The > in "if (chan > ADC5_MAX_CHANNEL)" should be >= to prevent an out
of bound read of the adc->data->adc_chans[] array.

Fixes: baff45179e90 ("iio: adc: Add support for QCOM PMIC5 Gen3 ADC")
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
This email is a free service from the Smatch-CI project [smatch.sf.net].

 drivers/iio/adc/qcom-spmi-adc5-gen3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/adc/qcom-spmi-adc5-gen3.c b/drivers/iio/adc/qcom-spmi-adc5-gen3.c
index f8168a14b907..48c793b18d11 100644
--- a/drivers/iio/adc/qcom-spmi-adc5-gen3.c
+++ b/drivers/iio/adc/qcom-spmi-adc5-gen3.c
@@ -482,7 +482,7 @@ static int adc5_gen3_get_fw_channel_data(struct adc5_chip *adc,
 	sid = FIELD_GET(ADC5_GEN3_VIRTUAL_SID_MASK, chan);
 	chan = FIELD_GET(ADC5_GEN3_CHANNEL_MASK, chan);
 
-	if (chan > ADC5_MAX_CHANNEL)
+	if (chan >= ADC5_MAX_CHANNEL)
 		return dev_err_probe(dev, -EINVAL,
 				     "%s invalid channel number %d\n",
 				     name, chan);
-- 
2.53.0

On 4/10/26 12:12 PM, Dan Carpenter wrote:
> The > in "if (chan > ADC5_MAX_CHANNEL)" should be >= to prevent an out
> of bound read of the adc->data->adc_chans[] array.
> 
> Fixes: baff45179e90 ("iio: adc: Add support for QCOM PMIC5 Gen3 ADC")
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> ---

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>

Konrad

On Fri, 10 Apr 2026 12:15:41 +0200
Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> wrote:

> On 4/10/26 12:12 PM, Dan Carpenter wrote:
> > The > in "if (chan > ADC5_MAX_CHANNEL)" should be >= to prevent an out
> > of bound read of the adc->data->adc_chans[] array.
> > 
> > Fixes: baff45179e90 ("iio: adc: Add support for QCOM PMIC5 Gen3 ADC")
> > Signed-off-by: Dan Carpenter <error27@gmail.com>
> > ---  
> 
> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
> 
This was waiting on the char-misc pull requests going upstream so I could
rebase my fixes branch.  That's now happened, but I will rebase again on
rc1 once available (as a pull request based mid merge window isn't the best plan!)

Anyhow applied to the fixes-togreg branch of iio.git.

Thanks,

Jonathan

> Konrad