Re: [PATCH v4 1/4] iio: light: ltr501: Switch to read_avail() op from manual attribute registration

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] iio: light: ltr501: out-of-bounds write in ltr501_probe() gain
  table init
--

commit 738578de8560e9585a0ad5b6cdbf8ce32003ccdc
Author: Svyatoslav Ryhel <clamor95@gmail.com>

iio: light: ltr501: Switch to read_avail() op from manual attribute registration

This commit switches the ltr501 driver from manual sysfs attribute group
registration to the IIO read_avail() callback and consolidates the
per-chip iio_info structures.

> diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c
> index 24733607d1b49..3662aed5225bc 100644
> --- a/drivers/iio/light/ltr501.c
> +++ b/drivers/iio/light/ltr501.c

[ ... ]

> @@ -164,6 +178,8 @@ struct ltr501_data {
>  	struct regmap_field *reg_als_prst;
>  	struct regmap_field *reg_ps_prst;
>  	uint32_t near_level;
> +	struct ltr501_gain als_gain_tbl[ARRAY_SIZE(ltr559_als_gain_tbl)];
> +	u32 als_gain_tbl_len;
>  };

[ ... ]

> @@ -1548,7 +1500,16 @@ static int ltr501_probe(struct i2c_client *client)
>  				     &data->near_level))
>  		data->near_level = 0;
>  
> -	indio_dev->info = data->chip_info->info;
> +	for (int i = 0; i < data->chip_info->als_gain_tbl_size; i++) {
> +		if (data->chip_info->als_gain[i].scale == LTR501_RESERVED_GAIN)
> +			continue;
> +
> +		data->als_gain_tbl[j++].scale = data->chip_info->als_gain[i].scale;
> +		data->als_gain_tbl[j++].uscale = data->chip_info->als_gain[i].uscale;
> +	}
> +	data->als_gain_tbl_len = j;

[Severity: High]
Does post-incrementing j on both assignments overflow data->als_gain_tbl[]?

Because data->als_gain_tbl is an array of struct ltr501_gain rather than
int, incrementing j twice per iteration splits each gain entry across two
adjacent array elements (leaving the other field of each element zeroed)
and advances j to 12 for chips using ltr559_als_gain_tbl (6 non-reserved
entries).  That writes 4 elements past the 8-element als_gain_tbl array,
overwriting als_gain_tbl_len and past the end of struct ltr501_data, while
leaving corrupted scale values for ltr501_read_avail().

Assigning the struct in one step (data->als_gain_tbl[j++] =
data->chip_info->als_gain[i]) and setting data->als_gain_tbl_len = j * 2
would avoid the overflow and give ltr501_read_avail() the expected int
count.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261115083741.62140-1-clamor95@gmail.com?part=1