[PATCH] iio: adc: nxp-sar-adc: fix division by zero in write_raw

[PATCH] iio: adc: nxp-sar-adc: fix division by zero in write_raw

[Antoniu Miclaus]

Add a validation check for the sampling frequency value before using it
as a divisor. A user writing zero or a negative value to the
sampling_frequency sysfs attribute triggers a division by zero in the
kernel.

Also prevent unsigned integer underflow when the computed cycle count is
smaller than NXP_SAR_ADC_CONV_TIME, which would wrap the u32 inpsamp to
a huge value.

Fixes: fdee77dea4b6 ("iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms")
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
---
 drivers/iio/adc/nxp-sar-adc.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/adc/nxp-sar-adc.c b/drivers/iio/adc/nxp-sar-adc.c
index a6e4888a8464..c611f1c612e6 100644
--- a/drivers/iio/adc/nxp-sar-adc.c
+++ b/drivers/iio/adc/nxp-sar-adc.c
@@ -560,6 +560,9 @@ static int nxp_sar_adc_write_raw(struct iio_dev *indio_dev, struct iio_chan_spec
 
 	switch (mask) {
 	case IIO_CHAN_INFO_SAMP_FREQ:
+		if (val <= 0)
+			return -EINVAL;
+
 		/*
 		 * Configures the sample period duration in terms of the SAR
 		 * controller clock. The minimum acceptable value is 8.
@@ -568,7 +571,11 @@ static int nxp_sar_adc_write_raw(struct iio_dev *indio_dev, struct iio_chan_spec
 		 * sampling timing which gives us the number of cycles expected.
 		 * The value is 8-bit wide, consequently the max value is 0xFF.
 		 */
-		inpsamp = clk_get_rate(info->clk) / val - NXP_SAR_ADC_CONV_TIME;
+		inpsamp = clk_get_rate(info->clk) / val;
+		if (inpsamp < NXP_SAR_ADC_CONV_TIME)
+			return -EINVAL;
+
+		inpsamp -= NXP_SAR_ADC_CONV_TIME;
 		nxp_sar_adc_conversion_timing_set(info, inpsamp);
 		return 0;
 
-- 
2.43.0

Re: [PATCH] iio: adc: nxp-sar-adc: fix division by zero in write_raw

[Jonathan Cameron]

On Wed, 1 Apr 2026 18:29:24 +0300
Antoniu Miclaus <antoniu.miclaus@analog.com> wrote:

> Add a validation check for the sampling frequency value before using it
> as a divisor. A user writing zero or a negative value to the
> sampling_frequency sysfs attribute triggers a division by zero in the
> kernel.
> 
> Also prevent unsigned integer underflow when the computed cycle count is
> smaller than NXP_SAR_ADC_CONV_TIME, which would wrap the u32 inpsamp to
> a huge value.
> 
> Fixes: fdee77dea4b6 ("iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms")
> Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>

Ideally this would get an ack from someone familiar with the platform but
as it seems right to me I'll queue it up.

Applied and marked for stable.  Given I'll be rebasing anyway on rc1 there
is time to back it out or add tags.

Thanks,

Jonathan

> ---
>  drivers/iio/adc/nxp-sar-adc.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/adc/nxp-sar-adc.c b/drivers/iio/adc/nxp-sar-adc.c
> index a6e4888a8464..c611f1c612e6 100644
> --- a/drivers/iio/adc/nxp-sar-adc.c
> +++ b/drivers/iio/adc/nxp-sar-adc.c
> @@ -560,6 +560,9 @@ static int nxp_sar_adc_write_raw(struct iio_dev *indio_dev, struct iio_chan_spec
>  
>  	switch (mask) {
>  	case IIO_CHAN_INFO_SAMP_FREQ:
> +		if (val <= 0)
> +			return -EINVAL;
> +
>  		/*
>  		 * Configures the sample period duration in terms of the SAR
>  		 * controller clock. The minimum acceptable value is 8.
> @@ -568,7 +571,11 @@ static int nxp_sar_adc_write_raw(struct iio_dev *indio_dev, struct iio_chan_spec
>  		 * sampling timing which gives us the number of cycles expected.
>  		 * The value is 8-bit wide, consequently the max value is 0xFF.
>  		 */
> -		inpsamp = clk_get_rate(info->clk) / val - NXP_SAR_ADC_CONV_TIME;
> +		inpsamp = clk_get_rate(info->clk) / val;
> +		if (inpsamp < NXP_SAR_ADC_CONV_TIME)
> +			return -EINVAL;
> +
> +		inpsamp -= NXP_SAR_ADC_CONV_TIME;
>  		nxp_sar_adc_conversion_timing_set(info, inpsamp);
>  		return 0;
>