[PATCH] iio: light: adux1020: harden sampling frequency table lookup

[PATCH] iio: light: adux1020: harden sampling frequency table lookup

[Raffaele Tranfaglia via B4 Relay]

From: Raffaele Tranfaglia <raffaele.tranfaglia@gmail.com>

The proximity frequency field read from the FREQUENCY register is four
bits wide, so it can hold values from 0 to 15, but adux1020_rates[] only
has 14 entries. The driver never programs values 14 or 15, but if a
misbehaving device reports one of them, reading the sampling frequency
indexes past the end of the table and returns garbage.

Reject such values with -EINVAL instead of indexing past the end of
the table.

Signed-off-by: Raffaele Tranfaglia <raffaele.tranfaglia@gmail.com>
---
Found with LLM-assisted static analysis of drivers/iio, looking for
table lookups indexed by unchecked register fields; the fix was drafted
with the same assistant and reviewed and tested by me.

Tested on arm64 QEMU with i2c-stub and CONFIG_UBSAN_BOUNDS=y. After
setting the frequency field in FREQUENCY (0x40) to 14, reading
in_proximity_sampling_frequency:
- before: two array-index-out-of-bounds reports, and the attribute
  reads 0.025000
- after: the read fails with -EINVAL and no report is printed
---
 drivers/iio/light/adux1020.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/iio/light/adux1020.c b/drivers/iio/light/adux1020.c
index 0ea282ecc99a..d4281b9754c3 100644
--- a/drivers/iio/light/adux1020.c
+++ b/drivers/iio/light/adux1020.c
@@ -414,6 +414,10 @@ static int adux1020_read_raw(struct iio_dev *indio_dev,
 				goto fail;
 
 			regval = FIELD_GET(ADUX1020_PROX_FREQ_MASK, regval);
+			if (regval >= ARRAY_SIZE(adux1020_rates)) {
+				ret = -EINVAL;
+				goto fail;
+			}
 
 			*val = adux1020_rates[regval][0];
 			*val2 = adux1020_rates[regval][1];

---
base-commit: 20ce8ef9c9e04cd6c5ae0422e251a9b5936c6b7c
change-id: 20261104-adux1020-rate-bounds-61e3ff96e0f3

Best regards,
--  
Raffaele Tranfaglia <raffaele.tranfaglia@gmail.com>

Re: [PATCH] iio: light: adux1020: harden sampling frequency table lookup

[Jonathan Cameron]

On Wed, 04 Nov 2026 10:28:22 +0000
Raffaele Tranfaglia via B4 Relay <devnull+raffaele.tranfaglia.gmail.com@kernel.org> wrote:

> From: Raffaele Tranfaglia <raffaele.tranfaglia@gmail.com>
> 
> The proximity frequency field read from the FREQUENCY register is four
> bits wide, so it can hold values from 0 to 15, but adux1020_rates[] only
> has 14 entries. The driver never programs values 14 or 15, but if a
> misbehaving device reports one of them, reading the sampling frequency
> indexes past the end of the table and returns garbage.
> 
> Reject such values with -EINVAL instead of indexing past the end of
> the table.
> 
> Signed-off-by: Raffaele Tranfaglia <raffaele.tranfaglia@gmail.com>
Hi Raffaele

Change looks fine, but I'll not this code would benefit from use
of guard() to handle the locks if anyone wants to do that as a follow up.
From a quick glance, looks like it is a very straight forward change
for that type of modernization patch.

Applied this to the testing branch of iio.git.

thanks,

Jonathan

> ---
> Found with LLM-assisted static analysis of drivers/iio, looking for
> table lookups indexed by unchecked register fields; the fix was drafted
> with the same assistant and reviewed and tested by me.
> 
> Tested on arm64 QEMU with i2c-stub and CONFIG_UBSAN_BOUNDS=y. After
> setting the frequency field in FREQUENCY (0x40) to 14, reading
> in_proximity_sampling_frequency:
> - before: two array-index-out-of-bounds reports, and the attribute
>   reads 0.025000
> - after: the read fails with -EINVAL and no report is printed
> ---
>  drivers/iio/light/adux1020.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/iio/light/adux1020.c b/drivers/iio/light/adux1020.c
> index 0ea282ecc99a..d4281b9754c3 100644
> --- a/drivers/iio/light/adux1020.c
> +++ b/drivers/iio/light/adux1020.c
> @@ -414,6 +414,10 @@ static int adux1020_read_raw(struct iio_dev *indio_dev,
>  				goto fail;
>  
>  			regval = FIELD_GET(ADUX1020_PROX_FREQ_MASK, regval);
> +			if (regval >= ARRAY_SIZE(adux1020_rates)) {
> +				ret = -EINVAL;
> +				goto fail;
> +			}
>  
>  			*val = adux1020_rates[regval][0];
>  			*val2 = adux1020_rates[regval][1];
> 
> ---
> base-commit: 20ce8ef9c9e04cd6c5ae0422e251a9b5936c6b7c
> change-id: 20261104-adux1020-rate-bounds-61e3ff96e0f3
> 
> Best regards,
> --  
> Raffaele Tranfaglia <raffaele.tranfaglia@gmail.com>
> 
>