Re: [PATCH v2] iio: proximity: sx9324: fix out-of-bounds read of scan period table

[Andy Shevchenko <andriy.shevchenko@intel.com>]

On Sat, Oct 24, 2026 at 12:56:51AM +0530, Arnav Kapoor wrote:
> The scan period of the SX9324 is selected by the 5 bit wide
> SX9324_REG_GNRL_CTRL0_SCANPERIOD field, so it has 32 possible values.
> sx9324_scan_period_table[] however only has 16 entries, it was copied
> over from the SX9310 driver where the field is only 4 bits wide.
> 
> sx9324_wait_for_sample() indexes the table with the raw field value, so
> all the codes from 16 to 31 read past the end of the array. The default
> value of the register is SX9324_REG_GNRL_CTRL0_SCANPERIOD_100MS (0x16,
> i.e. 22), so the out-of-bounds read happens with the default
> configuration of the device. It is only avoided when the device has an
> interrupt line, as the wait is only done in the polling case.
> 
> The value read is then used as the duration of an msleep() call, so the
> sensor is polled with a completely random delay.
> 
> Fill the table with the scan periods of all 32 codes, which are the
> periods documented for the corresponding sx9324_samp_freq_table[]
> entries, and add a static assertion to keep both tables in sync.

...

> +/*
> + * The scan period of the SX9324 is selected by the 5 bit wide

5-bit

> + * SX9324_REG_GNRL_CTRL0_SCANPERIOD field. The values below are the scan
> + * periods in ms of the corresponding sx9324_samp_freq_table[] entries.
> + */
>  static const unsigned int sx9324_scan_period_table[] = {
> -	2,   15,  30,  45,   60,   90,	 120,  200,
> -	400, 600, 800, 1000, 2000, 3000, 4000, 5000,
> +	1, 2, 4, 6, 8, 10, 14, 18,			/* 0x00 - 0x07 */
> +	22, 26, 30, 34, 38, 42, 46, 50,			/* 0x08 - 0x0f */
> +	56, 62, 68, 74, 80, 90, 100, 200,		/* 0x10 - 0x17 */
> +	300, 400, 600, 800, 1000, 2000, 3000, 4000,	/* 0x18 - 0x1f */
>  };

Haven't checked if this is part of any ABI. Otherwise LGTM,
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>

-- 
With Best Regards,
Andy Shevchenko