Commit 399b883e authored by David Lechner's avatar David Lechner Committed by Jonathan Cameron
Browse files

iio: imu: bno055: fix OOB access of hw_xlate array 



Fix a potential out-of-bounds array access of the hw_xlate array in
bno055.c.

In bno055_get_regmask(), hw_xlate was iterated over the length of the
vals array instead of the length of the hw_xlate array. In the case of
bno055_gyr_scale, the vals array is larger than the hw_xlate array,
so this could result in an out-of-bounds access. In practice, this
shouldn't happen though because a match should always be found which
breaks out of the for loop before it iterates beyond the end of the
hw_xlate array.

By adding a new hw_xlate_len field to the bno055_sysfs_attr, we can be
sure we are iterating over the correct length.

Reported-by: default avatarkernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202507100510.rGt1YOOx-lkp@intel.com/


Fixes: 4aefe1c2 ("iio: imu: add Bosch Sensortec BNO055 core driver")
Signed-off-by: default avatarDavid Lechner <dlechner@baylibre.com>
Link: https://patch.msgid.link/20250709-iio-const-data-19-v2-1-fb3fc9191251@baylibre.com


Cc: <Stable@vger.kernel.org>
Signed-off-by: default avatarJonathan Cameron <Jonathan.Cameron@huawei.com>
parent 8749c542

drivers/iio/imu/bno055/bno055.c

+8 −3
Original line number Diff line number Diff line
@@ -118,6 +118,7 @@ struct bno055_sysfs_attr { 
	int len;

	int *fusion_vals;

	int *hw_xlate;

	int hw_xlate_len;

	int type;

};
@@ -170,20 +171,24 @@ static int bno055_gyr_scale_vals[] = { 
	1000, 1877467, 2000, 1877467,

};



static int bno055_gyr_scale_hw_xlate[] = {0, 1, 2, 3, 4};

static struct bno055_sysfs_attr bno055_gyr_scale = {

	.vals = bno055_gyr_scale_vals,

	.len = ARRAY_SIZE(bno055_gyr_scale_vals),

	.fusion_vals = (int[]){1, 900},

	.hw_xlate = (int[]){4, 3, 2, 1, 0},

	.hw_xlate = bno055_gyr_scale_hw_xlate,

	.hw_xlate_len = ARRAY_SIZE(bno055_gyr_scale_hw_xlate),

	.type = IIO_VAL_FRACTIONAL,

};



static int bno055_gyr_lpf_vals[] = {12, 23, 32, 47, 64, 116, 230, 523};

static int bno055_gyr_lpf_hw_xlate[] = {5, 4, 7, 3, 6, 2, 1, 0};

static struct bno055_sysfs_attr bno055_gyr_lpf = {

	.vals = bno055_gyr_lpf_vals,

	.len = ARRAY_SIZE(bno055_gyr_lpf_vals),

	.fusion_vals = (int[]){32},

	.hw_xlate = (int[]){5, 4, 7, 3, 6, 2, 1, 0},

	.hw_xlate = bno055_gyr_lpf_hw_xlate,

	.hw_xlate_len = ARRAY_SIZE(bno055_gyr_lpf_hw_xlate),

	.type = IIO_VAL_INT,

};
@@ -561,7 +566,7 @@ static int bno055_get_regmask(struct bno055_priv *priv, int *val, int *val2, 


	idx = (hwval & mask) >> shift;

	if (attr->hw_xlate)

		for (i = 0; i < attr->len; i++)

		for (i = 0; i < attr->hw_xlate_len; i++)

			if (attr->hw_xlate[i] == idx) {

				idx = i;

				break;