Re: [PATCH] iio: light: al3010: fix out-of-bounds read of the scale table

[Jonathan Cameron]

On Tue, 3 Nov 2026 14:00:55 +0100
Joshua Crofts <crofts@xxxxxxxxxx> wrote:

> On Tue, 03 Nov 2026 08:42:48 +0000
> Raffaele Tranfaglia via B4 Relay <devnull+raffaele.tranfaglia.gmail.com@xxxxxxxxxx> wrote:
> 
> > From: Raffaele Tranfaglia <raffaele.tranfaglia@xxxxxxxxx>
> > 
> > The gain field read from the CONFIG register is three bits wide, so it
> > can hold values from 0 to 7, but al3010_scales[] only has four entries.
> > If the register holds a gain value of 4 or more, reading the scale
> > attribute indexes past the end of the table and returns garbage.
> > 
> > Reject such values with -EINVAL instead of indexing past the end of
> > the table.
> > 
> > Fixes: c36b5195ab70 ("iio: light: add Dyna-Image AL3010 driver")
Dropped the fixes tag.  This is hardening against buggy hardware
rather than fixing an issue anyone should encounter with a correctly
functioning device.

I don't mind such hardening (when simple and maintainable which 
your example here is) but I don't want to mark them as fixes
as that tends to trigger backporting which may not be appropriate.

Applied to the testing branch of iio.git with that tag dropped.

Jonathan

> > Signed-off-by: Raffaele Tranfaglia <raffaele.tranfaglia@xxxxxxxxx>
> > ---
> > Found with LLM-assisted static analysis of drivers/iio, looking for
> > table lookups indexed by unchecked register fields; the fix was drafted
> > with the same assistant and reviewed and tested by me.
> > 
> > Tested on arm64 QEMU with i2c-stub and CONFIG_UBSAN_BOUNDS=y. After
> > writing a gain value of 4 to CONFIG (0x10), reading
> > in_illuminance_scale:
> > - before: two array-index-out-of-bounds reports (al3010.c:137 and
> >   :138), and the attribute reads 0.000000
> > - after: the read fails with -EINVAL and no report is printed
> > ---  
> 
> Reviewed-by: Joshua Crofts <crofts@xxxxxxxxxx>
>