kernel/linux.git/drivers/iio/buffer, branch v7.0.12

iio: buffer: hw-consumer: fix use-after-free in error path

2026-06-09T10:32:37+00:00

commit 6f5ed4f2c7c83f33344e0ba179f72a12e5dad4a4 upstream. In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code was using list_for_each_entry() to iterate through buffers while calling iio_buffer_put() which can free the current buffer if refcount drops to 0. The list_for_each_entry() loop macro then evaluates buf->head.next to continue iteration, accessing the freed buffer. Fix this by using list_for_each_entry_safe(). Fixes: 48b66f8f936f ("iio: Add hardware consumer buffer support") Reported-by: sashiko Closes: https://sashiko.dev/#/patchset/20260427-iio_buf-v1-1-2bbdac844647%40gmail.com Signed-off-by: Felix Gu Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Reviewed-by: Maxwell Doose Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman

Convert 'alloc_flex' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This is the exact same thing as the 'alloc_obj()' version, only much smaller because there are a lot fewer users of the *alloc_flex() interface. As with alloc_obj() version, this was done entirely with mindless brute force, using the same script, except using 'flex' in the pattern rather than 'objs*'. Signed-off-by: Linus Torvalds

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

iio: buffer-dmaengine: Fix coding style complains

2025-12-21T12:01:55+00:00

Just making sure checkpatch is happy. No functional change intended. Signed-off-by: Nuno Sá Signed-off-by: Jonathan Cameron

iio: buffer-dmaengine: Use the cleanup.h API

2025-12-21T12:01:00+00:00

Make use of the cleanup.h API for locks in order to simplify some code paths. Signed-off-by: Nuno Sá Signed-off-by: Jonathan Cameron

iio: buffer-dma: Fix coding style complains

2025-12-21T12:00:27+00:00

Just making sure checkpatch is happy. No functional change intended. Signed-off-by: Nuno Sá Signed-off-by: Jonathan Cameron

iio: buffer-dma: Turn iio_dma_buffer_init() void

2025-12-21T11:58:01+00:00

iio_dma_buffer_init() always return 0. Therefore there's no point in returning int. While at it, fix a mismatch between the function declaration and definition regarding the struct device (dma_dev != dev). Signed-off-by: Nuno Sá Signed-off-by: Jonathan Cameron

iio: buffer-dma: Use the cleanup.h API

2025-12-21T11:55:12+00:00

Make use of the cleanup.h API for locks and memory allocation in order to simplify some code paths. Signed-off-by: Nuno Sá Signed-off-by: Jonathan Cameron

iio: buffer-dma: Use lockdep for locking annotations

2025-12-21T11:54:39+00:00

Don't use mutex_is_locked() + WARN_ON() for checking if a specif lock is taken. Instead use the existing annotations which means lockdep_assert_held(). Signed-off-by: Nuno Sá Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron