Re: [PATCH v3] iio: accel: bmc150: clamp the device-reported FIFO frame count

[Andy Shevchenko]

On Tue, Jun 16, 2026 at 08:56:51PM -0500, Bryam Vargas via B4 Relay wrote:

> __bmc150_accel_fifo_flush() transfers the frame count the device reports
> in FIFO_STATUS into an on-stack buffer sized for BMC150_ACCEL_FIFO_LENGTH
> (32) samples, but the count is masked to 7 bits (0..127) and the optional
> caller budget does not bound the flush-all path. A device, or an attacker
> on the I2C/SPI bus, reporting up to 127 frames overflows the buffer by up
> to 570 bytes: a stack out-of-bounds write.
> 
> Clamp the count to BMC150_ACCEL_FIFO_LENGTH before the transfer, mirroring
> the clamp already applied in bmc150_accel_set_watermark(). Conforming
> hardware reports at most that many frames and is unaffected.

LGTM now,
Reviewed-by: Andy Shevchenko <andriy.shevchenko@xxxxxxxxx>

-- 
With Best Regards,
Andy Shevchenko