Re: [PATCH v3 1/4] iio: light: ltr501: Switch to read_avail() op from manual attribute registration

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] iio: light: ltr501: stack use-after-return in
  ltr501_read_avail()
--

commit 865563656e5e5188134453546f2c2ea7f31369cb
Author: Svyatoslav Ryhel <clamor95@gmail.com>

iio: light: ltr501: Switch to read_avail() op from manual attribute registration

This commit replaces manual *_available sysfs attribute registration in
the ltr501 driver with the IIO read_avail() callback and channel
info_mask_*_available masks.

> diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c
> index 302be2fc314c5..1ddd0dfd55ea2 100644
> --- a/drivers/iio/light/ltr501.c
> +++ b/drivers/iio/light/ltr501.c

[ ... ]

> @@ -1111,111 +1124,67 @@ static int ltr501_write_event_config(struct iio_dev *indio_dev,
>  	return -EINVAL;
>  }
>  
> -static ssize_t ltr501_show_proximity_scale_avail(struct device *dev,
> -						 struct device_attribute *attr,
> -						 char *buf)
> +static int ltr501_read_avail(struct iio_dev *indio_dev,
> +			     struct iio_chan_spec const *chan,
> +			     const int **vals, int *type, int *length, long mask)
>  {
> -	struct ltr501_data *data = iio_priv(dev_to_iio_dev(dev));
> +	struct ltr501_data *data = iio_priv(indio_dev);
>  	const struct ltr501_chip_info *info = data->chip_info;
> -	ssize_t len = 0;
> -	int i;
> -
> -	for (i = 0; i < info->ps_gain_tbl_size; i++) {
> -		if (info->ps_gain[i].scale == LTR501_RESERVED_GAIN)
> -			continue;
> -		len += scnprintf(buf + len, PAGE_SIZE - len, "%d.%06d ",
> -				 info->ps_gain[i].scale,
> -				 info->ps_gain[i].uscale);
> -	}
>  
> -	buf[len - 1] = '\n';
> +	switch (mask) {
> +	case IIO_CHAN_INFO_SCALE:
> +		if (chan->type == IIO_INTENSITY) {
> +			int valid_als_gains[ARRAY_SIZE(ltr559_als_gain_tbl) * 2];
> +			int j = 0;
> +
> +			for (int i = 0; i < info->als_gain_tbl_size; i++) {
> +				if (info->als_gain[i].scale == LTR501_RESERVED_GAIN)
> +					continue;
> +
> +				valid_als_gains[j++] = info->als_gain[i].scale;
> +				valid_als_gains[j++] = info->als_gain[i].uscale;
> +			}
> +
> +			*length = j;
> +			*vals = (const int *)valid_als_gains;

[Severity: High]
Does assigning valid_als_gains to *vals return a dangling stack pointer?
valid_als_gains has automatic storage duration inside the if block, so
when iio_read_channel_info_avail() calls iio_format_avail_list() after
ltr501_read_avail() returns, reading in_intensity_scale_available
triggers a stack use-after-return and exposes kernel stack contents to
userspace.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108094253.83899-1-clamor95@gmail.com?part=1