[PATCH 0/2] iio: chemical: sps30: fix buffer size calculations

[PATCH 0/2] iio: chemical: sps30: fix buffer size calculations

[Antoniu Miclaus]

Fix incorrect buffer size calculations in sps30_i2c_read_meas() and
sps30_serial_read_meas(). Both functions used sizeof(num) which
evaluates to sizeof(size_t) (8 bytes on 64-bit) instead of
sizeof(*meas) (4 bytes for __be32), leading to oversized buffer
requests.

Antoniu Miclaus (2):
  iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
  iio: chemical: sps30_serial: fix buffer size in
    sps30_serial_read_meas()

 drivers/iio/chemical/sps30_i2c.c    | 2 +-
 drivers/iio/chemical/sps30_serial.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

-- 
2.43.0

[PATCH 1/2] iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()

[Antoniu Miclaus]

sizeof(num) evaluates to sizeof(size_t) (8 bytes on 64-bit) instead
of the intended __be32 element size (4 bytes). Use sizeof(*meas) to
correctly match the buffer element type.

Fixes: 8f3f13085278 ("iio: sps30: separate core and interface specific code")
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
---
 drivers/iio/chemical/sps30_i2c.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/chemical/sps30_i2c.c b/drivers/iio/chemical/sps30_i2c.c
index f692c089d17b..c92f04990c34 100644
--- a/drivers/iio/chemical/sps30_i2c.c
+++ b/drivers/iio/chemical/sps30_i2c.c
@@ -171,7 +171,7 @@ static int sps30_i2c_read_meas(struct sps30_state *state, __be32 *meas, size_t n
 	if (!sps30_i2c_meas_ready(state))
 		return -ETIMEDOUT;
 
-	return sps30_i2c_command(state, SPS30_I2C_READ_MEAS, NULL, 0, meas, sizeof(num) * num);
+	return sps30_i2c_command(state, SPS30_I2C_READ_MEAS, NULL, 0, meas, sizeof(*meas) * num);
 }
 
 static int sps30_i2c_clean_fan(struct sps30_state *state)
-- 
2.43.0

Re: [PATCH 1/2] iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()

[Andy Shevchenko]

On Thu, Feb 12, 2026 at 02:46:07PM +0200, Antoniu Miclaus wrote:
> sizeof(num) evaluates to sizeof(size_t) (8 bytes on 64-bit) instead
> of the intended __be32 element size (4 bytes). Use sizeof(*meas) to
> correctly match the buffer element type.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH 1/2] iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()

[Tomasz Duszyński]

On Thu, Feb 12, 2026 at 1:46 PM Antoniu Miclaus
<antoniu.miclaus@analog.com> wrote:
>
> sizeof(num) evaluates to sizeof(size_t) (8 bytes on 64-bit) instead
> of the intended __be32 element size (4 bytes). Use sizeof(*meas) to
> correctly match the buffer element type.
>
> Fixes: 8f3f13085278 ("iio: sps30: separate core and interface specific code")
> Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
> ---
>  drivers/iio/chemical/sps30_i2c.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/iio/chemical/sps30_i2c.c b/drivers/iio/chemical/sps30_i2c.c
> index f692c089d17b..c92f04990c34 100644
> --- a/drivers/iio/chemical/sps30_i2c.c
> +++ b/drivers/iio/chemical/sps30_i2c.c
> @@ -171,7 +171,7 @@ static int sps30_i2c_read_meas(struct sps30_state *state, __be32 *meas, size_t n
>         if (!sps30_i2c_meas_ready(state))
>                 return -ETIMEDOUT;
>
> -       return sps30_i2c_command(state, SPS30_I2C_READ_MEAS, NULL, 0, meas, sizeof(num) * num);
> +       return sps30_i2c_command(state, SPS30_I2C_READ_MEAS, NULL, 0, meas, sizeof(*meas) * num);
>  }
>
>  static int sps30_i2c_clean_fan(struct sps30_state *state)
> --
> 2.43.0
>

Acked-by: Tomasz Duszynski <tduszyns@gmail.com>

[PATCH 2/2] iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()

[Antoniu Miclaus]

sizeof(num) evaluates to sizeof(size_t) which is 8 bytes on 64-bit,
but the buffer elements are only 4 bytes. The same function already
uses sizeof(*meas) on line 312, making the mismatch evident. Use
sizeof(*meas) consistently.

Fixes: b2e171f5a5c6 ("iio: sps30: add support for serial interface")
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
---
 drivers/iio/chemical/sps30_serial.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/chemical/sps30_serial.c b/drivers/iio/chemical/sps30_serial.c
index 008bc88590f3..a5e6bc08d5fd 100644
--- a/drivers/iio/chemical/sps30_serial.c
+++ b/drivers/iio/chemical/sps30_serial.c
@@ -303,7 +303,7 @@ static int sps30_serial_read_meas(struct sps30_state *state, __be32 *meas, size_
 	if (msleep_interruptible(1000))
 		return -EINTR;
 
-	ret = sps30_serial_command(state, SPS30_SERIAL_READ_MEAS, NULL, 0, meas, num * sizeof(num));
+	ret = sps30_serial_command(state, SPS30_SERIAL_READ_MEAS, NULL, 0, meas, num * sizeof(*meas));
 	if (ret < 0)
 		return ret;
 	/* if measurements aren't ready sensor returns empty frame */
-- 
2.43.0

Re: [PATCH 2/2] iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()

[Andy Shevchenko]

On Thu, Feb 12, 2026 at 02:46:08PM +0200, Antoniu Miclaus wrote:
> sizeof(num) evaluates to sizeof(size_t) which is 8 bytes on 64-bit,
> but the buffer elements are only 4 bytes. The same function already
> uses sizeof(*meas) on line 312, making the mismatch evident. Use
> sizeof(*meas) consistently.

Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH 2/2] iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()

[Tomasz Duszyński]

On Thu, Feb 12, 2026 at 1:46 PM Antoniu Miclaus
<antoniu.miclaus@analog.com> wrote:
>
> sizeof(num) evaluates to sizeof(size_t) which is 8 bytes on 64-bit,
> but the buffer elements are only 4 bytes. The same function already
> uses sizeof(*meas) on line 312, making the mismatch evident. Use
> sizeof(*meas) consistently.
>
> Fixes: b2e171f5a5c6 ("iio: sps30: add support for serial interface")
> Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
> ---
>  drivers/iio/chemical/sps30_serial.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/iio/chemical/sps30_serial.c b/drivers/iio/chemical/sps30_serial.c
> index 008bc88590f3..a5e6bc08d5fd 100644
> --- a/drivers/iio/chemical/sps30_serial.c
> +++ b/drivers/iio/chemical/sps30_serial.c
> @@ -303,7 +303,7 @@ static int sps30_serial_read_meas(struct sps30_state *state, __be32 *meas, size_
>         if (msleep_interruptible(1000))
>                 return -EINTR;
>
> -       ret = sps30_serial_command(state, SPS30_SERIAL_READ_MEAS, NULL, 0, meas, num * sizeof(num));
> +       ret = sps30_serial_command(state, SPS30_SERIAL_READ_MEAS, NULL, 0, meas, num * sizeof(*meas));
>         if (ret < 0)
>                 return ret;
>         /* if measurements aren't ready sensor returns empty frame */
> --
> 2.43.0
>

Acked-by: Tomasz Duszynski <tduszyns@gmail.com>

Re: [PATCH 0/2] iio: chemical: sps30: fix buffer size calculations

[Jonathan Cameron]

On Thu, 12 Feb 2026 14:46:06 +0200
Antoniu Miclaus <antoniu.miclaus@analog.com> wrote:

> Fix incorrect buffer size calculations in sps30_i2c_read_meas() and
> sps30_serial_read_meas(). Both functions used sizeof(num) which
> evaluates to sizeof(size_t) (8 bytes on 64-bit) instead of
> sizeof(*meas) (4 bytes for __be32), leading to oversized buffer
> requests.
> 
> Antoniu Miclaus (2):
>   iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
>   iio: chemical: sps30_serial: fix buffer size in
>     sps30_serial_read_meas()
> 
>  drivers/iio/chemical/sps30_i2c.c    | 2 +-
>  drivers/iio/chemical/sps30_serial.c | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
Applied to the fixes-togreg branch of iio.git and marked for stable.

Thanks,

Jonathan