[PATCH v2] iio: adc: stm32-adc: fix possible division by zero in processed channel

[PATCH v2] iio: adc: stm32-adc: fix possible division by zero in processed channel

[Fabrice Gasnier]

In case the conversion has failed or returned zero, processing *val
can lead to a division by zero. Need to check for errors, or converted
value is zero, before processing the data. In case the converted value
is zero, e.g. the Vrefint channel, this should be considered as invalid
in all cases.

Fixes: 0e346b2cfa85 ("iio: adc: stm32-adc: add vrefint calibration support")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/all/20260911161555.244F31F000FF@smtp.kernel.org/
Cc: stable@vger.kernel.org
Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
---
Changes in v2:
- Review comments from Andy:
-- Correct commit message: single paragraph
-- Use a temporary variable instead of *val to improve readability
-- Drop ternary operation and use simpler conditional checks
- Link to v1: https://patch.msgid.link/20260915-adc-fix-div0-v1-1-7daed9e52f2f@foss.st.com
---
 drivers/iio/adc/stm32-adc.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
index 5c6c06b269be..b9468b9e560a 100644
--- a/drivers/iio/adc/stm32-adc.c
+++ b/drivers/iio/adc/stm32-adc.c
@@ -1609,8 +1609,23 @@ static int stm32_adc_read_raw(struct iio_dev *indio_dev,
 		else
 			ret = -EINVAL;
 
-		if (mask == IIO_CHAN_INFO_PROCESSED)
-			*val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / *val;
+		if (mask == IIO_CHAN_INFO_PROCESSED) {
+			int vrefint_raw;
+
+			if (ret < 0) {
+				iio_device_release_direct(indio_dev);
+				return ret;
+			}
+
+			vrefint_raw = *val;
+
+			if (vrefint_raw == 0) {
+				iio_device_release_direct(indio_dev);
+				return -EINVAL;
+			}
+
+			*val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / vrefint_raw;
+		}
 
 		iio_device_release_direct(indio_dev);
 		return ret;

---
base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
change-id: 20260915-adc-fix-div0-ae38365abfeb

Best regards,
--  
Fabrice Gasnier <fabrice.gasnier@foss.st.com>

Re: [PATCH v2] iio: adc: stm32-adc: fix possible division by zero in processed channel

[Andy Shevchenko]

On Wed, Sep 16, 2026 at 04:10:05PM +0200, Fabrice Gasnier wrote:
> In case the conversion has failed or returned zero, processing *val
> can lead to a division by zero. Need to check for errors, or converted
> value is zero, before processing the data. In case the converted value
> is zero, e.g. the Vrefint channel, this should be considered as invalid
> in all cases.

...

> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Link: https://lore.kernel.org/all/20260911161555.244F31F000FF@smtp.kernel.org/

Closes: ^^^


> +		if (mask == IIO_CHAN_INFO_PROCESSED) {
> +			int vrefint_raw;
> +
> +			if (ret < 0) {
> +				iio_device_release_direct(indio_dev);
> +				return ret;
> +			}
> +
> +			vrefint_raw = *val;

> +

Unneeded blank line.

> +			if (vrefint_raw == 0) {
> +				iio_device_release_direct(indio_dev);
> +				return -EINVAL;
> +			}
> +
> +			*val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / vrefint_raw;
> +		}

Let's look at the current code in this switch-case

	case IIO_CHAN_INFO_PROCESSED:
		if (!iio_device_claim_direct(indio_dev))
			return -EBUSY;
		if (chan->type == IIO_VOLTAGE)
			ret = stm32_adc_single_conv(indio_dev, chan, val);
		else
			ret = -EINVAL;

		if (mask == IIO_CHAN_INFO_PROCESSED)
			*val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / *val;

		iio_device_release_direct(indio_dev);
		return ret;

In the previous version you were trying to keep goto-less approach.
However in the current state of affairs I don't think the goto is
too bad (after all we need to backport this to the kernels that may
not have IIO_DEV_ACQUIRE_DIRECT_MODE() macro).

Also checking 'ret' under another condition seems unusual.

What about

	case IIO_CHAN_INFO_PROCESSED:
		if (!iio_device_claim_direct(indio_dev))
			return -EBUSY;
		if (chan->type == IIO_VOLTAGE)
			ret = stm32_adc_single_conv(indio_dev, chan, val);
		else
			ret = -EINVAL;
		iio_device_release_direct(indio_dev);
		if (ret)
			return ret;

		if (*val == 0)
			return -EINVAL;

		if (mask == IIO_CHAN_INFO_PROCESSED)
			*val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / *val;

		return 0;

? (Yes, we leave that line untouched, but we get the change cleaner.)


-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH v2] iio: adc: stm32-adc: fix possible division by zero in processed channel

[Fabrice Gasnier]

On 9/16/26 16:39, Andy Shevchenko wrote:

[ snip ]

> Let's look at the current code in this switch-case
> 

Hi Andy,

Thanks for you suggestions !

Let's keep in the picture the 'normal' raw case:

	case IIO_CHAN_INFO_RAW:
> 	case IIO_CHAN_INFO_PROCESSED:
> 		if (!iio_device_claim_direct(indio_dev))
> 			return -EBUSY;
> 		if (chan->type == IIO_VOLTAGE)
> 			ret = stm32_adc_single_conv(indio_dev, chan, val);
> 		else
> 			ret = -EINVAL;
> 
> 		if (mask == IIO_CHAN_INFO_PROCESSED)
> 			*val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / *val;
> 
> 		iio_device_release_direct(indio_dev);
> 		return ret;
> 
> In the previous version you were trying to keep goto-less approach.
> However in the current state of affairs I don't think the goto is
> too bad (after all we need to backport this to the kernels that may
> not have IIO_DEV_ACQUIRE_DIRECT_MODE() macro).
> 
> Also checking 'ret' under another condition seems unusual.
> 
> What about
> 
> 	case IIO_CHAN_INFO_PROCESSED:
> 		if (!iio_device_claim_direct(indio_dev))
> 			return -EBUSY;
> 		if (chan->type == IIO_VOLTAGE)
> 			ret = stm32_adc_single_conv(indio_dev, chan, val);
> 		else
> 			ret = -EINVAL;
> 		iio_device_release_direct(indio_dev);
> 		if (ret)
> 			return ret;
> 
> 		if (*val == 0)
> 			return -EINVAL;

So *val == 0 is normally a valid value, for 'normal' raw channels.

> 
> 		if (mask == IIO_CHAN_INFO_PROCESSED)
> 			*val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / *val;

With you suggestion, moving if (*val == 0) to here should be fine ?

		if (mask == IIO_CHAN_INFO_PROCESSED) {
			if (*val == 0)
				return -EINVAL;
			*val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / *val;
		}

Best Regards,
Fabrice

> 
> 		return 0;
> 
> ? (Yes, we leave that line untouched, but we get the change cleaner.)
> 
> 

Re: [PATCH v2] iio: adc: stm32-adc: fix possible division by zero in processed channel

[Andy Shevchenko]

On Wed, Sep 16, 2026 at 05:20:48PM +0200, Fabrice Gasnier wrote:
> On 9/16/26 16:39, Andy Shevchenko wrote:

[ snip ]

> > Let's look at the current code in this switch-case
> 
> Thanks for you suggestions !
> 
> Let's keep in the picture the 'normal' raw case:

Ah, an important detail!

> 	case IIO_CHAN_INFO_RAW:
> > 	case IIO_CHAN_INFO_PROCESSED:
> > 		if (!iio_device_claim_direct(indio_dev))
> > 			return -EBUSY;
> > 		if (chan->type == IIO_VOLTAGE)
> > 			ret = stm32_adc_single_conv(indio_dev, chan, val);
> > 		else
> > 			ret = -EINVAL;
> > 
> > 		if (mask == IIO_CHAN_INFO_PROCESSED)
> > 			*val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / *val;
> > 
> > 		iio_device_release_direct(indio_dev);
> > 		return ret;
> > 
> > In the previous version you were trying to keep goto-less approach.
> > However in the current state of affairs I don't think the goto is
> > too bad (after all we need to backport this to the kernels that may
> > not have IIO_DEV_ACQUIRE_DIRECT_MODE() macro).
> > 
> > Also checking 'ret' under another condition seems unusual.
> > 
> > What about
> > 
> > 	case IIO_CHAN_INFO_PROCESSED:
> > 		if (!iio_device_claim_direct(indio_dev))
> > 			return -EBUSY;
> > 		if (chan->type == IIO_VOLTAGE)
> > 			ret = stm32_adc_single_conv(indio_dev, chan, val);
> > 		else
> > 			ret = -EINVAL;
> > 		iio_device_release_direct(indio_dev);
> > 		if (ret)
> > 			return ret;
> > 
> > 		if (*val == 0)
> > 			return -EINVAL;
> 
> So *val == 0 is normally a valid value, for 'normal' raw channels.
> 
> > 		if (mask == IIO_CHAN_INFO_PROCESSED)
> > 			*val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / *val;
> 
> With you suggestion, moving if (*val == 0) to here should be fine ?

Yep.

> 		if (mask == IIO_CHAN_INFO_PROCESSED) {
> 			if (*val == 0)
> 				return -EINVAL;
> 			*val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / *val;
> 		}
> 
> > 		return 0;
> > 
> > ? (Yes, we leave that line untouched, but we get the change cleaner.)

-- 
With Best Regards,
Andy Shevchenko