Re: [PATCH v4 2/4] iio: light: ltr501: Switch to modern match mechanism

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] iio: light: ltr501: out-of-bounds write in ltr501_probe() gain
  table loop
--

commit 2ee88d940ef79eabde357ad61e65124e0b97da91
Author: Svyatoslav Ryhel <clamor95@gmail.com>

iio: light: ltr501: Switch to modern match mechanism

This commit replaces the chip enum and ltr501_chip_info_tbl array with
per-chip structures retrieved via i2c_get_match_data().

> diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c
> index 3662aed5225bc..bf3cc32a55c3c 100644
> --- a/drivers/iio/light/ltr501.c
> +++ b/drivers/iio/light/ltr501.c

[ ... ]

> @@ -1481,18 +1473,10 @@ static int ltr501_probe(struct i2c_client *client)
>  	if (ret < 0)
>  		return ret;
>  
> -	if (id) {
> -		name = id->name;
> -		chip_idx = id->driver_data;
> -	} else {
> -		name = iio_get_acpi_device_name_and_data(&client->dev, &ddata);
> -		chip_idx = (intptr_t)ddata;
> -	}
> -	if (!name)
> +	data->chip_info = i2c_get_match_data(client);
> +	if (!data->chip_info)
>  		return -ENODEV;
>  
> -	data->chip_info = &ltr501_chip_info_tbl[chip_idx];
> -
>  	if ((partid >> 4) != data->chip_info->partid)
>  		return -ENODEV;

[Severity: High]
Can the gain table loop right below this in ltr501_probe() overflow
data->als_gain_tbl[]?

The earlier commit "iio: light: ltr501: Switch to read_avail() op from
manual attribute registration" in this series added:

drivers/iio/light/ltr501.c:ltr501_probe() {
    ...
	for (int i = 0; i < data->chip_info->als_gain_tbl_size; i++) {
		if (data->chip_info->als_gain[i].scale == LTR501_RESERVED_GAIN)
			continue;

		data->als_gain_tbl[j++].scale = data->chip_info->als_gain[i].scale;
		data->als_gain_tbl[j++].uscale = data->chip_info->als_gain[i].uscale;
	}
	data->als_gain_tbl_len = j;
    ...
}

Each element of data->als_gain_tbl[] is a struct ltr501_gain holding both
scale and uscale, and the array is sized to ARRAY_SIZE(ltr559_als_gain_tbl)
(8 elements).  Post-incrementing j on both assignments advances by two
elements per entry, leaving interleaved zeros in the table exposed by
ltr501_read_avail().  On chips using ltr559_als_gain_tbl (such as ltr559,
which has 6 non-reserved entries), j reaches 12 and writes past the end of
data->als_gain_tbl[], overwriting data->als_gain_tbl_len and adjacent slab
memory after struct ltr501_data.

j should be incremented once per non-reserved entry, with
data->als_gain_tbl_len set to j * 2 for IIO_VAL_INT_PLUS_MICRO.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261115083741.62140-1-clamor95@gmail.com?part=2