Re: [PATCH 2/8] iio: adc: stm32-adc: manage characterization voltage diversity

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Missing error check after ADC conversion allows division by zero or division by uninitialized memory if the conversion fails or returns zero.
--

commit 0d19a7183285228478d5cfa82a3785b87f3e1bd1
Author: Olivier Moysan <olivier.moysan@foss.st.com>

iio: adc: stm32-adc: manage characterization voltage diversity

This commit introduces a vref_charac field in stm32_adc_cfg to store 
SoC-specific characterization voltage. It updates the stm32_adc_read_raw 
function to use this field in the vref computation formula.

> diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
> --- a/drivers/iio/adc/stm32-adc.c
> +++ b/drivers/iio/adc/stm32-adc.c
[ ... ]
> @@ -1610,7 +1611,7 @@ static int stm32_adc_read_raw(struct iio_dev *indio_dev,
>  			ret = -EINVAL;
>  
>  		if (mask == IIO_CHAN_INFO_PROCESSED)
> -			*val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / *val;
> +			*val = adc->cfg->vref_charac * adc->vrefint.vrefint_cal / *val;

[Severity: Critical]
This isn't a bug introduced by this patch, but does this division need to
check if the conversion actually succeeded?

Looking at the preceding code in stm32_adc_read_raw():

    if (chan->type == IIO_VOLTAGE)
        ret = stm32_adc_single_conv(indio_dev, chan, val);
    else
        ret = -EINVAL;

If a sysfs read (such as in_voltageX_input) is interrupted by a signal,
stm32_adc_single_conv() can abort via wait_for_completion_interruptible_timeout()
and return an error like -ERESTARTSYS. When this happens, *val remains
uninitialized.

Since there is no error check on ret before the division, this code will
proceed to divide by the uninitialized *val. If the kernel is compiled with
CONFIG_INIT_STACK_ALL_ZERO=y, the uninitialized stack variable will be 0,
which could lead to a division by zero kernel panic.

Should we verify that ret indicates success and that *val is non-zero
before attempting the scaling calculation?

>  
>  		iio_device_release_direct(indio_dev);
>  		return ret;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260911-adc-stm32mp25-v1-v1-0-cef26eecdef2@foss.st.com?part=2