[PATCH] iio: light: adux1020: harden sampling frequency table lookup

[Raffaele Tranfaglia via B4 Relay <devnull+raffaele.tranfaglia.gmail.com@kernel.org>]

From: Raffaele Tranfaglia <raffaele.tranfaglia@gmail.com>

The proximity frequency field read from the FREQUENCY register is four
bits wide, so it can hold values from 0 to 15, but adux1020_rates[] only
has 14 entries. The driver never programs values 14 or 15, but if a
misbehaving device reports one of them, reading the sampling frequency
indexes past the end of the table and returns garbage.

Reject such values with -EINVAL instead of indexing past the end of
the table.

Signed-off-by: Raffaele Tranfaglia <raffaele.tranfaglia@gmail.com>
---
Found with LLM-assisted static analysis of drivers/iio, looking for
table lookups indexed by unchecked register fields; the fix was drafted
with the same assistant and reviewed and tested by me.

Tested on arm64 QEMU with i2c-stub and CONFIG_UBSAN_BOUNDS=y. After
setting the frequency field in FREQUENCY (0x40) to 14, reading
in_proximity_sampling_frequency:
- before: two array-index-out-of-bounds reports, and the attribute
  reads 0.025000
- after: the read fails with -EINVAL and no report is printed
---
 drivers/iio/light/adux1020.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/iio/light/adux1020.c b/drivers/iio/light/adux1020.c
index 0ea282ecc99a..d4281b9754c3 100644
--- a/drivers/iio/light/adux1020.c
+++ b/drivers/iio/light/adux1020.c
@@ -414,6 +414,10 @@ static int adux1020_read_raw(struct iio_dev *indio_dev,
 				goto fail;
 
 			regval = FIELD_GET(ADUX1020_PROX_FREQ_MASK, regval);
+			if (regval >= ARRAY_SIZE(adux1020_rates)) {
+				ret = -EINVAL;
+				goto fail;
+			}
 
 			*val = adux1020_rates[regval][0];
 			*val2 = adux1020_rates[regval][1];

---
base-commit: 20ce8ef9c9e04cd6c5ae0422e251a9b5936c6b7c
change-id: 20261104-adux1020-rate-bounds-61e3ff96e0f3

Best regards,
--  
Raffaele Tranfaglia <raffaele.tranfaglia@gmail.com>