[PATCH] iio: proximity: sx9324: fix out-of-bounds read of scan

[PATCH] iio: proximity: sx9324: fix out-of-bounds read of scan

[Arnav Kapoor]

The scan period of the SX9324 is selected by the 5 bit wide
SX9324_REG_GNRL_CTRL0_SCANPERIOD field, so it has 32 possible values.
sx9324_scan_period_table[] however only has 16 entries, it was copied
over from the SX9310 driver where the field is only 4 bits wide.

sx9324_wait_for_sample() indexes the table with the raw field value, so
all the codes from 16 to 31 read past the end of the array. The default
value of the register is SX9324_REG_GNRL_CTRL0_SCANPERIOD_100MS (0x16,
i.e. 22), so the out-of-bounds read happens with the default
configuration of the device. It is only avoided when the device has an
interrupt line, as the wait is only done in the polling case.

The value read is then used as the duration of an msleep() call, so the
sensor is polled with a completely random delay.

Fill the table with the scan periods of all 32 codes, which are the
periods documented for the corresponding sx9324_samp_freq_table[]
entries, and add a static assertion to keep both tables in sync.

Signed-off-by: Arnav Kapoor <kapoorarnav43@gmail.com>
---
 drivers/iio/proximity/sx9324.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/proximity/sx9324.c b/drivers/iio/proximity/sx9324.c
index 13b4ef2896e3..36ab83d3f493 100644
--- a/drivers/iio/proximity/sx9324.c
+++ b/drivers/iio/proximity/sx9324.c
@@ -279,11 +279,20 @@ static const struct {
 	{ 0, 250000 },  /* 11111: 4 s */
 };
 
+/*
+ * The scan period of the SX9324 is selected by the 5 bit wide
+ * SX9324_REG_GNRL_CTRL0_SCANPERIOD field. The values below are the scan
+ * periods in ms of the corresponding sx9324_samp_freq_table[] entries.
+ */
 static const unsigned int sx9324_scan_period_table[] = {
-	2,   15,  30,  45,   60,   90,	 120,  200,
-	400, 600, 800, 1000, 2000, 3000, 4000, 5000,
+	1, 2, 4, 6, 8, 10, 14, 18, 22, 26, 30, 34, 38, 42, 46, 50,
+	56, 62, 68, 74, 80, 90, 100, 200, 300, 400, 600, 800, 1000,
+	2000, 3000, 4000,
 };
 
+static_assert(ARRAY_SIZE(sx9324_scan_period_table) ==
+	      ARRAY_SIZE(sx9324_samp_freq_table));
+
 static const struct regmap_range sx9324_writable_reg_ranges[] = {
 	/*
 	 * To set COMPSTAT for compensation, even if datasheet says register is

Re: [PATCH] iio: proximity: sx9324: fix out-of-bounds read of scan

[Andy Shevchenko]

On Thu, Oct 22, 2026 at 04:24:11AM +0530, Arnav Kapoor wrote:
> The scan period of the SX9324 is selected by the 5 bit wide
> SX9324_REG_GNRL_CTRL0_SCANPERIOD field, so it has 32 possible values.
> sx9324_scan_period_table[] however only has 16 entries, it was copied
> over from the SX9310 driver where the field is only 4 bits wide.
> 
> sx9324_wait_for_sample() indexes the table with the raw field value, so
> all the codes from 16 to 31 read past the end of the array. The default
> value of the register is SX9324_REG_GNRL_CTRL0_SCANPERIOD_100MS (0x16,
> i.e. 22), so the out-of-bounds read happens with the default
> configuration of the device. It is only avoided when the device has an
> interrupt line, as the wait is only done in the polling case.
> 
> The value read is then used as the duration of an msleep() call, so the
> sensor is polled with a completely random delay.
> 
> Fill the table with the scan periods of all 32 codes, which are the
> periods documented for the corresponding sx9324_samp_freq_table[]
> entries, and add a static assertion to keep both tables in sync.

...

>  static const unsigned int sx9324_scan_period_table[] = {
> -	2,   15,  30,  45,   60,   90,	 120,  200,
> -	400, 600, 800, 1000, 2000, 3000, 4000, 5000,
> +	1, 2, 4, 6, 8, 10, 14, 18, 22, 26, 30, 34, 38, 42, 46, 50,
> +	56, 62, 68, 74, 80, 90, 100, 200, 300, 400, 600, 800, 1000,
> +	2000, 3000, 4000,

NAK to this hunk.
Homework:
read my comments regarding formatting such arrays in linux-iio@ mailing list
for last calendar year or so and summarize the idea.

>  };

...

> +static_assert(ARRAY_SIZE(sx9324_scan_period_table) ==
> +	      ARRAY_SIZE(sx9324_samp_freq_table));

This is fine, but I would dare make it a single line.

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH] iio: proximity: sx9324: fix out-of-bounds read of scan

[Arnav Kapoor]

On Thu, Oct 22, 2026 at 07:40:29PM +0300, Andy Shevchenko wrote:
> NAK to this hunk.
> Homework:
> read my comments regarding formatting such arrays in linux-iio@ mailing list
> for last calendar year or so and summarize the idea.

Understood. I'll go through your comments on linux-iio about formatting
such tables and redo the array accordingly in v2.

> > +static_assert(ARRAY_SIZE(sx9324_scan_period_table) ==
> > +	      ARRAY_SIZE(sx9324_samp_freq_table));
>
> This is fine, but I would dare make it a single line.

Will do.

Thanks for the review,
Arnav