kernel/linux.git/drivers/iio/trigger, branch v6.1.168

iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()

2022-10-24T17:48:57+00:00

dev_set_name() allocates memory for name, it need be freed when device_add() fails, call put_device() to give up the reference that hold in device_initialize(), so that it can be freed in kobject_cleanup() when the refcount hit to 0. Fault injection test can trigger this: unreferenced object 0xffff8e8340a7b4c0 (size 32): comm "modprobe", pid 243, jiffies 4294678145 (age 48.845s) hex dump (first 32 bytes): 69 69 6f 5f 73 79 73 66 73 5f 74 72 69 67 67 65 iio_sysfs_trigge 72 00 a7 40 83 8e ff ff 00 86 13 c4 f6 ee ff ff r..@............ backtrace: [<0000000074999de8>] __kmem_cache_alloc_node+0x1e9/0x360 [<00000000497fd30b>] __kmalloc_node_track_caller+0x44/0x1a0 [<000000003636c520>] kstrdup+0x2d/0x60 [<0000000032f84da2>] kobject_set_name_vargs+0x1e/0x90 [<0000000092efe493>] dev_set_name+0x4e/0x70 Fixes: 1f785681a870 ("staging:iio:trigger sysfs userspace trigger rework.") Signed-off-by: Yang Yingliang Cc: Link: https://lore.kernel.org/r/20221022074212.1386424-1-yangyingliang@huawei.com Signed-off-by: Jonathan Cameron

Merge tag 'iio-for-5.20a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next

2022-07-14T13:04:49+00:00

Jonathan writes: IIO new device support, features and minor fixes for 5.20 Several on-running cleanup efforts dominate this time, plus the DMA safety alignment issue identified due to improved understanding of the restrictions as a result of Catalin Marinas' efforts in that area. One immutable branch in here due to MFD and SPMI elements needed for the qcom-rradc driver. Device support * bmi088 - Add support for bmi085 (accelerometer part of IMU) - Add support for bmi090l (accelerometer part of IMU) * mcp4922 - Add support for single channel device MCP4921 * rzg2l-adc - Add compatible and minor tweaks to support RZ/G2UL ADC * sca3300 - Add support for scl3300 including refactoring driver to support multiple device types and cleanup noticed whilst working on driver. * spmi-rradc - New driver for Qualcomm SPMI Round Robin ADC including necessary additional utility functions in SPMI core and related MFD driver. * ti-dac55781 - Add compatible for DAC121C081 which is very similar to existing parts. Features * core - Warn on iio_trigger_get() on an unregistered IIO trigger. * bma400 - Triggered buffer support - Activity and step counting - Misc driver improvements such as devm and header ordering * cm32181 - Add PM support. * cros_ec - Sensor location support * sx9324 - Add precharge resistor setting - Add internal compensation resistor setting - Add CS idle/sleep mode. * sx9360 - Add precharge resistor setting * vl53l0x - Handle reset GPIO, regulator and relax handling of irq type. Cleanup and minor fixes: Treewide changes - Cleanup of error handling in remove functions in many drivers. - Update dt-binding maintainers for a number of ADI bindings. - Several sets of conversion of drivers from device tree specific to generic device properties. Includes fixing up various related header and Kconfig issues. - Drop include of of.h from iio.h and fix up drivers that need to include it directly. - More moves of clusters of drivers into appropriate IIO_XXX namespaces. - Tree wide fix of a long running bug around DMA safety requirements. IIO was using __cacheline_aligned to pad iio_priv() structures. This worked for a long time by coincidence, but correct alignment is ARCH_KMALLOC_MINALIGN. As there is activity around this area, introduce an IIO local IIO_DMA_MINALIGN to allow for changing it in one place rather than every driver in future. Note, there have been no reports of this bug in the wild, and it may not happen on any platforms supported by upstream, so no rush to backport these fixes. Other cleanup * core - Switch to ida_alloc()/free() - Drop unused iio_get_time_res() - Octal permissions and DEVICE_ATTR_* macros. - Cleanup bared unsigned usage. * MAINTAINERS - Add include/dt-bindings/iio/ to the main IIO entry. * ad5380 - Comment syntax fix. * ad74413r - Call to for_each_set_bit_from(), with from value as 0 replaced. * ad7768-1 - Drop explicit setting of INDIO_BUFFER_TRIGGERED as now done by the core. * adxl345 - Fix wrong address in dt-binding example. * adxl367 - Drop extra update of FIFO watermark. * at91-sama5d2 - Limit requested watermark to the hwfifo size. * bmg160, bme680 - Typos * cio-dac - Switch to iomap rather than direct use of ioports * kxsd9 - Replace CONFIG_PM guards with new PM macros that let the compiler cleanly remove the unused code and structures when !CONFIG_PM * lsm6dsx - Use new pm_sleep_ptr() and EXPORT_SIMPLE_DEV_PM_OPS(). Then move to Namespace. * meson_saradc - general cleanup. - Avoid attaching resources to iio_dev->dev - Use same struct device for all error messages - Convert to dev_err_probe() and use local struct device *dev to reduce code complexity. - Use devm_clk_get_optional() instead of hand rolling. - Use regmap_read_poll_timeout() instead of hand rolling. * mma7660 - Drop ACPI_PTR() use that is unhelpful. * mpu3050 - Stop exporting symbols not used outside of module - Switch to new DEFINE_RUNTIME_DEV_PM_OPS() macro and move to Namespace. * ping - Typo fix * qcom-spmi-rradc - Typo fix * sc27xx - Convert to generic struct u32_fract * srf08 - Drop a redundant check on !val * st_lsm6dsx - Limit the requested watermark to the hwfifo size. * stm32-adc - Use generic_handle_domain_irq() instead of opencoding. - Fix handling of ADC disable. * stm32-dac - Use str_enabled_disable() instead of open coding. * stx104 - Switch to iomap rather than direct use of ioports * tsc2046 - Drop explicit setting of INDIO_BUFFER_TRIGGERED as now done by the core. * tsl2563 - Replace flush_scheduled_work() with cancel_delayed_work_sync() - Replace cancel_delayed_work() with cancel_delayed_work_sync() * vl53l0x - Make the VDD regulator optional by allowing a dummy regulator. * tag 'iio-for-5.20a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (244 commits) iio: adc: xilinx-xadc: Drop duplicate NULL check in xadc_parse_dt() iio: adc: xilinx-xadc: Make use of device properties iio: light: cm32181: Add PM support iio: adc: ad778-1: do not explicity set INDIO_BUFFER_TRIGGERED mode iio: adc: ti-tsc2046: do not explicity set INDIO_BUFFER_TRIGGERED mode iio: adc: stm32-adc: disable adc before calibration iio: adc: stm32-adc: make safe adc disable iio: dac: ad5380: align '*' each line and drop unneeded blank line iio: adc: qcom-spmi-rradc: Fix spelling mistake "coherrency" -> "coherency" iio: Don't use bare "unsigned" dt-bindings: iio: dac: mcp4922: expand for mcp4921 support iio: dac: mcp4922: add support to mcp4921 iio: chemical: sps30: Move symbol exports into IIO_SPS30 namespace iio: pressure: bmp280: Move symbol exports to IIO_BMP280 namespace iio: imu: bmi160: Move exported symbols to IIO_BMI160 namespace iio: adc: stm32-adc: Use generic_handle_domain_irq() proximity: vl53l0x: Make VDD regulator actually optional MAINTAINERS: add include/dt-bindings/iio to IIO SUBSYSTEM AND DRIVERS dt-bindings: iio/accel: Fix adi,adxl345/6 example I2C address iio: gyro: bmg160: Fix typo in comment ...

Merge tag 'iio-fixes-for-5.19a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next

2022-06-20T07:49:52+00:00

Jonathan writes: 1st set of IIO fixes for the 5.19 cycle. Most of these have been in next for a long time. Unfortunately there was one stray patch in the branch (wasn't a fix), so I've just rebased to remove that. * testing - Fix a missing MODULE_LICENSE() warning by restricting possible build configs. * Various drivers - Fix ordering of iio_get_trigger() being called before iio_trigger_register() * adi,admv1014 - Fix dubious x & !y warning. * adi,axi-adc - Fix missing of_node_put() in error and normal paths. * aspeed,adc - Add missing of_node_put() * fsl,mma8452 - Fix broken probing from device tree. - Drop check on return value of i2c write to device to cause reset as ACK will be missing (device reset before sending it). * fsl,vf610 - Fix documentation of in_conversion_mode ABI. * iio-trig-sysfs - Ensure irq work has finished before freeing the trigger. * invensense,mpu3050 - Disable regulators in error path. * invensense,icm42600 - Fix collision of enum value of 0 with error path where 0 is no match. * renesas,rzg2l_Adc - Add missing fwnode_handle_put() in error path. * rescale - Fix a boolean logic bug for detection of raw + scale affecting an obscure corner case. * semtech,sx9324 - Check return value of read of pin_defs * st,stm32-adc: - Fix interaction across ADC instances for some supported devices. - Drop false spurious IRQ messages. - Fix calibration value handling. If we can't calibrate don't expose the vref_int channel. - Fix maximum clock rate for stm32pm15x * ti,ads131e08 - Add missing fwnode_handle_put() in error paths. * xilinx,ams - Fix variable checked for error from platform_get_irq() * x-powers,axp288 - Overide TS_PIN bias current for boards where it is not correctly initialized. * yamaha,yas530 - Fix inverted check on calibration data being all zeros. * tag 'iio-fixes-for-5.19a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (26 commits) iio:proximity:sx9324: Check ret value of device_property_read_u32_array() iio: accel: mma8452: ignore the return value of reset operation iio: adc: stm32: fix maximum clock rate for stm32mp15x iio: adc: stm32: fix vrefint wrong calibration value handling iio: imu: inv_icm42600: Fix broken icm42600 (chip id 0 value) iio: adc: vf610: fix conversion mode sysfs node name iio: adc: adi-axi-adc: Fix refcount leak in adi_axi_adc_attach_client iio: test: fix missing MODULE_LICENSE for IIO_RESCALE=m iio:humidity:hts221: rearrange iio trigger get and register iio:chemical:ccs811: rearrange iio trigger get and register iio:accel:mxc4005: rearrange iio trigger get and register iio:accel:kxcjk-1013: rearrange iio trigger get and register iio:accel:bma180: rearrange iio trigger get and register iio: afe: rescale: Fix boolean logic bug iio: adc: aspeed: Fix refcount leak in aspeed_adc_set_trim_data iio: adc: stm32: Fix IRQs on STM32F4 by removing custom spurious IRQs message iio: adc: stm32: Fix ADCs iteration in irq handler iio: adc: ti-ads131e08: add missing fwnode_handle_put() in ads131e08_alloc_channels() iio: adc: rzg2l_adc: add missing fwnode_handle_put() in rzg2l_adc_parse_properties() iio: trigger: sysfs: fix use-after-free on remove ...

iio: trigger: sysfs: fix use-after-free on remove

2022-06-19T16:22:48+00:00

Ensure that the irq_work has completed before the trigger is freed. ================================================================== BUG: KASAN: use-after-free in irq_work_run_list Read of size 8 at addr 0000000064702248 by task python3/25 Call Trace: irq_work_run_list irq_work_tick update_process_times tick_sched_handle tick_sched_timer __hrtimer_run_queues hrtimer_interrupt Allocated by task 25: kmem_cache_alloc_trace iio_sysfs_trig_add dev_attr_store sysfs_kf_write kernfs_fop_write_iter new_sync_write vfs_write ksys_write sys_write Freed by task 25: kfree iio_sysfs_trig_remove dev_attr_store sysfs_kf_write kernfs_fop_write_iter new_sync_write vfs_write ksys_write sys_write ================================================================== Fixes: f38bc926d022 ("staging:iio:sysfs-trigger: Use irq_work to properly active trigger") Signed-off-by: Vincent Whitchurch Reviewed-by: Lars-Peter Clausen Link: https://lore.kernel.org/r/20220519091925.1053897-1-vincent.whitchurch@axis.com Cc: Signed-off-by: Jonathan Cameron

iio: trigger: stm32-lptimer-trigger: explicitly add proper header files

2022-06-14T10:53:21+00:00

Do not trust the fact that iio.h includes of.h which in turn includes all the headers we are relying on. The ultimate goal is to actually drop of.h from iio.h. Signed-off-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220610084545.547700-19-nuno.sa@analog.com Signed-off-by: Jonathan Cameron

iio: trigger: stm32-lptimer-trigger: Make use of device properties

2022-06-11T13:35:25+00:00

Convert the module to be property provider agnostic and allow it to be used on non-OF platforms. Signed-off-by: Andy Shevchenko Reviewed-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20220413185656.21994-1-andriy.shevchenko@linux.intel.com Signed-off-by: Jonathan Cameron

iio: sysfs-trigger: replace usage of found with dedicated list iterator variable

2022-04-04T08:11:25+00:00

To move the list iterator variable into the list_for_each_entry_*() macro in the future it should be avoided to use the list iterator variable after the loop body. To *never* use the list iterator variable after the loop it was concluded to use a separate iterator variable instead of a found boolean [1]. This removes the need to use a found variable and simply checking if the variable was set, can determine if the break/goto was hit. Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1] Signed-off-by: Jakob Koschel Reviewed-by: Nuno Sá Link: https://lore.kernel.org/r/20220331230632.957634-3-jakobkoschel@gmail.com Signed-off-by: Jonathan Cameron

iio:adc:stm32*: Use pm[_sleep]_ptr() etc to avoid need to make pm __maybe_unused

2022-02-21T19:33:04+00:00

The combinations of either * pm_sleep_ptr() and DEFINE_SIMPLE_DEV_PM_OPS() * pm_ptr() and RUNTIME_PM_OPS()/SYSTEM_SLEEP_PM_OPS Make sure the functions are always visible to the compiler and removed by it rather than requring #ifdef magic. This removes the need to mark the functions as __maybe_unused and saves additional space with some build options as the dev_pm_ops structure itself can be dropped automatically if CONFIG_PM is not enabled. Signed-off-by: Jonathan Cameron Cc: Olivier Moysan Cc: Fabrice Gasnier Reviewed-by: Fabrice Gasnier Reviewed-by: Paul Cercueil Link: https://lore.kernel.org/r/20220130193147.279148-51-jic23@kernel.org

iio: trigger: stm32-timer: Make use of device properties

2022-02-18T11:35:49+00:00

Convert the module to be property provider agnostic and allow it to be used on non-OF platforms. Signed-off-by: Andy Shevchenko Reviewed-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20220202204112.57095-1-andriy.shevchenko@linux.intel.com Signed-off-by: Jonathan Cameron

Merge tag 'iio-for-5.17a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next

2021-12-22T11:33:01+00:00

Jonathan writes: 1st set of IIO new device support, features and cleanup for 5.17 Includes some fixes that were either late breaking, low priority or complex enough to not be good to rush in late in the cycle. Tree rebased today to fix up some trivial issues + pull in a fix that was previously on the fixes-togreg branch. Vast majority have been in linux-next for some time now. New device support * adi,ad7293 - New driver and bindings for this Power Amplifier drain current controller. A complex device with various related monitoring functions. * adi,ad75513R - New driver and bindings for this combined ADC and DAC device. - A few follow up fixes. * adi,admv8818 - New driver (and type) for this 2-18GHz filter device. Includes bindings and ABI documentation to allow clk_notifier based auto adjustment of the filters in appropriate applications. * liteon,ltr501 - Support for the ltr303. ID and chip specific info table. * xilinx,ams - New generic firmware function fwnode_iomap() as used in this driver. - New driver and bindings for this ADC and on-chip sensors as found in various Xilinx devices. Core * Introduced IIO_VAL_INT_64 which uses val and val2 in IIO callbacks to form a 64 bit integer when higher precision needed. * Allow IIO_ENUM_AVAILABLE to be used with different shared values. * Fix a long term issue with scheduling whilst atomic when iio_trig_poll() is called but no trigger consumers are actually enabled and hence the trigger may be reenabled from the interrupt handler. Seen in the wild on the tsc2046. * Mark iio_device_type const. * buffer: Use a separate index variable to simplify code. * buffer-dma: Clear out unused struct iio_buffer_block * buffer-dmaengine: Switch to cheaper round_down() as power of 2 values. Tests/tools * format_value - Check against NULL returns from allocations in tests. - Add IIO_VAL_INT_64 test case. * event_monitor - Flush the output after event to given more consistent latency when tool output piped to other programs. Driver Features * axp20x - Add support for NTC thermistor channel and document TS pin binding. * arm,scmi - Add reading of raw channel values (using IIO_VAL_INT_64) * liteon,ltr501 - Add proximity-near-level support and dt-binding. Tree wide cleanup * Remove no-op trigger ops from multiple drivers. * Stop using dev_get_drvdata() on the iio_dev->dev in various drivers and then stop assigning it to allow this to be used for other purposes. We can always get to the indio_dev using dev_to_iio_dev() which is a container_of() based approach. Also cleanup up some related unnecessary convoluted cases. - atmel,at91-sam5d2 - nxp,imx7d - meas,ms5611 - st,st_sensors * Where available (or easy to introduce) use the scan_type.* values in place of a second copy for read_raw and similar paths. - adi,ad7266 - bosch,bma220 - fsl,mac3110 - fsl,mma7455 - fsl,mpl3115 - kionix,kcjk-1013 - sensortek,stk8ba50 - sensortek,stk8312 - ti,adc12138 - ti,ads1015 - vti,sca3000 - xilinx,xadc-core * Switch drives over to generic firmware properties including appropriate header changes to avoid including of.h - Various DACs had false CONFIG_OF dependencies. - dpot-dac - envelope-detector - adi,ad5755 - adi,ad5758 - capella,cm3605 - maxim,max9611 - microchip,mcp41010 - microchip,mcp3911 - ti,adc12138 * Trivial clang warning fixes for W=1 warnings. Driver specific cleanup and minor fixes * adi,ad7606 - Comment fixes. * ams,ad3935 - Drop pointless cast to the same type. * atmel,at91-sama5d2 - Fix wrong cast of iio_dev->dev to platform_device that happened to be harmless. * fsl,mma7660 - Stop i2c remove() function returning an error code. Part of a rework to eventually stop returning anything from these. * fsl,mma8452 - Use correct type for local irqreturn_t. * nxp,imx8mq - Maintainer email address update. * nxp,lpc18xx_adc - Ensure clk_prepare_enable() called before clk_get_rate(). - Switch of.h for mod_devicetable.h to reflect no of specific functions, just the id table. * renesas,rzg2l - Drop a dev_err() that just duplicates error printed in platform_get_irq() * sgx,vz89x - Drop pointless cast. * st,lsm6dsx - Make it possible to disable the sensorhub from DT to avoid a corner case where the address of a slave device many be accidentally modified. * st,stm32-adc - Stop leaking an of_node in an error path. * st,stmp2 - Avoid wrong sized type for bit field which could result in over-reading (harmless). Precursor to enabling -Warray-bounds. * ti,adc081c - Put back some ACPI support for non standards compliant ADC081C ID because it is known to be in the wild on some Aaeon boards. * ti,ads8688 - Cleanup redundant local ret variable assignment. * ti,ina2xx-adc - Use helper macro kthread_run() to replace some boilerplate. - Avoid double reference counting. - Drop pointless cast. * xilinx,xadc - Make the IRQ optional as not always wired to the host system. * tag 'iio-for-5.17a' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (103 commits) iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs iio:addac:ad74413r: Fix uninitialized ret in a path that won't be hit. MAINTAINERS: Add maintainer for xilinx-ams dt-bindings: iio: adc: Add Xilinx AMS binding documentation iio: adc: Add Xilinx AMS driver device property: Add fwnode_iomap() iio:accel:kxcjk-1013: Mark struct __maybe_unused to avoid warning. iio:accel:bmc150: Mark structure __maybe_unused as only needed with for pm ops. iio:dummy: Drop set but unused variable len. iio:magn:ak8975: Suppress clang W=1 warning about pointer to enum conversion. iio:imu:inv_mpu6050: Suppress clang W=1 warning about pointer to enum conversion. iio:imu:inv_icm42600: Suppress clang W=1 warning about pointer to enum conversion. iio:dac:mcp4725: Suppress clang W=1 warning about pointer to enum conversion. iio:amplifiers:hmc425a: Suppress clang W=1 warning about pointer to enum conversion. iio:adc:ti-ads1015: Suppress clang W=1 warning about pointer to enum conversion. iio:adc:rcar: Suppress clang W=1 warning about pointer to enum conversion. iio:adc:ina2xx-adc: Suppress clang W=1 warning about pointer to enum conversion. iio:accel:bma180: Suppress clang W=1 warning about pointer to enum conversion. drivers:iio:dac: Add AD3552R driver support dt-bindings: iio: dac: Add adi,ad3552r.yaml ...