Re: [PATCH v4 04/10] iio: adc: ti-ads1262: support per-channel sampling frequency

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Out-of-bounds array read when accessing the soft timestamp channel.
--

commit dd8f25ef4ef94f53753566f6a544d3947f644a0f
Author: Kurt Borja <kuurtb@gmail.com>

iio: adc: ti-ads1262: support per-channel sampling frequency
    
This commit adds per-channel sampling frequency support by introducing a
channel-specific configuration array and assigning the available attributes
per-channel.

> diff --git a/drivers/iio/adc/ti-ads1262.c b/drivers/iio/adc/ti-ads1262.c
> index d919144c23cb2..86ea9b6232d8f 100644
> --- a/drivers/iio/adc/ti-ads1262.c
> +++ b/drivers/iio/adc/ti-ads1262.c

[ ... ]

> @@ -375,9 +449,18 @@ static int ads1262_wait_for_conversion(struct ads1262 *st)
>  static int ads1262_channel_enable(struct ads1262 *st,
>  				  const struct iio_chan_spec *spec)
>  {
> +	struct ads1262_channel *chan = &st->channels[spec->scan_index];
> +	int ret;
> +
>  	guard(mutex)(&st->xfer_lock);
>  	guard(mutex)(&st->chan_lock);

[Severity: High]
If a user enables the IIO timestamp channel (in_timestamp_en=1) alongside
other channels, could spec->scan_index exceed the allocated size of
st->channels here?

The IIO core includes the timestamp channel in indio_dev->active_scan_mask.
In the later commit "iio: adc: ti-ads1262: support triggered buffer sampling",
the driver iterates over active_scan_mask and passes each channel to this
function without skipping the timestamp channel.

Looking at how the array is allocated:

> @@ -763,8 +970,15 @@ static int ads1262_parse_channels(struct iio_dev *indio_dev)
>  	if (!chan_specs)
>  		return -ENOMEM;
>  
> +	st->num_channels = num_fw_channels + ADS1262_MON_CHANNEL_COUNT;
> +	st->channels = devm_kcalloc(dev, st->num_channels, sizeof(*st->channels),
> +				    GFP_KERNEL);
> +	if (!st->channels)
> +		return -ENOMEM;

Because st->channels is sized to strictly exclude the timestamp channel, the
timestamp channel's scan_index will equal st->num_channels.

Will this cause an out-of-bounds read when preparing the SPI transmission,
potentially sending garbage data to the ADC hardware and causing the driver
to hang waiting for an interrupt?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260828-ads126x-v4-0-1dc27e9c0260@gmail.com?part=4