Re: [PATCH] iio: light: hid-sensor-als: Don't read past the end of short fields

[Jonathan Cameron <jic23@kernel.org>]

On Tue, 27 Oct 2026 18:58:39 +0800
Daniel Schaefer via B4 Relay <devnull+dhs.frame.work@kernel.org> wrote:

> From: Daniel Schaefer <dhs@frame.work>
> 
> Reports are not guaranteed to be 4 bytes.
> On color ALS sensors there are fields that can be shorter than 4 bytes:
> 16-bit illuminance, color temperature and chromaticity x/y.
> 
> I don't have such a sensor right now, but I have emulated one in
> firmware. With this patch, no garbage data is read from the next report:
> 
>   before: 05dc02bc 05dc02bc 190005dc 0ce41900 00000ce4
>   after:  000002bc 000002bc 000005dc 00001900 00000ce4
> 
> Same fix as commit ad02ca57e44e ("iio: hid-sensor-prox: Add support for
> 16-bit report size").
> 
> Fixes: ed5514c925a0 ("iio: hid-sensors: Added ALS")
> Signed-off-by: Daniel Schaefer <dhs@frame.work>
Hi Daniel,

Seems in line with the referenced commit and to make sense to me.
So I'll pick this up now - however still time for more reviews as
I'll need to rebase on rc1 anyway in the next few days.

Applied to the fixes-togreg branch of iio.git

Thanks,

Jonathan

> ---
> Tested on an emulated sensor with 2 byte reports that is correctly recognized
> by Windows.
> 
> Cc: Sven Vainküla <sven@xn--vainkla-r2a.ee>
> ---
>  drivers/iio/light/hid-sensor-als.c | 16 +++++++++++++++-
>  1 file changed, 15 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/light/hid-sensor-als.c b/drivers/iio/light/hid-sensor-als.c
> index 929343e42d83..00dfc2037c19 100644
> --- a/drivers/iio/light/hid-sensor-als.c
> +++ b/drivers/iio/light/hid-sensor-als.c
> @@ -267,7 +267,21 @@ static int als_capture_sample(struct hid_sensor_hub_device *hsdev,
>  	struct iio_dev *indio_dev = platform_get_drvdata(priv);
>  	struct als_state *als_state = iio_priv(indio_dev);
>  	int ret = -EINVAL;
> -	u32 sample_data = *(u32 *)raw_data;
> +	u32 sample_data;
> +
> +	switch (raw_len) {
> +	case 1:
> +		sample_data = *(u8 *)raw_data;
> +		break;
> +	case 2:
> +		sample_data = *(u16 *)raw_data;
> +		break;
> +	default:
> +		if (raw_len < sizeof(u32))
> +			return -EINVAL;
> +		sample_data = *(u32 *)raw_data;
> +		break;
> +	}
>  
>  	switch (usage_id) {
>  	case HID_USAGE_SENSOR_LIGHT_ILLUM:
> 
> ---
> base-commit: 09f742b49cb2728086d78be2b0b35e4d1d71fc85
> change-id: 20261027-iio-als-overread-c9e538fa61fa
> 
> Best regards,