[PATCH] iio: adc: ad4062: Add missing IS_ERR() check

[PATCH] iio: adc: ad4062: Add missing IS_ERR() check

[Ethan Tidmore]

In the function ad4062_sizeof_storagebits() iio_get_current_scan_type()
is called which can return an error pointer and is not checked for it.
Also the function ad4062_sizeof_storagebits() returns type size_t but,
is only used once and the variable assigned from it is type u8.

Add check for error pointer in ad4062_sizeof_storagebits() and change
return type to int so the error code can be properly propagated and then
checked.

Fixes: 23cc92280302d ("iio: adc: ad4062: Add IIO Trigger support")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/r/202512280539.AholFF7m-lkp@intel.com/
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
---
 drivers/iio/adc/ad4062.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/adc/ad4062.c b/drivers/iio/adc/ad4062.c
index dd4ad32aa6f5..c864de3b46ba 100644
--- a/drivers/iio/adc/ad4062.c
+++ b/drivers/iio/adc/ad4062.c
@@ -1199,11 +1199,14 @@ static int ad4062_write_event_value(struct iio_dev *indio_dev,
  * The AD4062 in burst averaging mode increases realbits from 16-bits to
  * 20-bits, increasing the storagebits from 16-bits to 32-bits.
  */
-static inline size_t ad4062_sizeof_storagebits(struct ad4062_state *st)
+static inline int ad4062_sizeof_storagebits(struct ad4062_state *st)
 {
 	const struct iio_scan_type *scan_type =
 		iio_get_current_scan_type(st->indio_dev, st->chip->channels);
 
+	if (IS_ERR(scan_type))
+		return PTR_ERR(scan_type);
+
 	return BITS_TO_BYTES(scan_type->storagebits);
 }
 
@@ -1233,7 +1236,12 @@ static int pm_ad4062_triggered_buffer_postenable(struct ad4062_state *st)
 	if (ret)
 		return ret;
 
-	st->conv_sizeof = ad4062_sizeof_storagebits(st);
+	ret = ad4062_sizeof_storagebits(st);
+	if (ret < 0)
+		return ret;
+
+	st->conv_sizeof = ret;
+
 	st->conv_addr = ad4062_get_conv_addr(st, st->conv_sizeof);
 	/* CONV_READ requires read to trigger first sample. */
 	struct i3c_xfer xfer_sample[2] = {
-- 
2.53.0

Re: [PATCH] iio: adc: ad4062: Add missing IS_ERR() check

[Jorge Marques]

On Fri, Feb 13, 2026 at 06:53:32PM -0600, Ethan Tidmore wrote:
> In the function ad4062_sizeof_storagebits() iio_get_current_scan_type()
> is called which can return an error pointer and is not checked for it.
> Also the function ad4062_sizeof_storagebits() returns type size_t but,
> is only used once and the variable assigned from it is type u8.
> 
> Add check for error pointer in ad4062_sizeof_storagebits() and change
> return type to int so the error code can be properly propagated and then
> checked.
> 

Hi Ethan,

Thank you for adding the check.

Reviewed-by: Jorge Marques <jorge.marques@analog.com>

For risk assessment of the bug:

  static int ad4062_get_current_scan_type(const struct iio_dev *indio_dev,
  					const struct iio_chan_spec *chan)
  {
  	struct ad4062_state *st = iio_priv(indio_dev);
  
  	return st->mode == AD4062_BURST_AVERAGING_MODE ?
  			   AD4062_SCAN_TYPE_BURST_AVG :
  			   AD4062_SCAN_TYPE_SAMPLE;
  }

  There is no path where the method returns an error.

It definitely makes sense to add the inexpensive check, since the
*_get_current_scan_type could be patched with an error case (e.g., added
support to other devices) and the lack of check could slip through (due
to previously marked as false positive).

Thanks,
Jorge

> Fixes: 23cc92280302d ("iio: adc: ad4062: Add IIO Trigger support")
> Reported-by: kernel test robot <lkp@intel.com>
> Reported-by: Dan Carpenter <error27@gmail.com>
> Closes: https://lore.kernel.org/r/202512280539.AholFF7m-lkp@intel.com/
> Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
> ---
>  drivers/iio/adc/ad4062.c | 12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iio/adc/ad4062.c b/drivers/iio/adc/ad4062.c
> index dd4ad32aa6f5..c864de3b46ba 100644
> --- a/drivers/iio/adc/ad4062.c
> +++ b/drivers/iio/adc/ad4062.c
> @@ -1199,11 +1199,14 @@ static int ad4062_write_event_value(struct iio_dev *indio_dev,
>   * The AD4062 in burst averaging mode increases realbits from 16-bits to
>   * 20-bits, increasing the storagebits from 16-bits to 32-bits.
>   */
> -static inline size_t ad4062_sizeof_storagebits(struct ad4062_state *st)
> +static inline int ad4062_sizeof_storagebits(struct ad4062_state *st)
>  {
>  	const struct iio_scan_type *scan_type =
>  		iio_get_current_scan_type(st->indio_dev, st->chip->channels);
>  
> +	if (IS_ERR(scan_type))
> +		return PTR_ERR(scan_type);
> +
>  	return BITS_TO_BYTES(scan_type->storagebits);
>  }
>  
> @@ -1233,7 +1236,12 @@ static int pm_ad4062_triggered_buffer_postenable(struct ad4062_state *st)
>  	if (ret)
>  		return ret;
>  
> -	st->conv_sizeof = ad4062_sizeof_storagebits(st);
> +	ret = ad4062_sizeof_storagebits(st);
> +	if (ret < 0)
> +		return ret;
> +
> +	st->conv_sizeof = ret;
> +
>  	st->conv_addr = ad4062_get_conv_addr(st, st->conv_sizeof);
>  	/* CONV_READ requires read to trigger first sample. */
>  	struct i3c_xfer xfer_sample[2] = {
> -- 
> 2.53.0
>o 

Re: [PATCH] iio: adc: ad4062: Add missing IS_ERR() check

[Jonathan Cameron]

On Sat, 14 Feb 2026 15:36:35 +0100
Jorge Marques <gastmaier@gmail.com> wrote:

> On Fri, Feb 13, 2026 at 06:53:32PM -0600, Ethan Tidmore wrote:
> > In the function ad4062_sizeof_storagebits() iio_get_current_scan_type()
> > is called which can return an error pointer and is not checked for it.
> > Also the function ad4062_sizeof_storagebits() returns type size_t but,
> > is only used once and the variable assigned from it is type u8.
> > 
> > Add check for error pointer in ad4062_sizeof_storagebits() and change
> > return type to int so the error code can be properly propagated and then
> > checked.
> >   
> 
> Hi Ethan,
> 
> Thank you for adding the check.
> 
> Reviewed-by: Jorge Marques <jorge.marques@analog.com>
> 
> For risk assessment of the bug:
> 
>   static int ad4062_get_current_scan_type(const struct iio_dev *indio_dev,
>   					const struct iio_chan_spec *chan)
>   {
>   	struct ad4062_state *st = iio_priv(indio_dev);
>   
>   	return st->mode == AD4062_BURST_AVERAGING_MODE ?
>   			   AD4062_SCAN_TYPE_BURST_AVG :
>   			   AD4062_SCAN_TYPE_SAMPLE;
>   }
> 
>   There is no path where the method returns an error.
> 
> It definitely makes sense to add the inexpensive check, since the
> *_get_current_scan_type could be patched with an error case (e.g., added
> support to other devices) and the lack of check could slip through (due
> to previously marked as false positive).
> 
Given it's a false positive I'll merge this the slow way.
I considered dropping the fixes tag, but then various bots will complain
if we keep the closes etc so I left it.  I haven't tagged it for stable
however as we probably don't care strongly either way on whether this one
gets backported.

So applied to the testing branch of iio.git which I'll rebase on rc1 once
available.

Thanks,

Jonathan

> Thanks,
> Jorge
> 
> > Fixes: 23cc92280302d ("iio: adc: ad4062: Add IIO Trigger support")
> > Reported-by: kernel test robot <lkp@intel.com>
> > Reported-by: Dan Carpenter <error27@gmail.com>
> > Closes: https://lore.kernel.org/r/202512280539.AholFF7m-lkp@intel.com/
> > Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
> > ---
> >  drivers/iio/adc/ad4062.c | 12 ++++++++++--
> >  1 file changed, 10 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/iio/adc/ad4062.c b/drivers/iio/adc/ad4062.c
> > index dd4ad32aa6f5..c864de3b46ba 100644
> > --- a/drivers/iio/adc/ad4062.c
> > +++ b/drivers/iio/adc/ad4062.c
> > @@ -1199,11 +1199,14 @@ static int ad4062_write_event_value(struct iio_dev *indio_dev,
> >   * The AD4062 in burst averaging mode increases realbits from 16-bits to
> >   * 20-bits, increasing the storagebits from 16-bits to 32-bits.
> >   */
> > -static inline size_t ad4062_sizeof_storagebits(struct ad4062_state *st)
> > +static inline int ad4062_sizeof_storagebits(struct ad4062_state *st)
> >  {
> >  	const struct iio_scan_type *scan_type =
> >  		iio_get_current_scan_type(st->indio_dev, st->chip->channels);
> >  
> > +	if (IS_ERR(scan_type))
> > +		return PTR_ERR(scan_type);
> > +
> >  	return BITS_TO_BYTES(scan_type->storagebits);
> >  }
> >  
> > @@ -1233,7 +1236,12 @@ static int pm_ad4062_triggered_buffer_postenable(struct ad4062_state *st)
> >  	if (ret)
> >  		return ret;
> >  
> > -	st->conv_sizeof = ad4062_sizeof_storagebits(st);
> > +	ret = ad4062_sizeof_storagebits(st);
> > +	if (ret < 0)
> > +		return ret;
> > +
> > +	st->conv_sizeof = ret;
> > +
> >  	st->conv_addr = ad4062_get_conv_addr(st, st->conv_sizeof);
> >  	/* CONV_READ requires read to trigger first sample. */
> >  	struct i3c_xfer xfer_sample[2] = {
> > -- 
> > 2.53.0
> >o