--- /dev/null
+From 3f9c6d38797e9903937b007a341dad0c251765d6 Mon Sep 17 00:00:00 2001
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Date: Sun, 17 May 2020 18:29:56 +0100
+Subject: iio:health:afe4403 Fix timestamp alignment and prevent data leak.
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+commit 3f9c6d38797e9903937b007a341dad0c251765d6 upstream.
+
+One of a class of bugs pointed out by Lars in a recent review.
+iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
+to the size of the timestamp (8 bytes). This is not guaranteed in
+this driver which uses a 32 byte array of smaller elements on the stack.
+As Lars also noted this anti pattern can involve a leak of data to
+userspace and that indeed can happen here. We close both issues by
+moving to a suitable structure in the iio_priv() data with alignment
+explicitly requested. This data is allocated with kzalloc so no
+data can leak appart from previous readings.
+
+Fixes: eec96d1e2d31 ("iio: health: Add driver for the TI AFE4403 heart monitor")
+Reported-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Acked-by: Andrew F. Davis <afd@ti.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/health/afe4403.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/iio/health/afe4403.c
++++ b/drivers/iio/health/afe4403.c
+@@ -71,6 +71,7 @@ static const struct reg_field afe4403_re
+ * @regulator: Pointer to the regulator for the IC
+ * @trig: IIO trigger for this device
+ * @irq: ADC_RDY line interrupt number
++ * @buffer: Used to construct data layout to push into IIO buffer.
+ */
+ struct afe4403_data {
+ struct device *dev;
+@@ -80,6 +81,8 @@ struct afe4403_data {
+ struct regulator *regulator;
+ struct iio_trigger *trig;
+ int irq;
++ /* Ensure suitable alignment for timestamp */
++ s32 buffer[8] __aligned(8);
+ };
+
+ enum afe4403_chan_id {
+@@ -318,7 +321,6 @@ static irqreturn_t afe4403_trigger_handl
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct afe4403_data *afe = iio_priv(indio_dev);
+ int ret, bit, i = 0;
+- s32 buffer[8];
+ u8 tx[4] = {AFE440X_CONTROL0, 0x0, 0x0, AFE440X_CONTROL0_READ};
+ u8 rx[3];
+
+@@ -335,9 +337,9 @@ static irqreturn_t afe4403_trigger_handl
+ if (ret)
+ goto err;
+
+- buffer[i++] = (rx[0] << 16) |
+- (rx[1] << 8) |
+- (rx[2]);
++ afe->buffer[i++] = (rx[0] << 16) |
++ (rx[1] << 8) |
++ (rx[2]);
+ }
+
+ /* Disable reading from the device */
+@@ -346,7 +348,8 @@ static irqreturn_t afe4403_trigger_handl
+ if (ret)
+ goto err;
+
+- iio_push_to_buffers_with_timestamp(indio_dev, buffer, pf->timestamp);
++ iio_push_to_buffers_with_timestamp(indio_dev, afe->buffer,
++ pf->timestamp);
+ err:
+ iio_trigger_notify_done(indio_dev->trig);
+
--- /dev/null
+From ea5e7a7bb6205d24371373cd80325db1bc15eded Mon Sep 17 00:00:00 2001
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Date: Sun, 7 Jun 2020 16:53:52 +0100
+Subject: iio:humidity:hdc100x Fix alignment and data leak issues
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+commit ea5e7a7bb6205d24371373cd80325db1bc15eded upstream.
+
+One of a class of bugs pointed out by Lars in a recent review.
+iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
+to the size of the timestamp (8 bytes). This is not guaranteed in
+this driver which uses an array of smaller elements on the stack.
+As Lars also noted this anti pattern can involve a leak of data to
+userspace and that indeed can happen here. We close both issues by
+moving to a suitable structure in the iio_priv() data.
+This data is allocated with kzalloc so no data can leak apart
+from previous readings.
+
+Fixes: 16bf793f86b2 ("iio: humidity: hdc100x: add triggered buffer support for HDC100X")
+Reported-by: Lars-Peter Clausen <lars@metafoo.de>
+Acked-by: Matt Ranostay <matt.ranostay@konsulko.com>
+Cc: Alison Schofield <amsfield22@gmail.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/humidity/hdc100x.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/iio/humidity/hdc100x.c
++++ b/drivers/iio/humidity/hdc100x.c
+@@ -46,6 +46,11 @@ struct hdc100x_data {
+
+ /* integration time of the sensor */
+ int adc_int_us[2];
++ /* Ensure natural alignment of timestamp */
++ struct {
++ __be16 channels[2];
++ s64 ts __aligned(8);
++ } scan;
+ };
+
+ /* integration time in us */
+@@ -327,7 +332,6 @@ static irqreturn_t hdc100x_trigger_handl
+ struct i2c_client *client = data->client;
+ int delay = data->adc_int_us[0] + data->adc_int_us[1];
+ int ret;
+- s16 buf[8]; /* 2x s16 + padding + 8 byte timestamp */
+
+ /* dual read starts at temp register */
+ mutex_lock(&data->lock);
+@@ -338,13 +342,13 @@ static irqreturn_t hdc100x_trigger_handl
+ }
+ usleep_range(delay, delay + 1000);
+
+- ret = i2c_master_recv(client, (u8 *)buf, 4);
++ ret = i2c_master_recv(client, (u8 *)data->scan.channels, 4);
+ if (ret < 0) {
+ dev_err(&client->dev, "cannot read sensor data\n");
+ goto err;
+ }
+
+- iio_push_to_buffers_with_timestamp(indio_dev, buf,
++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+ iio_get_time_ns(indio_dev));
+ err:
+ mutex_unlock(&data->lock);
--- /dev/null
+From 838e00b13bfd4cac8b24df25bfc58e2eb99bcc70 Mon Sep 17 00:00:00 2001
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Date: Sun, 7 Jun 2020 16:53:49 +0100
+Subject: iio:magnetometer:ak8974: Fix alignment and data leak issues
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+commit 838e00b13bfd4cac8b24df25bfc58e2eb99bcc70 upstream.
+
+One of a class of bugs pointed out by Lars in a recent review.
+iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
+to the size of the timestamp (8 bytes). This is not guaranteed in
+this driver which uses an array of smaller elements on the stack.
+As Lars also noted this anti pattern can involve a leak of data to
+userspace and that indeed can happen here. We close both issues by
+moving to a suitable structure in the iio_priv() data.
+
+This data is allocated with kzalloc so no data can leak appart from
+previous readings.
+
+Fixes: 7c94a8b2ee8cf ("iio: magn: add a driver for AK8974")
+Reported-by: Lars-Peter Clausen <lars@metafoo.de>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/magnetometer/ak8974.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/iio/magnetometer/ak8974.c
++++ b/drivers/iio/magnetometer/ak8974.c
+@@ -184,6 +184,11 @@ struct ak8974 {
+ bool drdy_irq;
+ struct completion drdy_complete;
+ bool drdy_active_low;
++ /* Ensure timestamp is naturally aligned */
++ struct {
++ __le16 channels[3];
++ s64 ts __aligned(8);
++ } scan;
+ };
+
+ static const char ak8974_reg_avdd[] = "avdd";
+@@ -580,7 +585,6 @@ static void ak8974_fill_buffer(struct ii
+ {
+ struct ak8974 *ak8974 = iio_priv(indio_dev);
+ int ret;
+- __le16 hw_values[8]; /* Three axes + 64bit padding */
+
+ pm_runtime_get_sync(&ak8974->i2c->dev);
+ mutex_lock(&ak8974->lock);
+@@ -590,13 +594,13 @@ static void ak8974_fill_buffer(struct ii
+ dev_err(&ak8974->i2c->dev, "error triggering measure\n");
+ goto out_unlock;
+ }
+- ret = ak8974_getresult(ak8974, hw_values);
++ ret = ak8974_getresult(ak8974, ak8974->scan.channels);
+ if (ret) {
+ dev_err(&ak8974->i2c->dev, "error getting measures\n");
+ goto out_unlock;
+ }
+
+- iio_push_to_buffers_with_timestamp(indio_dev, hw_values,
++ iio_push_to_buffers_with_timestamp(indio_dev, &ak8974->scan,
+ iio_get_time_ns(indio_dev));
+
+ out_unlock:
--- /dev/null
+From 0187294d227dfc42889e1da8f8ce1e44fc25f147 Mon Sep 17 00:00:00 2001
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Date: Tue, 26 May 2020 18:47:17 +0800
+Subject: iio: magnetometer: ak8974: Fix runtime PM imbalance on error
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+commit 0187294d227dfc42889e1da8f8ce1e44fc25f147 upstream.
+
+When devm_regmap_init_i2c() returns an error code, a pairing
+runtime PM usage counter decrement is needed to keep the
+counter balanced. For error paths after ak8974_set_power(),
+ak8974_detect() and ak8974_reset(), things are the same.
+
+However, When iio_triggered_buffer_setup() returns an error
+code, there will be two PM usgae counter decrements.
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Fixes: 7c94a8b2ee8c ("iio: magn: add a driver for AK8974")
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/magnetometer/ak8974.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+--- a/drivers/iio/magnetometer/ak8974.c
++++ b/drivers/iio/magnetometer/ak8974.c
+@@ -769,19 +769,21 @@ static int ak8974_probe(struct i2c_clien
+ ak8974->map = devm_regmap_init_i2c(i2c, &ak8974_regmap_config);
+ if (IS_ERR(ak8974->map)) {
+ dev_err(&i2c->dev, "failed to allocate register map\n");
++ pm_runtime_put_noidle(&i2c->dev);
++ pm_runtime_disable(&i2c->dev);
+ return PTR_ERR(ak8974->map);
+ }
+
+ ret = ak8974_set_power(ak8974, AK8974_PWR_ON);
+ if (ret) {
+ dev_err(&i2c->dev, "could not power on\n");
+- goto power_off;
++ goto disable_pm;
+ }
+
+ ret = ak8974_detect(ak8974);
+ if (ret) {
+ dev_err(&i2c->dev, "neither AK8974 nor AMI30x found\n");
+- goto power_off;
++ goto disable_pm;
+ }
+
+ ret = ak8974_selftest(ak8974);
+@@ -791,14 +793,9 @@ static int ak8974_probe(struct i2c_clien
+ ret = ak8974_reset(ak8974);
+ if (ret) {
+ dev_err(&i2c->dev, "AK8974 reset failed\n");
+- goto power_off;
++ goto disable_pm;
+ }
+
+- pm_runtime_set_autosuspend_delay(&i2c->dev,
+- AK8974_AUTOSUSPEND_DELAY);
+- pm_runtime_use_autosuspend(&i2c->dev);
+- pm_runtime_put(&i2c->dev);
+-
+ indio_dev->dev.parent = &i2c->dev;
+ indio_dev->channels = ak8974_channels;
+ indio_dev->num_channels = ARRAY_SIZE(ak8974_channels);
+@@ -851,6 +848,11 @@ no_irq:
+ goto cleanup_buffer;
+ }
+
++ pm_runtime_set_autosuspend_delay(&i2c->dev,
++ AK8974_AUTOSUSPEND_DELAY);
++ pm_runtime_use_autosuspend(&i2c->dev);
++ pm_runtime_put(&i2c->dev);
++
+ return 0;
+
+ cleanup_buffer:
+@@ -859,7 +861,6 @@ disable_pm:
+ pm_runtime_put_noidle(&i2c->dev);
+ pm_runtime_disable(&i2c->dev);
+ ak8974_set_power(ak8974, AK8974_PWR_OFF);
+-power_off:
+ regulator_bulk_disable(ARRAY_SIZE(ak8974->regs), ak8974->regs);
+
+ return ret;
--- /dev/null
+From d7369ae1f4d7cffa7574d15e1f787dcca184c49d Mon Sep 17 00:00:00 2001
+From: Chuhong Yuan <hslester96@gmail.com>
+Date: Thu, 28 May 2020 14:41:21 +0800
+Subject: iio: mma8452: Add missed iio_device_unregister() call in mma8452_probe()
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+commit d7369ae1f4d7cffa7574d15e1f787dcca184c49d upstream.
+
+The function iio_device_register() was called in mma8452_probe().
+But the function iio_device_unregister() was not called after
+a call of the function mma8452_set_freefall_mode() failed.
+Thus add the missed function call for one error case.
+
+Fixes: 1a965d405fc6 ("drivers:iio:accel:mma8452: added cleanup provision in case of failure.")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/accel/mma8452.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/accel/mma8452.c
++++ b/drivers/iio/accel/mma8452.c
+@@ -1583,10 +1583,13 @@ static int mma8452_probe(struct i2c_clie
+
+ ret = mma8452_set_freefall_mode(data, false);
+ if (ret < 0)
+- goto buffer_cleanup;
++ goto unregister_device;
+
+ return 0;
+
++unregister_device:
++ iio_device_unregister(indio_dev);
++
+ buffer_cleanup:
+ iio_triggered_buffer_cleanup(indio_dev);
+
--- /dev/null
+From 8db4afe163bbdd93dca6fcefbb831ef12ecc6b4d Mon Sep 17 00:00:00 2001
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Date: Sun, 7 Jun 2020 16:53:57 +0100
+Subject: iio:pressure:ms5611 Fix buffer element alignment
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+commit 8db4afe163bbdd93dca6fcefbb831ef12ecc6b4d upstream.
+
+One of a class of bugs pointed out by Lars in a recent review.
+iio_push_to_buffers_with_timestamp assumes the buffer used is aligned
+to the size of the timestamp (8 bytes). This is not guaranteed in
+this driver which uses an array of smaller elements on the stack.
+Here there is no data leak possibility so use an explicit structure
+on the stack to ensure alignment and nice readable fashion.
+
+The forced alignment of ts isn't strictly necessary in this driver
+as the padding will be correct anyway (there isn't any). However
+it is probably less fragile to have it there and it acts as
+documentation of the requirement.
+
+Fixes: 713bbb4efb9dc ("iio: pressure: ms5611: Add triggered buffer support")
+Reported-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Acked-by: Tomasz Duszynski <tomasz.duszynski@octakon.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/pressure/ms5611_core.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/iio/pressure/ms5611_core.c
++++ b/drivers/iio/pressure/ms5611_core.c
+@@ -215,16 +215,21 @@ static irqreturn_t ms5611_trigger_handle
+ struct iio_poll_func *pf = p;
+ struct iio_dev *indio_dev = pf->indio_dev;
+ struct ms5611_state *st = iio_priv(indio_dev);
+- s32 buf[4]; /* s32 (pressure) + s32 (temp) + 2 * s32 (timestamp) */
++ /* Ensure buffer elements are naturally aligned */
++ struct {
++ s32 channels[2];
++ s64 ts __aligned(8);
++ } scan;
+ int ret;
+
+ mutex_lock(&st->lock);
+- ret = ms5611_read_temp_and_pressure(indio_dev, &buf[1], &buf[0]);
++ ret = ms5611_read_temp_and_pressure(indio_dev, &scan.channels[1],
++ &scan.channels[0]);
+ mutex_unlock(&st->lock);
+ if (ret < 0)
+ goto err;
+
+- iio_push_to_buffers_with_timestamp(indio_dev, buf,
++ iio_push_to_buffers_with_timestamp(indio_dev, &scan,
+ iio_get_time_ns(indio_dev));
+
+ err:
--- /dev/null
+From d88de040e1df38414fc1e4380be9d0e997ab4d58 Mon Sep 17 00:00:00 2001
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+Date: Thu, 4 Jun 2020 21:44:44 -0500
+Subject: iio: pressure: zpa2326: handle pm_runtime_get_sync failure
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+commit d88de040e1df38414fc1e4380be9d0e997ab4d58 upstream.
+
+Calling pm_runtime_get_sync increments the counter even in case of
+failure, causing incorrect ref count. Call pm_runtime_put if
+pm_runtime_get_sync fails.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Fixes: 03b262f2bbf4 ("iio:pressure: initial zpa2326 barometer support")
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/pressure/zpa2326.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/pressure/zpa2326.c
++++ b/drivers/iio/pressure/zpa2326.c
+@@ -672,8 +672,10 @@ static int zpa2326_resume(const struct i
+ int err;
+
+ err = pm_runtime_get_sync(indio_dev->dev.parent);
+- if (err < 0)
++ if (err < 0) {
++ pm_runtime_put(indio_dev->dev.parent);
+ return err;
++ }
+
+ if (err > 0) {
+ /*
i2c-eg20t-load-module-automatically-if-id-matches.patch
arm64-alternative-use-true-and-false-for-boolean-val.patch
arm64-alternatives-don-t-patch-up-internal-branches.patch
+iio-magnetometer-ak8974-fix-alignment-and-data-leak-issues.patch
+iio-humidity-hdc100x-fix-alignment-and-data-leak-issues.patch
+iio-magnetometer-ak8974-fix-runtime-pm-imbalance-on-error.patch
+iio-mma8452-add-missed-iio_device_unregister-call-in-mma8452_probe.patch
+iio-pressure-zpa2326-handle-pm_runtime_get_sync-failure.patch
+iio-pressure-ms5611-fix-buffer-element-alignment.patch
+iio-health-afe4403-fix-timestamp-alignment-and-prevent-data-leak.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
