Re: [PATCH v2 2/2] iio: accel: adxl367: reject out-of-range FIFO entry count

[Andy Shevchenko <andriy.shevchenko@intel.com>]

On Wed, Aug 12, 2026 at 03:58:50PM +0800, Shengzhuo Wei wrote:
> The FIFO entry count reported by the device can be as large as 1023
> (the low byte plus the low two bits of the high byte), but fifo_buf[]
> only has room for ADXL367_FIFO_SIZE (512) entries.
> adxl367_push_fifo_data() passes the reported count straight to the FIFO
> read, so a count above ADXL367_FIFO_SIZE overflows fifo_buf, a heap
> out-of-bounds write of up to 1022 bytes into adjacent memory.
> 
> Rather than clamp the count and silently drop the excess, abort the
> read: a count beyond the FIFO size means the device is returning
> garbage, so the data cannot be trusted. The message is ratelimited
> because a stuck device can raise the IRQ repeatedly.

Aren't they already were discussed in linux-iio@ mailing list earlier?

...

> +		dev_err_ratelimited(st->dev,
> +				    "FIFO entry count %u exceeds FIFO size %lu\n",
> +				    fifo_entries,
> +				    (unsigned long)ADXL367_FIFO_SIZE);

In majority of the explicit castings when printing a message they are wrong or
unneeded. Use correct format specifiers to begin with.

-- 
With Best Regards,
Andy Shevchenko