- 25 Sep, 2020 2 commits
-
-
Arnd Bergmann authored
As found earlier, there is a problem in the create_pagelist() function that takes a pointer argument that either points into vmalloc space or into user space, with the pointer value controlled by user space allowing a malicious user to trick the driver into accessing the kernel instead. Avoid this problem by adding another function argument and passing kernel pointers separately from user pointers. This makes it possible to rely on sparse to point out invalid conversions, and it prevents user space from faking a kernel pointer. Signed-off-by:
Arnd Bergmann <arnd@arndb.de> Link: https://lore.kernel.org/r/20200925114424.2647144-2-arnd@arndb.deSigned-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Arnd Bergmann authored
My earlier patches caused some new sparse warnings, but it turns out that a number of those are actual bugs, or at least suspicous code. Adding __user annotations to the data structures that are defined in uapi headers helps avoid the new warnings, but that causes a different set of warnings to show up, as some of these structures are used both inside of the kernel and at the user interface but storing pointers to different things there. Duplicating the vchiq_service_params and vchiq_completion_data structures in turn takes care of most of those, and then it turns out that there is a 'data' pointer that can be any of a __user address, a dmd_addr_t and a kernel pointer in vmalloc space at times. I'm trying to annotate these as best I can without changing behavior, but there still seems to be a serious bug when user space passes a valid vmalloc space address instead of a user pointer. Adding comments in the code there, and leaving the warnings in place that seem to correspond to actual bugs. Signed-off-by:
-
- 22 Sep, 2020 17 commits
-
-
Ivan Safonov authored
WIFI_REASON_CODE is duplication of enum ieee80211_reasoncode. Signed-off-by:
Ivan Safonov <insafonov@gmail.com> Link: https://lore.kernel.org/r/20200919212443.264126-1-insafonov@gmail.comSigned-off-by:
-
Alex Dewar authored
In hi3670_phy_probe(), when reading property tx-vboost-lvl fails, its default value is assigned to priv->eye_diagram_param, rather than to priv->tx_vboost_lvl. Fix this. Fixes: 8971a3b8 ("staging: hikey9xx: add USB physical layer for Kirin 3670") Addresses-Coverity: CID 1497107: Incorrect expression (COPY_PASTE_ERROR) Signed-off-by:
Alex Dewar <alex.dewar90@gmail.com> Link: https://lore.kernel.org/r/20200921212146.34662-1-alex.dewar90@gmail.comSigned-off-by:
-
Michael Straube authored
Clean up comparsions to NULL reported by checkpatch. if (x == NULL) -> if (!x) if (x != NULL) -> if (x) Signed-off-by:
Michael Straube <straube.linux@gmail.com> Link: https://lore.kernel.org/r/20200919150823.16923-3-straube.linux@gmail.comSigned-off-by:
-
Michael Straube authored
Move 'else if' to the same line as the closing brace of the corresponding 'if' to follow kernel coding style. Signed-off-by:
-
Michael Straube authored
Add missing and remove unnecessary blank lines to clear checkpatch issues. CHECK: Please use a blank line after function/struct/union/enum declarations CHECK: Blank lines aren't necessary before a close brace '}' CHECK: Please don't use multiple blank lines CHECK: Blank lines aren't necessary after an open brace '{' Signed-off-by: -
Michael Straube authored
Clean up alignment style issues to follow kernel coding style and clear checkpatch issues. CHECK: Alignment should match open parenthesis Signed-off-by:
-
Michael Straube authored
Clean up block comment style issues to follow kernel coding style and clear checkpatch warnings. WARNING: Block comments should align the * on each line WARNING: Block comments use a trailing */ on a separate line WARNING: Block comments use * on subsequent lines Signed-off-by:
-
Michael Straube authored
Use empty brace syntax to initialize zero valued arrays. Simplifies and shortens the code a little bit. Signed-off-by:
-
Michael Straube authored
Clean up comparsions to NULL Reported by checkpatch. if (x == NULL) -> if (!x) if (x != NULL) -> if (x) Signed-off-by:
-
Dan Carpenter authored
The ioremap() was never unmapped in the probe error handling or in the remove function. The fix is to use the devm_ioremap() function so it gets cleaned up automatically. Fixes: 70f59c90 ("staging: spmi: add Hikey 970 SPMI controller driver") Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/20200918143338.GE909725@mwandaSigned-off-by:
-
Colin Ian King authored
A couple of statements are indented too deeply, remove the extraneous tabs. Signed-off-by:
Colin Ian King <colin.king@canonical.com> Link: https://lore.kernel.org/r/20200918214731.48750-1-colin.king@canonical.comSigned-off-by:
-
Arnd Bergmann authored
Split out the ioctl implementation for VCHIQ_IOC_QUEUE_BULK_TRANSMIT into a separate function so it can be shared with the compat implementation. This one is the trickiest conversion, as the compat implementation is already quite different from the native one. By using a common handler, the behavior is changed to be the same again: The indirect __user pointer accesses are now handled through helper functions that check for compat mode internally. Signed-off-by:
-
Arnd Bergmann authored
Split out the ioctl implementation for VCHIQ_IOC_QUEUE_BULK_TRANSMIT into a separate function so it can be shared with the compat implementation. Here, the input data is converted separately in the compat handler, while the output data is passed as a __user pointer to thec vchiq_queue_bulk_transfer->mode word that is compatible. Signed-off-by:
-
Arnd Bergmann authored
Split out the ioctl implementation for VCHIQ_IOC_DEQUEUE_MESSAGE into a separate function so it can be shared with the compat implementation. Signed-off-by:
-
Arnd Bergmann authored
Split out the ioctl implementation for VCHIQ_IOC_CREATE_SERVICE into a separate function so it can be shared with the compat implementation. Signed-off-by:
-
Arnd Bergmann authored
The compat handlers for VCHIQ_IOC_QUEUE_MESSAGE32 and VCHIQ_IOC_GET_CONFIG32 can simply call the underlying implementations that are already separate functions rather than using copy_in_user to simulate the native 64-bit interface for the full ioctl handler. vchiq_ioc_queue_message gets a small update to the calling conventions to simplify the compat version by directly returning a normal errno value. Signed-off-by:
-
Greg Kroah-Hartman authored
Merge tag 'iio-for-5.10b-take2' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-next Jonathan writes: Second set of features and cleanups for IIO in 5.10 We have a couple of changes that apply to large sets of drivers, so I have grouped those to keep this short. There are a few late breaking fixes in here that can wait for the merge window. dt yaml conversions ------------------- * adi,ad7768-1 * adi,ad7949 * aspeed,ast2400 * cosmic,10001-adc * dlg,da9150-gpadc * fsl,imx25-gcq * fsl,imx7d-adc * fsl,vf610 * holt,hi8435 * marvell,berlin2-adc * motorola,cpcap-adc * nuvoton,nau7802 * nuvoton,npcm750-adc * nxp,lpc1850-adc * nxp,lpc3220 * sprd,sc2720-adc * st,stmpe-adc * ti,adc12138 * ti,ads1015 * ti,ads7950 * ti,twl4030-madc Features -------- * adxrs290 - Add triggered buffer support and expose data ready signal as a possible trigger. Includes updating bindings. - Add debugfs hooks for register access. * mlx90632 - Add a clear user interface to override the measured ambient temperature. * vl53l0x - Add IRQ support including dt bindings. Cleanups and minor fixes ------------------------ (groups) Replace mlock with local lock: * adf4350 * exynos-adc * fls-imx25-gcq * stm32-dac devm use to simplify probe error handling and remove functions. * adis16201 * adis16203 * adis16209 * adis16240 * adis16136 * adis16260 * adis16400 * adis16460 * adis16480 * adis library - drop unused adis_setup_buffer_and_trigger() of_match_ptr removal and incorrect ACPI binding removal of_match_ptr() rarely makes sense in an IIO driver as space saving is trivial and it breaks ACPI PRP0001 based instantiation. Mostly this series is about removing examples that get copied into new drivers. * ad2s1200 * ad5272 * ad5446 * ad5592r * ad5593r * ad5703 * ak8974 * ak8975 * ams-iaq-core * as3935 * atlas-sensor * ds1803 * hdc100x * htu21 * icp10100 * lmp91000 * pulsedlight * max30102 * max5432 * max5481 * mcp4018 * mcp4131 * mcp4531 * mcp4725 * ms5611 * ms5637 * si7020 * sgp30 * ti-dac082s085 * ti-dac5571 * tmp007 * tsys01 * vz89x * zpa2326 kernel-doc fixes * iio-core * ad7303 * ad7947 * adis16080 * adis16400 * iio_dummy_evgen * sgp30 Fixes for buffer alignment when passed to iio_push_to_buffers_with_timestamp() This is a long running effort. There are a few more drivers to come. * inv_mpu6050 * itg3200 * si1145 * st_lsm6dsx * ti-adc0832 * ti-adc12138 (not driver focused) * MAINTAINERS - Consolidate Analog Device IIO entries whilst removing Beniamin Bia. - Remove Hartmut Knaack as a listed IIO maintainer as he hasn't been active for a long time and people are getting intermitted bounces. * Add __printf() markings to a few functions that were missing them. * drop some rotted documentation from staging. * rework buffer sysfs file creation (precursor to multiple buffer support) (individual drivers) * ad5592r - Fix use of true for IIO_SHARED_BY_TYPE - Tidy up locking and indentation. * ad9467 - Improve error message on chip-id missmatch. - Use more appropriate error value if chip-id not recognised. * adis-library - Simplify burst mode handling. * adxrs290 - Make sure to switch device to standby mode during remove. * as73211 - Increase measurement timeout as seems some devices are slower. * bma180 - Fix use of true fo IIO_SHARED_BY_TYPE * exynos_adc - Update binding to require second interrut with touch screen. - Update binding to not require syscon on S5Pv210 * hmc5843 - Fix use of true for IIO_SHARED_BY_TYPE * inv_mpu6050 - Use regmap_noinc_read() for fifo reading. * palmas_gpadc - Use module_platform_driver() to remove boilerplate. * meson-saradc - style consistency fixes * rockchip_saradc - Allow compile testing with !ARM. * st_lsm6dsx - Changing scaling factor to use IIO_VAL_INT_PLUS_NANO to improve precision. - Fix an issue with unchecked return value. * stm32-adc - Fix a missing return introduced in dev_err_probe() patch earlier in cycle. * sx9310 - Prefer async mode for probe as paticularly slow startup. * vcnl4000 - Add missing interrupt property to dt binding. * tag 'iio-for-5.10b-take2' of https://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (126 commits) dt-bindings: iio: vishay,vcnl4000: add interrupts property iio:imu:inv_mpu6050: Use regmap_noinc_read for fifo reads. iio:imu:inv_mpu6050 Fix dma and ts alignment and data leak issues. iio:adc:ti-adc12138 Fix alignment issue with timestamp iio:adc:ti-adc0832 Fix alignment issue with timestamp iio:imu:st_lsm6dsx Fix alignment and data leak issues iio:light:si1145: Fix timestamp alignment and prevent data leak. iio:gyro:itg3200: Fix timestamp alignment and prevent data leak. iio:imu:st_lsm6dsx: check st_lsm6dsx_shub_read_output return iio: adc: exynos_adc: Replace indio_dev->mlock with own device lock dt-bindings:iio:adc:holt,hi8435 yaml conversion dt-bindings:iio:adc:adi,ad7768-1 yaml conversion dt-bindings:iio:adc:adi,ad7949 yaml conversion dt-bindings:iio:adc:dlg,da9150-gpadc yaml conversion dt-bindings:iio:adc:motorola,cpcap-adc yaml conversion dt-bindings:iio:adc:nxp,lpc3220-adc yaml conversion dt-bindings:iio:adc:nxp,lpc1850-adc yaml conversion dt-bindings:iio:adc:fsl,imx25-gcq yaml conversion dt-bindings:iio:adc:fsl,imx7d-adc yaml conversion dt-bindings:iio:adc:ti,ads1015 yaml conversion ...
-
- 21 Sep, 2020 21 commits
-
-
Krzysztof Kozlowski authored
The dtschema should list all properties, including the common ones like interrupts. This fixes dtbs_check warnings like: arch/arm64/boot/dts/freescale/imx8mq-librem5-r3.dt.yaml: prox@60: 'interrupt-parent', 'interrupts' do not match any of the regexes: 'pinctrl-[0-9]+' Signed-off-by:Krzysztof Kozlowski <krzk@kernel.org> Link: https://lore.kernel.org/r/20200920203845.17758-1-krzk@kernel.orgSigned-off-by:
Jonathan Cameron <Jonathan.Cameron@huawei.com>
-
Jonathan Cameron authored
We should not be assuming that we are reading a sequence of registers as here we are doing a read of a lot of data from a single register address. Not marked for stable as by coincidence it being wrong doesn't make any difference. Suggested-by:
Jean-Baptiste Maneyrol <jmaneyrol@invensense.com> Signed-off-by:
-
Jonathan Cameron authored
This case is a bit different to the rest of the series. The driver was doing a regmap_bulk_read into a buffer that wasn't dma safe as it was on the stack with no guarantee of it being in a cacheline on it's own. Fixing that also dealt with the data leak and alignment issues that Lars-Peter pointed out. Also removed some unaligned handling as we are now aligned. Fixes tag is for the dma safe buffer issue. Potentially we would need to backport timestamp alignment futher but that is a totally different patch. Fixes: fd64df16 ("iio: imu: inv_mpu6050: Add SPI support for MPU6000") Reported-by:
Lars-Peter Clausen <lars@metafoo.de> Signed-off-by:
Andy Shevchenko <andy.shevchenko@gmail.com> Reviewed-by:
-
Jonathan Cameron authored
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses an array of smaller elements on the stack. We move to a suitable structure in the iio_priv() data with alignment explicitly requested. This data is allocated with kzalloc so no data can leak apart from previous readings. Note that previously no leak at all could occur, but previous readings should never be a problem. In this case the timestamp location depends on what other channels are enabled. As such we can't use a structure without misleading by suggesting only one possible timestamp location. Fixes: 50a6edb1 ("iio: adc: add ADC12130/ADC12132/ADC12138 ADC driver") Reported-by:
-
Jonathan Cameron authored
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses an array of smaller elements on the stack. We fix this issues by moving to a suitable structure in the iio_priv() data with alignment explicitly requested. This data is allocated with kzalloc so no data can leak apart from previous readings. Note that previously no data could leak 'including' previous readings but I don't think it is an issue to potentially leak them like this now does. In this case the postioning of the timestamp is depends on what other channels are enabled. As such we cannot use a structure to make the alignment explicit as it would be missleading by suggesting only one possible location for the timestamp. Fixes: 815bbc87 ("iio: ti-adc0832: add triggered buffer support") Reported-by:
-
Jonathan Cameron authored
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses an array of smaller elements on the stack. As Lars also noted this anti pattern can involve a leak of data to userspace and that indeed can happen here. We close both issues by moving to an array of suitable structures in the iio_priv() data. This data is allocated with kzalloc so no data can leak apart from previous readings. For the tagged path the data is aligned by using __aligned(8) for the buffer on the stack. There has been a lot of churn in this driver, so likely backports may be needed for stable. Fixes: 290a6ce1 ("iio: imu: add support to lsm6dsx driver") Reported-by:
-
Jonathan Cameron authored
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses a 24 byte array of smaller elements on the stack. As Lars also noted this anti pattern can involve a leak of data to userspace and that indeed can happen here. We close both issues by moving to a suitable array in the iio_priv() data with alignment explicitly requested. This data is allocated with kzalloc so no data can leak appart from previous readings. Depending on the enabled channels, the location of the timestamp can be at various aligned offsets through the buffer. As such we any use of a structure to enforce this alignment would incorrectly suggest a single location for the timestamp. Comments adjusted to express this clearly in the code. Fixes: ac45e57f ("iio: light: Add driver for Silabs si1132, si1141/2/3 and si1145/6/7 ambient light, uv index and proximity sensors") Reported-by:
-
Jonathan Cameron authored
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses a 16 byte array of smaller elements on the stack. This is fixed by using an explicit c structure. As there are no holes in the structure, there is no possiblity of data leakage in this case. The explicit alignment of ts is not strictly necessary but potentially makes the code slightly less fragile. It also removes the possibility of this being cut and paste into another driver where the alignment isn't already true. Fixes: 36e0371e ("iio:itg3200: Use iio_push_to_buffers_with_timestamp()") Reported-by:
-
Tom Rix authored
Potential error return is not checked. This can lead to use of undefined data. Detected by clang static analysis. st_lsm6dsx_shub.c:540:8: warning: Assigned value is garbage or undefined *val = (s16)le16_to_cpu(*((__le16 *)data)); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Fixes: c91c1c84 ("iio: imu: st_lsm6dsx: add i2c embedded controller support") Signed-off-by: Tom Rix <trix@redhat.com Cc: <Stable@vger.kernel.org> Reviewed-by: -
Sergiu Cuciurean authored
As part of the general cleanup of indio_dev->mlock, this change replaces it with a local lock, to protect potential concurrent access to the completion callback during a conversion. This is part of a bigger cleanup. Link: https://lore.kernel.org/linux-iio/CA+U=Dsoo6YABe5ODLp+eFNPGFDjk5ZeQEceGkqjxXcVEhLWubw@mail.gmail.com/Signed-off-by:
Sergiu Cuciurean <sergiu.cuciurean@analog.com> Signed-off-by:
Alexandru Ardelean <alexandru.ardelean@analog.com> Reviewed-by:
-
Jonathan Cameron authored
Very simple binding. I've changed the example to use the node name threshold-detector@0 as sensor@0 seemed too generic. Signed-off-by:
Rob Herring <robh@kernel.org> Cc: Vladimir Barinov <vladimir.barinov@cogentembedded.com> Link: https://lore.kernel.org/r/20200909175946.395313-18-jic23@kernel.org
-
Jonathan Cameron authored
Fairly straight conversion. The one oddity in the original binding is that spi-cpha and spi-cpol were not marked as required, but were in the example. Looking at the datasheet, there isn't any documented flexibility in the possible SPI modes, so I have moved these to requires. For spi-max-frequency I have gone the other way. I absolutely agree that it is good to specify this in the dt-binding, but it's not strictly required. As Stefan's email is bouncing I have gone with Michael as maintainer of this one as it falls under the ADI catch all entry in MAINTAINERS. Signed-off-by:
-
Jonathan Cameron authored
Simple SPI driver. I've added the #io-channel-cells as an optional parameter to allow use of this device as a provider of ADC capabilities to other devices. Signed-off-by:
-
Jonathan Cameron authored
This is a small part of an MFD so perhaps ultimately it makes more sense to document it with that MFD binding rather than separately. In the meantime it's a straightforward conversion from txt to yaml. Signed-off-by:
Adam Thomson <Adam.Thomson.Opensource@diasemi.com> Link: https://lore.kernel.org/r/20200909175946.395313-13-jic23@kernel.org
-
Jonathan Cameron authored
Conversion from txt to yaml. Slightly expanded example to give a bit more context. Description lifted from the original driver commit. Signed-off-by:
-
Jonathan Cameron authored
Renamed to remove the wild cards. These go wrong far too often so in general preferred to use the name of a specific part. As this binding only provides one compatible, I went with that. Signed-off-by:
-
Jonathan Cameron authored
Most of the description in the original doc is effectively boilerplate and does not bring much value so I have not carried it over into the yaml. Added #io-channel-cells to simplify use of channels on this ADC by consumer drivers. Signed-off-by:
-
Jonathan Cameron authored
This binding has a few corners that would have been done different today but hopefully the yaml schema captures the constraints correctly. The child node names are not constrained hence the fairly open regexp. I've also documented the defaults for the two references that the driver seems to use and copied the value descriptions from the header because I think they should be in the dt-binding itself. This is part of a general effort to convert all the IIO bindings over to yaml Unfortunately I don't have a current address for Markus, so have put myself as the maintainer for this binding until someone else steps up! Signed-off-by:
-
Jonathan Cameron authored
A nice simple binding. Only real different from txt is that I dropped some descriptions where the naming of the parameter was self explanatory Signed-off-by:
-
Jonathan Cameron authored
This binding was moved over from hwmon some time ago so is a bit unusual in terms of IIO bindings. However, conversion was fairly straight forwards. I've listed both Dirk (who think wrote original binding) and Daniel who added the IIO driver for this device. Signed-off-by:
-
Jonathan Cameron authored
I don't really know much about this one, hence the binding is a simple conversion of what was in the txt file. Note that I have taken on maintenance of this binding as I don't have a recent address for Phani Movva. Signed-off-by:
-
