[PATCH v2 2/2] iio: accel: adxl367: reject out-of-range FIFO entry count

[Shengzhuo Wei]

The FIFO entry count reported by the device can be as large as 1023
(the low byte plus the low two bits of the high byte), but fifo_buf[]
only has room for ADXL367_FIFO_SIZE (512) entries.
adxl367_push_fifo_data() passes the reported count straight to the FIFO
read, so a count above ADXL367_FIFO_SIZE overflows fifo_buf, a heap
out-of-bounds write of up to 1022 bytes into adjacent memory.

Rather than clamp the count and silently drop the excess, abort the
read: a count beyond the FIFO size means the device is returning
garbage, so the data cannot be trusted. The message is ratelimited
because a stuck device can raise the IRQ repeatedly.

Assisted-by: GLM:5.2
Signed-off-by: Shengzhuo Wei <me@xxxxxxxx>
---
 drivers/iio/accel/adxl367.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/iio/accel/adxl367.c b/drivers/iio/accel/adxl367.c
index 8c3de11a10a37d228f8758b688156e3ee958c4e9..270d6feede2f60f4274dead7b3974cd04abb14a6 100644
--- a/drivers/iio/accel/adxl367.c
+++ b/drivers/iio/accel/adxl367.c
@@ -787,6 +787,14 @@ static bool adxl367_push_fifo_data(struct iio_dev *indio_dev, u8 status,
 	if (!FIELD_GET(ADXL367_STATUS_FIFO_FULL_MASK, status))
 		return false;
 
+	if (fifo_entries > ADXL367_FIFO_SIZE) {
+		dev_err_ratelimited(st->dev,
+				    "FIFO entry count %u exceeds FIFO size %lu\n",
+				    fifo_entries,
+				    (unsigned long)ADXL367_FIFO_SIZE);
+		return true;
+	}
+
 	fifo_entries -= fifo_entries % st->fifo_set_size;
 
 	ret = st->ops->read_fifo(st->context, st->fifo_buf, fifo_entries);

-- 
2.47.3