From: Greg Kroah-Hartman Date: Mon, 20 Jan 2025 15:32:23 +0000 (+0100) Subject: 5.15-stable patches X-Git-Tag: v6.6.73~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e3c1e6307a3803d92f3ea221bf71b57beba85f45;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: iio-adc-rockchip_saradc-fix-information-leak-in-triggered-buffer.patch iio-imu-inv_icm42600-fix-spi-burst-write-not-supported.patch iio-imu-inv_icm42600-fix-timestamps-after-suspend-if-sensor-is-on.patch --- diff --git a/queue-5.15/iio-adc-rockchip_saradc-fix-information-leak-in-triggered-buffer.patch b/queue-5.15/iio-adc-rockchip_saradc-fix-information-leak-in-triggered-buffer.patch new file mode 100644 index 0000000000..2fae8730e2 --- /dev/null +++ b/queue-5.15/iio-adc-rockchip_saradc-fix-information-leak-in-triggered-buffer.patch @@ -0,0 +1,38 @@ +From 38724591364e1e3b278b4053f102b49ea06ee17c Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Mon, 25 Nov 2024 22:16:12 +0100 +Subject: iio: adc: rockchip_saradc: fix information leak in triggered buffer + +From: Javier Carrasco + +commit 38724591364e1e3b278b4053f102b49ea06ee17c upstream. + +The 'data' local struct is used to push data to user space from a +triggered buffer, but it does not set values for inactive channels, as +it only uses iio_for_each_active_channel() to assign new values. + +Initialize the struct to zero before using it to avoid pushing +uninitialized information to userspace. + +Cc: stable@vger.kernel.org +Fixes: 4e130dc7b413 ("iio: adc: rockchip_saradc: Add support iio buffers") +Signed-off-by: Javier Carrasco +Link: https://patch.msgid.link/20241125-iio_memset_scan_holes-v1-4-0cb6e98d895c@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Bin Lan +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/rockchip_saradc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/iio/adc/rockchip_saradc.c ++++ b/drivers/iio/adc/rockchip_saradc.c +@@ -270,6 +270,8 @@ static irqreturn_t rockchip_saradc_trigg + int ret; + int i, j = 0; + ++ memset(&data, 0, sizeof(data)); ++ + mutex_lock(&i_dev->mlock); + + for_each_set_bit(i, i_dev->active_scan_mask, i_dev->masklength) { diff --git a/queue-5.15/iio-imu-inv_icm42600-fix-spi-burst-write-not-supported.patch b/queue-5.15/iio-imu-inv_icm42600-fix-spi-burst-write-not-supported.patch new file mode 100644 index 0000000000..548dd7b4f6 --- /dev/null +++ b/queue-5.15/iio-imu-inv_icm42600-fix-spi-burst-write-not-supported.patch @@ -0,0 +1,68 @@ +From c0f866de4ce447bca3191b9cefac60c4b36a7922 Mon Sep 17 00:00:00 2001 +From: Jean-Baptiste Maneyrol +Date: Tue, 12 Nov 2024 10:30:10 +0100 +Subject: iio: imu: inv_icm42600: fix spi burst write not supported + +From: Jean-Baptiste Maneyrol + +commit c0f866de4ce447bca3191b9cefac60c4b36a7922 upstream. + +Burst write with SPI is not working for all icm42600 chips. It was +only used for setting user offsets with regmap_bulk_write. + +Add specific SPI regmap config for using only single write with SPI. + +Fixes: 9f9ff91b775b ("iio: imu: inv_icm42600: add SPI driver for inv_icm42600 driver") +Cc: stable@vger.kernel.org +Signed-off-by: Jean-Baptiste Maneyrol +Link: https://patch.msgid.link/20241112-inv-icm42600-fix-spi-burst-write-not-supported-v2-1-97690dc03607@tdk.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/inv_icm42600/inv_icm42600.h | 1 + + drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 11 +++++++++++ + drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c | 3 ++- + 3 files changed, 14 insertions(+), 1 deletion(-) + +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600.h ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600.h +@@ -360,6 +360,7 @@ struct inv_icm42600_state { + typedef int (*inv_icm42600_bus_setup)(struct inv_icm42600_state *); + + extern const struct regmap_config inv_icm42600_regmap_config; ++extern const struct regmap_config inv_icm42600_spi_regmap_config; + extern const struct dev_pm_ops inv_icm42600_pm_ops; + + const struct iio_mount_matrix * +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +@@ -43,6 +43,17 @@ const struct regmap_config inv_icm42600_ + }; + EXPORT_SYMBOL_GPL(inv_icm42600_regmap_config); + ++/* define specific regmap for SPI not supporting burst write */ ++const struct regmap_config inv_icm42600_spi_regmap_config = { ++ .reg_bits = 8, ++ .val_bits = 8, ++ .max_register = 0x4FFF, ++ .ranges = inv_icm42600_regmap_ranges, ++ .num_ranges = ARRAY_SIZE(inv_icm42600_regmap_ranges), ++ .use_single_write = true, ++}; ++EXPORT_SYMBOL_NS_GPL(inv_icm42600_spi_regmap_config, IIO_ICM42600); ++ + struct inv_icm42600_hw { + uint8_t whoami; + const char *name; +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c +@@ -59,7 +59,8 @@ static int inv_icm42600_probe(struct spi + return -EINVAL; + chip = (enum inv_icm42600_chip)match; + +- regmap = devm_regmap_init_spi(spi, &inv_icm42600_regmap_config); ++ /* use SPI specific regmap */ ++ regmap = devm_regmap_init_spi(spi, &inv_icm42600_spi_regmap_config); + if (IS_ERR(regmap)) + return PTR_ERR(regmap); + diff --git a/queue-5.15/iio-imu-inv_icm42600-fix-timestamps-after-suspend-if-sensor-is-on.patch b/queue-5.15/iio-imu-inv_icm42600-fix-timestamps-after-suspend-if-sensor-is-on.patch new file mode 100644 index 0000000000..8cbb19d163 --- /dev/null +++ b/queue-5.15/iio-imu-inv_icm42600-fix-timestamps-after-suspend-if-sensor-is-on.patch @@ -0,0 +1,48 @@ +From 65a60a590142c54a3f3be11ff162db2d5b0e1e06 Mon Sep 17 00:00:00 2001 +From: Jean-Baptiste Maneyrol +Date: Wed, 13 Nov 2024 21:25:45 +0100 +Subject: iio: imu: inv_icm42600: fix timestamps after suspend if sensor is on + +From: Jean-Baptiste Maneyrol + +commit 65a60a590142c54a3f3be11ff162db2d5b0e1e06 upstream. + +Currently suspending while sensors are one will result in timestamping +continuing without gap at resume. It can work with monotonic clock but +not with other clocks. Fix that by resetting timestamping. + +Fixes: ec74ae9fd37c ("iio: imu: inv_icm42600: add accurate timestamping") +Cc: stable@vger.kernel.org +Signed-off-by: Jean-Baptiste Maneyrol +Link: https://patch.msgid.link/20241113-inv_icm42600-fix-timestamps-after-suspend-v1-1-dfc77c394173@tdk.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c +@@ -720,6 +720,8 @@ out_unlock: + static int __maybe_unused inv_icm42600_resume(struct device *dev) + { + struct inv_icm42600_state *st = dev_get_drvdata(dev); ++ struct inv_icm42600_timestamp *gyro_ts = iio_priv(st->indio_gyro); ++ struct inv_icm42600_timestamp *accel_ts = iio_priv(st->indio_accel); + int ret; + + mutex_lock(&st->lock); +@@ -740,9 +742,12 @@ static int __maybe_unused inv_icm42600_r + goto out_unlock; + + /* restore FIFO data streaming */ +- if (st->fifo.on) ++ if (st->fifo.on) { ++ inv_icm42600_timestamp_reset(gyro_ts); ++ inv_icm42600_timestamp_reset(accel_ts); + ret = regmap_write(st->map, INV_ICM42600_REG_FIFO_CONFIG, + INV_ICM42600_FIFO_CONFIG_STREAM); ++ } + + out_unlock: + mutex_unlock(&st->lock); diff --git a/queue-5.15/series b/queue-5.15/series index 9c13cf813c..033997a485 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -110,8 +110,10 @@ filemap-avoid-truncating-64-bit-offset-to-32-bits.patch fs-proc-fix-softlockup-in-__read_vmcore-part-2.patch gpiolib-cdev-fix-use-after-free-in-lineinfo_changed_notify.patch bluetooth-rfcomm-fix-not-validating-setsockopt-user-input.patch -irqchip-plug-a-of-node-reference-leak-in-platform_irqchip_probe.patch irqchip-gic-v3-handle-cpu_pm_enter_failed-correctly.patch hrtimers-handle-cpu-state-correctly-on-hotplug.patch drm-i915-fb-relax-clear-color-alignment-to-64-bytes.patch revert-pci-use-preserve_config-in-place-of-pci_flags.patch +iio-imu-inv_icm42600-fix-spi-burst-write-not-supported.patch +iio-imu-inv_icm42600-fix-timestamps-after-suspend-if-sensor-is-on.patch +iio-adc-rockchip_saradc-fix-information-leak-in-triggered-buffer.patch