Re: [PATCH v3 0/2] iio: adc: xilinx-ams: fix out-of-bounds accesses when parsing channels

[Jonathan Cameron]

On Wed,  4 Nov 2026 22:14:59 +0530
Arnav Kapoor <kapoorarnav43@xxxxxxxxx> wrote:

> The driver sizes its channel array for 10 fixed and 21 external PL
> channels, but accepts external channel nodes numbered 20 to 50, and it
> never checks the remaining room while filling the array. Channels 20 to
> 29 are the fixed ones, so listing them adds duplicates and overflows
> the array.
> 
> Patch 1 limits the external channels in the binding to 30-50, as Sai
> pointed out. Patch 2 does the same in the driver and adds the bounds
> checks from v2.

Applied with the fixes tag for dt binding dropped.  
Note I'll take this the slow way so this will only merge next
cycle.

Thanks,

Jonathan

> 
> Changes in v3:
> - New patch 1: limit the binding to channels 30-50 (Sai)
> - Patch 2: only accept channels 30-50, so a channel node can no longer
>   duplicate a fixed channel (Sai), and add a static_assert() that
>   ams_pl_channels[] holds the fixed plus the external channels
> - Patch 2: rework the commit message around the duplicate channels
> - Rebase on fixes-togreg (now on 7.4-rc1)
> 
> v2: https://lore.kernel.org/all/20261023185652.195025-1-kapoorarnav43@xxxxxxxxx/
> v1: https://lore.kernel.org/all/20261021225356.625288-1-kapoorarnav43@xxxxxxxxx/
> 
> Compile-tested only (W=1); I don't have ZynqMP hardware. dt_binding_check
> passes, and rejects a channel@25 node in the example.
> 
> Arnav Kapoor (2):
>   dt-bindings: iio: adc: xlnx,zynqmp-ams: limit external channels to
>     30-50
>   iio: adc: xilinx-ams: fix out-of-bounds accesses when parsing channels
> 
>  .../bindings/iio/adc/xlnx,zynqmp-ams.yaml     |  7 ++-
>  drivers/iio/adc/xilinx-ams.c                  | 57 +++++++++++++++----
>  2 files changed, 50 insertions(+), 14 deletions(-)
> 
> 
> base-commit: c293f0db308fe76a0a9b0f6674cd2dea149b03aa