linux.git/drivers/staging/iio, branch v6.12 Linux kernel source tree staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg() 2024-10-24T17:30:47+00:00 Zicheng Qu quzicheng@huawei.com 2024-10-22T13:43:54+00:00 6bd301819f8f69331a55ae2336c8b111fc933f3d In the ad9832_write_frequency() function, clk_get_rate() might return 0. This can lead to a division by zero when calling ad9832_calc_freqreg(). The check if (fout > (clk_get_rate(st->mclk) / 2)) does not protect against the case when fout is 0. The ad9832_write_frequency() function is called from ad9832_write(), and fout is derived from a text buffer, which can contain any value. Link: https://lore.kernel.org/all/2024100904-CVE-2024-47663-9bdc@gregkh/ Fixes: ea707584bac1 ("Staging: IIO: DDS: AD9832 / AD9835 driver") Cc: stable@vger.kernel.org Signed-off-by: Zicheng Qu <quzicheng@huawei.com> Reviewed-by: Nuno Sa <nuno.sa@analog.com> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://patch.msgid.link/20241022134354.574614-1-quzicheng@huawei.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> 
In the ad9832_write_frequency() function, clk_get_rate() might return 0.
This can lead to a division by zero when calling ad9832_calc_freqreg().
The check if (fout > (clk_get_rate(st->mclk) / 2)) does not protect
against the case when fout is 0. The ad9832_write_frequency() function
is called from ad9832_write(), and fout is derived from a text buffer,
which can contain any value.

Link: https://lore.kernel.org/all/2024100904-CVE-2024-47663-9bdc@gregkh/
Fixes: ea707584bac1 ("Staging: IIO: DDS: AD9832 / AD9835 driver")
Cc: stable@vger.kernel.org
Signed-off-by: Zicheng Qu <quzicheng@huawei.com>
Reviewed-by: Nuno Sa <nuno.sa@analog.com>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/20241022134354.574614-1-quzicheng@huawei.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Merge 6.11-rc7 into char-misc-next 2024-09-09T06:36:23+00:00 Greg Kroah-Hartman gregkh@linuxfoundation.org 2024-09-09T06:36:23+00:00 895b4fae931a256f6c7c6c68f77a8e337980b5a1 We need the char-misc fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
We need the char-misc fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
staging: iio: impedance-analyzer: ad5933: make use of iio_get_masklength() 2024-08-03T09:13:43+00:00 Nuno Sa nuno.sa@analog.com 2024-07-26T08:23:14+00:00 a71cfa4c7783798d62b90143d14159470f5304d0 Use iio_get_masklength() to access '.masklength' so it can be annotated as __private when there are no more direct users of it. Signed-off-by: Nuno Sa <nuno.sa@analog.com> Link: https://patch.msgid.link/20240726-dev-iio-masklength-private3-v1-22-82913fc0fb87@analog.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> 
Use iio_get_masklength() to access '.masklength' so it can be annotated
as __private when there are no more direct users of it.

Signed-off-by: Nuno Sa <nuno.sa@analog.com>
Link: https://patch.msgid.link/20240726-dev-iio-masklength-private3-v1-22-82913fc0fb87@analog.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
staging: iio: frequency: ad9834: Validate frequency parameter value 2024-07-29T19:31:23+00:00 Aleksandr Mishin amishin@t-argos.ru 2024-07-03T15:45:06+00:00 b48aa991758999d4e8f9296c5bbe388f293ef465 In ad9834_write_frequency() clk_get_rate() can return 0. In such case ad9834_calc_freqreg() call will lead to division by zero. Checking 'if (fout > (clk_freq / 2))' doesn't protect in case of 'fout' is 0. ad9834_write_frequency() is called from ad9834_write(), where fout is taken from text buffer, which can contain any value. Modify parameters checking. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 12b9d5bf76bf ("Staging: IIO: DDS: AD9833 / AD9834 driver") Suggested-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru> Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://patch.msgid.link/20240703154506.25584-1-amishin@t-argos.ru Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> 
In ad9834_write_frequency() clk_get_rate() can return 0. In such case
ad9834_calc_freqreg() call will lead to division by zero. Checking
'if (fout > (clk_freq / 2))' doesn't protect in case of 'fout' is 0.
ad9834_write_frequency() is called from ad9834_write(), where fout is
taken from text buffer, which can contain any value.

Modify parameters checking.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 12b9d5bf76bf ("Staging: IIO: DDS: AD9833 / AD9834 driver")
Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/20240703154506.25584-1-amishin@t-argos.ru
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
staging: iio: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-06-13T18:19:23+00:00 Uwe Kleine-König ukleinek@baylibre.com 2024-06-06T15:54:04+00:00 4f9b4594bb09734b53212d23f8a4b78b7a3bdc2d These drivers don't use the driver_data member of struct i2c_device_id, so don't explicitly initialize this member. This prepares putting driver_data in an anonymous union which requires either no initialization or named designators. But it's also a nice cleanup on its own. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Reviewed-by: Nuno Sa <nuno.sa@analog.com> Link: https://lore.kernel.org/r/20240606155407.499344-1-u.kleine-koenig@baylibre.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> 
These drivers don't use the driver_data member of struct i2c_device_id,
so don't explicitly initialize this member.

This prepares putting driver_data in an anonymous union which requires
either no initialization or named designators. But it's also a nice
cleanup on its own.

Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Reviewed-by: Nuno Sa <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20240606155407.499344-1-u.kleine-koenig@baylibre.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
staging: iio: adt7316: remove unused struct 'adt7316_limit_regs' 2024-06-04T18:53:07+00:00 Dr. David Alan Gilbert linux@treblig.org 2024-05-29T16:00:55+00:00 9be46ec5606e6e1aa4b9c6086762ed82f34ceaae 'adt7316_limit_regs' has never been used since the original commit 35f6b6b86ede ("staging: iio: new ADT7316/7/8 and ADT7516/7/9 driver"). The comment above it is a copy-and-paste from a different struct. Remove both the struct and the comment. Reviewed-by: Nuno Sa <nuno.sa@analog.com> Signed-off-by: Dr. David Alan Gilbert <linux@treblig.org> Link: https://lore.kernel.org/r/20240529160055.28489-1-linux@treblig.org Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> 
'adt7316_limit_regs' has never been used since the original
commit 35f6b6b86ede ("staging: iio: new ADT7316/7/8 and ADT7516/7/9
driver").

The comment above it is a copy-and-paste from a different struct.

Remove both the struct and the comment.

Reviewed-by: Nuno Sa <nuno.sa@analog.com>
Signed-off-by: Dr. David Alan Gilbert <linux@treblig.org>
Link: https://lore.kernel.org/r/20240529160055.28489-1-linux@treblig.org
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
staging: iio: impedance-analyzer: ad5933: Use devm_regulator_get_enable_read_voltage() 2024-05-07T01:31:50+00:00 David Lechner dlechner@baylibre.com 2024-04-29T23:40:14+00:00 9fcf6ef3e10b9fc605d84802058c0f30517bbaa7 We can reduce boilerplate code by using devm_regulator_get_enable_read_voltage(). Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: David Lechner <dlechner@baylibre.com> Link: https://lore.kernel.org/r/20240429-regulator-get-enable-get-votlage-v2-6-b1f11ab766c1@baylibre.com Signed-off-by: Mark Brown <broonie@kernel.org> 
We can reduce boilerplate code by using
devm_regulator_get_enable_read_voltage().

Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: David Lechner <dlechner@baylibre.com>
Link: https://lore.kernel.org/r/20240429-regulator-get-enable-get-votlage-v2-6-b1f11ab766c1@baylibre.com
Signed-off-by: Mark Brown <broonie@kernel.org>
staging: iio: ad5933: fix type mismatch regression 2024-01-27T16:00:02+00:00 David Schiller david.schiller@jku.at 2024-01-22T13:49:17+00:00 6db053cd949fcd6254cea9f2cd5d39f7bd64379c Commit 4c3577db3e4f ("Staging: iio: impedance-analyzer: Fix sparse warning") fixed a compiler warning, but introduced a bug that resulted in one of the two 16 bit IIO channels always being zero (when both are enabled). This is because int is 32 bits wide on most architectures and in the case of a little-endian machine the two most significant bytes would occupy the buffer for the second channel as 'val' is being passed as a void pointer to 'iio_push_to_buffers()'. Fix by defining 'val' as u16. Tested working on ARM64. Fixes: 4c3577db3e4f ("Staging: iio: impedance-analyzer: Fix sparse warning") Signed-off-by: David Schiller <david.schiller@jku.at> Link: https://lore.kernel.org/r/20240122134916.2137957-1-david.schiller@jku.at Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> 
Commit 4c3577db3e4f ("Staging: iio: impedance-analyzer: Fix sparse
warning") fixed a compiler warning, but introduced a bug that resulted
in one of the two 16 bit IIO channels always being zero (when both are
enabled).

This is because int is 32 bits wide on most architectures and in the
case of a little-endian machine the two most significant bytes would
occupy the buffer for the second channel as 'val' is being passed as a
void pointer to 'iio_push_to_buffers()'.

Fix by defining 'val' as u16. Tested working on ARM64.

Fixes: 4c3577db3e4f ("Staging: iio: impedance-analyzer: Fix sparse warning")
Signed-off-by: David Schiller <david.schiller@jku.at>
Link: https://lore.kernel.org/r/20240122134916.2137957-1-david.schiller@jku.at
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
iio: resolver: ad2s1210: move out of staging 2023-10-12T08:20:50+00:00 David Lechner dlechner@baylibre.com 2023-10-10T21:12:36+00:00 291e45eeeb901b1d22b74ac5ea48cab3c407c705 This moves the ad2s1210 resolver driver out of staging. The driver has been fixed up and is ready to graduate. Signed-off-by: David Lechner <dlechner@baylibre.com> Link: https://lore.kernel.org/r/20231010-ad2s1210-mainline-v5-4-35a0f6ffa04a@baylibre.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> 
This moves the ad2s1210 resolver driver out of staging. The driver has
been fixed up and is ready to graduate.

Signed-off-by: David Lechner <dlechner@baylibre.com>
Link: https://lore.kernel.org/r/20231010-ad2s1210-mainline-v5-4-35a0f6ffa04a@baylibre.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
staging: iio: resolver: ad2s1210: simplify code with guard(mutex) 2023-10-12T08:00:58+00:00 David Lechner dlechner@baylibre.com 2023-10-10T21:12:35+00:00 169dc2adafecc19ecf53a101398edd7f3ff03529 We can simplify the code and get rid of most of the gotos by using guard(mutex) from cleanup.h. Signed-off-by: David Lechner <dlechner@baylibre.com> Link: https://lore.kernel.org/r/20231010-ad2s1210-mainline-v5-3-35a0f6ffa04a@baylibre.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> 
We can simplify the code and get rid of most of the gotos by using
guard(mutex) from cleanup.h.

Signed-off-by: David Lechner <dlechner@baylibre.com>
Link: https://lore.kernel.org/r/20231010-ad2s1210-mainline-v5-3-35a0f6ffa04a@baylibre.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>