Re: [PATCH v7 3/5] iio: osf: add protocol decoding

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The protocol major version and header reserved fields are not validated, contradicting the commit message.
--

--- Patch [3]: [PATCH v7 3/5] iio: osf: add protocol decoding ---
commit 4b68faaa805d7ad7aeb0c1d32700ea5abc7cccf2
Author: Jinseob Kim <kimjinseob88@gmail.com>

iio: osf: add protocol decoding

This commit adds helpers for decoding Open Sensor Fusion frame headers and
supported message payloads.

> diff --git a/drivers/iio/opensensorfusion/osf_protocol.c b/drivers/iio/opensensorfusion/osf_protocol.c
> new file mode 100644
> index 0000000000000..b5749525e4c43
> --- /dev/null
> +++ b/drivers/iio/opensensorfusion/osf_protocol.c

[ ... ]

> +int osf_protocol_decode_frame(const u8 *buf, size_t len,
> +			      struct osf_frame *frame, size_t *frame_len)
> +{
> +	u32 expected_crc;
> +	u32 actual_crc;
> +	u32 payload_len;
> +	size_t total_len;

[ ... ]

> +	if (actual_crc != expected_crc)
> +		return -EBADMSG;
> +
> +	frame->protocol_major = buf[4];
> +	frame->protocol_minor = buf[5];
> +	frame->message_type = get_unaligned_le16(buf + 8);
> +	frame->payload_len = payload_len;
> +	frame->sequence = get_unaligned_le64(buf + 14);
> +	frame->timestamp_us = get_unaligned_le64(buf + 22);
> +	frame->flags = get_unaligned_le32(buf + 30);
> +	frame->reserved = get_unaligned_le32(buf + 34);

[Severity: Medium]
The commit message states: "The decoder validates the OSF0 wire magic,
protocol major version, header length, payload bounds, reserved fields
and CRC..."

Are the protocol major version and reserved fields actually being validated
here in osf_protocol_decode_frame()?

It looks like buf[4] is being assigned directly to frame->protocol_major
without checking it against OSF_PROTOCOL_MAJOR, and the reserved field is
similarly assigned without verifying if it is zero. Could this lead to
compatibility issues if a future protocol major version reuses the same
magic number but alters field semantics?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707014525.1015-1-kimjinseob88@gmail.com?part=3