Re: [PATCH] iio: light: hid-sensor-als: Don't read past the end of short fields

["Pandruvada, Srinivas" <srinivas.pandruvada@intel.com>]

On Sun, 2026-11-01 at 03:37 +0000, Jonathan Cameron wrote:
> On Tue, 27 Oct 2026 18:58:39 +0800
> Daniel Schaefer via B4 Relay <devnull+dhs.frame.work@kernel.org>
> wrote:
> 
> > From: Daniel Schaefer <dhs@frame.work>
> > 
> > Reports are not guaranteed to be 4 bytes.
> > On color ALS sensors there are fields that can be shorter than 4
> > bytes:
> > 16-bit illuminance, color temperature and chromaticity x/y.
> > 
> > I don't have such a sensor right now, but I have emulated one in
> > firmware. With this patch, no garbage data is read from the next
> > report:
> > 
> >   before: 05dc02bc 05dc02bc 190005dc 0ce41900 00000ce4
> >   after:  000002bc 000002bc 000005dc 00001900 00000ce4
> > 
> > Same fix as commit ad02ca57e44e ("iio: hid-sensor-prox: Add support
> > for
> > 16-bit report size").
> > 
> > Fixes: ed5514c925a0 ("iio: hid-sensors: Added ALS")
> > Signed-off-by: Daniel Schaefer <dhs@frame.work>
> Hi Daniel,
> 
> Seems in line with the referenced commit and to make sense to me.
> So I'll pick this up now - however still time for more reviews as
> I'll need to rebase on rc1 anyway in the next few days.
> 
> Applied to the fixes-togreg branch of iio.git
> 

LGTM also. Thanks Jonathan. Slowly catching up after vacation.

-Srinivas

> Thanks,
> 
> Jonathan
> 
> > ---
> > Tested on an emulated sensor with 2 byte reports that is correctly
> > recognized
> > by Windows.
> > 
> > Cc: Sven Vainküla <sven@xn--vainkla-r2a.ee>
> > ---
> >  drivers/iio/light/hid-sensor-als.c | 16 +++++++++++++++-
> >  1 file changed, 15 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/iio/light/hid-sensor-als.c
> > b/drivers/iio/light/hid-sensor-als.c
> > index 929343e42d83..00dfc2037c19 100644
> > --- a/drivers/iio/light/hid-sensor-als.c
> > +++ b/drivers/iio/light/hid-sensor-als.c
> > @@ -267,7 +267,21 @@ static int als_capture_sample(struct
> > hid_sensor_hub_device *hsdev,
> >  	struct iio_dev *indio_dev = platform_get_drvdata(priv);
> >  	struct als_state *als_state = iio_priv(indio_dev);
> >  	int ret = -EINVAL;
> > -	u32 sample_data = *(u32 *)raw_data;
> > +	u32 sample_data;
> > +
> > +	switch (raw_len) {
> > +	case 1:
> > +		sample_data = *(u8 *)raw_data;
> > +		break;
> > +	case 2:
> > +		sample_data = *(u16 *)raw_data;
> > +		break;
> > +	default:
> > +		if (raw_len < sizeof(u32))
> > +			return -EINVAL;
> > +		sample_data = *(u32 *)raw_data;
> > +		break;
> > +	}
> >  
> >  	switch (usage_id) {
> >  	case HID_USAGE_SENSOR_LIGHT_ILLUM:
> > 
> > ---
> > base-commit: 09f742b49cb2728086d78be2b0b35e4d1d71fc85
> > change-id: 20261027-iio-als-overread-c9e538fa61fa
> > 
> > Best regards,