[PATCH] iio: imu: inv_icm45600: clamp FIFO packet count to buffer size

[Linkai Gong]

The IRQ path calls inv_icm45600_buffer_fifo_read(st, 0), so the raw
16-bit FIFO count sizes the read into st->fifo.data (8K). Cap the
packet count so the transfer cannot exceed that buffer.

Fixes: 06674a72cf7a ("iio: imu: inv_icm45600: add buffer support in iio devices")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Linkai Gong <gonglinkai@xxxxxxxxxx>
---
 drivers/iio/imu/inv_icm45600/inv_icm45600_buffer.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/imu/inv_icm45600/inv_icm45600_buffer.c b/drivers/iio/imu/inv_icm45600/inv_icm45600_buffer.c
index 2b9ea317385c..62e9e138bc89 100644
--- a/drivers/iio/imu/inv_icm45600/inv_icm45600_buffer.c
+++ b/drivers/iio/imu/inv_icm45600/inv_icm45600_buffer.c
@@ -419,8 +419,10 @@ int inv_icm45600_buffer_fifo_read(struct inv_icm45600_state *st,
 	fifo_nb = le16_to_cpup(raw_fifo_count);
 	if (fifo_nb == 0)
 		return 0;
-	if (max > 0 && fifo_nb > max)
-		fifo_nb = max;
+	if (max > 0)
+		fifo_nb = min(fifo_nb, (size_t)max);
+	fifo_nb = min_t(size_t, fifo_nb,
+			INV_ICM45600_FIFO_SIZE_MAX / packet_size);
 
 	/* Try to read all FIFO data in internal buffer. */
 	st->fifo.count = fifo_nb * packet_size;
-- 
2.25.1