[PATCH] iio: light: hid-sensor-als: Don't read past the end of short fields

[PATCH] iio: light: hid-sensor-als: Don't read past the end of short fields

[Daniel Schaefer via B4 Relay]

From: Daniel Schaefer <dhs@frame.work>

Reports are not guaranteed to be 4 bytes.
On color ALS sensors there are fields that can be shorter than 4 bytes:
16-bit illuminance, color temperature and chromaticity x/y.

I don't have such a sensor right now, but I have emulated one in
firmware. With this patch, no garbage data is read from the next report:

  before: 05dc02bc 05dc02bc 190005dc 0ce41900 00000ce4
  after:  000002bc 000002bc 000005dc 00001900 00000ce4

Same fix as commit ad02ca57e44e ("iio: hid-sensor-prox: Add support for
16-bit report size").

Fixes: ed5514c925a0 ("iio: hid-sensors: Added ALS")
Signed-off-by: Daniel Schaefer <dhs@frame.work>
---
Tested on an emulated sensor with 2 byte reports that is correctly recognized
by Windows.

Cc: Sven Vainküla <sven@xn--vainkla-r2a.ee>
---
 drivers/iio/light/hid-sensor-als.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/light/hid-sensor-als.c b/drivers/iio/light/hid-sensor-als.c
index 929343e42d83..00dfc2037c19 100644
--- a/drivers/iio/light/hid-sensor-als.c
+++ b/drivers/iio/light/hid-sensor-als.c
@@ -267,7 +267,21 @@ static int als_capture_sample(struct hid_sensor_hub_device *hsdev,
 	struct iio_dev *indio_dev = platform_get_drvdata(priv);
 	struct als_state *als_state = iio_priv(indio_dev);
 	int ret = -EINVAL;
-	u32 sample_data = *(u32 *)raw_data;
+	u32 sample_data;
+
+	switch (raw_len) {
+	case 1:
+		sample_data = *(u8 *)raw_data;
+		break;
+	case 2:
+		sample_data = *(u16 *)raw_data;
+		break;
+	default:
+		if (raw_len < sizeof(u32))
+			return -EINVAL;
+		sample_data = *(u32 *)raw_data;
+		break;
+	}
 
 	switch (usage_id) {
 	case HID_USAGE_SENSOR_LIGHT_ILLUM:

---
base-commit: 09f742b49cb2728086d78be2b0b35e4d1d71fc85
change-id: 20261027-iio-als-overread-c9e538fa61fa

Best regards,
-- 
Daniel Schaefer <dhs@frame.work>

Re: [PATCH] iio: light: hid-sensor-als: Don't read past the end of short fields

[Jonathan Cameron]

On Tue, 27 Oct 2026 18:58:39 +0800
Daniel Schaefer via B4 Relay <devnull+dhs.frame.work@kernel.org> wrote:

> From: Daniel Schaefer <dhs@frame.work>
> 
> Reports are not guaranteed to be 4 bytes.
> On color ALS sensors there are fields that can be shorter than 4 bytes:
> 16-bit illuminance, color temperature and chromaticity x/y.
> 
> I don't have such a sensor right now, but I have emulated one in
> firmware. With this patch, no garbage data is read from the next report:
> 
>   before: 05dc02bc 05dc02bc 190005dc 0ce41900 00000ce4
>   after:  000002bc 000002bc 000005dc 00001900 00000ce4
> 
> Same fix as commit ad02ca57e44e ("iio: hid-sensor-prox: Add support for
> 16-bit report size").
> 
> Fixes: ed5514c925a0 ("iio: hid-sensors: Added ALS")
> Signed-off-by: Daniel Schaefer <dhs@frame.work>
Hi Daniel,

Seems in line with the referenced commit and to make sense to me.
So I'll pick this up now - however still time for more reviews as
I'll need to rebase on rc1 anyway in the next few days.

Applied to the fixes-togreg branch of iio.git

Thanks,

Jonathan

> ---
> Tested on an emulated sensor with 2 byte reports that is correctly recognized
> by Windows.
> 
> Cc: Sven Vainküla <sven@xn--vainkla-r2a.ee>
> ---
>  drivers/iio/light/hid-sensor-als.c | 16 +++++++++++++++-
>  1 file changed, 15 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/light/hid-sensor-als.c b/drivers/iio/light/hid-sensor-als.c
> index 929343e42d83..00dfc2037c19 100644
> --- a/drivers/iio/light/hid-sensor-als.c
> +++ b/drivers/iio/light/hid-sensor-als.c
> @@ -267,7 +267,21 @@ static int als_capture_sample(struct hid_sensor_hub_device *hsdev,
>  	struct iio_dev *indio_dev = platform_get_drvdata(priv);
>  	struct als_state *als_state = iio_priv(indio_dev);
>  	int ret = -EINVAL;
> -	u32 sample_data = *(u32 *)raw_data;
> +	u32 sample_data;
> +
> +	switch (raw_len) {
> +	case 1:
> +		sample_data = *(u8 *)raw_data;
> +		break;
> +	case 2:
> +		sample_data = *(u16 *)raw_data;
> +		break;
> +	default:
> +		if (raw_len < sizeof(u32))
> +			return -EINVAL;
> +		sample_data = *(u32 *)raw_data;
> +		break;
> +	}
>  
>  	switch (usage_id) {
>  	case HID_USAGE_SENSOR_LIGHT_ILLUM:
> 
> ---
> base-commit: 09f742b49cb2728086d78be2b0b35e4d1d71fc85
> change-id: 20261027-iio-als-overread-c9e538fa61fa
> 
> Best regards,