
> +	return -EINVAL;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260513-fix-sunxi-gpadc-sparse-channels-v1-1-6c21e290bcee@mmpsystems.pl?part=1