Re: [PATCH] platform/chrome: sensorhub: Fix memory overread in ring handler

[Tzung-Bi Shih <tzungbi@kernel.org>]

On Wed, Jul 01, 2026 at 04:20:44PM +0900, Tomasz Figa wrote:
> > diff --git a/drivers/platform/chrome/cros_ec_sensorhub_ring.c b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
> > index 64e9615ed6f4..4b4adc38485c 100644
> > --- a/drivers/platform/chrome/cros_ec_sensorhub_ring.c
> > +++ b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
> > @@ -825,11 +825,19 @@ static void cros_ec_sensorhub_ring_handler(struct cros_ec_sensorhub *sensorhub)
> >                 sensorhub->msg->outsize = 1;
> >                 sensorhub->msg->insize = fifo_info_length;
> >
> > -               if (cros_ec_cmd_xfer_status(ec->ec_dev, sensorhub->msg) < 0)
> > +               ret = cros_ec_cmd_xfer_status(ec->ec_dev, sensorhub->msg);
> > +               if (ret < 0)
> 
> I think it would be much safer to just error out if ret != fifo_info_length:
>  - The data read here is used later in the code. Filling the array
> with zeroes would cause the code to act on some data that doesn't
> match the real hardware state, potentially leading to other buggy
> behaviors,
>  - We silently mask bad EC behavior.
> 
> We should probably also add a rate-limited print here to leave a trace
> in the logs.

Fix them in v2 [1].

[1] https://lore.kernel.org/all/20260702082745.1014968-1-tzungbi@kernel.org