From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ed1-f41.google.com (mail-ed1-f41.google.com [209.85.208.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A2491482D4 for ; Sat, 22 Aug 2026 02:19:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787365185; cv=none; b=ebF1SksxvHlo1bt96D0PZ6NXo5CmjOO8MmUTClZpHsi7uA9tMJD0kbxeg+L/UmBgJR9IivziS6MoIj/VTmvDBaHWd7ovw4/BfVwcr1xaQPnCGIteBHIN9MdLoLKQooEkmGnvcboDjQNFLMNKSUjy3jUOP3OtYY+Y1rcVjK1CWtQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787365185; c=relaxed/simple; bh=+3IrxbU2OFpkP2P2cp+e8PVSNHataW9AC9TlUBMVCOM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=qv7gDdh3bG2G/IpdvHh0jD6VADF/ILJElz6xvohwdJ1lCQ6bFCM8VyPvmrzuJyZNKGXJVexdu2Nv2hRUyoAsW+57P136mB3JDDKN3oTCTOVmp+H3SmRRcTtPKmNNZ2dLqnU2/bFrtR1QcpDVv/eqVn6lh/slhUc00ZmTmL9/6e0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Hbvd0d5P; arc=none smtp.client-ip=209.85.208.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Hbvd0d5P" Received: by mail-ed1-f41.google.com with SMTP id 4fb4d7f45d1cf-6a374bea882so3365685a12.1 for ; Fri, 21 Aug 2026 19:19:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787365182; x=1787969982; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=mwRH3/vEudD1r7EhMg9G6KfbEKZWIU1Zh3PgLptr0xc=; b=Hbvd0d5PuZljp+gDemjgBEf/0RZi8Y2p2thKXDfIlcvIDOOff+lVId+Z0t+vQAaMo7 XzPsenFqtCXd8BkspzVgg1b4PskbRuNLeqtmnnBUydtbyeqtWf0bM2omIiGFWvGeVHKU JfT6IrrpZODsMYXlENqpYQ8rhPsmQonccYoNa4+lAY2xPgiWwEdSRd1dyD6/Z2k/k345 Y9iFjOxa7ImzodlYAF+8XKrQtRex8gyjY4Hq1SgRSZIwjRakvCdtxRQPFWSR9vgkDCqg wo4/mtKLxYth+ZZc+V10bWXMmkqebFKFL9WRB/HU07MBpUa4fWcD3tdhT/JGaa0yLV7m JwOg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787365182; x=1787969982; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=mwRH3/vEudD1r7EhMg9G6KfbEKZWIU1Zh3PgLptr0xc=; b=cstSJ6n+/HyDKohDpH7xjOSN/aUxIUBNdFPf2oijznbS+cwmLUJ7L7TQmVyFukZHQF xOmm0fAQCHPRx14Oxyq8+bby7W+30PUIv6+ND3K5i9FZiNPeA9lLBE+DWdBFRg9KcoYo MXYeJjG7yZWlj4ZBB6zUoIulNn1cjS5Fn4p7ejQWtONroDkmFrPRlClTtjsQ+WoRTaOE p6nJN+mari8cK/xT5FlzQj95w1zquG0giqIyFkm8gSLdrbROCAGRponG7Y7gb6jWEqdY uZEEqlu6UuU8aDMObJwkmUciBa+Fw7+mzG/AfPYhSDx34739AZWY6LaAT9lFJnY/+VoA oI5Q== X-Forwarded-Encrypted: i=1; AHgh+RovGw2Aqa6VT3IhkX/kgTmqGaJYnVpnW3okc3rveT+5C9OR/k2+V6oTLyQmMqLvwmp9z+9wXe6zQfPtOXs=@vger.kernel.org X-Gm-Message-State: AFuF++mfzOfcrdv7MZXF5AA4X/Pu43jEhwj72m4OCVzC6tHW13AIhn+K iURu3fmL/kCMcbP5IW9mcQCQ0IFBE4iSG88GlkBFAdBjGjwaJ/oVaVRM X-Gm-Gg: AR+sD12gW2PYr7iu4CRksYBweQBkaXtVuOKVVBKUCfYxra8f+5/WBG3q8hGMYGkO30d YVhhmQ4xVBptm7x+CB0m4hZB+TPlNhkqjq7WW1goM075/xsg4JlBuvPzZCHLTWDkq1v4ehtE1HF wsS+mzHzzaTNhQtd6gq1mfTMFixY3Ne1h2Dyf9YnDG4XqFw86xaYeh0JdDN0PX2cRg0NZrQaIpt WKaW50/WzSYzboyLUjQml/wCQA2rRyKH0L4nNUltY6p1AjlynDw0ULYMx9ww6dwA8mYzvR4zaDS xAc5TMt6V7VRintHnNWagXPoV6gLmA866S8VtBa+gIkQAE74N9cSS7ryMecr6ZhSW1U14BHZ4aq LaZ6DQRDTQAXLE+enHqy1tocNKcXqXatgxm0sf1D3hzRcWRjwSIhyO7JupT/Y9AgVygm424hEV8 KnuCl99ybdYY7g58gn06H9egUL/njhStRLM0Zb0HasEElDijHRqfQ9gazojv3MYsUc/cgCWSPZ4 bfj0jZHiqIW X-Received: by 2002:a05:6402:428e:b0:6a1:fd14:8835 with SMTP id 4fb4d7f45d1cf-6a42eea5ed7mr6025591a12.0.1787365181645; Fri, 21 Aug 2026 19:19:41 -0700 (PDT) Received: from localhost.localdomain ([196.235.229.7]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-6a3feeca188sm9845924a12.6.2026.08.21.19.19.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 21 Aug 2026 19:19:41 -0700 (PDT) From: Salah Triki To: =?UTF-8?q?Nuno=20S=C3=A1?= , Michael Hennerich , Esteban Blanc , Jonathan Cameron , David Lechner , Andy Shevchenko Cc: linux@analog.com, linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, Salah Triki Subject: [PATCH] iio: adc: ad4030: fix invalid oversampling_ratio validation Date: Sat, 22 Aug 2026 03:19:35 +0100 Message-ID: <20260822021935.17058-1-salah.triki@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit ad4030_set_avg_frame_len() computes avg_log2 = ilog2(avg_val) before validating avg_val, and the subsequent range check only rejects negative values or values above the maximum supported OSR. It does not reject avg_val == 0, nor values that are not exact powers of 2. - avg_val == 0 passes the check (0 is not < 0 and not > max), so ilog2(0) is called with an undefined/garbage result. - Non-power-of-2 values (e.g. avg_val == 3) also pass the check and silently get rounded down by ilog2() to the nearest lower power of 2, so userspace can write a value to the oversampling_ratio sysfs attribute that does not match what actually gets programmed into hardware, without any error being reported. Only powers of 2 in [1, 65536] are valid OSR values, as listed in ad4030_average_modes[]. Validate avg_val fully before computing its log2, using is_power_of_2() and requiring avg_val > 0. Fixes: 949abd1ca5a4 ("iio: adc: ad4030: add averaging support") Signed-off-by: Salah Triki --- drivers/iio/adc/ad4030.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/iio/adc/ad4030.c b/drivers/iio/adc/ad4030.c index 9c5f19321e3b..93d9f143cc91 100644 --- a/drivers/iio/adc/ad4030.c +++ b/drivers/iio/adc/ad4030.c @@ -751,9 +751,11 @@ static int ad4030_set_avg_frame_len(struct iio_dev *dev, int avg_val) int freq_hz; int ret; - if (avg_val < 0 || avg_val > ad4030_average_modes[last_avg_idx]) + if (avg_val <= 0 || avg_val > ad4030_average_modes[last_avg_idx] || !is_power_of_2(avg_val)) return -EINVAL; + avg_log2 = ilog2(avg_val); + if (st->offload_trigger) { /* * The sample averaging and sampling frequency configurations -- 2.43.0