[PATCH] iio: accel: adxl380: clamp FIFO sample count

[Shengzhuo Wei]

The FIFO entry count is a 9-bit device-reported value and can therefore
be as large as 511. fifo_buf[], however, only has room for
ADXL380_FIFO_SAMPLES (315) entries.

After rounding the count down to a multiple of fifo_set_size,
adxl380_irq_handler() uses it directly as the length of a bulk FIFO
read. If the reported count exceeds ADXL380_FIFO_SAMPLES, this can
overflow fifo_buf.

Clamp the reported entry count to the size of fifo_buf before rounding
it down.

Fixes: df36de13677a ("iio: accel: add ADXL380 driver")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: GLM:5.2
Signed-off-by: Shengzhuo Wei <me@xxxxxxxx>
---
 drivers/iio/accel/adxl380.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iio/accel/adxl380.c b/drivers/iio/accel/adxl380.c
index 7dca5523091fc4c6a3c3bf7e388d5d0d507bee19..8a9d82e1d882aa45721013590ecbd86b083a15a6 100644
--- a/drivers/iio/accel/adxl380.c
+++ b/drivers/iio/accel/adxl380.c
@@ -966,6 +966,7 @@ static irqreturn_t adxl380_irq_handler(int irq, void  *p)
 	if (ret)
 		return IRQ_HANDLED;
 
+	fifo_entries = min(fifo_entries, ADXL380_FIFO_SAMPLES);
 	fifo_entries = rounddown(fifo_entries, st->fifo_set_size);
 	ret = regmap_noinc_read(st->regmap, ADXL380_FIFO_DATA, &st->fifo_buf,
 				sizeof(*st->fifo_buf) * fifo_entries);

---
base-commit: 848acc8ffe1b7cd5f1bf427b93069becfebc2c9d
change-id: 20260809-adxl380-fifo-clamp-f07a570d96b1

Best regards,
-- 
Shengzhuo Wei <me@xxxxxxxx>