Re: [PATCH v3 2/2] iio: proximity: sx9360: reject out-of-range hardware gain values

[Jonathan Cameron <jic23@kernel.org>]

On Wed, 11 Nov 2026 22:10:37 +0530
Arnav Kapoor <kapoorarnav43@gmail.com> wrote:

> sx9360_write_gain() passes the value from userspace to ilog2() and then
> FIELD_PREP() into the 3-bit PROX_CTRL0 gain field without checking it,
> so some values silently program a gain unrelated to the one requested,
> and the write still reports success:
> 
>   - 16 to 255 write gain codes 4 to 7, which the driver does not
>     advertise, and the next read reports gains of 16 to 128;
>   - 256 and larger wrap around in the field, e.g. 256 sets a gain of 1;
>   - 0 and negative values write code 7 (read back as 128), because
>     ilog2(0) is -1 and a negative int becomes a large unsigned value.
> 
> Return -ERANGE for values <= 0 and for values above the gain of 8 code.
> FIELD_FIT() is not enough here, as the field also holds codes 4 to 7,
> which the driver doesn't support. Values between the supported gains
> of 1, 2, 4 and 8 are still rounded down, as before.
> 
> Fixes: 1cdb4c47f7f5 ("iio:proximity:sx9360: Add sx9360 support")
> Signed-off-by: Arnav Kapoor <kapoorarnav43@gmail.com>
The whole off by one thing you had an RFC for can be handled
on top of this which is just making sure existing values actually
fit etc.

Applied to the testing branch of iio.git.

Thanks,

Jonathan

> ---
>  drivers/iio/proximity/sx9360.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/iio/proximity/sx9360.c b/drivers/iio/proximity/sx9360.c
> index 2a9b37df8f62..22b6b751c0a3 100644
> --- a/drivers/iio/proximity/sx9360.c
> +++ b/drivers/iio/proximity/sx9360.c
> @@ -68,6 +68,7 @@
>  #define SX9360_REG_PROX_CTRL0_PHM	0x41
>  #define SX9360_REG_PROX_CTRL0_GAIN_MASK	GENMASK(5, 3)
>  #define SX9360_REG_PROX_CTRL0_GAIN_1		0x80
> +#define SX9360_REG_PROX_CTRL0_GAIN_8		0x3
>  #define SX9360_REG_PROX_CTRL0_RAWFILT_MASK	GENMASK(2, 0)
>  #define SX9360_REG_PROX_CTRL0_RAWFILT_1P50	0x01
>  #define SX9360_REG_PROX_CTRL1		0x42
> @@ -625,7 +626,13 @@ static int sx9360_write_gain(struct sx_common_data *data,
>  {
>  	unsigned int gain, reg;
>  
> +	if (val <= 0)
> +		return -ERANGE;
> +
>  	gain = ilog2(val);
> +	if (gain > SX9360_REG_PROX_CTRL0_GAIN_8)
> +		return -ERANGE;
> +
>  	reg = SX9360_REG_PROX_CTRL0_PHR + chan->channel;
>  	gain = FIELD_PREP(SX9360_REG_PROX_CTRL0_GAIN_MASK, gain);
>