[PATCH v3 0/2] iio: proximity: sx9310/sx9360: reject out-of-range hardware gain values

[PATCH v3 0/2] iio: proximity: sx9310/sx9360: reject out-of-range hardware gain values

[Arnav Kapoor]

sx9310_write_gain() and sx9360_write_gain() squeeze ilog2() of any
integer into the register field. Values that don't fit wrap around,
and 0 and negative values turn into the maximum code, while the write
reports success. Reject those. One patch per driver, as the Fixes tags
differ.

Changes in v3:
- Return -ERANGE instead of -EINVAL (Andy)

Changes in v2:
- Keep rounding values between the supported gains down, instead of
  rejecting them, so the ABI doesn't change (Jonathan)
- Only reject values <= 0 and values that don't fit: FIELD_FIT() for
  sx9310 (Jonathan); sx9360 checks against the gain of 8 code, as its
  3-bit field also holds codes 4 to 7, which the driver doesn't support

v2: https://lore.kernel.org/all/20261109165200.305266-1-kapoorarnav43@gmail.com/
v1: https://lore.kernel.org/all/20261107111710.442318-1-kapoorarnav43@gmail.com/

Compile-tested only (W=1); I don't have SX9310 or SX9360 hardware.

Arnav Kapoor (2):
  iio: proximity: sx9310: reject out-of-range hardware gain values
  iio: proximity: sx9360: reject out-of-range hardware gain values

 drivers/iio/proximity/sx9310.c | 7 +++++++
 drivers/iio/proximity/sx9360.c | 7 +++++++
 2 files changed, 14 insertions(+)


base-commit: 340d44bdf9db0f095f99845b5ad8628781d79b6f
-- 
2.53.0

[PATCH v3 1/2] iio: proximity: sx9310: reject out-of-range hardware gain values

[Arnav Kapoor]

sx9310_write_gain() passes the value from userspace to ilog2() and then
FIELD_PREP() into a 2-bit gain field without checking it, so some
values silently program a gain unrelated to the one requested, and the
write still reports success:

  - 16 and larger wrap around in the 2-bit field, e.g. 16 sets a gain
    of 1 and 32 a gain of 2;
  - 0 and negative values set the maximum gain of 8, because ilog2(0)
    is -1 and a negative int becomes a large unsigned value.

Return -ERANGE for values <= 0 and for values whose ilog2() does not
fit in the gain field. Values between the supported gains of 1, 2, 4
and 8 are still rounded down, as before, and the gain read back
reflects what was applied.

Fixes: 227c83faa2f8 ("iio: sx9310: Support hardware gain factor")
Signed-off-by: Arnav Kapoor <kapoorarnav43@gmail.com>
---
 drivers/iio/proximity/sx9310.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/iio/proximity/sx9310.c b/drivers/iio/proximity/sx9310.c
index 2585b9c6fb69..f0280b79b56f 100644
--- a/drivers/iio/proximity/sx9310.c
+++ b/drivers/iio/proximity/sx9310.c
@@ -665,16 +665,23 @@ static int sx9310_write_gain(struct sx_common_data *data,
 {
 	unsigned int gain, mask;
 
+	if (val <= 0)
+		return -ERANGE;
+
 	gain = ilog2(val);
 
 	switch (chan->channel) {
 	case 0:
 	case 3:
+		if (!FIELD_FIT(SX9310_REG_PROX_CTRL3_GAIN0_MASK, gain))
+			return -ERANGE;
 		mask = SX9310_REG_PROX_CTRL3_GAIN0_MASK;
 		gain = FIELD_PREP(SX9310_REG_PROX_CTRL3_GAIN0_MASK, gain);
 		break;
 	case 1:
 	case 2:
+		if (!FIELD_FIT(SX9310_REG_PROX_CTRL3_GAIN12_MASK, gain))
+			return -ERANGE;
 		mask = SX9310_REG_PROX_CTRL3_GAIN12_MASK;
 		gain = FIELD_PREP(SX9310_REG_PROX_CTRL3_GAIN12_MASK, gain);
 		break;
-- 
2.53.0

[PATCH v3 2/2] iio: proximity: sx9360: reject out-of-range hardware gain values

[Arnav Kapoor]

sx9360_write_gain() passes the value from userspace to ilog2() and then
FIELD_PREP() into the 3-bit PROX_CTRL0 gain field without checking it,
so some values silently program a gain unrelated to the one requested,
and the write still reports success:

  - 16 to 255 write gain codes 4 to 7, which the driver does not
    advertise, and the next read reports gains of 16 to 128;
  - 256 and larger wrap around in the field, e.g. 256 sets a gain of 1;
  - 0 and negative values write code 7 (read back as 128), because
    ilog2(0) is -1 and a negative int becomes a large unsigned value.

Return -ERANGE for values <= 0 and for values above the gain of 8 code.
FIELD_FIT() is not enough here, as the field also holds codes 4 to 7,
which the driver doesn't support. Values between the supported gains
of 1, 2, 4 and 8 are still rounded down, as before.

Fixes: 1cdb4c47f7f5 ("iio:proximity:sx9360: Add sx9360 support")
Signed-off-by: Arnav Kapoor <kapoorarnav43@gmail.com>
---
 drivers/iio/proximity/sx9360.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/iio/proximity/sx9360.c b/drivers/iio/proximity/sx9360.c
index 2a9b37df8f62..22b6b751c0a3 100644
--- a/drivers/iio/proximity/sx9360.c
+++ b/drivers/iio/proximity/sx9360.c
@@ -68,6 +68,7 @@
 #define SX9360_REG_PROX_CTRL0_PHM	0x41
 #define SX9360_REG_PROX_CTRL0_GAIN_MASK	GENMASK(5, 3)
 #define SX9360_REG_PROX_CTRL0_GAIN_1		0x80
+#define SX9360_REG_PROX_CTRL0_GAIN_8		0x3
 #define SX9360_REG_PROX_CTRL0_RAWFILT_MASK	GENMASK(2, 0)
 #define SX9360_REG_PROX_CTRL0_RAWFILT_1P50	0x01
 #define SX9360_REG_PROX_CTRL1		0x42
@@ -625,7 +626,13 @@ static int sx9360_write_gain(struct sx_common_data *data,
 {
 	unsigned int gain, reg;
 
+	if (val <= 0)
+		return -ERANGE;
+
 	gain = ilog2(val);
+	if (gain > SX9360_REG_PROX_CTRL0_GAIN_8)
+		return -ERANGE;
+
 	reg = SX9360_REG_PROX_CTRL0_PHR + chan->channel;
 	gain = FIELD_PREP(SX9360_REG_PROX_CTRL0_GAIN_MASK, gain);
 
-- 
2.53.0

Re: [PATCH v3 0/2] iio: proximity: sx9310/sx9360: reject out-of-range hardware gain values

[Andy Shevchenko]

On Wed, Nov 11, 2026 at 10:10:35PM +0530, Arnav Kapoor wrote:
> sx9310_write_gain() and sx9360_write_gain() squeeze ilog2() of any
> integer into the register field. Values that don't fit wrap around,
> and 0 and negative values turn into the maximum code, while the write
> reports success. Reject those. One patch per driver, as the Fixes tags
> differ.

Now it looks better.
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v3 2/2] iio: proximity: sx9360: reject out-of-range hardware gain values

[Jonathan Cameron]

On Wed, 11 Nov 2026 22:10:37 +0530
Arnav Kapoor <kapoorarnav43@gmail.com> wrote:

> sx9360_write_gain() passes the value from userspace to ilog2() and then
> FIELD_PREP() into the 3-bit PROX_CTRL0 gain field without checking it,
> so some values silently program a gain unrelated to the one requested,
> and the write still reports success:
> 
>   - 16 to 255 write gain codes 4 to 7, which the driver does not
>     advertise, and the next read reports gains of 16 to 128;
>   - 256 and larger wrap around in the field, e.g. 256 sets a gain of 1;
>   - 0 and negative values write code 7 (read back as 128), because
>     ilog2(0) is -1 and a negative int becomes a large unsigned value.
> 
> Return -ERANGE for values <= 0 and for values above the gain of 8 code.
> FIELD_FIT() is not enough here, as the field also holds codes 4 to 7,
> which the driver doesn't support. Values between the supported gains
> of 1, 2, 4 and 8 are still rounded down, as before.
> 
> Fixes: 1cdb4c47f7f5 ("iio:proximity:sx9360: Add sx9360 support")
> Signed-off-by: Arnav Kapoor <kapoorarnav43@gmail.com>
The whole off by one thing you had an RFC for can be handled
on top of this which is just making sure existing values actually
fit etc.

Applied to the testing branch of iio.git.

Thanks,

Jonathan

> ---
>  drivers/iio/proximity/sx9360.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/iio/proximity/sx9360.c b/drivers/iio/proximity/sx9360.c
> index 2a9b37df8f62..22b6b751c0a3 100644
> --- a/drivers/iio/proximity/sx9360.c
> +++ b/drivers/iio/proximity/sx9360.c
> @@ -68,6 +68,7 @@
>  #define SX9360_REG_PROX_CTRL0_PHM	0x41
>  #define SX9360_REG_PROX_CTRL0_GAIN_MASK	GENMASK(5, 3)
>  #define SX9360_REG_PROX_CTRL0_GAIN_1		0x80
> +#define SX9360_REG_PROX_CTRL0_GAIN_8		0x3
>  #define SX9360_REG_PROX_CTRL0_RAWFILT_MASK	GENMASK(2, 0)
>  #define SX9360_REG_PROX_CTRL0_RAWFILT_1P50	0x01
>  #define SX9360_REG_PROX_CTRL1		0x42
> @@ -625,7 +626,13 @@ static int sx9360_write_gain(struct sx_common_data *data,
>  {
>  	unsigned int gain, reg;
>  
> +	if (val <= 0)
> +		return -ERANGE;
> +
>  	gain = ilog2(val);
> +	if (gain > SX9360_REG_PROX_CTRL0_GAIN_8)
> +		return -ERANGE;
> +
>  	reg = SX9360_REG_PROX_CTRL0_PHR + chan->channel;
>  	gain = FIELD_PREP(SX9360_REG_PROX_CTRL0_GAIN_MASK, gain);
>