kernel/linux.git/drivers/iio/pressure, branch v7.0.12

iio: pressure: bmp280: fix stack leak in bmp580 trigger handler

2026-06-09T10:32:30+00:00

commit 387c86b582e0782ab332e7bfcd4e6e3f93922961 upstream. bmp580_trigger_handler() declares its scan buffer on the stack without an initializer and then memcpy()s 3 bytes of 24-bit sensor data into each 4-byte __le32 field. The high byte of comp_temp and comp_press is left uninitialized, and the channel storagebits is 32, so two bytes of stack are pushed to userspace per scan. This is a regression from when the buffer lived in the private data, the move to a stack-local struct dropped the implicit zeroing. bme280_trigger_handler() was fixed up to handle this bug, but this driver was not fixed because there was no padding hole, but rather a short-fill issue. Fix this all by just zero-initializing the structure on the stack. Cc: Jonathan Cameron Cc: David Lechner Cc: "Nuno Sá" Cc: Andy Shevchenko Fixes: 872c8014e05e ("iio: pressure: bmp280: drop sensor_data array") Cc: stable Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman Reviewed-by: David Lechner Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman

iio: pressure: abp2030pa: Remove IRQF_ONESHOT from devm_request_irq()

2026-03-01T11:20:10+00:00

Since commit aef30c8d569c ("genirq: Warn about using IRQF_ONESHOT without a threaded handler"), the IRQ core checks IRQF_ONESHOT flag in IRQ request and gives a warning if there is no threaded handler. Remove IRQF_ONESHOT from devm_request_irq(). Fixes: 47d323ce1e89 ("iio: pressure: add Honeywell ABP2 driver") Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Felix Gu Tested-by: Petre Rodan Signed-off-by: Jonathan Cameron

iio: Replace IRQF_ONESHOT with IRQF_NO_THREAD

2026-01-29T16:11:50+00:00

Passing IRQF_ONESHOT ensures that the interrupt source is masked until the secondary (threaded) handler is done. If only a primary handler is used then the flag makes no sense because the interrupt can not fire (again) while its handler is running. The flag also disallows force-threading of the primary handler and the irq-core will warn about this. The intention here was probably not allowing forced-threading for handlers such as iio_trigger_generic_data_rdy_poll() will intends to invoke hard-interrupt handlers. Replace IRQF_ONESHOT with IRQF_NO_THREAD. Reviewed-by: Andy Shevchenko Reviewed-by: Marcus Folkesson Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Jonathan Cameron

iio: pressure: mprls0025pa: remove error message

2026-01-22T20:53:18+00:00

Do not print a duplicate error message if devm_request_irq() fails. Signed-off-by: Petre Rodan Suggested-by: Andy Shevchenko Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron

iio: pressure: mprls0025pa: add copyright line

2026-01-16T17:40:41+00:00

Add copyright line to the core driver. Signed-off-by: Petre Rodan Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron

iio: pressure: mprls0025pa: change measurement sequence

2026-01-16T17:40:41+00:00

Implement a measurement sequence that does not involve a one byte read of the status byte before reading the conversion. The sensor's conversions should be read either once the EoC interrupt has triggered or 5ms after the 0xaa command. See Options 1 and 2 respectively in Tables 16 (page 15) and 18 (page 18) of the datasheet. Note that Honeywell's example code also covered in the datasheet follows Option 2 for both i2c and SPI. The datasheet does not specify any of the retry parameters that are currently implemented in the driver. A simple 5+ms sleep as specified in Option 2 is enough for a valid measurement sequence. The change also gets rid of the code duplication tied to the verification of the status byte. This change only affects users that do not define the EoC interrupt in the device tree. Datasheet: https://prod-edam.honeywell.com/content/dam/honeywell-edam/sps/siot/en-us/products/sensors/pressure-sensors/board-mount-pressure-sensors/micropressure-mpr-series/documents/sps-siot-mpr-series-datasheet-32332628-ciid-172626.pdf?download=false Signed-off-by: Petre Rodan Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron

iio: pressure: mprls0025pa: stricter checks for the status byte

2026-01-16T17:40:41+00:00

Make sure a valid conversion comes with a status byte that only has the MPR_ST_POWER bit set. Return -EBUSY if also MPR_ST_BUSY is set or -EIO otherwise. Reviewed-by: Marcelo Schmitt Signed-off-by: Petre Rodan Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron

iio: pressure: mprls0025pa: move memset to core

2026-01-16T17:40:41+00:00

Move memset() from the bus specific code into core. Zeroing out the buffer is performed because the sensor has noticeable latch-up sensitivity and in some cases it clamps the MISO signal to GND in sync with SCLK [1]. A raw conversion of zero is out of bounds since valid values have to be between output_min and output_max (and the smallest output_min is 2.5% of 2^24 = 419430). The user is expected to discard out of bounds pressure values. Given the fact that we can't follow the behaviour of all SPI controllers when faced to this clamping of an output signal, a raw conversion of zero is used as an early warning in case the low level SPI API reacts unexpectedly. Link: https://e2e.ti.com/support/processors-group/processors/f/processors-forum/1588325/am3358-spi-tx-data-corruption [1] Signed-off-by: Petre Rodan Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron

iio: pressure: mprls0025pa: introduce tx buffer

2026-01-16T17:40:40+00:00

Use a tx_buf that is part of the priv struct for transferring data to the sensor instead of relying on a devm_kzalloc()-ed array. Remove the .init operation in the process. Reviewed-by: Marcelo Schmitt Signed-off-by: Petre Rodan Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron

iio: pressure: mprls0025pa: rename buffer variable

2026-01-16T17:40:40+00:00

For the reason of better naming consistency rename priv->buffer into priv->rx_buf since tx_buf will get introduced in the next patch. Signed-off-by: Petre Rodan Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Cameron