linux-toradex.git/drivers/iio, branch v5.17

Merge tag 'iio-fixes-for-5.17a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus

2022-02-21T16:58:09+00:00

Jonathan writes:

1st set of IIO fixes for the 5.17 cycle.

Several drivers:
 - Fix a failure to disable runtime in probe error paths. All cases
   were introduced in the same rework patch.

adi,ad7124
 - Fix incorrect register masking.
adi,ad74413r
 - Avoid referencing negative array offsets.
 - Use ngpio size when iterating over mask not numebr of channels.
 - Fix issue with wrong mask uage getting GPIOs.
adi,admv1014
 - Drop check on unsigned less than 0.
adi,ads16480
 - Correctly handle devices that don't have burst mode support.
fsl,fxls8962af
 - Add missing padding needed between address and data for SPI transfers.
men_z188
 - Fix iomap leak in error path.
st,lsm6dsx
 - Wait for setting time in oneshot reads to get a stable result.
ti,tsc2046
 - Prevent an array overflow.

* tag 'iio-fixes-for-5.17a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio:
  iio: imu: st_lsm6dsx: wait for settling time in st_lsm6dsx_read_oneshot
  iio: Fix error handling for PM
  iio: addac: ad74413r: correct comparator gpio getters mask usage
  iio: addac: ad74413r: use ngpio size when iterating over mask
  iio: addac: ad74413r: Do not reference negative array offsets
  iio: adc: men_z188_adc: Fix a resource leak in an error handling path
  iio: frequency: admv1013: remove the always true condition
  iio: accel: fxls8962af: add padding to regmap for SPI
  iio:imu:adis16480: fix buffering for devices with no burst mode
  iio: adc: ad7124: fix mask used for setting AIN_BUFP & AIN_BUFM bits
  iio: adc: tsc2046: fix memory corruption by preventing array overflow

iio: buffer: Fix file related error handling in IIO_BUFFER_GET_FD_IOCTL

2022-02-11T11:13:22+00:00

If we fail to copy the just created file descriptor to userland, we
try to clean up by putting back 'fd' and freeing 'ib'. The code uses
put_unused_fd() for the former which is wrong, as the file descriptor
was already published by fd_install() which gets called internally by
anon_inode_getfd().

This makes the error handling code leaving a half cleaned up file
descriptor table around and a partially destructed 'file' object,
allowing userland to play use-after-free tricks on us, by abusing
the still usable fd and making the code operate on a dangling
'file->private_data' pointer.

Instead of leaving the kernel in a partially corrupted state, don't
attempt to explicitly clean up and leave this to the process exit
path that'll release any still valid fds, including the one created
by the previous call to anon_inode_getfd(). Simply return -EFAULT to
indicate the error.

Fixes: f73f7f4da581 ("iio: buffer: add ioctl() to support opening extra buffers for IIO device")
Cc: stable@kernel.org
Cc: Jonathan Cameron 
Cc: Alexandru Ardelean 
Cc: Lars-Peter Clausen 
Cc: Nuno Sa 
Reported-by: Dan Carpenter 
Signed-off-by: Mathias Krause 
Reviewed-by: Jonathan Cameron 
Signed-off-by: Greg Kroah-Hartman

iio: imu: st_lsm6dsx: wait for settling time in st_lsm6dsx_read_oneshot

2022-02-07T20:45:49+00:00

We need to wait for sensor settling time (~ 3/ODR) before reading data
in st_lsm6dsx_read_oneshot routine in order to avoid corrupted samples.

Fixes: 290a6ce11d93 ("iio: imu: add support to lsm6dsx driver")
Reported-by: Mario Tesi 
Tested-by: Mario Tesi 
Signed-off-by: Lorenzo Bianconi 
Link: https://lore.kernel.org/r/b41ebda5535895298716c76d939f9f165fcd2d13.1644098120.git.lorenzo@kernel.org
Cc: 
Signed-off-by: Jonathan Cameron

iio: Fix error handling for PM

2022-01-30T14:50:34+00:00

The pm_runtime_enable will increase power disable depth.
If the probe fails, we should use pm_runtime_disable() to balance
pm_runtime_enable(). In the PM Runtime docs:
    Drivers in ->remove() callback should undo the runtime PM changes done
    in ->probe(). Usually this means calling pm_runtime_disable(),
    pm_runtime_dont_use_autosuspend() etc.
We should do this in error handling.

Fix this problem for the following drivers: bmc150, bmg160, kmx61,
kxcj-1013, mma9551, mma9553.

Fixes: 7d0ead5c3f00 ("iio: Reconcile operation order between iio_register/unregister and pm functions")
Signed-off-by: Miaoqian Lin 
Reviewed-by: Andy Shevchenko 
Link: https://lore.kernel.org/r/20220106112309.16879-1-linmq006@gmail.com
Cc: 
Signed-off-by: Jonathan Cameron

iio: addac: ad74413r: correct comparator gpio getters mask usage

2022-01-30T14:23:33+00:00

The value of the GPIOs is currently altered using offsets rather
than masks. Make use of __assign_bit and the BIT macro to turn
the offsets into masks.

Fixes: fea251b6a5db ("iio: addac: add AD74413R driver")
Signed-off-by: Cosmin Tanislav 
Reviewed-by: Andy Shevchenko 
Link: https://lore.kernel.org/r/20220111074703.3677392-2-cosmin.tanislav@analog.com
Signed-off-by: Jonathan Cameron

iio: addac: ad74413r: use ngpio size when iterating over mask

2022-01-30T14:22:21+00:00

ngpio is the actual number of GPIOs handled by the GPIO chip,
as opposed to the max number of GPIOs.

Fixes: fea251b6a5db ("iio: addac: add AD74413R driver")
Signed-off-by: Cosmin Tanislav 
Reviewed-by: Andy Shevchenko 
Link: https://lore.kernel.org/r/20220111074703.3677392-1-cosmin.tanislav@analog.com
Signed-off-by: Jonathan Cameron

iio: addac: ad74413r: Do not reference negative array offsets

2022-01-30T14:19:20+00:00

Instead of aiming rx_buf at an invalid array-boundary-crossing location,
just skip the first increment. Seen when building with -Warray-bounds:

drivers/iio/addac/ad74413r.c: In function 'ad74413r_update_scan_mode':
drivers/iio/addac/ad74413r.c:843:22: warning: array subscript -4 is below array bounds of 'u8[16]' { aka 'unsigned char[16]'} [-Warray-bounds]
  843 |         u8 *rx_buf = &st->adc_samples_buf.rx_buf[-1 * AD74413R_FRAME_SIZE];
      |                      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/iio/addac/ad74413r.c:84:20: note: while referencing 'rx_buf'
   84 |                 u8 rx_buf[AD74413R_FRAME_SIZE * AD74413R_CHANNEL_MAX];
      |                    ^~~~~~

Cc: Lars-Peter Clausen 
Cc: Michael Hennerich 
Cc: Jonathan Cameron 
Cc: linux-iio@vger.kernel.org
Fixes: fea251b6a5db ("iio: addac: add AD74413R driver")
Reviewed-by: Cosmin Tanislav 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220112203456.3950884-1-keescook@chromium.org
Signed-off-by: Jonathan Cameron

iio: adc: men_z188_adc: Fix a resource leak in an error handling path

2022-01-30T13:51:24+00:00

If iio_device_register() fails, a previous ioremap() is left unbalanced.

Update the error handling path and add the missing iounmap() call, as
already done in the remove function.

Fixes: 74aeac4da66f ("iio: adc: Add MEN 16z188 ADC driver")
Signed-off-by: Christophe JAILLET 
Link: https://lore.kernel.org/r/320fc777863880247c2aff4a9d1a54ba69abf080.1643445149.git.christophe.jaillet@wanadoo.fr
Cc: 
Signed-off-by: Jonathan Cameron

iio: frequency: admv1013: remove the always true condition

2022-01-30T11:50:16+00:00

unsigned int variable is always greater than or equal to zero. Make the
if condition simple.

Signed-off-by: Muhammad Usama Anjum 
Fixes: da35a7b526d9 ("iio: frequency: admv1013: add support for ADMV1013")
Link: https://lore.kernel.org/r/YdS3gJYtECMaDDjA@debian-BULLSEYE-live-builder-AMD64
Signed-off-by: Jonathan Cameron

iio: accel: fxls8962af: add padding to regmap for SPI

2022-01-23T18:23:48+00:00

Add missing don't care padding between address and
data for SPI transfers

Fixes: a3e0b51884ee ("iio: accel: add support for FXLS8962AF/FXLS8964AF accelerometers")
Signed-off-by: Sean Nyekjaer 
Link: https://lore.kernel.org/r/20211220125144.3630539-1-sean@geanix.com
Cc: 
Signed-off-by: Jonathan Cameron