Re: [PATCH RFC v2 3/7] iio: osf: add protocol v0 decoding

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The function `osf_protocol_decode_sensor_sample` fails to validate the untrusted `sensor_type` field from the payload.
--

commit 771f82b33a67fcd96de20b3ff22ae83721808219
Author: Jinseob Kim <kimjinseob88@gmail.com>

iio: osf: add protocol v0 decoding

This commit introduces the OSF0 protocol frame and payload decoders for
device-to-host messages.

> diff --git a/drivers/iio/opensensorfusion/osf_protocol.c b/drivers/iio/opensensorfusion/osf_protocol.c
> new file mode 100644
> index 0000000000000..ac3c37ae28f32
> --- /dev/null
> +++ b/drivers/iio/opensensorfusion/osf_protocol.c

[ ... ]

> +int osf_protocol_decode_sensor_sample(const struct osf_frame *frame,
> +				      struct osf_sensor_sample *sample)
> +{
> +	u16 channel_count;
> +	u16 sample_format;
> +	u32 expected_len;
> +	const u8 *payload;
> +
> +	if (!frame || !sample || !frame->payload)
> +		return -EINVAL;
> +
> +	if (frame->message_type != OSF_MSG_SENSOR_SAMPLE)
> +		return -EPROTO;
> +
> +	if (frame->payload_len < OSF_SENSOR_SAMPLE_BASE_LEN)
> +		return -EMSGSIZE;
> +
> +	payload = frame->payload;
> +	channel_count = get_unaligned_le16(payload + 4);
> +	sample_format = get_unaligned_le16(payload + 6);
> +
> +	if (sample_format != OSF_SAMPLE_FORMAT_S32)
> +		return -EPROTO;
> +
> +	expected_len = OSF_SENSOR_SAMPLE_BASE_LEN + channel_count * sizeof(s32);
> +	if (frame->payload_len != expected_len)
> +		return -EMSGSIZE;
> +
> +	sample->sensor_type = get_unaligned_le16(payload);

[Severity: Medium]
Should this code validate the untrusted sensor_type field?

The parser validates the sample format but assigns sample->sensor_type
directly from the untrusted device payload without calling the available
osf_sensor_type_valid() function.

If an invalid sensor type is accepted and passed to the core handler, it
could be stored in the latest_samples cache. Since the cache has a fixed
limit (OSF_MAX_CAPABILITIES), storing invalid sensor types from a malformed
payload could exhaust the available slots, causing legitimate future sensor
samples to be permanently dropped with -E2BIG.

> +	sample->sensor_index = get_unaligned_le16(payload + 2);
> +	sample->channel_count = channel_count;
> +	sample->sample_format = sample_format;
> +	sample->scale_nano = get_unaligned_le32(payload + 8);
> +	sample->reserved = get_unaligned_le32(payload + 12);
> +	sample->samples = payload + OSF_SENSOR_SAMPLE_BASE_LEN;
> +
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260524085312.15369-1-kimjinseob88@gmail.com?part=3