Re: [PATCH v3 2/2] iio: adc: add driver for Texas Instruments TLA2528 adc

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] iio: adc: ti-tla2528: uninitialized stack read in tla2528_read()
--

commit 533ebab68a73de725d753757faa2921e38e9ba64
Author: Maxime Chevallier <maxime.chevallier@bootlin.com>

iio: adc: add driver for Texas Instruments TLA2528 adc

This commit adds an IIO ADC driver for the Texas Instruments TLA2528 8-channel
12-bit I2C ADC, supporting direct-mode raw channel reads and scale reporting.

> diff --git a/drivers/iio/adc/ti-tla2528.c b/drivers/iio/adc/ti-tla2528.c
> new file mode 100644
> index 0000000000000..ec754ec43d7c0
> --- /dev/null
> +++ b/drivers/iio/adc/ti-tla2528.c
> @@ -0,0 +1,215 @@

[ ... ]

> +static int tla2528_read(struct tla2528 *tla2528, u8 channel, int *val)
> +{
> +	__be16 data;
> +	int ret;
> +
> +	guard(mutex)(&tla2528->lock);
> +
> +	ret = regmap_update_bits(tla2528->regmap, TLA2528_CHANNEL_SEL_ADR,
> +				 TLA2528_CHANNEL_SEL_MANUAL_CHID, channel);
> +	if (ret)
> +		return ret;
> +
> +	ret = i2c_master_recv(tla2528->client, (char *)&data, sizeof(data));
> +	if (ret < 0)
> +		return ret;
> +
> +	*val = be16_to_cpu(data) >> 4;
> +
> +	return 0;
> +}

[Severity: Medium]
As reported by Sashiko on v2 [1], in drivers/iio/adc/ti-tla2528.c, can
tla2528_read() return uninitialized stack memory from data to user-space when
tla2528_read_raw() reads a channel?

i2c_master_recv() calls i2c_transfer_buffer_flags(), which calls
i2c_transfer() for 1 message:

drivers/i2c/i2c-core-base.c:i2c_transfer_buffer_flags() {
	...
	ret = i2c_transfer(client->adapter, &msg, 1);

	/*
	 * If everything went ok (i.e. 1 msg transferred), return #bytes
	 * transferred, else error code.
	 */
	return (ret == 1) ? count : ret;
}

If the adapter's master_xfer callback returns 0 messages transferred (or fewer
than sizeof(data) bytes are received), i2c_master_recv() returns a
non-negative value other than sizeof(data) without populating data.

Since tla2528_read() only checks for ret < 0, should it also return -EIO when
ret != sizeof(data)?

[1] https://lore.kernel.org/r/20261030164705.297354-3-maxime.chevallier@bootlin.com

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104125726.1754980-1-maxime.chevallier@bootlin.com?part=2