Re: [PATCH 04/11] iio: magnetometer: hid-sensor-magn-3d: align parenthesis for readability

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Blindly reading 32 or 64 bits from `raw_data` without verifying `raw_len` can lead to slab-out-of-bounds reads.
--

commit 13804edb2c46947f67fe0d4d5d050f780422d2f7
Author: Sanjay Chitroda <sanjayembeddedse@gmail.com>

iio: magnetometer: hid-sensor-magn-3d: align parenthesis for readability

This commit adjusts the alignment of parentheses across multiple functions in
the hid-sensor-magn-3d driver. This improves readability and maintains
consistency with the kernel coding style.

> diff --git a/drivers/iio/magnetometer/hid-sensor-magn-3d.c b/drivers/iio/magnetometer/hid-sensor-magn-3d.c
> index 23884825eb00f..82507297c55bb 100644
> --- a/drivers/iio/magnetometer/hid-sensor-magn-3d.c
> +++ b/drivers/iio/magnetometer/hid-sensor-magn-3d.c

[ ... ]

> @@ -292,9 +291,9 @@ static int magn_3d_proc_event(struct hid_sensor_hub_device *hsdev,
>  
>  /* Capture samples in local storage */
>  static int magn_3d_capture_sample(struct hid_sensor_hub_device *hsdev,
> -				u32 usage_id,
> -				size_t raw_len, char *raw_data,
> -				void *priv)
> +				  u32 usage_id,
> +				  size_t raw_len, char *raw_data,
> +				  void *priv)
>  {
>  	struct iio_dev *indio_dev = platform_get_drvdata(priv);
>  	struct magn_3d_state *magn_state = iio_priv(indio_dev);

[Severity: High]
This is a pre-existing issue, but since this patch touches the signature of
magn_3d_capture_sample(), could we be at risk of a slab out-of-bounds read
further down in the function?

If a device presents a crafted HID report descriptor that defines the
HID_USAGE_SENSOR_TIME_TIMESTAMP field with a smaller size, it could result in
raw_len being less than 8.  Reading 8 bytes from raw_data in this case:

	case HID_USAGE_SENSOR_TIME_TIMESTAMP:
		magn_state->timestamp =
			hid_sensor_convert_timestamp(&magn_state->magn_flux_attributes,
						     *(s64 *)raw_data);

would read past the end of the buffer.

A similar dereference happens later in the function for the magnetic axes
where 4 bytes are read:

	iio_val = magn_state->magn_val_addr[offset];

	if (iio_val != NULL)
		*iio_val = *((u32 *)raw_data);

Could this also trigger an out-of-bounds read if raw_len is smaller than 4?
Should we verify the size of raw_len before making these casts?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260616-15-jun-hid-iio-alignment-v1-0-0cd544286575@gmail.com?part=4