From: Greg Kroah-Hartman Date: Mon, 13 Jul 2026 12:58:36 +0000 (+0200) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f1ae591612c27005cddd807bb94ac2b03710aa90;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: iio-accel-bmc150-clamp-the-device-reported-fifo-frame-count.patch iio-accel-kxsd9-fix-runtime-pm-imbalance-on-write_raw-error.patch iio-adc-lpc32xx-initialize-completion-before-requesting-irq.patch iio-adc-ti-ads124s08-return-reset-gpio-lookup-errors.patch iio-chemical-scd30-cleanup-initializations-and-fix-sign-extension-bug.patch iio-event-fix-event-fifo-reset-race.patch iio-gyro-bmg160-bail-out-when-bandwidth-filter-is-not-in-table.patch iio-gyro-bmg160-wait-full-startup-time-after-mode-change-at-probe.patch iio-imu-bmi160-add-irqf_no_thread-to-data-ready-trigger-irq.patch iio-imu-st_lsm6dsx-deselect-shub-page-before-reading-whoami.patch iio-light-al3010-fix-incorrect-scale-for-the-highest-gain-range.patch iio-light-gp2ap002-fix-runtime-pm-leak-on-read-error.patch iio-light-opt3001-fix-missing-state-reset-on-timeout.patch iio-light-veml6030-fix-channel-type-when-pushing-events.patch iio-magnetometer-ak8975-add-missed-pm_runtime_put_autosuspend-call.patch iio-temperature-ltc2983-fix-reinit_completion-called-after-conversion-start.patch usb-gadget-function-rndis-add-length-check-for-header.patch usb-gadget-function-rndis-add-length-check-to-response-query.patch --- diff --git a/queue-5.10/iio-accel-bmc150-clamp-the-device-reported-fifo-frame-count.patch b/queue-5.10/iio-accel-bmc150-clamp-the-device-reported-fifo-frame-count.patch new file mode 100644 index 0000000000..049a8e0028 --- /dev/null +++ b/queue-5.10/iio-accel-bmc150-clamp-the-device-reported-fifo-frame-count.patch @@ -0,0 +1,64 @@ +From ce0e1cae26096fe959a0da5563a6d6d5a801d5fb Mon Sep 17 00:00:00 2001 +From: Bryam Vargas +Date: Sat, 13 Jun 2026 02:18:39 -0500 +Subject: iio: accel: bmc150: clamp the device-reported FIFO frame count + +From: Bryam Vargas + +commit ce0e1cae26096fe959a0da5563a6d6d5a801d5fb upstream. + +__bmc150_accel_fifo_flush() copies the number of samples the device +reports in its hardware FIFO into an on-stack buffer + + u16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3]; + +which is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The +frame count is read from the FIFO_STATUS register and only masked to its +7 valid bits: + + count = val & 0x7F; + +so it can be 0..127. The only other limit applied to it is the optional +caller-supplied sample budget: + + if (samples && count > samples) + count = samples; + +which does not constrain count on the flush-all path (samples == 0), and +leaves it well above 32 whenever samples is larger. count samples are +then transferred into buffer[]: + + bmc150_accel_fifo_transfer(data, (u8 *)buffer, count); + +bmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a +malfunctioning, malicious or counterfeit accelerometer (or an attacker +tampering with the I2C/SPI bus) that reports up to 127 frames writes up +to 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up +to 570 bytes that clobbers the stack canary, saved registers and the +return address. + +Clamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[] +is sized for, before the transfer, mirroring the watermark clamp already +done in bmc150_accel_set_watermark(). A well-formed flush reports at most +BMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected. + +Fixes: 3bbec9773389 ("iio: bmc150_accel: add support for hardware fifo") +Cc: stable@vger.kernel.org +Signed-off-by: Bryam Vargas +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/accel/bmc150-accel-core.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/iio/accel/bmc150-accel-core.c ++++ b/drivers/iio/accel/bmc150-accel-core.c +@@ -919,6 +919,8 @@ static int __bmc150_accel_fifo_flush(str + if (samples && count > samples) + count = samples; + ++ count = min_t(u8, count, BMC150_ACCEL_FIFO_LENGTH); ++ + ret = bmc150_accel_fifo_transfer(data, (u8 *)buffer, count); + if (ret) + return ret; diff --git a/queue-5.10/iio-accel-kxsd9-fix-runtime-pm-imbalance-on-write_raw-error.patch b/queue-5.10/iio-accel-kxsd9-fix-runtime-pm-imbalance-on-write_raw-error.patch new file mode 100644 index 0000000000..0ff2131697 --- /dev/null +++ b/queue-5.10/iio-accel-kxsd9-fix-runtime-pm-imbalance-on-write_raw-error.patch @@ -0,0 +1,42 @@ +From 44a5fd874bb6873bdaec59f722c1d57832fbc9df Mon Sep 17 00:00:00 2001 +From: Biren Pandya +Date: Sun, 14 Jun 2026 12:45:46 +0530 +Subject: iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error + +From: Biren Pandya + +commit 44a5fd874bb6873bdaec59f722c1d57832fbc9df upstream. + +kxsd9_write_raw() takes a runtime PM reference with pm_runtime_get_sync() +but returns -EINVAL directly when a scale with a non-zero integer part is +requested, skipping the matching pm_runtime_put_autosuspend(). This leaks +a runtime PM usage-counter reference on every such write, after which the +device can no longer autosuspend. + +Set the error code and fall through to the existing put instead of +returning early. + +Fixes: 9a9a369d6178 ("iio: accel: kxsd9: Deploy system and runtime PM") +Signed-off-by: Biren Pandya +Assisted-by: Claude:claude-opus-4-8 coccinelle +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/accel/kxsd9.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/iio/accel/kxsd9.c ++++ b/drivers/iio/accel/kxsd9.c +@@ -146,8 +146,9 @@ static int kxsd9_write_raw(struct iio_de + if (mask == IIO_CHAN_INFO_SCALE) { + /* Check no integer component */ + if (val) +- return -EINVAL; +- ret = kxsd9_write_scale(indio_dev, val2); ++ ret = -EINVAL; ++ else ++ ret = kxsd9_write_scale(indio_dev, val2); + } + + pm_runtime_mark_last_busy(st->dev); diff --git a/queue-5.10/iio-adc-lpc32xx-initialize-completion-before-requesting-irq.patch b/queue-5.10/iio-adc-lpc32xx-initialize-completion-before-requesting-irq.patch new file mode 100644 index 0000000000..b18fc0a408 --- /dev/null +++ b/queue-5.10/iio-adc-lpc32xx-initialize-completion-before-requesting-irq.patch @@ -0,0 +1,73 @@ +From e561b35633f450ee607e87a6401d97f156a0cd54 Mon Sep 17 00:00:00 2001 +From: Maxwell Doose +Date: Fri, 12 Jun 2026 19:58:10 -0500 +Subject: iio: adc: lpc32xx: Initialize completion before requesting IRQ + +From: Maxwell Doose + +commit e561b35633f450ee607e87a6401d97f156a0cd54 upstream. + +In the report from Jaeyoung Chung: + +"lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its +interrupt handler with devm_request_irq() before it initializes +st->completion with init_completion(). If an interrupt arrives after +devm_request_irq() and before init_completion(), the handler calls +complete() on an uninitialized completion, causing a kernel panic. + +The probe path, in lpc32xx_adc_probe(): + + iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */ + ... + retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0, + LPC32XXAD_NAME, st); /* register handler */ + ... + init_completion(&st->completion); /* initialize completion */ + +lpc32xx_adc_isr() calls complete(): + + complete(&st->completion); + +If the device raises an interrupt before init_completion() runs, +complete() acquires the uninitialized wait.lock and walks the zeroed +task_list in swake_up_locked(). The zeroed task_list makes list_empty() +return false, so swake_up_locked() dereferences a NULL list entry, +triggering a KASAN wild-memory-access." + +Fix the chance of a spurious IRQ causing an uninitialized pointer +dereference by moving init_completion() above devm_request_irq(). + +Fixes: 7901b2a1453e ("staging:iio:adc:lpc32xx rename local state structure to _state") +Reported-by: Sangyun Kim +Reported-by: Kyungwook Boo +Reported-by: Jaeyoung Chung +Closes: https://lore.kernel.org/linux-iio/20260610115700.774689-1-jjy600901@snu.ac.kr/ +Signed-off-by: Maxwell Doose +Reviewed-by: Vladimir Zapolskiy +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/lpc32xx_adc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/iio/adc/lpc32xx_adc.c ++++ b/drivers/iio/adc/lpc32xx_adc.c +@@ -176,6 +176,8 @@ static int lpc32xx_adc_probe(struct plat + if (irq <= 0) + return -ENXIO; + ++ init_completion(&st->completion); ++ + retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0, + LPC32XXAD_NAME, st); + if (retval < 0) { +@@ -194,8 +196,6 @@ static int lpc32xx_adc_probe(struct plat + + platform_set_drvdata(pdev, iodev); + +- init_completion(&st->completion); +- + iodev->name = LPC32XXAD_NAME; + iodev->info = &lpc32xx_adc_iio_info; + iodev->modes = INDIO_DIRECT_MODE; diff --git a/queue-5.10/iio-adc-ti-ads124s08-return-reset-gpio-lookup-errors.patch b/queue-5.10/iio-adc-ti-ads124s08-return-reset-gpio-lookup-errors.patch new file mode 100644 index 0000000000..d9b3165b7b --- /dev/null +++ b/queue-5.10/iio-adc-ti-ads124s08-return-reset-gpio-lookup-errors.patch @@ -0,0 +1,43 @@ +From 7dc4de2aa6316f1d044cde21f5acfec5f3ec6b47 Mon Sep 17 00:00:00 2001 +From: Pengpeng Hou +Date: Thu, 25 Jun 2026 13:44:07 +0800 +Subject: iio: adc: ti-ads124s08: Return reset GPIO lookup errors + +From: Pengpeng Hou + +commit 7dc4de2aa6316f1d044cde21f5acfec5f3ec6b47 upstream. + +devm_gpiod_get_optional() returns NULL when the optional GPIO is absent, +but returns an ERR_PTR when the GPIO provider lookup fails, including +probe deferral. + +Probe currently logs the ERR_PTR case as if the reset GPIO were simply +absent and keeps the error pointer in reset_gpio. Later ads124s_reset() +treats any non-NULL reset_gpio as a valid descriptor and passes it to +gpiod_set_value_cansleep(). + +Return the lookup error instead of retaining the ERR_PTR. + +Fixes: e717f8c6dfec ("iio: adc: Add the TI ads124s08 ADC code") +Cc: stable@vger.kernel.org +Reviewed-by: Joshua Crofts +Signed-off-by: Pengpeng Hou +Reviewed-by: Andy Shevchenko +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ti-ads124s08.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/iio/adc/ti-ads124s08.c ++++ b/drivers/iio/adc/ti-ads124s08.c +@@ -323,7 +323,8 @@ static int ads124s_probe(struct spi_devi + ads124s_priv->reset_gpio = devm_gpiod_get_optional(&spi->dev, + "reset", GPIOD_OUT_LOW); + if (IS_ERR(ads124s_priv->reset_gpio)) +- dev_info(&spi->dev, "Reset GPIO not defined\n"); ++ return dev_err_probe(&spi->dev, PTR_ERR(ads124s_priv->reset_gpio), ++ "Failed to get reset GPIO\n"); + + ads124s_priv->chip_info = &ads124s_chip_info_tbl[spi_id->driver_data]; + diff --git a/queue-5.10/iio-chemical-scd30-cleanup-initializations-and-fix-sign-extension-bug.patch b/queue-5.10/iio-chemical-scd30-cleanup-initializations-and-fix-sign-extension-bug.patch new file mode 100644 index 0000000000..4f64aa94d1 --- /dev/null +++ b/queue-5.10/iio-chemical-scd30-cleanup-initializations-and-fix-sign-extension-bug.patch @@ -0,0 +1,76 @@ +From 60d877910a43c305b5165131b258a17b1d772d57 Mon Sep 17 00:00:00 2001 +From: Maxwell Doose +Date: Tue, 26 May 2026 17:55:24 -0500 +Subject: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug + +From: Maxwell Doose + +commit 60d877910a43c305b5165131b258a17b1d772d57 upstream. + +Include linux/bitfield.h for FIELD_GET(). + +Create new macros for bit manipulation in combination with manual bit +manipulation being replaced with FIELD_GET(). + +The current variable declaration and initializations are barely readable +and use comma separations across multiple lines. Refactor the +initializations so that mantissa and exp have separate declarations and +sign gets initialized later. + +In addition (and due to the nature of the cleanup), fix a sign-extension +bug where, float32 would get bitwise anded with ~BIT(31) +(which is 0xFFFFFFFF7FFFFFFF) which corrupted the exponent. + +Fixes: 64b3d8b1b0f5c ("iio: chemical: scd30: add core driver") +Reported-by: sashiko +Closes: https://sashiko.dev/#/patchset/20260524020309.18618-1-m32285159%40gmail.com +Signed-off-by: Maxwell Doose +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/chemical/scd30_core.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +--- a/drivers/iio/chemical/scd30_core.c ++++ b/drivers/iio/chemical/scd30_core.c +@@ -4,6 +4,8 @@ + * + * Copyright (c) 2020 Tomasz Duszynski + */ ++ ++#include + #include + #include + #include +@@ -43,6 +45,11 @@ + #define SCD30_TEMP_OFFSET_MAX 655360 + #define SCD30_EXTRA_TIMEOUT_PER_S 250 + ++/* Floating point arithmetic macros */ ++#define SCD30_FLOAT_MANTISSA_MSK GENMASK(22, 0) ++#define SCD30_FLOAT_EXP_MSK GENMASK(30, 23) ++#define SCD30_FLOAT_SIGN_MSK BIT(31) ++ + enum { + SCD30_CONC, + SCD30_TEMP, +@@ -89,10 +96,14 @@ static int scd30_reset(struct scd30_stat + /* simplified float to fixed point conversion with a scaling factor of 0.01 */ + static int scd30_float_to_fp(int float32) + { +- int fraction, shift, +- mantissa = float32 & GENMASK(22, 0), +- sign = (float32 & BIT(31)) ? -1 : 1, +- exp = (float32 & ~BIT(31)) >> 23; ++ int fraction, shift, sign; ++ int mantissa = FIELD_GET(SCD30_FLOAT_MANTISSA_MSK, float32); ++ int exp = FIELD_GET(SCD30_FLOAT_EXP_MSK, float32); ++ ++ if (float32 & SCD30_FLOAT_SIGN_MSK) ++ sign = -1; ++ else ++ sign = 1; + + /* special case 0 */ + if (!exp && !mantissa) diff --git a/queue-5.10/iio-event-fix-event-fifo-reset-race.patch b/queue-5.10/iio-event-fix-event-fifo-reset-race.patch new file mode 100644 index 0000000000..1e87279bd9 --- /dev/null +++ b/queue-5.10/iio-event-fix-event-fifo-reset-race.patch @@ -0,0 +1,76 @@ +From af791d295737ea6b6ff2c8d8488462a49c14af01 Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Mon, 6 Jul 2026 21:48:26 -0700 +Subject: iio: event: Fix event FIFO reset race +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lars-Peter Clausen + +commit af791d295737ea6b6ff2c8d8488462a49c14af01 upstream. + +`iio_event_getfd()` creates the event file descriptor with +`anon_inode_getfd()`, which allocates a new fd, creates the anonymous +file and installs it in the process fd table before returning to the +caller. + +The IIO code resets the event FIFO after `anon_inode_getfd()` has returned, +but before `IIO_GET_EVENT_FD_IOCTL` has copied the fd number to userspace. +But since fd tables are shared between threads, another thread can guess +the newly allocated fd number and issue a `read()` on it as soon as the fd +has been installed. + +This means the `kfifo_to_user()` in `iio_event_chrdev_read()` can run in +parallel with the `kfifo_reset_out()` in `iio_event_getfd()`. + +The kfifo documentation says that `kfifo_reset_out()` is only safe when it +is called from the reader thread and there is only one concurrent reader. +Otherwise it is dangerous and must be handled in the same way as +`kfifo_reset()`. + +If that happens, `kfifo_to_user()` can advance the FIFO `out` index based +on state from before the reset, after the reset has already moved the `out` +index to the current `in` index. That can leave the FIFO with an `out` +index past the `in` index. A later `read()` can then see an underflowed +FIFO length and copy more data than the event FIFO buffer contains. This +can result in an out-of-bounds read and leak adjacent kernel memory to +userspace. + +Move the FIFO reset before `anon_inode_getfd()`. At that point the event fd is +marked busy, but the new fd has not been installed yet, so userspace cannot +access it while the FIFO is reset. + +Fixes: b91accafbb10 ("iio:event: Fix and cleanup locking") +Reported-by: Codex:gpt-5.5 +Signed-off-by: Lars-Peter Clausen +Reviewed-by: Nuno Sá +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/industrialio-event.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/iio/industrialio-event.c ++++ b/drivers/iio/industrialio-event.c +@@ -205,6 +205,8 @@ int iio_event_getfd(struct iio_dev *indi + goto unlock; + } + ++ kfifo_reset_out(&ev_int->det_events); ++ + iio_device_get(indio_dev); + + fd = anon_inode_getfd("iio:event", &iio_event_chrdev_fileops, +@@ -212,10 +214,7 @@ int iio_event_getfd(struct iio_dev *indi + if (fd < 0) { + clear_bit(IIO_BUSY_BIT_POS, &ev_int->flags); + iio_device_put(indio_dev); +- } else { +- kfifo_reset_out(&ev_int->det_events); + } +- + unlock: + mutex_unlock(&indio_dev->mlock); + return fd; diff --git a/queue-5.10/iio-gyro-bmg160-bail-out-when-bandwidth-filter-is-not-in-table.patch b/queue-5.10/iio-gyro-bmg160-bail-out-when-bandwidth-filter-is-not-in-table.patch new file mode 100644 index 0000000000..30b2d14913 --- /dev/null +++ b/queue-5.10/iio-gyro-bmg160-bail-out-when-bandwidth-filter-is-not-in-table.patch @@ -0,0 +1,68 @@ +From 8320c77e67382d5d55d77043a5f60a867d408a2b Mon Sep 17 00:00:00 2001 +From: Stepan Ionichev +Date: Sun, 10 May 2026 07:35:00 +0500 +Subject: iio: gyro: bmg160: bail out when bandwidth/filter is not in table + +From: Stepan Ionichev + +commit 8320c77e67382d5d55d77043a5f60a867d408a2b upstream. + +bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry +matching the bw_bits value read from the chip: + + for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) { + if (bmg160_samp_freq_table[i].bw_bits == bw_bits) + break; + } + *val = bmg160_samp_freq_table[i].filter; + +If no entry matches, i ends up equal to the array size and the next line +reads one slot past the end. bmg160_set_filter() has the same shape, driven +by 'val' instead of bw_bits. + +smatch flags both: + + drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error: + buffer overflow 'bmg160_samp_freq_table' 7 <= 7 + drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error: + buffer overflow 'bmg160_samp_freq_table' 7 <= 7 + +Return -EINVAL when no entry matches. + +The set_filter() path is reachable from userspace via the sysfs +in_anglvel_filter_low_pass_3db_frequency interface, so userspace can +trivially trigger the out-of-bounds read with a value that is not in +bmg160_samp_freq_table[].filter. + +Fixes: 22b46c45fb9b ("iio:gyro:bmg160 Gyro Sensor driver") +Signed-off-by: Stepan Ionichev +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/gyro/bmg160_core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/iio/gyro/bmg160_core.c ++++ b/drivers/iio/gyro/bmg160_core.c +@@ -203,6 +203,9 @@ static int bmg160_get_filter(struct bmg1 + break; + } + ++ if (i == ARRAY_SIZE(bmg160_samp_freq_table)) ++ return -EINVAL; ++ + *val = bmg160_samp_freq_table[i].filter; + + return ret ? ret : IIO_VAL_INT; +@@ -220,6 +223,9 @@ static int bmg160_set_filter(struct bmg1 + break; + } + ++ if (i == ARRAY_SIZE(bmg160_samp_freq_table)) ++ return -EINVAL; ++ + ret = regmap_write(data->regmap, BMG160_REG_PMU_BW, + bmg160_samp_freq_table[i].bw_bits); + if (ret < 0) { diff --git a/queue-5.10/iio-gyro-bmg160-wait-full-startup-time-after-mode-change-at-probe.patch b/queue-5.10/iio-gyro-bmg160-wait-full-startup-time-after-mode-change-at-probe.patch new file mode 100644 index 0000000000..2dfa7e00c9 --- /dev/null +++ b/queue-5.10/iio-gyro-bmg160-wait-full-startup-time-after-mode-change-at-probe.patch @@ -0,0 +1,52 @@ +From 088fcb9b567f8723074ad9eb1bf5cb46f8a0096b Mon Sep 17 00:00:00 2001 +From: Stepan Ionichev +Date: Mon, 11 May 2026 11:40:20 +0500 +Subject: iio: gyro: bmg160: wait full startup time after mode change at probe + +From: Stepan Ionichev + +commit 088fcb9b567f8723074ad9eb1bf5cb46f8a0096b upstream. + +bmg160_chip_init() calls bmg160_set_mode(BMG160_MODE_NORMAL) and +then waits only 500-1000 us. Per the BMG160 datasheet +(BST-BMG160-DS000-07 Rev. 1.0, May 2013), the start-up and wake-up +times (tsu, twusm) are 30 ms. + +The same file already waits BMG160_MAX_STARTUP_TIME_MS (80 ms) +in bmg160_runtime_resume() after the same set_mode(NORMAL) +operation. The 500 us value at probe was likely a unit mix-up; +the old comment said "500 ms" while the code used microseconds. + +Reuse the same constant via msleep() and add a code comment +explaining the datasheet basis for the wait. Without this, +register writes that follow the mode change can hit the chip +before it is ready. + +Fixes: 22b46c45fb9b ("iio:gyro:bmg160 Gyro Sensor driver") +Signed-off-by: Stepan Ionichev +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/gyro/bmg160_core.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/iio/gyro/bmg160_core.c ++++ b/drivers/iio/gyro/bmg160_core.c +@@ -266,8 +266,14 @@ static int bmg160_chip_init(struct bmg16 + if (ret < 0) + return ret; + +- /* Wait upto 500 ms to be ready after changing mode */ +- usleep_range(500, 1000); ++ /* ++ * Wait for the chip to be ready after switching to normal mode. ++ * The BMG160 datasheet (BST-BMG160-DS000-07 Rev. 1.0, May 2013) ++ * specifies a start-up / wake-up time (tsu, twusm) of 30 ms; use ++ * BMG160_MAX_STARTUP_TIME_MS (80 ms) as a safety margin, matching ++ * what bmg160_runtime_resume() already does. ++ */ ++ msleep(BMG160_MAX_STARTUP_TIME_MS); + + /* Set Bandwidth */ + ret = bmg160_set_bw(data, BMG160_DEF_BW); diff --git a/queue-5.10/iio-imu-bmi160-add-irqf_no_thread-to-data-ready-trigger-irq.patch b/queue-5.10/iio-imu-bmi160-add-irqf_no_thread-to-data-ready-trigger-irq.patch new file mode 100644 index 0000000000..7925c31d7a --- /dev/null +++ b/queue-5.10/iio-imu-bmi160-add-irqf_no_thread-to-data-ready-trigger-irq.patch @@ -0,0 +1,45 @@ +From cd5a6a5096b246e10600da3ac47a1274ce9573c8 Mon Sep 17 00:00:00 2001 +From: Runyu Xiao +Date: Thu, 4 Jun 2026 09:42:47 +0800 +Subject: iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ + +From: Runyu Xiao + +commit cd5a6a5096b246e10600da3ac47a1274ce9573c8 upstream. + +bmi160_probe_trigger() registers iio_trigger_generic_data_rdy_poll() +through devm_request_irq(), but it passes only irq_type and does not add +IRQF_NO_THREAD. + +When the kernel is booted with forced IRQ threading, the parent IRQ can +otherwise be threaded by the IRQ core and the subsequent IIO trigger +child IRQ is dispatched from irq/... thread context instead of hardirq +context. Because the handler immediately pushes the event into +iio_trigger_poll(), this violates the hardirq-only IIO trigger helper +contract and can drive downstream trigger consumers through the wrong +execution context. + +Add IRQF_NO_THREAD on top of irq_type when registering the BMI160 data- +ready trigger handler. + +Fixes: 895bf81e6bbf ("iio:bmi160: add drdy interrupt support") +Cc: stable@vger.kernel.org +Signed-off-by: Runyu Xiao +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/bmi160/bmi160_core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/iio/imu/bmi160/bmi160_core.c ++++ b/drivers/iio/imu/bmi160/bmi160_core.c +@@ -801,7 +801,8 @@ int bmi160_probe_trigger(struct iio_dev + + ret = devm_request_irq(&indio_dev->dev, irq, + &iio_trigger_generic_data_rdy_poll, +- irq_type, "bmi160", data->trig); ++ irq_type | IRQF_NO_THREAD, ++ "bmi160", data->trig); + if (ret) + return ret; + diff --git a/queue-5.10/iio-imu-st_lsm6dsx-deselect-shub-page-before-reading-whoami.patch b/queue-5.10/iio-imu-st_lsm6dsx-deselect-shub-page-before-reading-whoami.patch new file mode 100644 index 0000000000..d6172126d0 --- /dev/null +++ b/queue-5.10/iio-imu-st_lsm6dsx-deselect-shub-page-before-reading-whoami.patch @@ -0,0 +1,85 @@ +From aede83625ff5d9539508582036df30c809d51058 Mon Sep 17 00:00:00 2001 +From: Andreas Kempe +Date: Thu, 2 Jul 2026 10:41:23 +0000 +Subject: iio: imu: st_lsm6dsx: deselect shub page before reading whoami + +From: Andreas Kempe + +commit aede83625ff5d9539508582036df30c809d51058 upstream. + +As part of driver initialization, e.g. st_lsm6dsx_init_shub() selects +the shub register page using st_lsm6dsx_set_page(). Selecting the shub +register page shadows the regular register space so whoami, among other +registers, is no longer accessible. + +In applications where the IMU is permanently powered separately from the +processor, there is a window where a reset of the CPU leaves the IMU in +the shub register page. Once this occurs, any subsequent probe attempt +fails because of the register shadowing. + +Using the ism330dlc, the error typically looks like + + st_lsm6dsx_i2c 3-006a: unsupported whoami [10] + +with the unknown whoami read from a reserved register in the shub page. + +The reset register is also shadowed by the page select, preventing a +reset from recovering the chip. + +Unconditionally clear the shub page before the whoami readout to ensure +normal register access and allow the initialization to proceed. + +Place the fix in st_lsm6dsx_check_whoami() before the whoami check +because hw->settings, which st_lsm6dsx_set_page() relies on, is first +assigned in that function. + +Placing the fix in a more logical place than the whoami check would +require a bigger restructuring of the code. + +Fixes: c91c1c844ebd ("iio: imu: st_lsm6dsx: add i2c embedded controller support") +Signed-off-by: Andreas Kempe +Acked-by: Lorenzo Bianconi +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 21 ++++++++++++++++++++- + 1 file changed, 20 insertions(+), 1 deletion(-) + +--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c ++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +@@ -1389,6 +1389,26 @@ static int st_lsm6dsx_check_whoami(struc + return -ENODEV; + } + ++ hw->settings = &st_lsm6dsx_sensor_settings[i]; ++ ++ if (hw->settings->shub_settings.page_mux.addr) { ++ /* ++ * If the IMU has the shub page selected on init, for example ++ * after a CPU watchdog reset while the page is selected, the ++ * regular register space is shadowed. While the regular ++ * register space is shadowed, the registers needed for ++ * initializing the IMU are not available. ++ * ++ * Unconditionally clear the shub page selection to ensure ++ * normal register access. ++ */ ++ err = st_lsm6dsx_set_page(hw, false); ++ if (err < 0) { ++ dev_err(hw->dev, "failed to clear shub page\n"); ++ return err; ++ } ++ } ++ + err = regmap_read(hw->regmap, ST_LSM6DSX_REG_WHOAMI_ADDR, &data); + if (err < 0) { + dev_err(hw->dev, "failed to read whoami register\n"); +@@ -1401,7 +1421,6 @@ static int st_lsm6dsx_check_whoami(struc + } + + *name = st_lsm6dsx_sensor_settings[i].id[j].name; +- hw->settings = &st_lsm6dsx_sensor_settings[i]; + + return 0; + } diff --git a/queue-5.10/iio-light-al3010-fix-incorrect-scale-for-the-highest-gain-range.patch b/queue-5.10/iio-light-al3010-fix-incorrect-scale-for-the-highest-gain-range.patch new file mode 100644 index 0000000000..fc1173dfb4 --- /dev/null +++ b/queue-5.10/iio-light-al3010-fix-incorrect-scale-for-the-highest-gain-range.patch @@ -0,0 +1,41 @@ +From aa411adc6ce40ad1a55ebc965f255a4cfc0005f8 Mon Sep 17 00:00:00 2001 +From: Vidhu Sarwal +Date: Sat, 4 Jul 2026 17:22:45 +0530 +Subject: iio: light: al3010: fix incorrect scale for the highest gain range + +From: Vidhu Sarwal + +commit aa411adc6ce40ad1a55ebc965f255a4cfc0005f8 upstream. + +al3010_scales[] encodes the highest gain range as {0, 1187200}. +For IIO_VAL_INT_PLUS_MICRO, the fractional part must be less than +1000000, so the scale 1.1872 should instead be represented as +{ 1, 187200 }. + +Since write_raw() compares the value from userspace against this +table, writing the advertised 1.1872 scale never matches the malformed +entry and returns -EINVAL. As a result, the highest gain range cannot +be selected. Reading the scale in that state also reports the malformed +value. + +Fixes: c36b5195ab70 ("iio: light: add Dyna-Image AL3010 driver") +Signed-off-by: Vidhu Sarwal +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/al3010.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/light/al3010.c ++++ b/drivers/iio/light/al3010.c +@@ -43,7 +43,7 @@ enum al3xxxx_range { + }; + + static const int al3010_scales[][2] = { +- {0, 1187200}, {0, 296800}, {0, 74200}, {0, 18600} ++ { 1, 187200 }, { 0, 296800 }, { 0, 74200 }, { 0, 18600 }, + }; + + struct al3010_data { diff --git a/queue-5.10/iio-light-gp2ap002-fix-runtime-pm-leak-on-read-error.patch b/queue-5.10/iio-light-gp2ap002-fix-runtime-pm-leak-on-read-error.patch new file mode 100644 index 0000000000..7d4dcdffef --- /dev/null +++ b/queue-5.10/iio-light-gp2ap002-fix-runtime-pm-leak-on-read-error.patch @@ -0,0 +1,38 @@ +From 38b72267b7e22768a1f26d9935de4e1752a1dc85 Mon Sep 17 00:00:00 2001 +From: Biren Pandya +Date: Sun, 14 Jun 2026 12:45:49 +0530 +Subject: iio: light: gp2ap002: fix runtime PM leak on read error + +From: Biren Pandya + +commit 38b72267b7e22768a1f26d9935de4e1752a1dc85 upstream. + +gp2ap002_read_raw() calls pm_runtime_get_sync() before reading the +lux value, but if gp2ap002_get_lux() fails, it returns directly. This +skips the pm_runtime_put_autosuspend() call at the "out" label, +permanently leaking a runtime PM reference and preventing the device +from autosuspending. + +Replace the direct return with a "goto out" to ensure the reference +is properly dropped on the error path. + +Fixes: f6dbf83c17cb ("iio: light: gp2ap002: Take runtime PM reference on light read") +Signed-off-by: Biren Pandya +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/gp2ap002.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/light/gp2ap002.c ++++ b/drivers/iio/light/gp2ap002.c +@@ -258,7 +258,7 @@ static int gp2ap002_read_raw(struct iio_ + case IIO_LIGHT: + ret = gp2ap002_get_lux(gp2ap002); + if (ret < 0) +- return ret; ++ goto out; + *val = ret; + ret = IIO_VAL_INT; + goto out; diff --git a/queue-5.10/iio-light-opt3001-fix-missing-state-reset-on-timeout.patch b/queue-5.10/iio-light-opt3001-fix-missing-state-reset-on-timeout.patch new file mode 100644 index 0000000000..9ab75f9782 --- /dev/null +++ b/queue-5.10/iio-light-opt3001-fix-missing-state-reset-on-timeout.patch @@ -0,0 +1,44 @@ +From c123ca6ee26ad98f70a866ff428b08145c5a24fe Mon Sep 17 00:00:00 2001 +From: Joshua Crofts +Date: Tue, 26 May 2026 13:15:29 +0200 +Subject: iio: light: opt3001: fix missing state reset on timeout + +From: Joshua Crofts + +commit c123ca6ee26ad98f70a866ff428b08145c5a24fe upstream. + +Currently in the function opt3001_get_processed(), there is a check +that directly returns -ETIMEDOUT if the conversion IRQ times out, +completely bypassing the err label, leaving ok_to_ignore_lock +permanently true, potentially breaking the device's falling threshold +interrupt detection. + +Assign -ETIMEDOUT to the return variable and jump to the error label +to ensure ok_to_ignore_lock is properly reset. + +Fixes: 26d90b559057 ("iio: light: opt3001: Fixed timeout error when 0 lux") +Reported-by: Sashiko +Closes: https://sashiko.dev/#/patchset/20260525-opt3001-cleanup-v4-0-65b36a174f78%40gmail.com?part=1 +Signed-off-by: Joshua Crofts +Cc: stable@vger.kernel.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/opt3001.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/iio/light/opt3001.c ++++ b/drivers/iio/light/opt3001.c +@@ -280,8 +280,10 @@ static int opt3001_get_lux(struct opt300 + ret = wait_event_timeout(opt->result_ready_queue, + opt->result_ready, + msecs_to_jiffies(OPT3001_RESULT_READY_LONG)); +- if (ret == 0) +- return -ETIMEDOUT; ++ if (ret == 0) { ++ ret = -ETIMEDOUT; ++ goto err; ++ } + } else { + /* Sleep for result ready time */ + timeout = (opt->int_time == OPT3001_INT_TIME_SHORT) ? diff --git a/queue-5.10/iio-light-veml6030-fix-channel-type-when-pushing-events.patch b/queue-5.10/iio-light-veml6030-fix-channel-type-when-pushing-events.patch new file mode 100644 index 0000000000..27b8bce6d7 --- /dev/null +++ b/queue-5.10/iio-light-veml6030-fix-channel-type-when-pushing-events.patch @@ -0,0 +1,40 @@ +From c52bb33b641ebaae3e209f97714cb1758206f7d9 Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Thu, 14 May 2026 14:01:11 +1300 +Subject: iio: light: veml6030: fix channel type when pushing events + +From: Javier Carrasco + +commit c52bb33b641ebaae3e209f97714cb1758206f7d9 upstream. + +The events are registered for IIO_LIGHT and not for IIO_INTENSITY. +Use the correct channel type. + +When at it, fix minor checkpatch code style warning (alignment). + +Cc: stable@vger.kernel.org +Fixes: 7b779f573c48 ("iio: light: add driver for veml6030 ambient light sensor") +Signed-off-by: Javier Carrasco +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/veml6030.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/iio/light/veml6030.c ++++ b/drivers/iio/light/veml6030.c +@@ -710,9 +710,11 @@ static irqreturn_t veml6030_event_handle + else + evtdir = IIO_EV_DIR_FALLING; + +- iio_push_event(indio_dev, IIO_UNMOD_EVENT_CODE(IIO_INTENSITY, +- 0, IIO_EV_TYPE_THRESH, evtdir), +- iio_get_time_ns(indio_dev)); ++ iio_push_event(indio_dev, IIO_UNMOD_EVENT_CODE(IIO_LIGHT, ++ 0, ++ IIO_EV_TYPE_THRESH, ++ evtdir), ++ iio_get_time_ns(indio_dev)); + + return IRQ_HANDLED; + } diff --git a/queue-5.10/iio-magnetometer-ak8975-add-missed-pm_runtime_put_autosuspend-call.patch b/queue-5.10/iio-magnetometer-ak8975-add-missed-pm_runtime_put_autosuspend-call.patch new file mode 100644 index 0000000000..3c08aabb75 --- /dev/null +++ b/queue-5.10/iio-magnetometer-ak8975-add-missed-pm_runtime_put_autosuspend-call.patch @@ -0,0 +1,34 @@ +From e94944d7364d3ddb273539492f9bd9c9a622549a Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Wed, 6 May 2026 10:27:55 +0200 +Subject: iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call + +From: Andy Shevchenko + +commit e94944d7364d3ddb273539492f9bd9c9a622549a upstream. + +On the failure in the ak8975_read_axis() the PM runtime gets unbalanced. +Balance it by calling pm_runtime_put_autosuspend() on error path as well. + +Fixes: cde4cb5dd422 ("iio: magn: ak8975: deploy runtime and system PM") +Reported-by: Sashiko +Closes: https://sashiko.dev/#/patchset/20260505-magnetometer-fixes-v5-0-831b9b5550fc%40gmail.com +Signed-off-by: Andy Shevchenko +Reviewed-by: Joshua Crofts +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/magnetometer/ak8975.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/magnetometer/ak8975.c ++++ b/drivers/iio/magnetometer/ak8975.c +@@ -715,6 +715,7 @@ static int ak8975_read_axis(struct iio_d + + exit: + mutex_unlock(&data->lock); ++ pm_runtime_put_autosuspend(&data->client->dev); + dev_err(&client->dev, "Error in reading axis\n"); + return ret; + } diff --git a/queue-5.10/iio-temperature-ltc2983-fix-reinit_completion-called-after-conversion-start.patch b/queue-5.10/iio-temperature-ltc2983-fix-reinit_completion-called-after-conversion-start.patch new file mode 100644 index 0000000000..6add05fbf9 --- /dev/null +++ b/queue-5.10/iio-temperature-ltc2983-fix-reinit_completion-called-after-conversion-start.patch @@ -0,0 +1,41 @@ +From 5cb9fdb446bfc3ae0524496f53fb68e67051701b Mon Sep 17 00:00:00 2001 +From: Liviu Stan +Date: Mon, 25 May 2026 19:39:29 +0300 +Subject: iio: temperature: ltc2983: Fix reinit_completion() called after conversion start + +From: Liviu Stan + +commit 5cb9fdb446bfc3ae0524496f53fb68e67051701b upstream. + +reinit_completion() was called after regmap_write() initiated the hardware +conversion, creating a race window where the interrupt could fire and call +complete() before reinit_completion() reset the completion. + +Move reinit_completion() before the regmap_write() to close the race. +ltc2983_eeprom_cmd() already does it in the correct order. + +Fixes: f110f3188e56 ("iio: temperature: Add support for LTC2983") +Signed-off-by: Liviu Stan +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/temperature/ltc2983.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/iio/temperature/ltc2983.c ++++ b/drivers/iio/temperature/ltc2983.c +@@ -1147,12 +1147,11 @@ static int ltc2983_chan_read(struct ltc2 + start_conversion |= LTC2983_STATUS_CHAN_SEL(sensor->chan); + dev_dbg(&st->spi->dev, "Start conversion on chan:%d, status:%02X\n", + sensor->chan, start_conversion); ++ reinit_completion(&st->completion); + /* start conversion */ + ret = regmap_write(st->regmap, LTC2983_STATUS_REG, start_conversion); + if (ret) + return ret; +- +- reinit_completion(&st->completion); + /* + * wait for conversion to complete. + * 300 ms should be more than enough to complete the conversion. diff --git a/queue-5.10/series b/queue-5.10/series index 472aded08b..b99546595e 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -30,3 +30,21 @@ i2c-core-fix-adapter-debugfs-creation.patch i2c-core-fix-adapter-registration-race.patch hdlc_ppp-sync-per-proto-timers-before-freeing-hdlc-state.patch xfrm-defensively-unhash-xfrm_state-lists-in-__xfrm_s.patch +usb-gadget-function-rndis-add-length-check-to-response-query.patch +usb-gadget-function-rndis-add-length-check-for-header.patch +iio-accel-bmc150-clamp-the-device-reported-fifo-frame-count.patch +iio-accel-kxsd9-fix-runtime-pm-imbalance-on-write_raw-error.patch +iio-adc-lpc32xx-initialize-completion-before-requesting-irq.patch +iio-adc-ti-ads124s08-return-reset-gpio-lookup-errors.patch +iio-chemical-scd30-cleanup-initializations-and-fix-sign-extension-bug.patch +iio-event-fix-event-fifo-reset-race.patch +iio-gyro-bmg160-bail-out-when-bandwidth-filter-is-not-in-table.patch +iio-gyro-bmg160-wait-full-startup-time-after-mode-change-at-probe.patch +iio-imu-bmi160-add-irqf_no_thread-to-data-ready-trigger-irq.patch +iio-imu-st_lsm6dsx-deselect-shub-page-before-reading-whoami.patch +iio-light-al3010-fix-incorrect-scale-for-the-highest-gain-range.patch +iio-light-gp2ap002-fix-runtime-pm-leak-on-read-error.patch +iio-light-opt3001-fix-missing-state-reset-on-timeout.patch +iio-light-veml6030-fix-channel-type-when-pushing-events.patch +iio-magnetometer-ak8975-add-missed-pm_runtime_put_autosuspend-call.patch +iio-temperature-ltc2983-fix-reinit_completion-called-after-conversion-start.patch diff --git a/queue-5.10/usb-gadget-function-rndis-add-length-check-for-header.patch b/queue-5.10/usb-gadget-function-rndis-add-length-check-for-header.patch new file mode 100644 index 0000000000..01ea678969 --- /dev/null +++ b/queue-5.10/usb-gadget-function-rndis-add-length-check-for-header.patch @@ -0,0 +1,37 @@ +From 21b5bf155435008e0fb0736795289788e63d426f Mon Sep 17 00:00:00 2001 +From: Griffin Kroah-Hartman +Date: Wed, 8 Jul 2026 13:08:59 +0200 +Subject: usb: gadget: function: rndis: add length check for header + +From: Griffin Kroah-Hartman + +commit 21b5bf155435008e0fb0736795289788e63d426f upstream. + +Add a length check for the rndis header in rndis_rm_hdr, to ensure that +MessageType, MessageLength, DataOffset, and DataLength fields are +present before they are accessed. + +Assisted-by: gkh_clanker_2000 +Cc: stable +Signed-off-by: Griffin Kroah-Hartman +Link: https://patch.msgid.link/20260708-usb-gadget-rndis-v1-2-e77e026dcc6a@kroah.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/rndis.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/gadget/function/rndis.c ++++ b/drivers/usb/gadget/function/rndis.c +@@ -1080,6 +1080,12 @@ int rndis_rm_hdr(struct gether *port, + /* tmp points to a struct rndis_packet_msg_type */ + __le32 *tmp = (void *)skb->data; + ++ /* Need at least MessageType, MessageLength, DataOffset, DataLength */ ++ if (skb->len < 16) { ++ dev_kfree_skb_any(skb); ++ return -EINVAL; ++ } ++ + /* MessageType, MessageLength */ + if (cpu_to_le32(RNDIS_MSG_PACKET) + != get_unaligned(tmp++)) { diff --git a/queue-5.10/usb-gadget-function-rndis-add-length-check-to-response-query.patch b/queue-5.10/usb-gadget-function-rndis-add-length-check-to-response-query.patch new file mode 100644 index 0000000000..9f29e278a7 --- /dev/null +++ b/queue-5.10/usb-gadget-function-rndis-add-length-check-to-response-query.patch @@ -0,0 +1,60 @@ +From 95f90eea070837f7c72207d5520f805bdefc3bc5 Mon Sep 17 00:00:00 2001 +From: Griffin Kroah-Hartman +Date: Wed, 8 Jul 2026 13:08:58 +0200 +Subject: usb: gadget: function: rndis: add length check to response query + +From: Griffin Kroah-Hartman + +commit 95f90eea070837f7c72207d5520f805bdefc3bc5 upstream. + +Add variable representations for BufLength and BufOffset in +rndis_query_response(), and perform a length check on them. + +This is identical to how rndis_set_response() handles these parameters. + +Assisted-by: gkh_clanker_2000 +Cc: stable +Signed-off-by: Griffin Kroah-Hartman +Link: https://patch.msgid.link/20260708-usb-gadget-rndis-v1-1-e77e026dcc6a@kroah.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/rndis.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/usb/gadget/function/rndis.c ++++ b/drivers/usb/gadget/function/rndis.c +@@ -591,6 +591,7 @@ static int rndis_init_response(struct rn + static int rndis_query_response(struct rndis_params *params, + rndis_query_msg_type *buf) + { ++ u32 BufLength, BufOffset; + rndis_query_cmplt_type *resp; + rndis_resp_t *r; + +@@ -598,6 +599,13 @@ static int rndis_query_response(struct r + if (!params->dev) + return -ENOTSUPP; + ++ BufLength = le32_to_cpu(buf->InformationBufferLength); ++ BufOffset = le32_to_cpu(buf->InformationBufferOffset); ++ if ((BufLength > RNDIS_MAX_TOTAL_SIZE) || ++ (BufOffset > RNDIS_MAX_TOTAL_SIZE) || ++ (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE)) ++ return -EINVAL; ++ + /* + * we need more memory: + * gen_ndis_query_resp expects enough space for +@@ -614,10 +622,8 @@ static int rndis_query_response(struct r + resp->RequestID = buf->RequestID; /* Still LE in msg buffer */ + + if (gen_ndis_query_resp(params, le32_to_cpu(buf->OID), +- le32_to_cpu(buf->InformationBufferOffset) +- + 8 + (u8 *)buf, +- le32_to_cpu(buf->InformationBufferLength), +- r)) { ++ BufOffset + 8 + (u8 *)buf, ++ BufLength, r)) { + /* OID not supported */ + resp->Status = cpu_to_le32(RNDIS_STATUS_NOT_SUPPORTED); + resp->MessageLength = cpu_to_le32(sizeof *resp);