[PATCH v2 1/2] iio: accel: adxl380: reject out-of-range FIFO entry count

[Shengzhuo Wei]

The FIFO entry count is a 9-bit device-reported value, so it can be as
large as 511, but fifo_buf[] only has room for ADXL380_FIFO_SAMPLES
(315) entries. adxl380_irq_handler() uses the reported count directly as
the length of a bulk FIFO read, so a count above ADXL380_FIFO_SAMPLES
overflows fifo_buf, a heap out-of-bounds write of up to 392 bytes into
adjacent memory.

Rather than clamp the count and silently drop the excess, abort the
read: a count beyond the FIFO size means the device is returning
garbage, so the data cannot be trusted. The message is ratelimited
because a stuck device can raise the watermark IRQ repeatedly.

Assisted-by: GLM:5.2
Signed-off-by: Shengzhuo Wei <me@xxxxxxxx>
---
 drivers/iio/accel/adxl380.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/iio/accel/adxl380.c b/drivers/iio/accel/adxl380.c
index 7dca5523091fc4c6a3c3bf7e388d5d0d507bee19..8518ee23e114901ee02933e91b8bdf8d7c83008c 100644
--- a/drivers/iio/accel/adxl380.c
+++ b/drivers/iio/accel/adxl380.c
@@ -966,6 +966,13 @@ static irqreturn_t adxl380_irq_handler(int irq, void  *p)
 	if (ret)
 		return IRQ_HANDLED;
 
+	if (fifo_entries > ADXL380_FIFO_SAMPLES) {
+		dev_err_ratelimited(st->dev,
+				    "FIFO entry count %u exceeds FIFO size %lu\n",
+				    fifo_entries, ADXL380_FIFO_SAMPLES);
+		return IRQ_HANDLED;
+	}
+
 	fifo_entries = rounddown(fifo_entries, st->fifo_set_size);
 	ret = regmap_noinc_read(st->regmap, ADXL380_FIFO_DATA, &st->fifo_buf,
 				sizeof(*st->fifo_buf) * fifo_entries);

-- 
2.47.3