[PATCH] iio: light: al3010: fix out-of-bounds read of the scale table

[PATCH] iio: light: al3010: fix out-of-bounds read of the scale table

[Raffaele Tranfaglia via B4 Relay]

From: Raffaele Tranfaglia <raffaele.tranfaglia@gmail.com>

The gain field read from the CONFIG register is three bits wide, so it
can hold values from 0 to 7, but al3010_scales[] only has four entries.
If the register holds a gain value of 4 or more, reading the scale
attribute indexes past the end of the table and returns garbage.

Reject such values with -EINVAL instead of indexing past the end of
the table.

Fixes: c36b5195ab70 ("iio: light: add Dyna-Image AL3010 driver")
Signed-off-by: Raffaele Tranfaglia <raffaele.tranfaglia@gmail.com>
---
Found with LLM-assisted static analysis of drivers/iio, looking for
table lookups indexed by unchecked register fields; the fix was drafted
with the same assistant and reviewed and tested by me.

Tested on arm64 QEMU with i2c-stub and CONFIG_UBSAN_BOUNDS=y. After
writing a gain value of 4 to CONFIG (0x10), reading
in_illuminance_scale:
- before: two array-index-out-of-bounds reports (al3010.c:137 and
  :138), and the attribute reads 0.000000
- after: the read fails with -EINVAL and no report is printed
---
 drivers/iio/light/al3010.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/iio/light/al3010.c b/drivers/iio/light/al3010.c
index 49f6d8336dbe..481dad5097b9 100644
--- a/drivers/iio/light/al3010.c
+++ b/drivers/iio/light/al3010.c
@@ -134,6 +134,9 @@ static int al3010_read_raw(struct iio_dev *indio_dev,
 			return ret;
 
 		gain = FIELD_GET(AL3010_GAIN_MASK, gain);
+		if (gain >= ARRAY_SIZE(al3010_scales))
+			return -EINVAL;
+
 		*val = al3010_scales[gain][0];
 		*val2 = al3010_scales[gain][1];
 

---
base-commit: d1425b382b9cc5bd19223fad8ba4a8af3dbe1305
change-id: 20261103-al3010-scale-bounds-04b891eea476

Best regards,
--  
Raffaele Tranfaglia <raffaele.tranfaglia@gmail.com>

Re: [PATCH] iio: light: al3010: fix out-of-bounds read of the scale table

[Joshua Crofts]

On Tue, 03 Nov 2026 08:42:48 +0000
Raffaele Tranfaglia via B4 Relay <devnull+raffaele.tranfaglia.gmail.com@kernel.org> wrote:

> From: Raffaele Tranfaglia <raffaele.tranfaglia@gmail.com>
> 
> The gain field read from the CONFIG register is three bits wide, so it
> can hold values from 0 to 7, but al3010_scales[] only has four entries.
> If the register holds a gain value of 4 or more, reading the scale
> attribute indexes past the end of the table and returns garbage.
> 
> Reject such values with -EINVAL instead of indexing past the end of
> the table.
> 
> Fixes: c36b5195ab70 ("iio: light: add Dyna-Image AL3010 driver")
> Signed-off-by: Raffaele Tranfaglia <raffaele.tranfaglia@gmail.com>
> ---
> Found with LLM-assisted static analysis of drivers/iio, looking for
> table lookups indexed by unchecked register fields; the fix was drafted
> with the same assistant and reviewed and tested by me.
> 
> Tested on arm64 QEMU with i2c-stub and CONFIG_UBSAN_BOUNDS=y. After
> writing a gain value of 4 to CONFIG (0x10), reading
> in_illuminance_scale:
> - before: two array-index-out-of-bounds reports (al3010.c:137 and
>   :138), and the attribute reads 0.000000
> - after: the read fails with -EINVAL and no report is printed
> ---

Reviewed-by: Joshua Crofts <crofts@kernel.org>

-- 
Kind regards,
Joshua Crofts

Re: [PATCH] iio: light: al3010: fix out-of-bounds read of the scale table

[Jonathan Cameron]

On Tue, 3 Nov 2026 14:00:55 +0100
Joshua Crofts <crofts@kernel.org> wrote:

> On Tue, 03 Nov 2026 08:42:48 +0000
> Raffaele Tranfaglia via B4 Relay <devnull+raffaele.tranfaglia.gmail.com@kernel.org> wrote:
> 
> > From: Raffaele Tranfaglia <raffaele.tranfaglia@gmail.com>
> > 
> > The gain field read from the CONFIG register is three bits wide, so it
> > can hold values from 0 to 7, but al3010_scales[] only has four entries.
> > If the register holds a gain value of 4 or more, reading the scale
> > attribute indexes past the end of the table and returns garbage.
> > 
> > Reject such values with -EINVAL instead of indexing past the end of
> > the table.
> > 
> > Fixes: c36b5195ab70 ("iio: light: add Dyna-Image AL3010 driver")
Dropped the fixes tag.  This is hardening against buggy hardware
rather than fixing an issue anyone should encounter with a correctly
functioning device.

I don't mind such hardening (when simple and maintainable which 
your example here is) but I don't want to mark them as fixes
as that tends to trigger backporting which may not be appropriate.

Applied to the testing branch of iio.git with that tag dropped.

Jonathan

> > Signed-off-by: Raffaele Tranfaglia <raffaele.tranfaglia@gmail.com>
> > ---
> > Found with LLM-assisted static analysis of drivers/iio, looking for
> > table lookups indexed by unchecked register fields; the fix was drafted
> > with the same assistant and reviewed and tested by me.
> > 
> > Tested on arm64 QEMU with i2c-stub and CONFIG_UBSAN_BOUNDS=y. After
> > writing a gain value of 4 to CONFIG (0x10), reading
> > in_illuminance_scale:
> > - before: two array-index-out-of-bounds reports (al3010.c:137 and
> >   :138), and the attribute reads 0.000000
> > - after: the read fails with -EINVAL and no report is printed
> > ---  
> 
> Reviewed-by: Joshua Crofts <crofts@kernel.org>
>