[PATCH] platform/chrome: sensorhub: Fix dropped timestamp events and log spam

[PATCH] platform/chrome: sensorhub: Fix dropped timestamp events and log spam

[Tzung-Bi Shih]

Commit 833740a2333c ("platform/chrome: sensorhub: Bound the EC-reported
sensor number") evaluated the `sensor_num` against the bounds limit even
for timestamp events.  A timestamp event typically has a `sensor_num` of
0xff [1], causing the driver to flag it as invalid and skip to the next
event.

As a result, we'd see a flooding of "Invalid sensor number 255 from EC"
warning logs and these timestamp events were being dropped.

Additionally, the firmware only ORs the tablet mode flag [2] onto
timestamp events.  Because the firmware strictly generates standalone
timestamps (without other flags like ODR or FLUSH), bypassing the bounds
check for anything containing the TIMESTAMP flag is safe and avoids
invalid array access.

Skip the bounds check for events carrying the
MOTIONSENSE_SENSOR_FLAG_TIMESTAMP flag.

[1] https://crrev.com/219ca6ef82ba266da788b673ee4ad50bd3ea1285/common/motion_sense_fifo.c#427
[2] https://crrev.com/219ca6ef82ba266da788b673ee4ad50bd3ea1285/common/motion_sense_fifo.c#296

Fixes: 833740a2333c ("platform/chrome: sensorhub: Bound the EC-reported sensor number")
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
---
 drivers/platform/chrome/cros_ec_sensorhub_ring.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/platform/chrome/cros_ec_sensorhub_ring.c b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
index 92941924c347..e0a1bc19dc7f 100644
--- a/drivers/platform/chrome/cros_ec_sensorhub_ring.c
+++ b/drivers/platform/chrome/cros_ec_sensorhub_ring.c
@@ -897,8 +897,12 @@ static void cros_ec_sensorhub_ring_handler(struct cros_ec_sensorhub *sensorhub)
 
 		for (in = sensorhub->resp->fifo_read.data, j = 0;
 		     j < number_data; j++, in++) {
-			/* Skip event if sensor_num from EC is out of bounds. */
-			if (in->sensor_num >= sensorhub->sensor_num) {
+			/*
+			 * Skip event if sensor_num from EC is out of bounds,
+			 * unless it is a timestamp event.
+			 */
+			if (!(in->flags & MOTIONSENSE_SENSOR_FLAG_TIMESTAMP) &&
+			    in->sensor_num >= sensorhub->sensor_num) {
 				dev_warn_ratelimited(sensorhub->dev,
 						     "Invalid sensor number %u from EC\n",
 						     in->sensor_num);
-- 
2.55.0.795.g602f6c329a-goog

Re: [PATCH] platform/chrome: sensorhub: Fix dropped timestamp events and log spam

[Tzung-Bi Shih]

On Tue, Jul 14, 2026 at 06:52:02AM +0000, Tzung-Bi Shih wrote:
> Commit 833740a2333c ("platform/chrome: sensorhub: Bound the EC-reported
> sensor number") evaluated the `sensor_num` against the bounds limit even
> for timestamp events.  A timestamp event typically has a `sensor_num` of
> 0xff [1], causing the driver to flag it as invalid and skip to the next
> event.
> 
> As a result, we'd see a flooding of "Invalid sensor number 255 from EC"
> warning logs and these timestamp events were being dropped.
> 
> Additionally, the firmware only ORs the tablet mode flag [2] onto
> timestamp events.  Because the firmware strictly generates standalone
> timestamps (without other flags like ODR or FLUSH), bypassing the bounds
> check for anything containing the TIMESTAMP flag is safe and avoids
> invalid array access.
> 
> Skip the bounds check for events carrying the
> MOTIONSENSE_SENSOR_FLAG_TIMESTAMP flag.

Please disregard the patch.  We found this just opens another door for
malfunctioned or compromised firmware to access the array `batch_state`
out of bound.  Will fix it in v2.