[PATCH v2] iio: core: fix signed integer overflow in iio_str_to_fixpoint()

[PATCH v2] iio: core: fix signed integer overflow in iio_str_to_fixpoint()

[Arnav Kapoor]

__iio_str_to_fixpoint() accumulates the integer part of the parsed number
into an int. Feeding it a string with more digits than an int can hold
overflows that variable, which is undefined behaviour.

The parser is reachable from userspace via the writable IIO channel
attributes, for example the "sampling_frequency" or "in_voltage_scale"
ones, and via the exported iio_str_to_fixpoint() helper used by a
number of IIO drivers. A user writing a long enough string therefore
triggers a signed integer overflow.

Use check_mul_overflow() and check_add_overflow() to accumulate the
integer part and return -ERANGE when it does not fit into an int. The
sign is applied while accumulating, so INT_MIN can still be parsed.

Fixes: 6807d7211327 ("iio: Factor out fixed point number parsing into its own function")
Signed-off-by: Arnav Kapoor <kapoorarnav43@gmail.com>
---
Changes in v2:
- Use check_mul_overflow()/check_add_overflow() instead of open-coded
  s64 accumulation and limits (Andy)
- Apply the sign while accumulating so INT_MIN needs no special case
- Drop the unrelated parenthesis change and the explicit casts (Andy)
- Add Fixes tag (Andy)
- Fix the truncated subject line
- No KUnit tests for the current parser, as it is replaced by the
  E notation series (Rodrigo)

The fractional part is left as is: with the fract_mult values used in
tree (at most 10^8) it cannot exceed 999999999.

Tested with a userspace harness built with -fsanitize=undefined on
inputs including "2147483647", "2147483648", "-2147483648",
"-2147483649", "99999999999999999999", "-0.5" and "12.345\n".
All inputs that fit into an int parse exactly as before. Compile-tested
in tree with W=1. Applies to both togreg and fixes-togreg.

v1: https://lore.kernel.org/all/20261021225306.623361-1-kapoorarnav43@gmail.com/

 drivers/iio/industrialio-core.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index d73f2541375f..f3bf17c13cea 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -25,6 +25,7 @@
 #include <linux/math64.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
+#include <linux/overflow.h>
 #include <linux/poll.h>
 #include <linux/property.h>
 #include <linux/sched.h>
@@ -1027,7 +1028,12 @@ static int __iio_str_to_fixpoint(const char *str, int fract_mult,
 	while (*str) {
 		if ('0' <= *str && *str <= '9') {
 			if (integer_part) {
-				i = i * 10 + *str - '0';
+				int digit = *str - '0';
+
+				/* Accumulate with the sign applied so INT_MIN fits */
+				if (check_mul_overflow(i, 10, &i) ||
+				    check_add_overflow(i, negative ? -digit : digit, &i))
+					return -ERANGE;
 			} else {
 				f += fract_mult * (*str - '0');
 				fract_mult /= 10;
@@ -1052,12 +1058,8 @@ static int __iio_str_to_fixpoint(const char *str, int fract_mult,
 		str++;
 	}
 
-	if (negative) {
-		if (i)
-			i = -i;
-		else
-			f = -f;
-	}
+	if (negative && !i)
+		f = -f;
 
 	*integer = i;
 	*fract = f;

base-commit: a3b3580713f3ac5a32dc2874ee546828977a1d68
-- 
2.53.0

Re: [PATCH v2] iio: core: fix signed integer overflow in iio_str_to_fixpoint()

[Nuno Sá]

On Thu, Oct 22, 2026 at 07:33:51PM +0530, Arnav Kapoor wrote:
> __iio_str_to_fixpoint() accumulates the integer part of the parsed number
> into an int. Feeding it a string with more digits than an int can hold
> overflows that variable, which is undefined behaviour.
> 
> The parser is reachable from userspace via the writable IIO channel
> attributes, for example the "sampling_frequency" or "in_voltage_scale"
> ones, and via the exported iio_str_to_fixpoint() helper used by a
> number of IIO drivers. A user writing a long enough string therefore
> triggers a signed integer overflow.
> 
> Use check_mul_overflow() and check_add_overflow() to accumulate the
> integer part and return -ERANGE when it does not fit into an int. The
> sign is applied while accumulating, so INT_MIN can still be parsed.
> 
> Fixes: 6807d7211327 ("iio: Factor out fixed point number parsing into its own function")
> Signed-off-by: Arnav Kapoor <kapoorarnav43@gmail.com>
> ---

LGTM (maybe a Cc to stable next time but Jonathan typically takes care
of that),

Reviewed-by: Nuno Sá <nuno.sa@analog.com>

> Changes in v2:
> - Use check_mul_overflow()/check_add_overflow() instead of open-coded
>   s64 accumulation and limits (Andy)
> - Apply the sign while accumulating so INT_MIN needs no special case
> - Drop the unrelated parenthesis change and the explicit casts (Andy)
> - Add Fixes tag (Andy)
> - Fix the truncated subject line
> - No KUnit tests for the current parser, as it is replaced by the
>   E notation series (Rodrigo)
> 
> The fractional part is left as is: with the fract_mult values used in
> tree (at most 10^8) it cannot exceed 999999999.
> 
> Tested with a userspace harness built with -fsanitize=undefined on
> inputs including "2147483647", "2147483648", "-2147483648",
> "-2147483649", "99999999999999999999", "-0.5" and "12.345\n".
> All inputs that fit into an int parse exactly as before. Compile-tested
> in tree with W=1. Applies to both togreg and fixes-togreg.
> 
> v1: https://lore.kernel.org/all/20261021225306.623361-1-kapoorarnav43@gmail.com/
> 
>  drivers/iio/industrialio-core.c | 16 +++++++++-------
>  1 file changed, 9 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
> index d73f2541375f..f3bf17c13cea 100644
> --- a/drivers/iio/industrialio-core.c
> +++ b/drivers/iio/industrialio-core.c
> @@ -25,6 +25,7 @@
>  #include <linux/math64.h>
>  #include <linux/module.h>
>  #include <linux/mutex.h>
> +#include <linux/overflow.h>
>  #include <linux/poll.h>
>  #include <linux/property.h>
>  #include <linux/sched.h>
> @@ -1027,7 +1028,12 @@ static int __iio_str_to_fixpoint(const char *str, int fract_mult,
>  	while (*str) {
>  		if ('0' <= *str && *str <= '9') {
>  			if (integer_part) {
> -				i = i * 10 + *str - '0';
> +				int digit = *str - '0';
> +
> +				/* Accumulate with the sign applied so INT_MIN fits */
> +				if (check_mul_overflow(i, 10, &i) ||
> +				    check_add_overflow(i, negative ? -digit : digit, &i))
> +					return -ERANGE;
>  			} else {
>  				f += fract_mult * (*str - '0');
>  				fract_mult /= 10;
> @@ -1052,12 +1058,8 @@ static int __iio_str_to_fixpoint(const char *str, int fract_mult,
>  		str++;
>  	}
>  
> -	if (negative) {
> -		if (i)
> -			i = -i;
> -		else
> -			f = -f;
> -	}
> +	if (negative && !i)
> +		f = -f;
>  
>  	*integer = i;
>  	*fract = f;
> 
> base-commit: a3b3580713f3ac5a32dc2874ee546828977a1d68
> -- 
> 2.53.0
>