Re: [PATCH] iio: light: al3010: fix out-of-bounds read of the scale table

[Joshua Crofts <crofts@kernel.org>]

On Tue, 03 Nov 2026 08:42:48 +0000
Raffaele Tranfaglia via B4 Relay <devnull+raffaele.tranfaglia.gmail.com@kernel.org> wrote:

> From: Raffaele Tranfaglia <raffaele.tranfaglia@gmail.com>
> 
> The gain field read from the CONFIG register is three bits wide, so it
> can hold values from 0 to 7, but al3010_scales[] only has four entries.
> If the register holds a gain value of 4 or more, reading the scale
> attribute indexes past the end of the table and returns garbage.
> 
> Reject such values with -EINVAL instead of indexing past the end of
> the table.
> 
> Fixes: c36b5195ab70 ("iio: light: add Dyna-Image AL3010 driver")
> Signed-off-by: Raffaele Tranfaglia <raffaele.tranfaglia@gmail.com>
> ---
> Found with LLM-assisted static analysis of drivers/iio, looking for
> table lookups indexed by unchecked register fields; the fix was drafted
> with the same assistant and reviewed and tested by me.
> 
> Tested on arm64 QEMU with i2c-stub and CONFIG_UBSAN_BOUNDS=y. After
> writing a gain value of 4 to CONFIG (0x10), reading
> in_illuminance_scale:
> - before: two array-index-out-of-bounds reports (al3010.c:137 and
>   :138), and the attribute reads 0.000000
> - after: the read fails with -EINVAL and no report is printed
> ---

Reviewed-by: Joshua Crofts <crofts@kernel.org>

-- 
Kind regards,
Joshua Crofts