Re: [PATCH v2 4/4] iio: adc: ltc2378: Enable triggered buffer data capture

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The `ltc2378_scan` structure is allocated on the stack but not fully initialized, leaving fields like `endianness`, `shift`, and `repeat` with garbage values. This leads to out-of-bounds array reads in the IIO core, data corruption, and potential information disclosure.
--

commit 9e45014ec9c648942b0872f2dcaabf867779b73e
Author: Marcelo Schmitt <marcelo.schmitt@analog.com>

iio: adc: ltc2378: Enable triggered buffer data capture

This commit adds support for triggered buffer data captures to the
LTC2378 ADC driver. It implements a trigger handler and configures the
scan type for both SPI offload and fallback triggered buffer cases.

> diff --git a/drivers/iio/adc/ltc2378.c b/drivers/iio/adc/ltc2378.c
> index 6b01d8e96cc60..514645b847f0b 100644
> --- a/drivers/iio/adc/ltc2378.c
> +++ b/drivers/iio/adc/ltc2378.c
[ ... ]
> @@ -314,17 +337,27 @@ static int ltc2378_probe(struct spi_device *spi)
>  	st->chans[0].type = IIO_VOLTAGE;
>  	st->chans[0].info_mask_separate = BIT(IIO_CHAN_INFO_RAW) |
>  					  BIT(IIO_CHAN_INFO_SCALE);
> +	st->chans[0].scan_index = 0;
>  
>  	struct iio_scan_type ltc2378_scan;
>  
>  	ret = ltc2378_offload_buffer_setup(indio_dev, spi);
>  	if (ret == -ENODEV) {
>  		/* SPI offloading is unavailable. Fall back to triggered buffer. */
> -		dev_dbg(dev, "triggered data capture not supported\n");
>  		ltc2378_scan.format = st->info->twos_comp ? IIO_SCAN_FORMAT_SIGNED_INT :
>  							    IIO_SCAN_FORMAT_UNSIGNED_INT;
>  		ltc2378_scan.realbits = st->info->resolution;
>  		ltc2378_scan.storagebits = st->info->resolution > 16 ? 32 : 16;

[Severity: High]
Does this leave fields in ltc2378_scan uninitialized?

It looks like ltc2378_scan is allocated on the stack but not fully
initialized. Only format, realbits, and storagebits are assigned here,
leaving fields like endianness, shift, and repeat with stack garbage.

When st->chans[0].scan_type is later assigned from this struct, the
uninitialized endianness field could cause an out-of-bounds array read in
iio_show_scan_type() when indexing into iio_endian_prefix.

The garbage repeat value could also result in miscalculated IIO buffer
chunk sizes.

Could ltc2378_scan be zero-initialized to prevent these issues?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1779976379.git.marcelo.schmitt@analog.com?part=4