Re: [PATCH v14 5/6] iio: adc: ad4691: add oversampling support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Out-of-bounds array access in SPI transfer setup when the soft timestamp channel is enabled.
--

commit 432eefa94b45dd8bef36e14221d32f97f7de44ee
Author: Radu Sabau <radu.sabau@analog.com>
Subject: iio: adc: ad4691: add oversampling support

This commit adds oversampling ratio (OSR) support for CNV burst mode and
introduces manual mode channels that omit the OSR attribute. It also manages
shared internal oscillator frequencies based on OSR.

> diff --git a/drivers/iio/adc/ad4691.c b/drivers/iio/adc/ad4691.c
> index b1d1b42f724e7..043143ae95608 100644
> --- a/drivers/iio/adc/ad4691.c
> +++ b/drivers/iio/adc/ad4691.c
[ ... ]
> @@ -241,23 +294,91 @@ static const struct iio_chan_spec ad4693_offload_channels[] = {
>  	AD4691_OFFLOAD_CHANNEL(7),
>  };
>  
> +static const struct iio_chan_spec ad4691_manual_channels[] = {
> +	AD4691_MANUAL_CHANNEL(0),
[ ... ]
> +	AD4691_MANUAL_CHANNEL(14),
> +	AD4691_MANUAL_CHANNEL(15),
> +	IIO_CHAN_SOFT_TIMESTAMP(16),
> +};

[Severity: High]
When the timestamp channel is enabled via sysfs, will this result in 17 active
channels in the scan mask?

If so, when iterating over the active channels in functions like
ad4691_cnv_burst_buffer_preenable() and
ad4691_cnv_burst_offload_buffer_postenable():

	k = 0;
	iio_for_each_active_channel(indio_dev, i) {
		put_unaligned_be16(0x8000 | AD4691_AVG_IN(i), &st->scan_tx[k]);
		...
		k++;
	}
	...
	st->scan_xfers[2 * k].tx_buf = st->scan_tx_reset;

Does k reach 17 after the loop, causing an out-of-bounds access to
st->scan_xfers[34] when setting up the reset transfer, and a similar
out-of-bounds access to st->scan_tx[17] in the manual mode path? The
st->scan_xfers array is sized at 34 and st->scan_tx at 17, making indices 34
and 17 out of bounds.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260529-ad4692-multichannel-sar-adc-driver-v14-0-e93c2747dc1f@analog.com?part=5