Re: [PATCH v2 6/6] iio: imu: adis16607: Add calibration bias support for gyro/accel

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] iio: missing bounds check in adis16607_write_raw() causes integer truncation
--

commit e23feabbd136bcd6fd30e2609a83f094ba9326fc
Author: Radu Sabau <radu.sabau@analog.com>

iio: imu: adis16607: Add calibration bias support for gyro/accel

This commit adds IIO_CHAN_INFO_CALIBBIAS support for the gyroscope and
accelerometer axes. It backs the new attribute using the device's per-axis
bias registers.

> diff --git a/drivers/iio/imu/adis16607.c b/drivers/iio/imu/adis16607.c
> index 0147eba0b1737..d4b3a8a9fd08a 100644
> --- a/drivers/iio/imu/adis16607.c
> +++ b/drivers/iio/imu/adis16607.c

[ ... ]

> @@ -1000,6 +1026,7 @@ static int adis16607_write_raw(struct iio_dev *indio_dev,
>  			       int val, int val2, long info)
>  {
>  	struct adis16607 *st = iio_priv(indio_dev);
> +	const int idx = chan->scan_index;
>  	u32 tmp;
>  
>  	switch (info) {
> @@ -1007,6 +1034,9 @@ static int adis16607_write_raw(struct iio_dev *indio_dev,
>  		tmp = val * 1000 + val2 / 1000;
>  		return adis16607_set_freq(st, tmp);
>  
> +	case IIO_CHAN_INFO_CALIBBIAS:
> +		return adis_write_reg_16(&st->adis, adis16607_calib_bias[idx], val);

[Severity: Medium]
Does this code silently truncate out-of-bounds user inputs? The `val`
parameter in adis16607_write_raw() is a 32-bit signed integer provided by
userspace, but adis_write_reg_16() expects a 16-bit integer. 

Because there is no bounds check on `val` before passing it down, out-of-range
values (values outside the 16-bit signed range [-32768, 32767]) could be
implicitly cast and wrapped. For example, 65536 would become 0, leading to
unintended calibration bias being applied to the device instead of rejecting
the write and returning an error to userspace.

> +
>  	default:
>  		return -EINVAL;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261008-adis16607-v2-0-7c94df80878a@analog.com?part=6