superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
mirror-linux/drivers/iio/accel
History
Sean Nyekjaer 1fe16dc1a2 iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush 
fxls8962af_fifo_flush() uses indio_dev->active_scan_mask (with
iio_for_each_active_channel()) without making sure the indio_dev
stays in buffer mode.
There is a race if indio_dev exits buffer mode in the middle of the
interrupt that flushes the fifo. Fix this by calling
synchronize_irq() to ensure that no interrupt is currently running when
disabling buffer mode.

Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read
[...]
_find_first_bit_le from fxls8962af_fifo_flush+0x17c/0x290
fxls8962af_fifo_flush from fxls8962af_interrupt+0x80/0x178
fxls8962af_interrupt from irq_thread_fn+0x1c/0x7c
irq_thread_fn from irq_thread+0x110/0x1f4
irq_thread from kthread+0xe0/0xfc
kthread from ret_from_fork+0x14/0x2c

Fixes: 79e3a5bdd9 ("iio: accel: fxls8962af: add hw buffered sampling")
Cc: stable@vger.kernel.org
Suggested-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Sean Nyekjaer <sean@geanix.com>
Link: https://patch.msgid.link/20250603-fxlsrace-v2-1-5381b36ba1db@geanix.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
 		2025-06-29 17:15:39 +01:00
..
Kconfig iio: accel: kx022a: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig 2024-10-06 16:27:25 +01:00
Makefile iio: accel: add ADXL380 driver 2024-08-03 10:13:36 +01:00
adis16201.c iio: adis16201: Correct inclinometer channel resolution 2025-04-21 14:58:31 +01:00
adis16209.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
adxl313.h
…
adxl313_core.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
adxl313_i2c.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
adxl313_spi.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
adxl345.h iio: accel: adxl345: use regmap cache for INT mapping 2025-04-22 19:09:51 +01:00
adxl345_core.c iio: accel: adxl345: set the tap suppress bit permanently 2025-05-21 14:20:27 +01:00
adxl345_i2c.c iio: accel: adxl345: use regmap cache for INT mapping 2025-04-22 19:09:51 +01:00
adxl345_spi.c iio: accel: adxl345: use regmap cache for INT mapping 2025-04-22 19:09:51 +01:00
adxl355.h drivers: iio: accel: Add support for ADXL359 device 2022-11-23 19:44:04 +00:00
adxl355_core.c IIO: New device support, features and cleanup for 6.16 - take 2 2025-05-22 15:54:52 +02:00
adxl355_i2c.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
adxl355_spi.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
adxl367.c iio: accel: adxl367: fix setting odr for activity time update 2025-04-07 19:32:49 +01:00
adxl367.h
…
adxl367_i2c.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
adxl367_spi.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
adxl372.c iio: accel: Switch to sparse friendly iio_device_claim/release_direct() 2025-03-04 13:17:48 +00:00
adxl372.h
…
adxl372_i2c.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
adxl372_spi.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
adxl380.c iio: accel: Switch to sparse friendly iio_device_claim/release_direct() 2025-03-04 13:17:48 +00:00
adxl380.h iio: accel: add ADXL380 driver 2024-08-03 10:13:36 +01:00
adxl380_i2c.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
adxl380_spi.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
bma180.c iio: accel: Use iio_push_to_buffers_with_ts() to provide length for runtime checks. 2025-05-21 14:20:26 +01:00
bma220_spi.c iio: accel: Use iio_push_to_buffers_with_ts() to provide length for runtime checks. 2025-05-21 14:20:26 +01:00
bma400.h iio: accel: bma400: Use devm_regulator_bulk_get_enable() 2022-12-28 17:19:45 +00:00
bma400_core.c iio: accel: Use iio_push_to_buffers_with_ts() to provide length for runtime checks. 2025-05-21 14:20:26 +01:00
bma400_i2c.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
bma400_spi.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
bmc150-accel-core.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
bmc150-accel-i2c.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
bmc150-accel-spi.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
bmc150-accel.h iio: accel: replace s64 __aligned(8) with aligned_s64 2024-10-28 20:04:10 +00:00
bmi088-accel-core.c iio: accel: Switch to sparse friendly iio_device_claim/release_direct() 2025-03-04 13:17:48 +00:00
bmi088-accel-i2c.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
bmi088-accel-spi.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
bmi088-accel.h
…
cros_ec_accel_legacy.c iio: accel: cros_ec_accel_legacy: make use of iio_get_masklength() 2024-07-29 20:31:08 +01:00
da280.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
da311.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
dmard06.c iio: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-05-27 09:48:57 +01:00
dmard09.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
dmard10.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
fxls8962af-core.c iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush 2025-06-29 17:15:39 +01:00
fxls8962af-i2c.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
fxls8962af-spi.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
fxls8962af.h iio: accel: fxls8962af: add fxls8967af support 2024-12-07 17:11:01 +00:00
hid-sensor-accel-3d.c iio: accel: hid: Use iio_push_to_buffers_with_ts() to provide length for runtime checks. 2025-05-21 14:20:26 +01:00
kionix-kx022a-i2c.c iio: accel: kx022a: Support KX134-1211 2024-12-07 17:52:39 +00:00
kionix-kx022a-spi.c iio: accel: kx022a: Support KX134-1211 2024-12-07 17:52:39 +00:00
kionix-kx022a.c iio: accel: kx022a: Switch to sparse friendly iio_device_claim/release_direct() 2025-03-04 13:17:48 +00:00
kionix-kx022a.h iio: kx022a: document new chip_info structure members 2024-12-08 18:26:31 +00:00
kxcjk-1013.c iio: accel: kxcjk-1013: Deduplicate setup interrupt functions 2025-05-21 14:20:28 +01:00
kxsd9-i2c.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
kxsd9-spi.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
kxsd9.c iio: accel: Use iio_push_to_buffers_with_ts() to provide length for runtime checks. 2025-05-21 14:20:26 +01:00
kxsd9.h
…
mc3230.c iio: accel: mc3230: add mc3510c support 2025-02-03 19:15:38 +00:00
mma7455.h
…
mma7455_core.c iio: accel: Use iio_push_to_buffers_with_ts() to provide length for runtime checks. 2025-05-21 14:20:26 +01:00
mma7455_i2c.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
mma7455_spi.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
mma7660.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
mma8452.c iio: accel: Use iio_push_to_buffers_with_ts() to provide length for runtime checks. 2025-05-21 14:20:26 +01:00
mma9551.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
mma9551_core.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
mma9551_core.h
…
mma9553.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
msa311.c iio: accel: Use iio_push_to_buffers_with_ts() to provide length for runtime checks. 2025-05-21 14:20:26 +01:00
mxc4005.c iio: accel: Use iio_push_to_buffers_with_ts() to provide length for runtime checks. 2025-05-21 14:20:26 +01:00
mxc6255.c iio: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-05-27 09:48:57 +01:00
sca3000.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
sca3300.c iio: accel: sca3300: use IIO_DECLARE_BUFFER_WITH_TS 2025-05-21 14:20:32 +01:00
ssp_accel_sensor.c module: Convert symbol namespace to string literal 2024-12-02 11:34:44 -08:00
st_accel.h iio: accel: st_accel: add support for LIS2DS12 2024-06-25 21:04:49 +01:00
st_accel_buffer.c
…
st_accel_core.c iio: common: st_sensors: Fix use of uninitialize device structs 2025-06-29 17:15:39 +01:00
st_accel_i2c.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
st_accel_spi.c iio: normalize array sentinel style 2025-04-22 19:10:04 +01:00
stk8ba50.c iio: accel: Use iio_push_to_buffers_with_ts() to provide length for runtime checks. 2025-05-21 14:20:26 +01:00
stk8312.c iio: accel: Use iio_push_to_buffers_with_ts() to provide length for runtime checks. 2025-05-21 14:20:26 +01:00