Re: [PATCH 3/3] iio: adc: ad7768-1: add bounds check to ad7768_filter_regval_to_type index

[Jonathan Cameron]

On Thu, 14 May 2026 18:23:22 +0200
Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> wrote:

> From: Sam Daly <sam@xxxxxxxxxx>
> 
> ad7768_filter_regval_to_type has 12 elements but the combined mask
> AD7768_DIG_FIL_EN_60HZ_REJ | AD7768_DIG_FIL_FIL_MSK spans 4 bits
> and can yield values 0-15. If it returns a value >= 12, this causes
> an out-of-bounds array access. Add a bounds check and return -EINVAL
> if the index is out of range.

I think this needs some more explanation as that's a sparsely filled array.
Now we are considering hardware returning values it shouldn't it gets
more complex.

So whilst it's not going to cause an out of bounds read, if we
get say a 5 then it shouldn't map to a SINC5 filter, but instead
return an error.

I suppose we could do it as a pair of fixes, but it feels like explicit
value matching is to ones we expect may well involve switching from
an array to a switch statement and once we've done that what is
being fixed here will be a natural side effect.

Given it's hardening against stuff we don't expect I'm not that worried
if it takes a little while to get the more complete fix in place.

Jonathan



> 
> Assisted-by: gkh_clanker_2000
> Cc: stable <stable@xxxxxxxxxx>
> Cc: Lars-Peter Clausen <lars@xxxxxxxxxx>
> Cc: Michael Hennerich <Michael.Hennerich@xxxxxxxxxx>
> Cc: Jonathan Cameron <jic23@xxxxxxxxxx>
> Cc: David Lechner <dlechner@xxxxxxxxxxxx>
> Cc: "Nuno Sá" <nuno.sa@xxxxxxxxxx>
> Cc: Andy Shevchenko <andy@xxxxxxxxxx>
> Signed-off-by: Sam Daly <sam@xxxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> ---
>  drivers/iio/adc/ad7768-1.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iio/adc/ad7768-1.c b/drivers/iio/adc/ad7768-1.c
> index e16dede687d3..52e95017d36b 100644
> --- a/drivers/iio/adc/ad7768-1.c
> +++ b/drivers/iio/adc/ad7768-1.c
> @@ -897,7 +897,7 @@ static int ad7768_get_filter_type_attr(struct iio_dev *dev,
>  {
>  	struct ad7768_state *st = iio_priv(dev);
>  	int ret;
> -	unsigned int mode, mask;
> +	unsigned int mode, mask, idx;
>  
>  	ret = regmap_read(st->regmap, AD7768_REG_DIGITAL_FILTER, &mode);
>  	if (ret)
> @@ -905,7 +905,11 @@ static int ad7768_get_filter_type_attr(struct iio_dev *dev,
>  
>  	mask = AD7768_DIG_FIL_EN_60HZ_REJ | AD7768_DIG_FIL_FIL_MSK;
>  	/* From the register value, get the corresponding filter type */
> -	return ad7768_filter_regval_to_type[FIELD_GET(mask, mode)];
> +	idx = FIELD_GET(mask, mode);
> +	if (idx >= ARRAY_SIZE(ad7768_filter_regval_to_type))
> +		return -EINVAL;
> +
> +	return ad7768_filter_regval_to_type[idx];
>  }
>  
>  static int ad7768_update_dec_rate(struct iio_dev *dev, unsigned int dec_rate)