[PATCH v2 0/4] iio: proximity: hx9023s: firmware property, safety fixes

[PATCH v2 0/4] iio: proximity: hx9023s: firmware property, safety fixes

[Yasin Lee]

Hi,

This series contains a set of small fixes and improvements for the hx9023s
proximity sensor driver.

The changes include:

- Fixing a potential out-of-bounds access when copying firmware data.
- Avoiding a division-by-zero case when the sampling frequency is unspecified.
- Allowing the firmware file name to be specified via firmware-name property,
  along with the corresponding DT binding update.

All changes are independent but related to robustness and platform support,
and are grouped together for easier review.

Tested on a DT-based platform with firmware loading enabled.

Thanks for your time and review.

Best regards,
Yasin Lee

Signed-off-by: Yasin Lee <yasin.lee.x@gmail.com>
---
Changes in v2:
- Patch 1: Added Fixes tag
- Patch 2: 
    - Added Fixes tag
    - Changed conditional logic to positive style (val || val2) as suggested
- Patch 3 (dt-bindings): 
    - Removed redundant description.
    - This patch now comes before driver implementation (documentation first)
- Patch 4 (driver): 
    - Fixed variable declaration order (reverse xmas tree)
    - Split declaration and assignment for fw_name
    - Removed unnecessary error checking for device_property_read_string()
    - Simplified to: fw_name = "hx9023s.bin"; device_property_read_string(...);
- Patch 5: Temporarily dropped (ACPI support)
    - Will resubmit separately once TYHX vendor ID is officially registered with UEFI Forum
    - Need to provide verified DSDT evidence
- Link to v1: https://lore.kernel.org/r/20260209-upstream-20260219-v1-0-2b4d74e309d1@gmail.com

---
Yasin Lee (4):
      iio: proximity: hx9023s: fix out-of-bounds access when copying firmware
      iio: proximity: hx9023s: Protect against division by zero in set_samp_freq
      dt-bindings: iio: proximity: hx9023s: support firmware-name property
      iio: proximity: hx9023s: support firmware-name property

 .../devicetree/bindings/iio/proximity/tyhx,hx9023s.yaml    |  4 ++++
 drivers/iio/proximity/hx9023s.c                            | 14 ++++++++++----
 2 files changed, 14 insertions(+), 4 deletions(-)
---
base-commit: c8bfb63c902678228a0a265e22a5f55404988a43
change-id: 20260209-upstream-20260219-a7af6d9a85ad

Best regards,
-- 
Yasin Lee <yasin.lee.x@gmail.com>

[PATCH v2 1/4] iio: proximity: hx9023s: fix out-of-bounds access when copying firmware

[Yasin Lee]

Initialize fw_size before copying firmware data into the flexible
array member to match the __counted_by() annotation. This fixes a
potential out-of-bounds access that could lead to a kernel crash.

Fixes: e9ed97be4fcc ("iio: proximity: hx9023s: Added firmware file parsing functionality")
Signed-off-by: Yasin Lee <yasin.lee.x@gmail.com>
---
 drivers/iio/proximity/hx9023s.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/iio/proximity/hx9023s.c b/drivers/iio/proximity/hx9023s.c
index 2918dfc0df54..ad839db6b326 100644
--- a/drivers/iio/proximity/hx9023s.c
+++ b/drivers/iio/proximity/hx9023s.c
@@ -1034,9 +1034,8 @@ static int hx9023s_send_cfg(const struct firmware *fw, struct hx9023s_data *data
 	if (!bin)
 		return -ENOMEM;
 
-	memcpy(bin->data, fw->data, fw->size);
-
 	bin->fw_size = fw->size;
+	memcpy(bin->data, fw->data, bin->fw_size);
 	bin->fw_ver = bin->data[FW_VER_OFFSET];
 	bin->reg_count = get_unaligned_le16(bin->data + FW_REG_CNT_OFFSET);
 

-- 
2.43.0

Re: [PATCH v2 1/4] iio: proximity: hx9023s: fix out-of-bounds access when copying firmware

[Andy Shevchenko]

On Thu, Feb 12, 2026 at 02:26:52PM +0800, Yasin Lee wrote:
> Initialize fw_size before copying firmware data into the flexible
> array member to match the __counted_by() annotation. This fixes a
> potential out-of-bounds access that could lead to a kernel crash.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v2 1/4] iio: proximity: hx9023s: fix out-of-bounds access when copying firmware

[Krzysztof Kozlowski]

On Thu, Feb 12, 2026 at 02:26:52PM +0800, Yasin Lee wrote:
> Initialize fw_size before copying firmware data into the flexible
> array member to match the __counted_by() annotation. This fixes a
> potential out-of-bounds access that could lead to a kernel crash.

I don't think so. Code is equivalent and this was just false positive
because compiler could not deduce that in this case counted_by can be by
fw->size.

> 
> Fixes: e9ed97be4fcc ("iio: proximity: hx9023s: Added firmware file parsing functionality")

Also not appropriate IMO, nothing to fix.

Commit is fine, but this is not a fix, IMO.

Best regards,
Krzysztof

Re: [PATCH v2 1/4] iio: proximity: hx9023s: fix out-of-bounds access when copying firmware

[Andy Shevchenko]

On Thu, Feb 12, 2026 at 12:25:54PM +0100, Krzysztof Kozlowski wrote:
> On Thu, Feb 12, 2026 at 02:26:52PM +0800, Yasin Lee wrote:
> > Initialize fw_size before copying firmware data into the flexible
> > array member to match the __counted_by() annotation. This fixes a
> > potential out-of-bounds access that could lead to a kernel crash.
> 
> I don't think so. Code is equivalent and this was just false positive
> because compiler could not deduce that in this case counted_by can be by
> fw->size.

In accordance with [1]:

   When finding the element count assignment, it must be reordered
   to before any accesses of the PTR->ARRAY itself, otherwise runtime
   checking will trigger (i.e. the index of ARRAY will be checked against
   COUNTER before COUNTER has been assigned the correct COUNT value).

[1]: https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci#L3

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v2 1/4] iio: proximity: hx9023s: fix out-of-bounds access when copying firmware

[Krzysztof Kozlowski]

On 12/02/2026 14:48, Andy Shevchenko wrote:
> On Thu, Feb 12, 2026 at 12:25:54PM +0100, Krzysztof Kozlowski wrote:
>> On Thu, Feb 12, 2026 at 02:26:52PM +0800, Yasin Lee wrote:
>>> Initialize fw_size before copying firmware data into the flexible
>>> array member to match the __counted_by() annotation. This fixes a
>>> potential out-of-bounds access that could lead to a kernel crash.
>>
>> I don't think so. Code is equivalent and this was just false positive
>> because compiler could not deduce that in this case counted_by can be by
>> fw->size.
> 
> In accordance with [1]:
> 
>    When finding the element count assignment, it must be reordered
>    to before any accesses of the PTR->ARRAY itself, otherwise runtime
>    checking will trigger (i.e. the index of ARRAY will be checked against
>    COUNTER before COUNTER has been assigned the correct COUNT value).
> 
> [1]: https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci#L3
> 

Thanks for correcting me. I agree this is a fix but, still, I think this
will no be an out-of-bounds access, because then the runtime checker
will use initial bin->fw_size value of 0.

Best regards,
Krzysztof

[PATCH v2 2/4] iio: proximity: hx9023s: Protect against division by zero in set_samp_freq

[Yasin Lee]

Avoid division by zero when sampling frequency is unspecified by
falling back to a default 100ms sampling period.

Fixes: 60df548277b7 ("iio: proximity: Add driver support for TYHX's HX9023S capacitive proximity sensor")
Signed-off-by: Yasin Lee <yasin.lee.x@gmail.com>
---
 drivers/iio/proximity/hx9023s.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/proximity/hx9023s.c b/drivers/iio/proximity/hx9023s.c
index ad839db6b326..e714fe00a44e 100644
--- a/drivers/iio/proximity/hx9023s.c
+++ b/drivers/iio/proximity/hx9023s.c
@@ -719,7 +719,11 @@ static int hx9023s_set_samp_freq(struct hx9023s_data *data, int val, int val2)
 	struct device *dev = regmap_get_device(data->regmap);
 	unsigned int i, period_ms;
 
-	period_ms = div_u64(NANO, (val * MEGA + val2));
+	if (val || val2)
+		period_ms = div_u64(NANO, (val * MEGA + val2));
+	else
+		/* Fallback to a safe default sampling period */
+		period_ms = 100;
 
 	for (i = 0; i < ARRAY_SIZE(hx9023s_samp_freq_table); i++) {
 		if (period_ms == hx9023s_samp_freq_table[i])

-- 
2.43.0

Re: [PATCH v2 2/4] iio: proximity: hx9023s: Protect against division by zero in set_samp_freq

[Andy Shevchenko]

On Thu, Feb 12, 2026 at 02:26:53PM +0800, Yasin Lee wrote:
> Avoid division by zero when sampling frequency is unspecified by
> falling back to a default 100ms sampling period.

...

> -	period_ms = div_u64(NANO, (val * MEGA + val2));
> +	if (val || val2)
> +		period_ms = div_u64(NANO, (val * MEGA + val2));

While at it, drop unneeded parentheses.

> +	else
> +		/* Fallback to a safe default sampling period */
> +		period_ms = 100;

Not sure about this. Perhaps we should rather do

	if (!val || !val2)
		return -EINVAL;

?

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v2 2/4] iio: proximity: hx9023s: Protect against division by zero in set_samp_freq

[Yasin Lee]

On Thu, Feb 12, 2026 at 6:56 PM Andy Shevchenko
<andriy.shevchenko@intel.com> wrote:
>
> On Thu, Feb 12, 2026 at 02:26:53PM +0800, Yasin Lee wrote:
> > Avoid division by zero when sampling frequency is unspecified by
> > falling back to a default 100ms sampling period.
>
> ...
>
> > -     period_ms = div_u64(NANO, (val * MEGA + val2));
> > +     if (val || val2)
> > +             period_ms = div_u64(NANO, (val * MEGA + val2));
>
> While at it, drop unneeded parentheses.
>
> > +     else
> > +             /* Fallback to a safe default sampling period */
> > +             period_ms = 100;
>
> Not sure about this. Perhaps we should rather do
>
>         if (!val || !val2)
>                 return -EINVAL;
>
> ?
>

Agreed. I will update this in v3 as below .
...
if (!val && !val2)
    return -EINVAL;

period_ms = div_u64(NANO, val * MEGA + val2);
...

> --
> With Best Regards,
> Andy Shevchenko
>
>

Re: [PATCH v2 2/4] iio: proximity: hx9023s: Protect against division by zero in set_samp_freq

[Andy Shevchenko]

On Fri, Feb 13, 2026 at 12:44:57AM +0800, Yasin Lee wrote:
> On Thu, Feb 12, 2026 at 6:56 PM Andy Shevchenko
> <andriy.shevchenko@intel.com> wrote:
> > On Thu, Feb 12, 2026 at 02:26:53PM +0800, Yasin Lee wrote:

...

> > Not sure about this. Perhaps we should rather do
> >
> >         if (!val || !val2)
> >                 return -EINVAL;
> >
> > ?
> 
> Agreed. I will update this in v3 as below .
> ...
> if (!val && !val2)
>     return -EINVAL;

> period_ms = div_u64(NANO, val * MEGA + val2);

Then don't touch parentheses, as the line will have nothing to do with
the scope of the patch.

-- 
With Best Regards,
Andy Shevchenko

[PATCH v2 3/4] dt-bindings: iio: proximity: hx9023s: support firmware-name property

[Yasin Lee]

Allow specifying the firmware file name via device tree.

Signed-off-by: Yasin Lee <yasin.lee.x@gmail.com>
---
 Documentation/devicetree/bindings/iio/proximity/tyhx,hx9023s.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Documentation/devicetree/bindings/iio/proximity/tyhx,hx9023s.yaml b/Documentation/devicetree/bindings/iio/proximity/tyhx,hx9023s.yaml
index 64ce8bc8bd36..cc5b5284c267 100644
--- a/Documentation/devicetree/bindings/iio/proximity/tyhx,hx9023s.yaml
+++ b/Documentation/devicetree/bindings/iio/proximity/tyhx,hx9023s.yaml
@@ -28,6 +28,9 @@ properties:
 
   vdd-supply: true
 
+  firmware-name:
+    maxItems: 1
+
   "#address-cells":
     const: 1
 
@@ -65,6 +68,7 @@ examples:
         interrupt-parent = <&pio>;
         interrupts = <16 IRQ_TYPE_EDGE_FALLING>;
         vdd-supply = <&pp1800_prox>;
+        firmware-name = "hx9023s.bin";
 
         #address-cells = <1>;
         #size-cells = <0>;

-- 
2.43.0

Re: [PATCH v2 3/4] dt-bindings: iio: proximity: hx9023s: support firmware-name property

[Krzysztof Kozlowski]

On Thu, Feb 12, 2026 at 02:26:54PM +0800, Yasin Lee wrote:
> Allow specifying the firmware file name via device tree.

Nothing improved here. So again: Why do we want to allow it? Why a
device needs a firmware now but before it did not need? What changed?

You already got these questions.


Best regards,
Krzysztof

Re: [PATCH v2 3/4] dt-bindings: iio: proximity: hx9023s: support firmware-name property

[Yasin Lee]

On Thu, Feb 12, 2026 at 7:23 PM Krzysztof Kozlowski <krzk@kernel.org> wrote:
>
> On Thu, Feb 12, 2026 at 02:26:54PM +0800, Yasin Lee wrote:
> > Allow specifying the firmware file name via device tree.
>
> Nothing improved here. So again: Why do we want to allow it? Why a
> device needs a firmware now but before it did not need? What changed?
>
> You already got these questions.
>

Hi Krzysztof,

You are right, the commit message did not sufficiently explain the
motivation.

The device has always required firmware; previously the driver assumed
a single default firmware file name suitable for the reference design.
What changes here is that different boards may use different electrode
layouts and mechanical structures, which require distinct calibration
and configuration data.

I will update the commit message in v3 to clearly describe this and to
clarify that the property represents board-level hardware differences.

Sorry for the confusion, and thank you for the review.

Best regards,
Yasin Lee

>
> Best regards,
> Krzysztof
>

[PATCH v2 4/4] iio: proximity: hx9023s: support firmware-name property

[Yasin Lee]

Add an optional firmware-name property to specify the firmware file.
If not provided, the driver falls back to the default firmware name.

Signed-off-by: Yasin Lee <yasin.lee.x@gmail.com>
---
 drivers/iio/proximity/hx9023s.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/proximity/hx9023s.c b/drivers/iio/proximity/hx9023s.c
index e714fe00a44e..b2cd0759fec2 100644
--- a/drivers/iio/proximity/hx9023s.c
+++ b/drivers/iio/proximity/hx9023s.c
@@ -1089,6 +1089,7 @@ static int hx9023s_probe(struct i2c_client *client)
 	struct device *dev = &client->dev;
 	struct iio_dev *indio_dev;
 	struct hx9023s_data *data;
+	const char *fw_name;
 	int ret;
 
 	indio_dev = devm_iio_device_alloc(dev, sizeof(*data));
@@ -1126,7 +1127,9 @@ static int hx9023s_probe(struct i2c_client *client)
 	if (ret)
 		return dev_err_probe(dev, ret, "channel config failed\n");
 
-	ret = request_firmware_nowait(THIS_MODULE, true, "hx9023s.bin", dev,
+	fw_name = "hx9023s.bin";
+	device_property_read_string(dev, "firmware-name", &fw_name);
+	ret = request_firmware_nowait(THIS_MODULE, true, fw_name, dev,
 				      GFP_KERNEL, data, hx9023s_cfg_update);
 	if (ret)
 		return dev_err_probe(dev, ret, "reg config failed\n");

-- 
2.43.0

Re: [PATCH v2 4/4] iio: proximity: hx9023s: support firmware-name property

[Andy Shevchenko]

On Thu, Feb 12, 2026 at 02:26:55PM +0800, Yasin Lee wrote:
> Add an optional firmware-name property to specify the firmware file.
> If not provided, the driver falls back to the default firmware name.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>

-- 
With Best Regards,
Andy Shevchenko