iio: imu: bno055: fix OOB access of hw_xlate array

Fix a potential out-of-bounds array access of the hw_xlate array in
bno055.c.

In bno055_get_regmask(), hw_xlate was iterated over the length of the
vals array instead of the length of the hw_xlate array. In the case of
bno055_gyr_scale, the vals array is larger than the hw_xlate array,
so this could result in an out-of-bounds access. In practice, this
shouldn't happen though because a match should always be found which
breaks out of the for loop before it iterates beyond the end of the
hw_xlate array.

By adding a new hw_xlate_len field to the bno055_sysfs_attr, we can be
sure we are iterating over the correct length.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202507100510.rGt1YOOx-lkp@intel.com/
Fixes: 4aefe1c2bd0c ("iio: imu: add Bosch Sensortec BNO055 core driver")
Signed-off-by: David Lechner <dlechner@baylibre.com>
Link: https://patch.msgid.link/20250709-iio-const-data-19-v2-1-fb3fc9191251@baylibre.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>

diff --git a/drivers/iio/imu/bno055/bno055.c b/drivers/iio/imu/bno055/bno055.c
index 3f4c18dc3ee983fe3c5569406a2c6350b0cc756c..0eb5e1334e5564284c7f4bf560424b5ec734903d 100644 (file)
--- a/drivers/iio/imu/bno055/bno055.c
+++ b/drivers/iio/imu/bno055/bno055.c
@@ -118,6 +118,7 @@ struct bno055_sysfs_attr {
        int len;
        int *fusion_vals;
        int *hw_xlate;
+       int hw_xlate_len;
        int type;
 };
 
@@ -170,20 +171,24 @@ static int bno055_gyr_scale_vals[] = {
        1000, 1877467, 2000, 1877467,
 };
 
+static int bno055_gyr_scale_hw_xlate[] = {0, 1, 2, 3, 4};
 static struct bno055_sysfs_attr bno055_gyr_scale = {
        .vals = bno055_gyr_scale_vals,
        .len = ARRAY_SIZE(bno055_gyr_scale_vals),
        .fusion_vals = (int[]){1, 900},
-       .hw_xlate = (int[]){4, 3, 2, 1, 0},
+       .hw_xlate = bno055_gyr_scale_hw_xlate,
+       .hw_xlate_len = ARRAY_SIZE(bno055_gyr_scale_hw_xlate),
        .type = IIO_VAL_FRACTIONAL,
 };
 
 static int bno055_gyr_lpf_vals[] = {12, 23, 32, 47, 64, 116, 230, 523};
+static int bno055_gyr_lpf_hw_xlate[] = {5, 4, 7, 3, 6, 2, 1, 0};
 static struct bno055_sysfs_attr bno055_gyr_lpf = {
        .vals = bno055_gyr_lpf_vals,
        .len = ARRAY_SIZE(bno055_gyr_lpf_vals),
        .fusion_vals = (int[]){32},
-       .hw_xlate = (int[]){5, 4, 7, 3, 6, 2, 1, 0},
+       .hw_xlate = bno055_gyr_lpf_hw_xlate,
+       .hw_xlate_len = ARRAY_SIZE(bno055_gyr_lpf_hw_xlate),
        .type = IIO_VAL_INT,
 };
 
@@ -561,7 +566,7 @@ static int bno055_get_regmask(struct bno055_priv *priv, int *val, int *val2,
 
        idx = (hwval & mask) >> shift;
        if (attr->hw_xlate)
-               for (i = 0; i < attr->len; i++)
+               for (i = 0; i < attr->hw_xlate_len; i++)
                        if (attr->hw_xlate[i] == idx) {
                                idx = i;
                                break;