iio: adc: ad_sigma_delta: fix CS held asserted and state leaks

In ad_sigma_delta_single_conversion(), set_mode(AD_SD_MODE_IDLE) and
disable_one() were called from the out: block while keep_cs_asserted
was still true. This caused any SPI transfer issued by those callbacks
to carry cs_change=1, leaving CS permanently asserted after the
conversion. Fix by moving both calls into the out_unlock: block, after
keep_cs_asserted is cleared, matching the pattern already used in
ad_sd_calibrate().

In the error path of ad_sd_buffer_postenable(), if an operation fails
after set_mode(AD_SD_MODE_CONTINUOUS) has already succeeded (e.g.
spi_offload_trigger_enable()), the device is left in continuous
conversion mode with CS physically asserted. Additionally,
bus_locked remaining true after spi_bus_unlock() causes subsequent
SPI operations to call spi_sync_locked() without the bus lock actually
held, allowing concurrent SPI access.

Fix the error path by clearing keep_cs_asserted first, then calling
set_mode(AD_SD_MODE_IDLE) to revert the device mode and deassert CS,
then clearing bus_locked before releasing the bus.

For devices that implement neither set_mode nor disable_one (such as
MAX11205, which has no physical CS pin), no SPI transfer is issued
during cleanup and the cs_change flag has no effect on any physical
line.

Fixes: 132d44dc6966 ("iio: adc: ad_sigma_delta: Check for previous ready signals")
Signed-off-by: Radu Sabau <radu.sabau@analog.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>

diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c
index a955556f9ec88645a742361e23854001ba92cb20..651ade67ad2e97794875872922d7d3a903b91498 100644 (file)
--- a/drivers/iio/adc/ad_sigma_delta.c
+++ b/drivers/iio/adc/ad_sigma_delta.c
@@ -441,11 +441,10 @@ int ad_sigma_delta_single_conversion(struct iio_dev *indio_dev,
 out:
        ad_sd_disable_irq(sigma_delta);
 
-       ad_sigma_delta_set_mode(sigma_delta, AD_SD_MODE_IDLE);
-       ad_sigma_delta_disable_one(sigma_delta, chan->address);
-
 out_unlock:
        sigma_delta->keep_cs_asserted = false;
+       ad_sigma_delta_set_mode(sigma_delta, AD_SD_MODE_IDLE);
+       ad_sigma_delta_disable_one(sigma_delta, chan->address);
        sigma_delta->bus_locked = false;
        spi_bus_unlock(sigma_delta->spi->controller);
 out_release:
@@ -578,6 +577,9 @@ static int ad_sd_buffer_postenable(struct iio_dev *indio_dev)
        return 0;
 
 err_unlock:
+       sigma_delta->keep_cs_asserted = false;
+       ad_sigma_delta_set_mode(sigma_delta, AD_SD_MODE_IDLE);
+       sigma_delta->bus_locked = false;
        spi_bus_unlock(sigma_delta->spi->controller);
        spi_unoptimize_message(&sigma_delta->sample_msg);