* [PATCH v2] iio: adc: stm32-adc: fix possible division by zero in processed channel
@ 2026-09-16 14:10 Fabrice Gasnier
2026-09-16 14:39 ` Andy Shevchenko
0 siblings, 1 reply; 4+ messages in thread
From: Fabrice Gasnier @ 2026-09-16 14:10 UTC (permalink / raw)
To: Jonathan Cameron, David Lechner, Nuno Sá,
Andy Shevchenko, Maxime Coquelin, Alexandre Torgue,
Olivier Moysan, Fabrice Gasnier
Cc: linux-iio, linux-stm32, linux-arm-kernel, linux-kernel,
Jonathan Cameron, Sashiko, stable
In case the conversion has failed or returned zero, processing *val
can lead to a division by zero. Need to check for errors, or converted
value is zero, before processing the data. In case the converted value
is zero, e.g. the Vrefint channel, this should be considered as invalid
in all cases.
Fixes: 0e346b2cfa85 ("iio: adc: stm32-adc: add vrefint calibration support")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/all/20260911161555.244F31F000FF@smtp.kernel.org/
Cc: stable@vger.kernel.org
Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
---
Changes in v2:
- Review comments from Andy:
-- Correct commit message: single paragraph
-- Use a temporary variable instead of *val to improve readability
-- Drop ternary operation and use simpler conditional checks
- Link to v1: https://patch.msgid.link/20260915-adc-fix-div0-v1-1-7daed9e52f2f@foss.st.com
---
drivers/iio/adc/stm32-adc.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
index 5c6c06b269be..b9468b9e560a 100644
--- a/drivers/iio/adc/stm32-adc.c
+++ b/drivers/iio/adc/stm32-adc.c
@@ -1609,8 +1609,23 @@ static int stm32_adc_read_raw(struct iio_dev *indio_dev,
else
ret = -EINVAL;
- if (mask == IIO_CHAN_INFO_PROCESSED)
- *val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / *val;
+ if (mask == IIO_CHAN_INFO_PROCESSED) {
+ int vrefint_raw;
+
+ if (ret < 0) {
+ iio_device_release_direct(indio_dev);
+ return ret;
+ }
+
+ vrefint_raw = *val;
+
+ if (vrefint_raw == 0) {
+ iio_device_release_direct(indio_dev);
+ return -EINVAL;
+ }
+
+ *val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / vrefint_raw;
+ }
iio_device_release_direct(indio_dev);
return ret;
---
base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
change-id: 20260915-adc-fix-div0-ae38365abfeb
Best regards,
--
Fabrice Gasnier <fabrice.gasnier@foss.st.com>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v2] iio: adc: stm32-adc: fix possible division by zero in processed channel
2026-09-16 14:10 [PATCH v2] iio: adc: stm32-adc: fix possible division by zero in processed channel Fabrice Gasnier
@ 2026-09-16 14:39 ` Andy Shevchenko
2026-09-16 15:20 ` Fabrice Gasnier
0 siblings, 1 reply; 4+ messages in thread
From: Andy Shevchenko @ 2026-09-16 14:39 UTC (permalink / raw)
To: Fabrice Gasnier
Cc: Jonathan Cameron, David Lechner, Nuno Sá,
Andy Shevchenko, Maxime Coquelin, Alexandre Torgue,
Olivier Moysan, linux-iio, linux-stm32, linux-arm-kernel,
linux-kernel, Sashiko, stable
On Wed, Sep 16, 2026 at 04:10:05PM +0200, Fabrice Gasnier wrote:
> In case the conversion has failed or returned zero, processing *val
> can lead to a division by zero. Need to check for errors, or converted
> value is zero, before processing the data. In case the converted value
> is zero, e.g. the Vrefint channel, this should be considered as invalid
> in all cases.
...
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Link: https://lore.kernel.org/all/20260911161555.244F31F000FF@smtp.kernel.org/
Closes: ^^^
> + if (mask == IIO_CHAN_INFO_PROCESSED) {
> + int vrefint_raw;
> +
> + if (ret < 0) {
> + iio_device_release_direct(indio_dev);
> + return ret;
> + }
> +
> + vrefint_raw = *val;
> +
Unneeded blank line.
> + if (vrefint_raw == 0) {
> + iio_device_release_direct(indio_dev);
> + return -EINVAL;
> + }
> +
> + *val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / vrefint_raw;
> + }
Let's look at the current code in this switch-case
case IIO_CHAN_INFO_PROCESSED:
if (!iio_device_claim_direct(indio_dev))
return -EBUSY;
if (chan->type == IIO_VOLTAGE)
ret = stm32_adc_single_conv(indio_dev, chan, val);
else
ret = -EINVAL;
if (mask == IIO_CHAN_INFO_PROCESSED)
*val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / *val;
iio_device_release_direct(indio_dev);
return ret;
In the previous version you were trying to keep goto-less approach.
However in the current state of affairs I don't think the goto is
too bad (after all we need to backport this to the kernels that may
not have IIO_DEV_ACQUIRE_DIRECT_MODE() macro).
Also checking 'ret' under another condition seems unusual.
What about
case IIO_CHAN_INFO_PROCESSED:
if (!iio_device_claim_direct(indio_dev))
return -EBUSY;
if (chan->type == IIO_VOLTAGE)
ret = stm32_adc_single_conv(indio_dev, chan, val);
else
ret = -EINVAL;
iio_device_release_direct(indio_dev);
if (ret)
return ret;
if (*val == 0)
return -EINVAL;
if (mask == IIO_CHAN_INFO_PROCESSED)
*val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / *val;
return 0;
? (Yes, we leave that line untouched, but we get the change cleaner.)
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v2] iio: adc: stm32-adc: fix possible division by zero in processed channel
2026-09-16 14:39 ` Andy Shevchenko
@ 2026-09-16 15:20 ` Fabrice Gasnier
2026-09-16 15:39 ` Andy Shevchenko
0 siblings, 1 reply; 4+ messages in thread
From: Fabrice Gasnier @ 2026-09-16 15:20 UTC (permalink / raw)
To: Andy Shevchenko
Cc: Jonathan Cameron, David Lechner, Nuno Sá,
Andy Shevchenko, Maxime Coquelin, Alexandre Torgue,
Olivier Moysan, linux-iio, linux-stm32, linux-arm-kernel,
linux-kernel, Sashiko, stable
On 9/16/26 16:39, Andy Shevchenko wrote:
[ snip ]
> Let's look at the current code in this switch-case
>
Hi Andy,
Thanks for you suggestions !
Let's keep in the picture the 'normal' raw case:
case IIO_CHAN_INFO_RAW:
> case IIO_CHAN_INFO_PROCESSED:
> if (!iio_device_claim_direct(indio_dev))
> return -EBUSY;
> if (chan->type == IIO_VOLTAGE)
> ret = stm32_adc_single_conv(indio_dev, chan, val);
> else
> ret = -EINVAL;
>
> if (mask == IIO_CHAN_INFO_PROCESSED)
> *val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / *val;
>
> iio_device_release_direct(indio_dev);
> return ret;
>
> In the previous version you were trying to keep goto-less approach.
> However in the current state of affairs I don't think the goto is
> too bad (after all we need to backport this to the kernels that may
> not have IIO_DEV_ACQUIRE_DIRECT_MODE() macro).
>
> Also checking 'ret' under another condition seems unusual.
>
> What about
>
> case IIO_CHAN_INFO_PROCESSED:
> if (!iio_device_claim_direct(indio_dev))
> return -EBUSY;
> if (chan->type == IIO_VOLTAGE)
> ret = stm32_adc_single_conv(indio_dev, chan, val);
> else
> ret = -EINVAL;
> iio_device_release_direct(indio_dev);
> if (ret)
> return ret;
>
> if (*val == 0)
> return -EINVAL;
So *val == 0 is normally a valid value, for 'normal' raw channels.
>
> if (mask == IIO_CHAN_INFO_PROCESSED)
> *val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / *val;
With you suggestion, moving if (*val == 0) to here should be fine ?
if (mask == IIO_CHAN_INFO_PROCESSED) {
if (*val == 0)
return -EINVAL;
*val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / *val;
}
Best Regards,
Fabrice
>
> return 0;
>
> ? (Yes, we leave that line untouched, but we get the change cleaner.)
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v2] iio: adc: stm32-adc: fix possible division by zero in processed channel
2026-09-16 15:20 ` Fabrice Gasnier
@ 2026-09-16 15:39 ` Andy Shevchenko
0 siblings, 0 replies; 4+ messages in thread
From: Andy Shevchenko @ 2026-09-16 15:39 UTC (permalink / raw)
To: Fabrice Gasnier
Cc: Jonathan Cameron, David Lechner, Nuno Sá,
Andy Shevchenko, Maxime Coquelin, Alexandre Torgue,
Olivier Moysan, linux-iio, linux-stm32, linux-arm-kernel,
linux-kernel, Sashiko, stable
On Wed, Sep 16, 2026 at 05:20:48PM +0200, Fabrice Gasnier wrote:
> On 9/16/26 16:39, Andy Shevchenko wrote:
[ snip ]
> > Let's look at the current code in this switch-case
>
> Thanks for you suggestions !
>
> Let's keep in the picture the 'normal' raw case:
Ah, an important detail!
> case IIO_CHAN_INFO_RAW:
> > case IIO_CHAN_INFO_PROCESSED:
> > if (!iio_device_claim_direct(indio_dev))
> > return -EBUSY;
> > if (chan->type == IIO_VOLTAGE)
> > ret = stm32_adc_single_conv(indio_dev, chan, val);
> > else
> > ret = -EINVAL;
> >
> > if (mask == IIO_CHAN_INFO_PROCESSED)
> > *val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / *val;
> >
> > iio_device_release_direct(indio_dev);
> > return ret;
> >
> > In the previous version you were trying to keep goto-less approach.
> > However in the current state of affairs I don't think the goto is
> > too bad (after all we need to backport this to the kernels that may
> > not have IIO_DEV_ACQUIRE_DIRECT_MODE() macro).
> >
> > Also checking 'ret' under another condition seems unusual.
> >
> > What about
> >
> > case IIO_CHAN_INFO_PROCESSED:
> > if (!iio_device_claim_direct(indio_dev))
> > return -EBUSY;
> > if (chan->type == IIO_VOLTAGE)
> > ret = stm32_adc_single_conv(indio_dev, chan, val);
> > else
> > ret = -EINVAL;
> > iio_device_release_direct(indio_dev);
> > if (ret)
> > return ret;
> >
> > if (*val == 0)
> > return -EINVAL;
>
> So *val == 0 is normally a valid value, for 'normal' raw channels.
>
> > if (mask == IIO_CHAN_INFO_PROCESSED)
> > *val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / *val;
>
> With you suggestion, moving if (*val == 0) to here should be fine ?
Yep.
> if (mask == IIO_CHAN_INFO_PROCESSED) {
> if (*val == 0)
> return -EINVAL;
> *val = STM32_ADC_VREFINT_VOLTAGE * adc->vrefint.vrefint_cal / *val;
> }
>
> > return 0;
> >
> > ? (Yes, we leave that line untouched, but we get the change cleaner.)
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-09-16 15:39 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-16 14:10 [PATCH v2] iio: adc: stm32-adc: fix possible division by zero in processed channel Fabrice Gasnier
2026-09-16 14:39 ` Andy Shevchenko
2026-09-16 15:20 ` Fabrice Gasnier
2026-09-16 15:39 ` Andy Shevchenko
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®