From aaac83ed142e8bb1719109a160dcb9e0ca101d2d Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 17 Jul 2020 17:11:28 +0200 Subject: [PATCH] 5.7-stable patches added patches: iio-core-add-missing-iio_mod_h2-ethanol-string-identifiers.patch iio-health-afe4403-fix-timestamp-alignment-and-prevent-data-leak.patch iio-humidity-hdc100x-fix-alignment-and-data-leak-issues.patch iio-humidity-hts221-fix-alignment-and-data-leak-issues.patch iio-magnetometer-ak8974-fix-alignment-and-data-leak-issues.patch iio-magnetometer-ak8974-fix-runtime-pm-imbalance-on-error.patch iio-mma8452-add-missed-iio_device_unregister-call-in-mma8452_probe.patch iio-pressure-ms5611-fix-buffer-element-alignment.patch iio-pressure-zpa2326-handle-pm_runtime_get_sync-failure.patch --- ...io_mod_h2-ethanol-string-identifiers.patch | 33 +++++++ ...tamp-alignment-and-prevent-data-leak.patch | 81 ++++++++++++++++ ...x-fix-alignment-and-data-leak-issues.patch | 69 ++++++++++++++ ...1-fix-alignment-and-data-leak-issues.patch | 92 +++++++++++++++++++ ...4-fix-alignment-and-data-leak-issues.patch | 69 ++++++++++++++ ...74-fix-runtime-pm-imbalance-on-error.patch | 90 ++++++++++++++++++ ...ice_unregister-call-in-mma8452_probe.patch | 41 +++++++++ ...-ms5611-fix-buffer-element-alignment.patch | 59 ++++++++++++ ...6-handle-pm_runtime_get_sync-failure.patch | 37 ++++++++ queue-5.7/series | 9 ++ 10 files changed, 580 insertions(+) create mode 100644 queue-5.7/iio-core-add-missing-iio_mod_h2-ethanol-string-identifiers.patch create mode 100644 queue-5.7/iio-health-afe4403-fix-timestamp-alignment-and-prevent-data-leak.patch create mode 100644 queue-5.7/iio-humidity-hdc100x-fix-alignment-and-data-leak-issues.patch create mode 100644 queue-5.7/iio-humidity-hts221-fix-alignment-and-data-leak-issues.patch create mode 100644 queue-5.7/iio-magnetometer-ak8974-fix-alignment-and-data-leak-issues.patch create mode 100644 queue-5.7/iio-magnetometer-ak8974-fix-runtime-pm-imbalance-on-error.patch create mode 100644 queue-5.7/iio-mma8452-add-missed-iio_device_unregister-call-in-mma8452_probe.patch create mode 100644 queue-5.7/iio-pressure-ms5611-fix-buffer-element-alignment.patch create mode 100644 queue-5.7/iio-pressure-zpa2326-handle-pm_runtime_get_sync-failure.patch diff --git a/queue-5.7/iio-core-add-missing-iio_mod_h2-ethanol-string-identifiers.patch b/queue-5.7/iio-core-add-missing-iio_mod_h2-ethanol-string-identifiers.patch new file mode 100644 index 00000000000..632fbcf9bf3 --- /dev/null +++ b/queue-5.7/iio-core-add-missing-iio_mod_h2-ethanol-string-identifiers.patch @@ -0,0 +1,33 @@ +From 25f02d3242ab4d16d0cee2dec0d89cedb3747fa9 Mon Sep 17 00:00:00 2001 +From: Matt Ranostay +Date: Tue, 9 Jun 2020 06:01:16 +0300 +Subject: iio: core: add missing IIO_MOD_H2/ETHANOL string identifiers + +From: Matt Ranostay + +commit 25f02d3242ab4d16d0cee2dec0d89cedb3747fa9 upstream. + +Add missing strings to iio_modifier_names[] for proper modification +of channels. + +Fixes: b170f7d48443d (iio: Add modifiers for ethanol and H2 gases) +Signed-off-by: Matt Ranostay +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/industrialio-core.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/iio/industrialio-core.c ++++ b/drivers/iio/industrialio-core.c +@@ -130,6 +130,8 @@ static const char * const iio_modifier_n + [IIO_MOD_PM2P5] = "pm2p5", + [IIO_MOD_PM4] = "pm4", + [IIO_MOD_PM10] = "pm10", ++ [IIO_MOD_ETHANOL] = "ethanol", ++ [IIO_MOD_H2] = "h2", + }; + + /* relies on pairs of these shared then separate */ diff --git a/queue-5.7/iio-health-afe4403-fix-timestamp-alignment-and-prevent-data-leak.patch b/queue-5.7/iio-health-afe4403-fix-timestamp-alignment-and-prevent-data-leak.patch new file mode 100644 index 00000000000..f4c1f105cbb --- /dev/null +++ b/queue-5.7/iio-health-afe4403-fix-timestamp-alignment-and-prevent-data-leak.patch @@ -0,0 +1,81 @@ +From 3f9c6d38797e9903937b007a341dad0c251765d6 Mon Sep 17 00:00:00 2001 +From: Jonathan Cameron +Date: Sun, 17 May 2020 18:29:56 +0100 +Subject: iio:health:afe4403 Fix timestamp alignment and prevent data leak. + +From: Jonathan Cameron + +commit 3f9c6d38797e9903937b007a341dad0c251765d6 upstream. + +One of a class of bugs pointed out by Lars in a recent review. +iio_push_to_buffers_with_timestamp assumes the buffer used is aligned +to the size of the timestamp (8 bytes). This is not guaranteed in +this driver which uses a 32 byte array of smaller elements on the stack. +As Lars also noted this anti pattern can involve a leak of data to +userspace and that indeed can happen here. We close both issues by +moving to a suitable structure in the iio_priv() data with alignment +explicitly requested. This data is allocated with kzalloc so no +data can leak appart from previous readings. + +Fixes: eec96d1e2d31 ("iio: health: Add driver for the TI AFE4403 heart monitor") +Reported-by: Lars-Peter Clausen +Signed-off-by: Jonathan Cameron +Acked-by: Andrew F. Davis +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/health/afe4403.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/iio/health/afe4403.c ++++ b/drivers/iio/health/afe4403.c +@@ -63,6 +63,7 @@ static const struct reg_field afe4403_re + * @regulator: Pointer to the regulator for the IC + * @trig: IIO trigger for this device + * @irq: ADC_RDY line interrupt number ++ * @buffer: Used to construct data layout to push into IIO buffer. + */ + struct afe4403_data { + struct device *dev; +@@ -72,6 +73,8 @@ struct afe4403_data { + struct regulator *regulator; + struct iio_trigger *trig; + int irq; ++ /* Ensure suitable alignment for timestamp */ ++ s32 buffer[8] __aligned(8); + }; + + enum afe4403_chan_id { +@@ -309,7 +312,6 @@ static irqreturn_t afe4403_trigger_handl + struct iio_dev *indio_dev = pf->indio_dev; + struct afe4403_data *afe = iio_priv(indio_dev); + int ret, bit, i = 0; +- s32 buffer[8]; + u8 tx[4] = {AFE440X_CONTROL0, 0x0, 0x0, AFE440X_CONTROL0_READ}; + u8 rx[3]; + +@@ -326,9 +328,9 @@ static irqreturn_t afe4403_trigger_handl + if (ret) + goto err; + +- buffer[i++] = (rx[0] << 16) | +- (rx[1] << 8) | +- (rx[2]); ++ afe->buffer[i++] = (rx[0] << 16) | ++ (rx[1] << 8) | ++ (rx[2]); + } + + /* Disable reading from the device */ +@@ -337,7 +339,8 @@ static irqreturn_t afe4403_trigger_handl + if (ret) + goto err; + +- iio_push_to_buffers_with_timestamp(indio_dev, buffer, pf->timestamp); ++ iio_push_to_buffers_with_timestamp(indio_dev, afe->buffer, ++ pf->timestamp); + err: + iio_trigger_notify_done(indio_dev->trig); + diff --git a/queue-5.7/iio-humidity-hdc100x-fix-alignment-and-data-leak-issues.patch b/queue-5.7/iio-humidity-hdc100x-fix-alignment-and-data-leak-issues.patch new file mode 100644 index 00000000000..5388bf02dc6 --- /dev/null +++ b/queue-5.7/iio-humidity-hdc100x-fix-alignment-and-data-leak-issues.patch @@ -0,0 +1,69 @@ +From ea5e7a7bb6205d24371373cd80325db1bc15eded Mon Sep 17 00:00:00 2001 +From: Jonathan Cameron +Date: Sun, 7 Jun 2020 16:53:52 +0100 +Subject: iio:humidity:hdc100x Fix alignment and data leak issues + +From: Jonathan Cameron + +commit ea5e7a7bb6205d24371373cd80325db1bc15eded upstream. + +One of a class of bugs pointed out by Lars in a recent review. +iio_push_to_buffers_with_timestamp assumes the buffer used is aligned +to the size of the timestamp (8 bytes). This is not guaranteed in +this driver which uses an array of smaller elements on the stack. +As Lars also noted this anti pattern can involve a leak of data to +userspace and that indeed can happen here. We close both issues by +moving to a suitable structure in the iio_priv() data. +This data is allocated with kzalloc so no data can leak apart +from previous readings. + +Fixes: 16bf793f86b2 ("iio: humidity: hdc100x: add triggered buffer support for HDC100X") +Reported-by: Lars-Peter Clausen +Acked-by: Matt Ranostay +Cc: Alison Schofield +Signed-off-by: Jonathan Cameron +Cc: +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/humidity/hdc100x.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/iio/humidity/hdc100x.c ++++ b/drivers/iio/humidity/hdc100x.c +@@ -38,6 +38,11 @@ struct hdc100x_data { + + /* integration time of the sensor */ + int adc_int_us[2]; ++ /* Ensure natural alignment of timestamp */ ++ struct { ++ __be16 channels[2]; ++ s64 ts __aligned(8); ++ } scan; + }; + + /* integration time in us */ +@@ -322,7 +327,6 @@ static irqreturn_t hdc100x_trigger_handl + struct i2c_client *client = data->client; + int delay = data->adc_int_us[0] + data->adc_int_us[1]; + int ret; +- s16 buf[8]; /* 2x s16 + padding + 8 byte timestamp */ + + /* dual read starts at temp register */ + mutex_lock(&data->lock); +@@ -333,13 +337,13 @@ static irqreturn_t hdc100x_trigger_handl + } + usleep_range(delay, delay + 1000); + +- ret = i2c_master_recv(client, (u8 *)buf, 4); ++ ret = i2c_master_recv(client, (u8 *)data->scan.channels, 4); + if (ret < 0) { + dev_err(&client->dev, "cannot read sensor data\n"); + goto err; + } + +- iio_push_to_buffers_with_timestamp(indio_dev, buf, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + iio_get_time_ns(indio_dev)); + err: + mutex_unlock(&data->lock); diff --git a/queue-5.7/iio-humidity-hts221-fix-alignment-and-data-leak-issues.patch b/queue-5.7/iio-humidity-hts221-fix-alignment-and-data-leak-issues.patch new file mode 100644 index 00000000000..38a27349d5f --- /dev/null +++ b/queue-5.7/iio-humidity-hts221-fix-alignment-and-data-leak-issues.patch @@ -0,0 +1,92 @@ +From 5c49056ad9f3c786f7716da2dd47e4488fc6bd25 Mon Sep 17 00:00:00 2001 +From: Jonathan Cameron +Date: Sun, 7 Jun 2020 16:53:53 +0100 +Subject: iio:humidity:hts221 Fix alignment and data leak issues + +From: Jonathan Cameron + +commit 5c49056ad9f3c786f7716da2dd47e4488fc6bd25 upstream. + +One of a class of bugs pointed out by Lars in a recent review. +iio_push_to_buffers_with_timestamp assumes the buffer used is aligned +to the size of the timestamp (8 bytes). This is not guaranteed in +this driver which uses an array of smaller elements on the stack. +As Lars also noted this anti pattern can involve a leak of data to +userspace and that indeed can happen here. We close both issues by +moving to a suitable structure in the iio_priv() data. +This data is allocated with kzalloc so no data can leak +apart from previous readings. + +Explicit alignment of ts needed to ensure consistent padding +on all architectures (particularly x86_32 with it's 4 byte alignment +of s64) + +Fixes: e4a70e3e7d84 ("iio: humidity: add support to hts221 rh/temp combo device") +Reported-by: Lars-Peter Clausen +Acked-by: Lorenzo Bianconi +Signed-off-by: Jonathan Cameron +Cc: +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/humidity/hts221.h | 7 +++++-- + drivers/iio/humidity/hts221_buffer.c | 9 +++++---- + 2 files changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/iio/humidity/hts221.h ++++ b/drivers/iio/humidity/hts221.h +@@ -14,8 +14,6 @@ + + #include + +-#define HTS221_DATA_SIZE 2 +- + enum hts221_sensor_type { + HTS221_SENSOR_H, + HTS221_SENSOR_T, +@@ -39,6 +37,11 @@ struct hts221_hw { + + bool enabled; + u8 odr; ++ /* Ensure natural alignment of timestamp */ ++ struct { ++ __le16 channels[2]; ++ s64 ts __aligned(8); ++ } scan; + }; + + extern const struct dev_pm_ops hts221_pm_ops; +--- a/drivers/iio/humidity/hts221_buffer.c ++++ b/drivers/iio/humidity/hts221_buffer.c +@@ -162,7 +162,6 @@ static const struct iio_buffer_setup_ops + + static irqreturn_t hts221_buffer_handler_thread(int irq, void *p) + { +- u8 buffer[ALIGN(2 * HTS221_DATA_SIZE, sizeof(s64)) + sizeof(s64)]; + struct iio_poll_func *pf = p; + struct iio_dev *iio_dev = pf->indio_dev; + struct hts221_hw *hw = iio_priv(iio_dev); +@@ -172,18 +171,20 @@ static irqreturn_t hts221_buffer_handler + /* humidity data */ + ch = &iio_dev->channels[HTS221_SENSOR_H]; + err = regmap_bulk_read(hw->regmap, ch->address, +- buffer, HTS221_DATA_SIZE); ++ &hw->scan.channels[0], ++ sizeof(hw->scan.channels[0])); + if (err < 0) + goto out; + + /* temperature data */ + ch = &iio_dev->channels[HTS221_SENSOR_T]; + err = regmap_bulk_read(hw->regmap, ch->address, +- buffer + HTS221_DATA_SIZE, HTS221_DATA_SIZE); ++ &hw->scan.channels[1], ++ sizeof(hw->scan.channels[1])); + if (err < 0) + goto out; + +- iio_push_to_buffers_with_timestamp(iio_dev, buffer, ++ iio_push_to_buffers_with_timestamp(iio_dev, &hw->scan, + iio_get_time_ns(iio_dev)); + + out: diff --git a/queue-5.7/iio-magnetometer-ak8974-fix-alignment-and-data-leak-issues.patch b/queue-5.7/iio-magnetometer-ak8974-fix-alignment-and-data-leak-issues.patch new file mode 100644 index 00000000000..cd66babd5e3 --- /dev/null +++ b/queue-5.7/iio-magnetometer-ak8974-fix-alignment-and-data-leak-issues.patch @@ -0,0 +1,69 @@ +From 838e00b13bfd4cac8b24df25bfc58e2eb99bcc70 Mon Sep 17 00:00:00 2001 +From: Jonathan Cameron +Date: Sun, 7 Jun 2020 16:53:49 +0100 +Subject: iio:magnetometer:ak8974: Fix alignment and data leak issues + +From: Jonathan Cameron + +commit 838e00b13bfd4cac8b24df25bfc58e2eb99bcc70 upstream. + +One of a class of bugs pointed out by Lars in a recent review. +iio_push_to_buffers_with_timestamp assumes the buffer used is aligned +to the size of the timestamp (8 bytes). This is not guaranteed in +this driver which uses an array of smaller elements on the stack. +As Lars also noted this anti pattern can involve a leak of data to +userspace and that indeed can happen here. We close both issues by +moving to a suitable structure in the iio_priv() data. + +This data is allocated with kzalloc so no data can leak appart from +previous readings. + +Fixes: 7c94a8b2ee8cf ("iio: magn: add a driver for AK8974") +Reported-by: Lars-Peter Clausen +Reviewed-by: Linus Walleij +Signed-off-by: Jonathan Cameron +Cc: +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/magnetometer/ak8974.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/iio/magnetometer/ak8974.c ++++ b/drivers/iio/magnetometer/ak8974.c +@@ -185,6 +185,11 @@ struct ak8974 { + bool drdy_irq; + struct completion drdy_complete; + bool drdy_active_low; ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ __le16 channels[3]; ++ s64 ts __aligned(8); ++ } scan; + }; + + static const char ak8974_reg_avdd[] = "avdd"; +@@ -581,7 +586,6 @@ static void ak8974_fill_buffer(struct ii + { + struct ak8974 *ak8974 = iio_priv(indio_dev); + int ret; +- __le16 hw_values[8]; /* Three axes + 64bit padding */ + + pm_runtime_get_sync(&ak8974->i2c->dev); + mutex_lock(&ak8974->lock); +@@ -591,13 +595,13 @@ static void ak8974_fill_buffer(struct ii + dev_err(&ak8974->i2c->dev, "error triggering measure\n"); + goto out_unlock; + } +- ret = ak8974_getresult(ak8974, hw_values); ++ ret = ak8974_getresult(ak8974, ak8974->scan.channels); + if (ret) { + dev_err(&ak8974->i2c->dev, "error getting measures\n"); + goto out_unlock; + } + +- iio_push_to_buffers_with_timestamp(indio_dev, hw_values, ++ iio_push_to_buffers_with_timestamp(indio_dev, &ak8974->scan, + iio_get_time_ns(indio_dev)); + + out_unlock: diff --git a/queue-5.7/iio-magnetometer-ak8974-fix-runtime-pm-imbalance-on-error.patch b/queue-5.7/iio-magnetometer-ak8974-fix-runtime-pm-imbalance-on-error.patch new file mode 100644 index 00000000000..5dbe625850d --- /dev/null +++ b/queue-5.7/iio-magnetometer-ak8974-fix-runtime-pm-imbalance-on-error.patch @@ -0,0 +1,90 @@ +From 0187294d227dfc42889e1da8f8ce1e44fc25f147 Mon Sep 17 00:00:00 2001 +From: Dinghao Liu +Date: Tue, 26 May 2020 18:47:17 +0800 +Subject: iio: magnetometer: ak8974: Fix runtime PM imbalance on error + +From: Dinghao Liu + +commit 0187294d227dfc42889e1da8f8ce1e44fc25f147 upstream. + +When devm_regmap_init_i2c() returns an error code, a pairing +runtime PM usage counter decrement is needed to keep the +counter balanced. For error paths after ak8974_set_power(), +ak8974_detect() and ak8974_reset(), things are the same. + +However, When iio_triggered_buffer_setup() returns an error +code, there will be two PM usgae counter decrements. + +Signed-off-by: Dinghao Liu +Fixes: 7c94a8b2ee8c ("iio: magn: add a driver for AK8974") +Reviewed-by: Linus Walleij +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/magnetometer/ak8974.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +--- a/drivers/iio/magnetometer/ak8974.c ++++ b/drivers/iio/magnetometer/ak8974.c +@@ -768,19 +768,21 @@ static int ak8974_probe(struct i2c_clien + ak8974->map = devm_regmap_init_i2c(i2c, &ak8974_regmap_config); + if (IS_ERR(ak8974->map)) { + dev_err(&i2c->dev, "failed to allocate register map\n"); ++ pm_runtime_put_noidle(&i2c->dev); ++ pm_runtime_disable(&i2c->dev); + return PTR_ERR(ak8974->map); + } + + ret = ak8974_set_power(ak8974, AK8974_PWR_ON); + if (ret) { + dev_err(&i2c->dev, "could not power on\n"); +- goto power_off; ++ goto disable_pm; + } + + ret = ak8974_detect(ak8974); + if (ret) { + dev_err(&i2c->dev, "neither AK8974 nor AMI30x found\n"); +- goto power_off; ++ goto disable_pm; + } + + ret = ak8974_selftest(ak8974); +@@ -790,14 +792,9 @@ static int ak8974_probe(struct i2c_clien + ret = ak8974_reset(ak8974); + if (ret) { + dev_err(&i2c->dev, "AK8974 reset failed\n"); +- goto power_off; ++ goto disable_pm; + } + +- pm_runtime_set_autosuspend_delay(&i2c->dev, +- AK8974_AUTOSUSPEND_DELAY); +- pm_runtime_use_autosuspend(&i2c->dev); +- pm_runtime_put(&i2c->dev); +- + indio_dev->dev.parent = &i2c->dev; + indio_dev->channels = ak8974_channels; + indio_dev->num_channels = ARRAY_SIZE(ak8974_channels); +@@ -850,6 +847,11 @@ no_irq: + goto cleanup_buffer; + } + ++ pm_runtime_set_autosuspend_delay(&i2c->dev, ++ AK8974_AUTOSUSPEND_DELAY); ++ pm_runtime_use_autosuspend(&i2c->dev); ++ pm_runtime_put(&i2c->dev); ++ + return 0; + + cleanup_buffer: +@@ -858,7 +860,6 @@ disable_pm: + pm_runtime_put_noidle(&i2c->dev); + pm_runtime_disable(&i2c->dev); + ak8974_set_power(ak8974, AK8974_PWR_OFF); +-power_off: + regulator_bulk_disable(ARRAY_SIZE(ak8974->regs), ak8974->regs); + + return ret; diff --git a/queue-5.7/iio-mma8452-add-missed-iio_device_unregister-call-in-mma8452_probe.patch b/queue-5.7/iio-mma8452-add-missed-iio_device_unregister-call-in-mma8452_probe.patch new file mode 100644 index 00000000000..83151434be8 --- /dev/null +++ b/queue-5.7/iio-mma8452-add-missed-iio_device_unregister-call-in-mma8452_probe.patch @@ -0,0 +1,41 @@ +From d7369ae1f4d7cffa7574d15e1f787dcca184c49d Mon Sep 17 00:00:00 2001 +From: Chuhong Yuan +Date: Thu, 28 May 2020 14:41:21 +0800 +Subject: iio: mma8452: Add missed iio_device_unregister() call in mma8452_probe() + +From: Chuhong Yuan + +commit d7369ae1f4d7cffa7574d15e1f787dcca184c49d upstream. + +The function iio_device_register() was called in mma8452_probe(). +But the function iio_device_unregister() was not called after +a call of the function mma8452_set_freefall_mode() failed. +Thus add the missed function call for one error case. + +Fixes: 1a965d405fc6 ("drivers:iio:accel:mma8452: added cleanup provision in case of failure.") +Signed-off-by: Chuhong Yuan +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/accel/mma8452.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/iio/accel/mma8452.c ++++ b/drivers/iio/accel/mma8452.c +@@ -1685,10 +1685,13 @@ static int mma8452_probe(struct i2c_clie + + ret = mma8452_set_freefall_mode(data, false); + if (ret < 0) +- goto buffer_cleanup; ++ goto unregister_device; + + return 0; + ++unregister_device: ++ iio_device_unregister(indio_dev); ++ + buffer_cleanup: + iio_triggered_buffer_cleanup(indio_dev); + diff --git a/queue-5.7/iio-pressure-ms5611-fix-buffer-element-alignment.patch b/queue-5.7/iio-pressure-ms5611-fix-buffer-element-alignment.patch new file mode 100644 index 00000000000..d2267a98db8 --- /dev/null +++ b/queue-5.7/iio-pressure-ms5611-fix-buffer-element-alignment.patch @@ -0,0 +1,59 @@ +From 8db4afe163bbdd93dca6fcefbb831ef12ecc6b4d Mon Sep 17 00:00:00 2001 +From: Jonathan Cameron +Date: Sun, 7 Jun 2020 16:53:57 +0100 +Subject: iio:pressure:ms5611 Fix buffer element alignment + +From: Jonathan Cameron + +commit 8db4afe163bbdd93dca6fcefbb831ef12ecc6b4d upstream. + +One of a class of bugs pointed out by Lars in a recent review. +iio_push_to_buffers_with_timestamp assumes the buffer used is aligned +to the size of the timestamp (8 bytes). This is not guaranteed in +this driver which uses an array of smaller elements on the stack. +Here there is no data leak possibility so use an explicit structure +on the stack to ensure alignment and nice readable fashion. + +The forced alignment of ts isn't strictly necessary in this driver +as the padding will be correct anyway (there isn't any). However +it is probably less fragile to have it there and it acts as +documentation of the requirement. + +Fixes: 713bbb4efb9dc ("iio: pressure: ms5611: Add triggered buffer support") +Reported-by: Lars-Peter Clausen +Signed-off-by: Jonathan Cameron +Acked-by: Tomasz Duszynski +Cc: +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/pressure/ms5611_core.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/iio/pressure/ms5611_core.c ++++ b/drivers/iio/pressure/ms5611_core.c +@@ -212,16 +212,21 @@ static irqreturn_t ms5611_trigger_handle + struct iio_poll_func *pf = p; + struct iio_dev *indio_dev = pf->indio_dev; + struct ms5611_state *st = iio_priv(indio_dev); +- s32 buf[4]; /* s32 (pressure) + s32 (temp) + 2 * s32 (timestamp) */ ++ /* Ensure buffer elements are naturally aligned */ ++ struct { ++ s32 channels[2]; ++ s64 ts __aligned(8); ++ } scan; + int ret; + + mutex_lock(&st->lock); +- ret = ms5611_read_temp_and_pressure(indio_dev, &buf[1], &buf[0]); ++ ret = ms5611_read_temp_and_pressure(indio_dev, &scan.channels[1], ++ &scan.channels[0]); + mutex_unlock(&st->lock); + if (ret < 0) + goto err; + +- iio_push_to_buffers_with_timestamp(indio_dev, buf, ++ iio_push_to_buffers_with_timestamp(indio_dev, &scan, + iio_get_time_ns(indio_dev)); + + err: diff --git a/queue-5.7/iio-pressure-zpa2326-handle-pm_runtime_get_sync-failure.patch b/queue-5.7/iio-pressure-zpa2326-handle-pm_runtime_get_sync-failure.patch new file mode 100644 index 00000000000..a898a843adc --- /dev/null +++ b/queue-5.7/iio-pressure-zpa2326-handle-pm_runtime_get_sync-failure.patch @@ -0,0 +1,37 @@ +From d88de040e1df38414fc1e4380be9d0e997ab4d58 Mon Sep 17 00:00:00 2001 +From: Navid Emamdoost +Date: Thu, 4 Jun 2020 21:44:44 -0500 +Subject: iio: pressure: zpa2326: handle pm_runtime_get_sync failure + +From: Navid Emamdoost + +commit d88de040e1df38414fc1e4380be9d0e997ab4d58 upstream. + +Calling pm_runtime_get_sync increments the counter even in case of +failure, causing incorrect ref count. Call pm_runtime_put if +pm_runtime_get_sync fails. + +Signed-off-by: Navid Emamdoost +Fixes: 03b262f2bbf4 ("iio:pressure: initial zpa2326 barometer support") +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/pressure/zpa2326.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/iio/pressure/zpa2326.c ++++ b/drivers/iio/pressure/zpa2326.c +@@ -664,8 +664,10 @@ static int zpa2326_resume(const struct i + int err; + + err = pm_runtime_get_sync(indio_dev->dev.parent); +- if (err < 0) ++ if (err < 0) { ++ pm_runtime_put(indio_dev->dev.parent); + return err; ++ } + + if (err > 0) { + /* diff --git a/queue-5.7/series b/queue-5.7/series index cdcd27ce8f2..8d61bebc040 100644 --- a/queue-5.7/series +++ b/queue-5.7/series @@ -57,3 +57,12 @@ arm64-add-kryo4xx-gold-cpu-cores-to-erratum-list-146.patch arm64-add-kryo4xx-silver-cpu-cores-to-erratum-list-1.patch i2c-eg20t-load-module-automatically-if-id-matches.patch arm64-alternatives-don-t-patch-up-internal-branches.patch +iio-magnetometer-ak8974-fix-alignment-and-data-leak-issues.patch +iio-humidity-hdc100x-fix-alignment-and-data-leak-issues.patch +iio-magnetometer-ak8974-fix-runtime-pm-imbalance-on-error.patch +iio-core-add-missing-iio_mod_h2-ethanol-string-identifiers.patch +iio-mma8452-add-missed-iio_device_unregister-call-in-mma8452_probe.patch +iio-pressure-zpa2326-handle-pm_runtime_get_sync-failure.patch +iio-humidity-hts221-fix-alignment-and-data-leak-issues.patch +iio-pressure-ms5611-fix-buffer-element-alignment.patch +iio-health-afe4403-fix-timestamp-alignment-and-prevent-data-leak.patch -- 2.47.3