Re: [PATCH] iio: accel: adxl367: clamp FIFO sample count

[Jonathan Cameron]

On Sun, 09 Aug 2026 06:32:37 +0800
"Shengzhuo Wei" <me@xxxxxxxx> wrote:

> The FIFO entry count is a 10-bit device-reported value and can therefore
> be as large as 1023. fifo_buf[], however, only has room for
> ADXL367_FIFO_SIZE (512) entries.
> 
> After rounding the count down to a multiple of fifo_set_size,
> adxl367_push_fifo_data() uses it directly as the length of a bulk FIFO
> read. If the reported count exceeds ADXL367_FIFO_SIZE, this can
> overflow fifo_buf.
> 
> Clamp the reported entry count to the size of fifo_buf before rounding
> it down.
> 
> Fixes: cbab791c5e2a ("iio: accel: add ADXL367 driver")
Same comments as previous patch.

For 'similar' fixes like this, even though they are to different
drivers I'd put them in a series.  Makes it easy for reviewers
to post comments on the whole series.

Jonathan

> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: GLM:5.2
> Signed-off-by: Shengzhuo Wei <me@xxxxxxxx>
> ---
>  drivers/iio/accel/adxl367.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/iio/accel/adxl367.c b/drivers/iio/accel/adxl367.c
> index 8c3de11a10a37d228f8758b688156e3ee958c4e9..c82f6c8e5a0d8f4a66ea6c97b78c3838f6138502 100644
> --- a/drivers/iio/accel/adxl367.c
> +++ b/drivers/iio/accel/adxl367.c
> @@ -787,6 +787,7 @@ static bool adxl367_push_fifo_data(struct iio_dev *indio_dev, u8 status,
>  	if (!FIELD_GET(ADXL367_STATUS_FIFO_FULL_MASK, status))
>  		return false;
>  
> +	fifo_entries = min(fifo_entries, ADXL367_FIFO_SIZE);
>  	fifo_entries -= fifo_entries % st->fifo_set_size;
>  
>  	ret = st->ops->read_fifo(st->context, st->fifo_buf, fifo_entries);
> 
> ---
> base-commit: 848acc8ffe1b7cd5f1bf427b93069becfebc2c9d
> change-id: 20260809-adxl367-fifo-clamp-50f2110e03f8
> 
> Best regards,