kernel/linux.git/drivers/iio/buffer, branch v5.10.259

iio: buffer: hw-consumer: fix use-after-free in error path

2026-06-19T11:21:28+00:00

commit 6f5ed4f2c7c83f33344e0ba179f72a12e5dad4a4 upstream. In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code was using list_for_each_entry() to iterate through buffers while calling iio_buffer_put() which can free the current buffer if refcount drops to 0. The list_for_each_entry() loop macro then evaluates buf->head.next to continue iteration, accessing the freed buffer. Fix this by using list_for_each_entry_safe(). Fixes: 48b66f8f936f ("iio: Add hardware consumer buffer support") Reported-by: sashiko Closes: https://sashiko.dev/#/patchset/20260427-iio_buf-v1-1-2bbdac844647%40gmail.com Signed-off-by: Felix Gu Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Reviewed-by: Maxwell Doose Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman

iio: buffer-dmaengine: fix releasing dma channel on error

2024-09-12T09:06:50+00:00

commit 84c65d8008764a8fb4e627ff02de01ec4245f2c4 upstream. If dma_get_slave_caps() fails, we need to release the dma channel before returning an error to avoid leaking the channel. Fixes: 2d6ca60f3284 ("iio: Add a DMAengine framework based buffer") Signed-off-by: David Lechner Link: https://patch.msgid.link/20240723-iio-fix-dmaengine-free-on-error-v1-1-2c7cbc9b92ff@baylibre.com Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman

iio: buffer: Kconfig: add title for IIO_TRIGGERED_BUFFER symbol

2020-09-29T16:27:08+00:00

For some embedded systems, a workflow involving external kernel modules that implement IIO devices is more practical than working with in-tree sources. Kconfig symbols without any titles do not show up in menuconfig, and as such are more difficult to configure granularly, as they need to be selected by potentially unused/un-needed drivers. This change adds a title to the IIO_TRIGGERED_BUFFER Kconfig symbol. Signed-off-by: Alexandru Ardelean Link: https://lore.kernel.org/r/20200924111758.196367-4-alexandru.ardelean@analog.com Signed-off-by: Jonathan Cameron

iio: dma-buffer: Kconfig: Provide titles for IIO DMA Kconfig symbols

2020-09-29T16:27:08+00:00

For some embedded systems, a workflow involving external kernel modules that implement IIO devices is more practical than working with in-tree sources. Kconfig symbols without any titles do not show up in menuconfig, and as such are more difficult to configure granularly, as they need to be selected by potentially unused/un-needed drivers. This change adds titles to the IIO DMA Kconfig symbols to address this. This change also updates DMAengine -> DMAEngine, which is the correct/nitpick-y name of the framework. Signed-off-by: Alexandru Ardelean Link: https://lore.kernel.org/r/20200924111758.196367-2-alexandru.ardelean@analog.com Signed-off-by: Jonathan Cameron

iio: buffer-dmaengine: remove non managed alloc/free

2020-09-29T16:27:06+00:00

This is to encourage the use of devm_iio_dmaengine_buffer_alloc(). Currently the managed version of the DMAEngine buffer alloc is the only function used from this part of the framework. Signed-off-by: Alexandru Ardelean Link: https://lore.kernel.org/r/20200923121810.944075-1-alexandru.ardelean@analog.com Signed-off-by: Jonathan Cameron

iio: buffer-dmaengine: adjust `bytes_used` with residue info

2020-09-03T18:40:58+00:00

A transfer may fall shorter than the bytes in the block. This information is available in the residue from the DMA engine, so we can compute actual `bytes_used` with that by subtracting the residue. Signed-off-by: Alexandru Ardelean Signed-off-by: Lars-Peter Clausen Link: https://lore.kernel.org/r/20200826052011.13348-1-lars@metafoo.de Signed-off-by: Jonathan Cameron

iio: Move attach/detach of the poll func to the core

2020-06-20T16:34:44+00:00

All devices using a triggered buffer need to attach and detach the trigger to the device in order to properly work. Instead of doing this in each and every driver by hand move this into the core. At this point in time, all drivers should have been resolved to attach/detach the poll-function in the same order. This patch removes all explicit calls of iio_triggered_buffer_postenable() & iio_triggered_buffer_predisable() in all drivers, since the core handles now the pollfunc attach/detach. The more peculiar change is for the 'at91-sama5d2_adc' driver, since it's not immediately obvious that removing the hooks doesn't break anything. Eugen was able to test on at91-sama5d2-adc driver, sama5d2-xplained board. All seems to be fine. Signed-off-by: Lars-Peter Clausen Signed-off-by: Alexandru Ardelean Tested-by: Eugen Hristev #for at91-sama5d2-adc Signed-off-by: Jonathan Cameron

iio: buffer: drop devm_iio_kfifo_free() API call

2020-04-19T15:56:38+00:00

It's unused so far, so it can be removed. Also makes sense to remove it to discourage weird uses of this call during review. Signed-off-by: Alexandru Ardelean Signed-off-by: Jonathan Cameron

iio: buffer: drop devm_iio_hw_consumer_free() API call

2020-04-19T15:56:37+00:00

It's unused so far, so it can be removed. Also makes sense to remove it to discourage weird uses of this call during review. Signed-off-by: Alexandru Ardelean Signed-off-by: Jonathan Cameron

iio: core: drop devm_iio_triggered_buffer_cleanup() API call

2020-04-19T15:56:35+00:00

It's unused so far, so it can be removed. Also makes sense to remove it to discourage weird uses of this call during review. Signed-off-by: Alexandru Ardelean Signed-off-by: Jonathan Cameron