linux/drivers/iio, branch for-next

Merge tag 'iio-fixes-for-6.13a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus

2024-12-16T15:29:55Z

Jonathan writes: IIO: 1st set of fixes for 6.13 cycle. The usual mixed back of fixes for ancient and recent bugs A number of these were from an audit by Javier Carrasco of places we may leak stack data via holes in structures passed to userspace that were not explicitly zeroed. Very helpful effort after we found a similar bug in review of new code. This affected: - dummy driver - kionix,kmx61 - murrata,zpa2326 - rockchip,saradc - rohm,bh1745 - veml,vcnl4035 - ti,ads1119 - ti,ads8688 - ti,tmp0006 Other fixes: core,inkern - Underflow fo reference count issue in error path of iio_channel_get_all() for devices we haven't yet gotten. tests - Kconfig typo fix so it's possible to tell what test is being enabled. - Check for allocation failures. adi,ad4695 - Ensure timing requirement wrt to final clock edge vs next conversion signal are met by adding an additional SPI transfer. adi,ad7124 - Ensure channels are disabled at probe to avoid wrong data if channel 0 is not the first one read. adi,ad7173 - Fix handing of multiple devices by not editing a single static structure and instead making a per instance copy. adi,ad9467 - Fix handing of multiple devices by not editing a single static structure and instead making a per instance copy. adi,ad9832 - Off by one error on input verification for phase control adi,ad9834 - Off by one error on input verification for phase control. atmel,at91 - In an error path don't use a variable that hasn't been initialized yet. invensense,icm42600 - SPI burst write does not work for some icm426000 chips, disable it. - Ensure correct handling of timestamps after resume. st,sensors - Add back accidentally dropped IIS2MDC compatible in binding doc. st,stm32-dfsdm: - label property was accidentally made a required property. Make it optional again to fix use of older DT. ti,ads1119 - Use a fixed size for the channel data rather than an integer, bringing the code inline with the advertised 16 bit channel size and avoiding userspace misinterpreting the data. ti,ads124s08 - Use _cansleep gpio calls as no reason to prevent sleeping and it was stopping a new board design working (trivial fix). ti,ads1298 - Add a check on failure of devm_kasprintf() * tag 'iio-fixes-for-6.13a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (27 commits) iio: adc: ti-ads1119: fix sample size in scan struct for triggered buffer iio: temperature: tmp006: fix information leak in triggered buffer iio: inkern: call iio_device_put() only on mapped devices iio: adc: ad9467: Fix the "don't allow reading vref if not available" case iio: adc: at91: call input_free_device() on allocated iio_dev iio: adc: ad7173: fix using shared static info struct iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep() iio: adc: ti-ads1119: fix information leak in triggered buffer iio: pressure: zpa2326: fix information leak in triggered buffer iio: adc: rockchip_saradc: fix information leak in triggered buffer iio: imu: kmx61: fix information leak in triggered buffer iio: light: vcnl4035: fix information leak in triggered buffer iio: light: bh1745: fix information leak in triggered buffer iio: adc: ti-ads8688: fix information leak in triggered buffer iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer iio: test: Fix GTS test config dt-bindings: iio: st-sensors: Re-add IIS2MDC magnetometer iio: adc: ti-ads1298: Add NULL check in ads1298_init iio: adc: stm32-dfsdm: handle label as an optional property iio: adc: ad4695: fix buffered read, single sample timings ...

Merge tag 'mm-hotfixes-stable-2024-12-07-22-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2024-12-08T19:26:13Z

Pull misc fixes from Andrew Morton: "24 hotfixes. 17 are cc:stable. 15 are MM and 9 are non-MM. The usual bunch of singletons - please see the relevant changelogs for details" * tag 'mm-hotfixes-stable-2024-12-07-22-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (24 commits) iio: magnetometer: yas530: use signed integer type for clamp limits sched/numa: fix memory leak due to the overwritten vma->numab_state mm/damon: fix order of arguments in damos_before_apply tracepoint lib: stackinit: hide never-taken branch from compiler mm/filemap: don't call folio_test_locked() without a reference in next_uptodate_folio() scatterlist: fix incorrect func name in kernel-doc mm: correct typo in MMAP_STATE() macro mm: respect mmap hint address when aligning for THP mm: memcg: declare do_memsw_account inline mm/codetag: swap tags when migrate pages ocfs2: update seq_file index in ocfs2_dlm_seq_next stackdepot: fix stack_depot_save_flags() in NMI context mm: open-code page_folio() in dump_page() mm: open-code PageTail in folio_flags() and const_folio_flags() mm: fix vrealloc()'s KASAN poisoning logic Revert "readahead: properly shorten readahead when falling back to do_page_cache_ra()" selftests/damon: add _damon_sysfs.py to TEST_FILES selftest: hugetlb_dio: fix test naming ocfs2: free inode when ocfs2_get_init_inode() fails nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() ...

iio: adc: ti-ads1119: fix sample size in scan struct for triggered buffer

2024-12-08T16:59:13Z

This device returns signed, 16-bit samples as stated in its datasheet (see 8.5.2 Data Format). That is in line with the scan_type definition for the IIO_VOLTAGE channel, but 'unsigned int' is being used to read and push the data to userspace. Given that the size of that type depends on the architecture (at least 2 bytes to store values up to 65535, but its actual size is often 4 bytes), use the 's16' type to provide the same structure in all cases. Fixes: a9306887eba4 ("iio: adc: ti-ads1119: Add driver") Signed-off-by: Javier Carrasco Reviewed-by: Francesco Dolcini Link: https://patch.msgid.link/20241202-ti-ads1119_s16_chan-v1-1-fafe3136dc90@gmail.com Cc: Signed-off-by: Jonathan Cameron

iio: temperature: tmp006: fix information leak in triggered buffer

2024-12-08T16:51:35Z

The 'scan' local struct is used to push data to user space from a triggered buffer, but it has a hole between the two 16-bit data channels and the timestamp. This hole is never initialized. Initialize the struct to zero before using it to avoid pushing uninitialized information to userspace. Fixes: 91f75ccf9f03 ("iio: temperature: tmp006: add triggered buffer support") Signed-off-by: Javier Carrasco Link: https://patch.msgid.link/20241204-iio_memset_scan_holes-v2-1-3f941592a76d@gmail.com Signed-off-by: Jonathan Cameron

iio: inkern: call iio_device_put() only on mapped devices

2024-12-08T16:49:09Z

In the error path of iio_channel_get_all(), iio_device_put() is called on all IIO devices, which can cause a refcount imbalance. Fix this error by calling iio_device_put() only on IIO devices whose refcounts were previously incremented by iio_device_get(). Fixes: 314be14bb893 ("iio: Rename _st_ functions to loose the bit that meant the staging version.") Signed-off-by: Joe Hattori Link: https://patch.msgid.link/20241204111342.1246706-1-joe@pf.is.s.u-tokyo.ac.jp Cc: Signed-off-by: Jonathan Cameron

iio: adc: ad9467: Fix the "don't allow reading vref if not available" case

2024-12-07T17:57:19Z

The commit in Fixes adds a special case when only one possible scale is available. If several scales are available, it sets the .read_avail field of the struct iio_info to ad9467_read_avail(). However, this field already holds this function pointer, so the code is a no-op. Use another struct iio_info instead to actually reflect the intent described in the commit message. This way, the structure to use is selected at runtime and they can be kept as const. This is safer because modifying static structs that are shared between all instances like this, based on the properties of a single instance, is asking for trouble down the road. Fixes: b92f94f74826 ("iio: adc: ad9467: don't allow reading vref if not available") Signed-off-by: Christophe JAILLET Link: https://patch.msgid.link/cc65da19e0578823d29e11996f86042e84d5715c.1733503146.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jonathan Cameron

iio: adc: at91: call input_free_device() on allocated iio_dev

2024-12-07T17:28:39Z

Current implementation of at91_ts_register() calls input_free_deivce() on st->ts_input, however, the err label can be reached before the allocated iio_dev is stored to st->ts_input. Thus call input_free_device() on input instead of st->ts_input. Fixes: 84882b060301 ("iio: adc: at91_adc: Add support for touchscreens without TSMR") Signed-off-by: Joe Hattori Link: https://patch.msgid.link/20241207043045.1255409-1-joe@pf.is.s.u-tokyo.ac.jp Cc: Signed-off-by: Jonathan Cameron

iio: adc: ad7173: fix using shared static info struct

2024-12-07T17:23:42Z

Fix a possible race condition during driver probe in the ad7173 driver due to using a shared static info struct. If more that one instance of the driver is probed at the same time, some of the info could be overwritten by the other instance, leading to incorrect operation. To fix this, make the static info struct const so that it is read-only and make a copy of the info struct for each instance of the driver that can be modified. Reported-by: Uwe Kleine-König Fixes: 76a1e6a42802 ("iio: adc: ad7173: add AD7173 driver") Signed-off-by: David Lechner Tested-by: Guillaume Ranquet Link: https://patch.msgid.link/20241127-iio-adc-ad7313-fix-non-const-info-struct-v2-1-b6d7022b7466@baylibre.com Cc: Signed-off-by: Jonathan Cameron

iio: adc: ti-ads124s08: Use gpiod_set_value_cansleep()

2024-12-07T17:23:42Z

Using gpiod_set_value() to control the reset GPIO causes some verbose warnings during boot when the reset GPIO is controlled by an I2C IO expander. As the caller can sleep, use the gpiod_set_value_cansleep() variant to fix the issue. Tested on a custom i.MX93 board with a ADS124S08 ADC. Cc: stable@kernel.org Fixes: e717f8c6dfec ("iio: adc: Add the TI ads124s08 ADC code") Signed-off-by: Fabio Estevam Link: https://patch.msgid.link/20241122164308.390340-1-festevam@gmail.com Signed-off-by: Jonathan Cameron

iio: adc: ti-ads1119: fix information leak in triggered buffer

2024-12-07T17:23:42Z

The 'scan' local struct is used to push data to user space from a triggered buffer, but it has a hole between the sample (unsigned int) and the timestamp. This hole is never initialized. Initialize the struct to zero before using it to avoid pushing uninitialized information to userspace. Cc: stable@vger.kernel.org Fixes: a9306887eba4 ("iio: adc: ti-ads1119: Add driver") Signed-off-by: Javier Carrasco Reviewed-by: Francesco Dolcini Link: https://patch.msgid.link/20241125-iio_memset_scan_holes-v1-2-0cb6e98d895c@gmail.com Signed-off-by: Jonathan Cameron