kernel/linux.git/drivers/iio/buffer, branch v6.18.35

iio: buffer: hw-consumer: fix use-after-free in error path

2026-06-09T10:28:39+00:00

commit 6f5ed4f2c7c83f33344e0ba179f72a12e5dad4a4 upstream. In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code was using list_for_each_entry() to iterate through buffers while calling iio_buffer_put() which can free the current buffer if refcount drops to 0. The list_for_each_entry() loop macro then evaluates buf->head.next to continue iteration, accessing the freed buffer. Fix this by using list_for_each_entry_safe(). Fixes: 48b66f8f936f ("iio: Add hardware consumer buffer support") Reported-by: sashiko Closes: https://sashiko.dev/#/patchset/20260427-iio_buf-v1-1-2bbdac844647%40gmail.com Signed-off-by: Felix Gu Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Reviewed-by: Maxwell Doose Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman

iio: buffer-dmaengine: enable .get_dma_dev()

2025-10-13T07:38:08+00:00

Wire up the .get_dma_dev() callback to use the DMA buffer infrastructure's implementation. This ensures that DMABUF operations use the correct DMA device for mapping, which is essential for proper operation on systems where memory is mapped above the 32-bit range. Without this callback, the core would fall back to using the IIO device's parent, which may not have the appropriate DMA mask configuration for high memory access. Fixes: 7a86d469983a ("iio: buffer-dmaengine: Support new DMABUF based userspace API") Reviewed-by: David Lechner Signed-off-by: Nuno Sá Cc: Signed-off-by: Jonathan Cameron

iio: buffer-dma: support getting the DMA channel

2025-10-13T07:38:08+00:00

Implement the .get_dma_dev() callback for DMA buffers by returning the device that owns the DMA channel. This allows the core DMABUF infrastructure to properly map DMA buffers using the correct device, avoiding the need for bounce buffers on systems where memory is mapped above the 32-bit range. The function returns the DMA queue's device, which is the actual device responsible for DMA operations in buffer-dma implementations. Cc: stable@vger.kernel.org Reviewed-by: David Lechner Signed-off-by: Nuno Sá Signed-off-by: Jonathan Cameron

iio: buffer: buffer-cb: drop double initialization of demux list

2025-08-16T10:57:06+00:00

Drop the call to INIT_LIST_HEAD(&cb_buff->buffer.demux_list). That's already done in iio_buffer_init(&cb_buff->buffer). Signed-off-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250725-iio-minor-cleanup-v1-1-4e561372142e@analog.com Signed-off-by: Jonathan Cameron

iio: buffer: Fix checkpatch.pl warning

2025-06-09T06:45:35+00:00

Remove the following trivial warning: "WARNING: Block comments should align the * on each line" Signed-off-by: Gyeyoung Baek Link: https://patch.msgid.link/20250519-timestamp-v1-1-fcb4f6c2721c@gmail.com Signed-off-by: Jonathan Cameron

iio: buffer-dma: Fix docstrings

2025-03-04T14:49:31+00:00

Fix a typo in the docstring of iio_dma_buffer_read() and fix what looks like a copy-and-paste error in the iio_dma_buffer_write() docstring. Signed-off-by: Folker Schwesinger Reviewed-by: Nuno Sá Link: https://patch.msgid.link/D83IPSTKYWNB.1PUBV1530XI86@folker-schwesinger.de Signed-off-by: Jonathan Cameron

iio: buffer-dmaengine: add devm_iio_dmaengine_buffer_setup_with_handle()

2025-02-10T18:47:49+00:00

Add a new devm_iio_dmaengine_buffer_setup_with_handle() function to handle cases where the DMA channel is managed by the caller rather than being requested and released by the iio_dmaengine module. Reviewed-by: Nuno Sa Signed-off-by: David Lechner Link: https://patch.msgid.link/20250207-dlech-mainline-spi-engine-offload-2-v8-9-e48a489be48c@baylibre.com Signed-off-by: Jonathan Cameron

iio: buffer-dmaengine: split requesting DMA channel from allocating buffer

2025-02-10T18:47:29+00:00

Refactor the IIO dmaengine buffer code to split requesting the DMA channel from allocating the buffer. We want to be able to add a new function where the IIO device driver manages the DMA channel, so these two actions need to be separate. To do this, calling dma_request_chan() is moved from iio_dmaengine_buffer_alloc() to iio_dmaengine_buffer_setup_ext(). A new __iio_dmaengine_buffer_setup_ext() helper function is added to simplify error unwinding and will also be used by a new function in a later patch. iio_dmaengine_buffer_free() now only frees the buffer and does not release the DMA channel. A new iio_dmaengine_buffer_teardown() function is added to unwind everything done in iio_dmaengine_buffer_setup_ext(). This keeps things more symmetrical with obvious pairs alloc/free and setup/teardown. Calling dma_get_slave_caps() in iio_dmaengine_buffer_alloc() is moved so that we can avoid any gotos for error unwinding. Reviewed-by: Nuno Sa Signed-off-by: David Lechner Link: https://patch.msgid.link/20250207-dlech-mainline-spi-engine-offload-2-v8-8-e48a489be48c@baylibre.com Signed-off-by: Jonathan Cameron

iio: buffer-dmaengine: document iio_dmaengine_buffer_setup_ext

2024-12-07T17:47:58+00:00

The iio_dmaengine_buffer_setup_ext() function is public and should be documented. Also, while touching this, fix the description of @dev in related functions. @dev does not strictly have to be the parent of the IIO device. It is only passed to dma_request_chan() so strictly speaking, it can be any device that is a valid DMA channel consumer. Signed-off-by: David Lechner Link: https://patch.msgid.link/20241115-dlech-mainline-spi-engine-offload-2-v5-9-bea815bd5ea5@baylibre.com Signed-off-by: Jonathan Cameron

module: Convert symbol namespace to string literal

2024-12-02T19:34:44+00:00

Clean up the existing export namespace code along the same lines of commit 33def8498fdd ("treewide: Convert macro and uses of __section(foo) to __section("foo")") and for the same reason, it is not desired for the namespace argument to be a macro expansion itself. Scripted using git grep -l -e MODULE_IMPORT_NS -e EXPORT_SYMBOL_NS | while read file; do awk -i inplace ' /^#define EXPORT_SYMBOL_NS/ { gsub(/__stringify$ns$/, "ns"); print; next; } /^#define MODULE_IMPORT_NS/ { gsub(/__stringify$ns$/, "ns"); print; next; } /MODULE_IMPORT_NS/ { $0 = gensub(/MODULE_IMPORT_NS$([^)]*)$/, "MODULE_IMPORT_NS(\"\\1\")", "g"); } /EXPORT_SYMBOL_NS/ { if ($0 ~ /(EXPORT_SYMBOL_NS[^(]*)$([^,]+),/) { if ($0 !~ /(EXPORT_SYMBOL_NS[^(]*)\(([^,]+), ([^)]+)$/ && $0 !~ /(EXPORT_SYMBOL_NS[^(]*)/ && $0 !~ /^my/) { getline line; gsub(/[[:space:]]*\\$/, ""); gsub(/[[:space:]]/, "", line); $0 = $0 " " line; } $0 = gensub(/(EXPORT_SYMBOL_NS[^(]*)$([^,]+), ([^)]+)$/, "\\1(\\2, \"\\3\")", "g"); } } { print }' $file; done Requested-by: Masahiro Yamada Signed-off-by: Peter Zijlstra (Intel) Link: https://mail.google.com/mail/u/2/#inbox/FMfcgzQXKWgMmjdFwwdsfgxzKpVHWPlc Acked-by: Greg KH Signed-off-by: Linus Torvalds