From d2a44111379c44011517795bf2b48aed79502fc8 Mon Sep 17 00:00:00 2001 From: Bryam Vargas Date: Tue, 16 Jun 2026 20:56:51 -0500 Subject: [PATCH] iio: accel: bmc150: clamp the device-reported FIFO frame count __bmc150_accel_fifo_flush() transfers the frame count the device reports in FIFO_STATUS into an on-stack buffer sized for BMC150_ACCEL_FIFO_LENGTH (32) samples, but the count is masked to 7 bits (0..127) and the optional caller budget does not bound the flush-all path. A device, or an attacker on the I2C/SPI bus, reporting up to 127 frames overflows the buffer by up to 570 bytes: a stack out-of-bounds write. Clamp the count to BMC150_ACCEL_FIFO_LENGTH before the transfer, mirroring the clamp already applied in bmc150_accel_set_watermark(). Conforming hardware reports at most that many frames and is unaffected. Signed-off-by: Bryam Vargas Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron --- drivers/iio/accel/bmc150-accel-core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c index 2398eb7e12cd..ecaa4782d847 100644 --- a/drivers/iio/accel/bmc150-accel-core.c +++ b/drivers/iio/accel/bmc150-accel-core.c @@ -988,8 +988,10 @@ static int __bmc150_accel_fifo_flush(struct iio_dev *indio_dev, do_div(sample_period, count); tstamp = data->timestamp - (count - 1) * sample_period; - if (samples && count > samples) - count = samples; + if (samples) + count = min3(count, samples, BMC150_ACCEL_FIFO_LENGTH); + else + count = min(count, BMC150_ACCEL_FIFO_LENGTH); ret = bmc150_accel_fifo_transfer(data, (u8 *)buffer, count); if (ret)