[PATCH] iio: light: hid-sensor-als: Don't read past the end of short fields

[PATCH] iio: light: hid-sensor-als: Don't read past the end of short fields

[Daniel Schaefer via B4 Relay]

From: Daniel Schaefer <dhs@frame.work>

Reports are not guaranteed to be 4 bytes.
On color ALS sensors there are fields that can be shorter than 4 bytes:
16-bit illuminance, color temperature and chromaticity x/y.

I don't have such a sensor right now, but I have emulated one in
firmware. With this patch, no garbage data is read from the next report:

  before: 05dc02bc 05dc02bc 190005dc 0ce41900 00000ce4
  after:  000002bc 000002bc 000005dc 00001900 00000ce4

Same fix as commit ad02ca57e44e ("iio: hid-sensor-prox: Add support for
16-bit report size").

Fixes: ed5514c925a0 ("iio: hid-sensors: Added ALS")
Signed-off-by: Daniel Schaefer <dhs@frame.work>
---
Tested on an emulated sensor with 2 byte reports that is correctly recognized
by Windows.

Cc: Sven Vainküla <sven@xn--vainkla-r2a.ee>
---
 drivers/iio/light/hid-sensor-als.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/light/hid-sensor-als.c b/drivers/iio/light/hid-sensor-als.c
index 929343e42d83..00dfc2037c19 100644
--- a/drivers/iio/light/hid-sensor-als.c
+++ b/drivers/iio/light/hid-sensor-als.c
@@ -267,7 +267,21 @@ static int als_capture_sample(struct hid_sensor_hub_device *hsdev,
 	struct iio_dev *indio_dev = platform_get_drvdata(priv);
 	struct als_state *als_state = iio_priv(indio_dev);
 	int ret = -EINVAL;
-	u32 sample_data = *(u32 *)raw_data;
+	u32 sample_data;
+
+	switch (raw_len) {
+	case 1:
+		sample_data = *(u8 *)raw_data;
+		break;
+	case 2:
+		sample_data = *(u16 *)raw_data;
+		break;
+	default:
+		if (raw_len < sizeof(u32))
+			return -EINVAL;
+		sample_data = *(u32 *)raw_data;
+		break;
+	}
 
 	switch (usage_id) {
 	case HID_USAGE_SENSOR_LIGHT_ILLUM:

---
base-commit: 09f742b49cb2728086d78be2b0b35e4d1d71fc85
change-id: 20261027-iio-als-overread-c9e538fa61fa

Best regards,
-- 
Daniel Schaefer <dhs@frame.work>