linux-stable.git/drivers/iio/imu, branch master

iio: imu: adis16550: fix stack leak in trigger handler

2026-05-15T11:01:38+00:00

adis16550_trigger_handler() declares the scan data array on the stack
without initializing it.  The memcpy() at the bottom fills only the
first 28 bytes (TEMP + 6 channels of GYRO/ACCEL data), and
iio_push_to_buffers_with_timestamp() writes the s64 timestamp at the
8-byte-aligned offset 32.  Bytes 28-31 remain uninitialized stack data
which leaks to userspace on ever trigger.

Fix this all by just zero-initializing the structure on the stack.

Cc: Lars-Peter Clausen 
Cc: Michael Hennerich 
Cc: Jonathan Cameron 
Cc: David Lechner 
Cc: "Nuno Sá" 
Cc: Andy Shevchenko 
Fixes: e4570f4bb231 ("iio: imu: adis16550: align buffers for timestamp")
Cc: stable 
Assisted-by: gregkh_clanker_t1000
Signed-off-by: Greg Kroah-Hartman 
Reviewed-by: David Lechner 
Signed-off-by: Jonathan Cameron

iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer

2026-05-15T11:01:38+00:00

The tagged FIFO path declares iio_buff on the stack with __aligned(8)
but no initializer, but there is a hole in the structure, which will
then leak to userspace as ST_LSM6DSX_SAMPLE_SIZE bytes (6) will be
copied, but the space between that and the timestamp are not
initialized.

Commit c14edb4d0bdc ("iio:imu:st_lsm6dsx Fix alignment and data leak
issues") moved the untagged FIFO path to a kzalloc'd buffer in hw->scan,
but for the tagged path it only added the alignment qualifier and not
the initializer :(

Fix this by just zero-initializing the structure on the stack.

Cc: Lorenzo Bianconi 
Cc: Jonathan Cameron 
Cc: David Lechner 
Cc: "Nuno Sá" 
Cc: Andy Shevchenko 
Fixes: c14edb4d0bdc ("iio:imu:st_lsm6dsx Fix alignment and data leak issues")
Cc: stable 
Assisted-by: gregkh_clanker_t1000
Signed-off-by: Greg Kroah-Hartman 
Reviewed-by: David Lechner 
Signed-off-by: Jonathan Cameron

Merge tag 'v7.0-rc7' into char-misc-next

2026-04-06T07:04:53+00:00

We need the char/misc/iio/comedi fixes in here as well for testing

Signed-off-by: Greg Kroah-Hartman

iio: imu: st_lsm6dsx: Add ACPI ID for SHIFT13mi gyroscope

2026-03-26T19:55:30+00:00

The SHIFT13mi or SHIFTbook tablet device by the German manufacturer
SHIFT contains an STM LSM6DSO IMU declared in the DSDT with the
hardware ID SMOCF00. Add this ID to the ACPI match table so that the
driver binds correctly to this device.

WHO_AM_I register returns 0x6c, confirming LSM6DSO.

Signed-off-by: Milan Misic 
Reviewed-by: Andy Shevchenko 
Signed-off-by: Jonathan Cameron

Merge tag 'v7.0-rc4' into togreg

2026-03-22T12:20:42+00:00

Linux 7.0-rc4

Required for the ds4422 series which is build upon;
5187e03b817c ("iio: dac: ds4424: reject -128 RAW value")

iio: imu: fix typo from adjustement to adjustment

2026-03-21T19:13:51+00:00

Fix incorrect spelling in a comment.

- adjustement -> adjustment

Signed-off-by: Shi Hao 
Signed-off-by: Jonathan Cameron

iio: imu: bmi160: Remove potential undefined behavior in bmi160_config_pin()

2026-03-15T12:20:34+00:00

If 'pin' is not one of its expected values, the value of
'int_out_ctrl_shift' is undefined.  With UBSAN enabled, this causes
Clang to generate undefined behavior, resulting in the following
warning:

  drivers/iio/imu/bmi160/bmi160_core.o: warning: objtool: bmi160_setup_irq() falls through to next function __cfi_bmi160_core_runtime_resume()

Prevent the UB and improve error handling by returning an error if 'pin'
has an unexpected value.

While at it, simplify the code a bit by moving the 'pin_name' assignment
to the first switch statement.

Fixes: 895bf81e6bbf ("iio:bmi160: add drdy interrupt support")
Reported-by: Arnd Bergmann 
Closes: https://lore.kernel.org/a426d669-58bb-4be1-9eaa-6f3d83109e2d@app.fastmail.com
Signed-off-by: Josh Poimboeuf 
Reviewed-by: Nuno Sá 
Reviewed-by: Andy Shevchenko 
Cc: 
Signed-off-by: Jonathan Cameron

iio: imu: adis16550: fix swapped gyro/accel filter functions

2026-03-07T14:11:30+00:00

The low-pass filter handlers for IIO_ANGL_VEL and IIO_ACCEL call each
other's filter functions in both read_raw and write_raw. Swap them so
each channel type uses its correct filter accessor.

Fixes: bac4368fab62 ("iio: imu: adis16550: add adis16550 support")
Signed-off-by: Antoniu Miclaus 
Acked-by: Robert Budai 
Cc: 
Signed-off-by: Jonathan Cameron

iio: imu: bmi323: remove unused drdy_trigger_enabled

2026-03-03T21:20:03+00:00

Remove unused drdy_trigger_enabled field from bmi323_data
struct. The field is declared but never accessed in the
driver.

Signed-off-by: Antoniu Miclaus 
Reviewed-by: Andy Shevchenko 
Signed-off-by: Jonathan Cameron

iio: imu: inv_icm42600: Convert to uXX and sXX integer types

2026-03-03T21:20:00+00:00

The driver has a some use of intXX_t and uintXX_t types which is
not the pattern we use in the IIO subsystem. Switch the driver
to use kernel internal types for that. No functional changes.

Signed-off-by: Andy Shevchenko 
Signed-off-by: Jonathan Cameron