From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f42.google.com (mail-wm1-f42.google.com [209.85.128.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8ED8B1A682C for ; Thu, 6 Aug 2026 07:01:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785999679; cv=none; b=Z6WTXxWw3X8Dc3h3Uq7foOYlmj0NB4u1akjcX7vDR786ZrLQEKZIWg3roHbBw2NhZt3CLU9oW0hX5K3JdN/eZm0AkYuqWAUDIFiNv6Y60ZDPfemzppNq6K5hQxgLM3mxZH0NPSBm4Tjvw5X42SiPli3U8TDE2f049HiBlrzBkuc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785999679; c=relaxed/simple; bh=FUr7+8XCM9C5LQXFrSAbnj32rYDp2mpjf3Wil/NUWOU=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=iucGrj3M1bf13ORLz+X4XSnzCwjhclKraAGmaaoBRpfqOhwG9cqGYmSzujBTUgQ8CT1q3y7mnqerctdwa9Gt3zujAAxpG/rkKj+5/6tiZDhnjmr0AjtGNFe6YOHND90KzX+JefjsnQ5ltOmFptE/RtKeOOvqwewAFPUX8p8b8Vs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=fPfppkF8; arc=none smtp.client-ip=209.85.128.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="fPfppkF8" Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-4994c49f588so5893145e9.0 for ; Thu, 06 Aug 2026 00:01:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785999676; x=1786604476; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=JHCjuqA116INNULVQeMYQUxLnjzVId5qnDvtMozvW48=; b=fPfppkF817BmEWc6e+IgcHn3Op7T50+Eu9QJSzeOaQbcD+Zbbrv6WtX85PHi+/DYrn ePMie01YBtdF+WuGWde9xdlD82toRfXPGC0glG/lpgoNmA4126DzcrT0uhMvtim+Pix5 lagHY14/hjdXPHNPxiStGGXehYnwR2tyq5js8Iq0Tq7bRXqxbszIWbx8MqKLY5r+P6W0 qgeKAMvf6nHEDsHko7J6aMUc1ZTayBDKz9VaM/0Nfq9zNuF58aQfIZJPLX9scDD010vJ 3cijRQ1F7JahJNJRpUs0SU0i2talE+5O2OVWvnjav5AgvwfzYYisuUMjdppviIXz522S g3xA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785999676; x=1786604476; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=JHCjuqA116INNULVQeMYQUxLnjzVId5qnDvtMozvW48=; b=gW4xW0DELGcDk04IwUaJI/Jn/anbTGYxB721R/jhvAUpAAqh+B7//nMOLHdDWi6a0i sofd9mr6tSVMyu8GhcGUfq0JXW5p27phNpYQFNJ7a0cPKoDZZbIoz6g0ke/+7ylH9Y0A qrgJvMVr1ptNHv+1phpzBRAGB+EPcnDbThVu4yIbTK4Lj9EPocrPur1GhH0a2oTZctdY wBTvoPCF4OgxpF5tL95WePud1cJH7JEwWWxSzIKUWRYuKmLDCTj9yKMNJ+p9bO7ej3DR 8N4wZkqeHXIkma0+AlyOKnz5sMrthYOxQbV0SOcmd9xXZ0K/TYXvBDcGFdMh7AF/YeNe qymA== X-Forwarded-Encrypted: i=1; AHgh+Rq/KlTD3YyV7QeD5ljBBpfXiTf3HO26ZXqiYWRn+P3gKgSmPQP/4eKAByoBZuuID0cPmeXSWcWe5ltZfMQ=@vger.kernel.org X-Gm-Message-State: AOJu0YxVxwPNcskUapfnqR7P0pc/KA42IJBulKZ3O4x3FUIyKjj/wrGa spoDkt+nJhUY9B/3q+jotAGzBXKTleFV6Z88Ej8bpnDdnynR7KE2jZwT X-Gm-Gg: AR+sD12v19GXbLUgL0ql1tnsMET60cVEF2dV9EHNq0H7yONyZOS+5ygWWjErca9p/oA ZEc3/x8tY4Qn1QS0FVUTQ1/57mebEKDrs5H6lxXqdobeYcqKUC4loMaEfSY7VgTV8OjTCzQgbGX hZmstaUkE1i8yCO4eI2ibUAOprJZ5bryV3738G8vVrzUQh7ift6TDutGv1rnggFy3f5R6db2C9R GHpxGWfAwtBYj7O8k2AUQorISNXUS2PUFdee664MfiXWQqLmyYx53p5/iD3Mv8glR0Ulb/dxmXW vs9LG8N9WIA/M2KQij1pUm4xFUcX+F8bYkrUZj+vXsJKq5DwprnR28VF/lt/m1VNWmSyOuyjBIh NZAICWJxD+iQi1XYo1pwPaLcLAB03bE8FrY3MUK0xltfPpML43ufeJSgvQuSr1RLFIIqr3Vanq5 UgaNVVvETqACNdkKKKih15rgmA7msFmUr2FGsQw0tHRk3a70gwLLJL0+wWesO8aV3rI2YALjoRf h+4ZYtZEwSBlS1S0uo5vJQ+l1ljIGrzGftdRZ8ZDUUEu8NKUDcRvSB3lzG287Smlxq56NpR8yoS E3Vy11s2kyuAlG9hXiPKuNw3FD6Syx5sSdqmhzfF6Pyn2OTSegzoK7y2972UKU1dYxtKxlxxhcO 0o+WOrJgmDgkLrERvgYeihciYSHA44lJeDm64wZ1iAl/Doxu/7BkHrwUk X-Received: by 2002:a05:600c:3542:b0:494:1f7:8057 with SMTP id 5b1f17b1804b1-499553bccc0mr21135755e9.1.1785999675699; Thu, 06 Aug 2026 00:01:15 -0700 (PDT) Received: from localhost (90-182-112-124.rcp.o2.cz. [90.182.112.124]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4995427a244sm36121895e9.10.2026.08.06.00.01.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 06 Aug 2026 00:01:14 -0700 (PDT) Date: Thu, 6 Aug 2026 09:01:11 +0200 From: Joshua Crofts To: Hui Su Cc: jic23@kernel.org, dlechner@baylibre.com, nuno.sa@analog.com, andy@kernel.org, linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH] iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup Message-ID: <20260806090105.000059c9@gmail.com> In-Reply-To: <20260805074127.473731-1-sh_def@163.com> References: <20260805074127.473731-1-sh_def@163.com> X-Mailer: Claws Mail 4.4.0 (GTK 3.24.51; x86_64-w64-mingw32) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Wed, 5 Aug 2026 15:41:27 +0800 Hui Su wrote: > The sampling frequency tables store each frequency as an integer part > and a fractional part in micro units. num_sampling_freq_avail is > initialized to the number of flattened integer elements because > read_avail() returns the table as a flat array. > > bmp280_write_sampling_frequency(), however, indexes the same table as a > two-dimensional array and uses num_sampling_freq_avail as the number of > rows. This makes the lookup walk past the end of the table when an > unsupported sampling frequency is written. > > Convert the flattened element count back to the number of rows before > iterating over the table. > > Fixes: 10b40ffba2f9 ("iio: pressure: bmp280: Add more tunable config parameters for BMP380") > Cc: stable@vger.kernel.org > Signed-off-by: Hui Su > --- LGTM Reviewed-by: Joshua Crofts -- Kind regards, Joshua Crofts