linux-stable.git/drivers/iio/trigger, branch linux-5.10.y

iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()

2022-11-25T16:45:51+00:00

commit efa17e90e1711bdb084e3954fa44afb6647331c0 upstream.

dev_set_name() allocates memory for name, it need be freed
when device_add() fails, call put_device() to give up the
reference that hold in device_initialize(), so that it can
be freed in kobject_cleanup() when the refcount hit to 0.

Fault injection test can trigger this:

unreferenced object 0xffff8e8340a7b4c0 (size 32):
  comm "modprobe", pid 243, jiffies 4294678145 (age 48.845s)
  hex dump (first 32 bytes):
    69 69 6f 5f 73 79 73 66 73 5f 74 72 69 67 67 65  iio_sysfs_trigge
    72 00 a7 40 83 8e ff ff 00 86 13 c4 f6 ee ff ff  r..@............
  backtrace:
    [<0000000074999de8>] __kmem_cache_alloc_node+0x1e9/0x360
    [<00000000497fd30b>] __kmalloc_node_track_caller+0x44/0x1a0
    [<000000003636c520>] kstrdup+0x2d/0x60
    [<0000000032f84da2>] kobject_set_name_vargs+0x1e/0x90
    [<0000000092efe493>] dev_set_name+0x4e/0x70

Fixes: 1f785681a870 ("staging:iio:trigger sysfs userspace trigger rework.")
Signed-off-by: Yang Yingliang 
Cc: 
Link: https://lore.kernel.org/r/20221022074212.1386424-1-yangyingliang@huawei.com
Signed-off-by: Jonathan Cameron 
Signed-off-by: Greg Kroah-Hartman

iio: trigger: sysfs: fix use-after-free on remove

2022-06-29T06:59:52+00:00

commit 78601726d4a59a291acc5a52da1d3a0a6831e4e8 upstream.

Ensure that the irq_work has completed before the trigger is freed.

 ==================================================================
 BUG: KASAN: use-after-free in irq_work_run_list
 Read of size 8 at addr 0000000064702248 by task python3/25

 Call Trace:
  irq_work_run_list
  irq_work_tick
  update_process_times
  tick_sched_handle
  tick_sched_timer
  __hrtimer_run_queues
  hrtimer_interrupt

 Allocated by task 25:
  kmem_cache_alloc_trace
  iio_sysfs_trig_add
  dev_attr_store
  sysfs_kf_write
  kernfs_fop_write_iter
  new_sync_write
  vfs_write
  ksys_write
  sys_write

 Freed by task 25:
  kfree
  iio_sysfs_trig_remove
  dev_attr_store
  sysfs_kf_write
  kernfs_fop_write_iter
  new_sync_write
  vfs_write
  ksys_write
  sys_write

 ==================================================================

Fixes: f38bc926d022 ("staging:iio:sysfs-trigger: Use irq_work to properly active trigger")
Signed-off-by: Vincent Whitchurch 
Reviewed-by: Lars-Peter Clausen 
Link: https://lore.kernel.org/r/20220519091925.1053897-1-vincent.whitchurch@axis.com
Cc: 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Greg Kroah-Hartman

iio: trigger: stm32-timer: fix MODULE_ALIAS

2021-12-14T10:32:44+00:00

commit 893621e0606747c5bbefcaf2794d12c7aa6212b7 upstream.

modprobe can't handle spaces in aliases.

Fixes: 93fbe91b5521 ("iio: Add STM32 timer trigger driver")
Signed-off-by: Alyssa Ross 
Link: https://lore.kernel.org/r/20211125182850.2645424-1-hi@alyssa.is
Cc: 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Greg Kroah-Hartman

iio: hrtimer-trigger: Mark hrtimer to expire in hard interrupt context

2020-12-30T10:53:33+00:00

[ Upstream commit 0178297c1e6898e2197fe169ef3be723e019b971 ]

On PREEMPT_RT enabled kernels unmarked hrtimers are moved into soft
interrupt expiry mode by default.

The IIO hrtimer-trigger needs to run in hard interrupt context since it
will end up calling generic_handle_irq() which has the requirement to run
in hard interrupt context.

Explicitly specify that the timer needs to run in hard interrupt context by
using the HRTIMER_MODE_REL_HARD flag.

Fixes: f5c2f0215e36 ("hrtimer: Move unmarked hrtimers to soft interrupt expiry on RT")
Reported-by: Christian Eggers 
Signed-off-by: Lars-Peter Clausen 
Acked-by: Sebastian Andrzej Siewior 
Link: https://lore.kernel.org/r/20201117103751.16131-1-lars@metafoo.de
Signed-off-by: Jonathan Cameron 
Signed-off-by: Sasha Levin

iio: Remove superfluous of_node assignments

2020-06-14T13:20:08+00:00

If a driver does not assign an of_node to a IIO device to IIO core will
automatically assign the of_node of the parent device. This automatic
assignment is done in the iio_device_register() function.

There is a fair amount of drivers that currently manually assign the
of_node of the IIO device. All but 4 of them can make use of the automatic
assignment though.

The exceptions are:
 * mxs-lradc-adc: Which uses the of_node of the parent of the parent.
 * stm32-dfsdm-adc, stm32-adc and stm32-dac: Which reference the of_node
   assigned to the IIO device before iio_device_register() is called.

All other drivers are updated to use automatic assignment. This reduces
the amount of boilerplate code involved in setting up the IIO device.

The patch has mostly been auto-generated with the following semantic patch

// 
@exists@
expression indio_dev;
expression parent;
@@
indio_dev = \(devm_iio_device_alloc\|iio_device_alloc\)(&parent, ...)
...
-indio_dev->dev.of_node = parent.of_node;

@exists@
expression indio_dev;
expression parent;
@@
indio_dev = \(devm_iio_device_alloc\|iio_device_alloc\)(parent, ...)
...
-indio_dev->dev.of_node = parent->of_node;
// 

Signed-off-by: Lars-Peter Clausen 
Reviewed-by: Andy Shevchenko 
Signed-off-by: Jonathan Cameron

iio: remove explicit IIO device parent assignment

2020-06-14T10:49:59+00:00

This patch applies the semantic patch:
@@
expression I, P, SP;
@@
   I = devm_iio_device_alloc(P, SP);
   ...
-  I->dev.parent = P;

It updates 302 files and does 307 deletions.
This semantic patch also removes some comments like
'/* Establish that the iio_dev is a child of the i2c device */'

But this is is only done in case where the block is left empty.

The patch does not seem to cover all cases. It looks like in some cases a
different variable is used in some cases to assign the parent, but it
points to the same reference.
In other cases, the block covered by ... may be just too big to be covered
by the semantic patch.

However, this looks pretty good as well, as it does cover a big bulk of the
drivers that should remove the parent assignment.

Signed-off-by: Alexandru Ardelean 
Signed-off-by: Jonathan Cameron

Merge tag 'iio-for-5.8a' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-next

2020-04-23T09:06:48+00:00

Jonathan writes:

First set of new IIO device support, features and cleanup for the 5.8 cycle

Usual mix of new drivers, new support in old drivers and lots of minor
cleanup. Yaml conversions also continue to trickle in (plenty more to go!)

New device support
* ad7476
- Add ad7091 support (ID only)
* ad9467
- New driver for this 200/250 MSPS adi-axi-adc and SPI attached ADC.
* adi-axi-adc
- New driver to support ADIs generic AXI ADC IP core, used to provide
high speed interfaces to ADCs (JESD204B/C or parallel interfaces). Usually
paired with a device using a slow configuration interface (spi etc)
Includes DT bindings and some fixes for fpga headers.
* bmg160
- Add support for BMI088 (ID only)
* max1241
- New driver for this ADC.
* st_sensors
- Add support for LIS2HH12 accelerometer
* sx9310
- New driver supporting sx9310 and sx9311 proximity sensors.

Yaml DT binding conversions
* rockchip-saradc (including adding some missing parts)
* stm32-dac
* tsl2563
* vcnl4000

Features
* st_lsm6dsx
- Add LIS3MDL as a possible sensor hub device.
* vcnl4000
- Add new concept of near level (from DT) to provide to userspace which
often needs to have some calibrated concept of 'near'.

Cleanups, minor fixes etc.
* core
- Use snprintf for functions where strings are built and there is
potential for overflow.
- Correct docs to indicate mlock should not be used directly by drivers.
- Fix up accidental dropping of a patch to use bitmap_zalloc.
- Stop allowing enabling of buffers with no channels enabled.
- Drop unused 'stufftoread' from iio_buffer.
- Drop scan_el_attrs form iio_buffer as unused.
- Reorder sanity checks in __iio_device_register to fail earlier.
- Drop all the devm_ runregister / free functions from IIO as they
were never used and encourage poor design.
* dma-buffer
- Tidy up includes.
* dma-engine-buffer
- Provide dev-managed allocator.
- Fix an issue with printing a size_t
* cross subsystem (kxsd9, bmg160, mpu3050, bmi160, mpu6050, bmc150)
- Replace some unnecessary casts of error ptrs and whilst there.
use the %pe printf parameter to print them in a more useful fashion.
* cross subsystem
- Drop casts in calls to regmap_bulk_read as they make no sense.
- Use devm_platform_ioremap_resource to reduce boilerplate.
- Fix typos in Analog Devices.
* counters/104-quad
- Add Syed Nayyar Waris as an additional maintainer.
* ad7476
- Generate CONVST signal internally rather than requiring external
trigger. Add sysfs read back as can now do so.
- use devm_add_action_or_reset to tidy up error and remove handling.
* ad7793
- Switch to read_avail from explicit attribute. Mostly done to avoid
confusing people with a - sign (without surounding spaces) that
was correct but checkpatch didn't like.
* adis library
- Add missing newlines at end of error messages.
* adis16400
- Use DEFINE_DEBUGS_ATTRIBUTE rather than DEFINE_SIMPLE_ATTR.
* adis16460
- Use DEFINE_DEBUGS_ATTRIBUTE rather than DEFINE_SIMPLE_ATTR.
* ad_sigma_delta
- Move some channel definitions into individual drivers to avoid
having to deal with complex options.
* ak8974
- Silence an error on deffered probe.
* bmp280
- Harden against IRQ before registration.
- Convert to read_avail instead of opencoding the equivalent.
- Explicitly mark GPIO as optional.
- Cleanup casts.
- Remove line breaks from strings.
* htts221
- Replace direct access to platform_data with dev_get_platdata().
- Use device properties rather than device tree ones to allow ACPI
probing.
- Casting cleanups.
* intel_mrfld_adc
- Don't use unaligned accessor for aligned data.
* isl29125
- Reorder buer pre and post hooks to allow for coming core rework.
* ltc2983
- Remove comp to bool.
* max1363
- Stop using mlock from the iio_dev directly in favour of a local lock
with clearly defined scope.
* max30100
- Use generic device properties to allow ACPI probe.
* mpu6050
- Convert to i2c_new_client_device.
- Add debugfs register access.
* st_lsm6dsx
- Provide means of configuring full scale on slave device if supported.
- Drop include of st_sensors header to get one value. Its not otherwise
used by this driver.
* st-sensors
- Replace direct access to platform_data with dev_get_platdata().
- Casting cleanups.
- Avoid splitting strings.
* st_uvis25
- Casting cleanups.
* tsl2563
- Typo fix.
* tsl2772
- scnprintf in a non obvious string building usecase. Note also 'fixes'
a wrong calculation of remaining space that couldn't actually cause
any trouble as there was lots of room.
* xilinx-xadc
- Fix Lars-Peter spelling his own name wrong :) + additional typos.

* tag 'iio-for-5.8a' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (101 commits)
iio: magnetometer: ak8974: Silence deferred-probe error
Documentation: ABI: document IIO in_proximity_nearlevel file
iio: vcnl4000: Export near level property for proximity sensor
dt-bindings: iio: light: vcnl4000: Add proximity-near-level
dt-bindings: iio: Introduce common properties for iio sensors
dt-bindings: iio: vcnl4000: convert bindings to YAML format
iio: Fix misspellings of "Analog Devices"
iio: light: isl29125: fix iio_triggered_buffer_{predisable,postenable} positions
iio: adc: fsl-imx25-gcq: Use devm_platform_ioremap_resource
iio: adc: at91-adc: Use devm_platform_ioremap_resource
iio: adc: sun4i-gpadc-iio: Use devm_platform_ioremap_resource
iio:light:ltr501: Drop unnecessary cast of parameter in regmap_bulk_read
iio:magn:mmc35240: Drop unnecessary casts of val parameter in regmap_bulk*
iio:imu:mpu6050: Tidy up parameters to regmap_bulk functions.
iio:chemical:bme680: Tidy up parameters to regmap_bulk_read
iio:chemical:atlas-sensor: Drop unnecessary explicit casts in regmap_bulk_read calls
iio:accel:mxc4005: Drop unnecessary explicit casts in regmap_bulk_read calls
iio: imu: st_lsm6dsx: drop huge include in sensor-hub driver
iio: buffer: drop devm_iio_kfifo_free() API call
iio: buffer: drop devm_iio_hw_consumer_free() API call
...

iio: Fix misspellings of "Analog Devices"

2020-04-19T15:56:41+00:00

According to https://www.analog.com/, the company name is spelled
"Analog Devices".

Signed-off-by: Geert Uytterhoeven 
Reviewed-by: Alexandru Ardelean 
Signed-off-by: Jonathan Cameron

Merge 5.6-rc7 into staging-next

2020-03-23T07:01:20+00:00

We need the staging/iio fixes in here as well

Signed-off-by: Greg Kroah-Hartman

iio: trigger: stm32-timer: add power management support

2020-03-08T17:28:53+00:00

Add suspend/resume PM sleep ops to stm32-timer-trigger driver.
Register contents may be lost depending on low power modes.
When going to low power, enforce the timer isn't active. Gracefully
restore its state upon resume in case it's been left enabled prior to
suspend.

Signed-off-by: Fabrice Gasnier 
Signed-off-by: Jonathan Cameron