Commit ecf11d31 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'char-misc-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc 

Pull char / misc / IIO fixes from Greg KH:
 "Here are some char/misc/iio and other driver fixes for 6.16-rc7.
  Included in here are:

   - IIO driver fixes for reported problems

   - Interconnect driver fixes for reported problems

   - nvmem driver fixes

   - bunch of comedi driver fixes for long-term bugs

   - Kconfig dependancy fixes for mux drivers

   - other small driver fixes for reported problems.

  All of these have been in linux-next for a while with no reported
  problems"

* tag 'char-misc-6.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (35 commits)
  nvmem: layouts: u-boot-env: remove crc32 endianness conversion
  misc: amd-sbi: Explicitly clear in/out arg "mb_in_out"
  misc: amd-sbi: Address copy_to/from_user() warning reported in smatch
  misc: amd-sbi: Address potential integer overflow issue reported in smatch
  comedi: comedi_test: Fix possible deletion of uninitialized timers
  comedi: Fix initialization of data for instructions that write to subdevice
  comedi: Fix use of uninitialized data in insn_rw_emulate_bits()
  comedi: das6402: Fix bit shift out of bounds
  comedi: aio_iiro_16: Fix bit shift out of bounds
  comedi: pcl812: Fix bit shift out of bounds
  comedi: das16m1: Fix bit shift out of bounds
  comedi: Fix some signed shift left operations
  comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
  nvmem: imx-ocotp: fix MAC address byte length
  MAINTAINERS: add miscdevice Rust abstractions
  mux: mmio: Fix missing CONFIG_REGMAP_MMIO
  iio: dac: ad3530r: Fix incorrect masking for channels 4-7 in powerdown mode
  iio: adc: ad7380: fix adi,gain-milli property parsing
  iio: adc: ad7949: use spi_is_bpw_supported()
  iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush
  ...
parents 990b11a5 2d7521aa

Documentation/devicetree/bindings/iio/adc/adi,ad7606.yaml

+0 −6
Original line number Diff line number Diff line
@@ -223,12 +223,6 @@ allOf: 
      - required:

          - pwms



  - oneOf:

      - required:

          - interrupts

      - required:

          - io-backends



  - if:

      properties:

        compatible:

Documentation/devicetree/bindings/iio/gyroscope/invensense,mpu3050.yaml

+1 −1
Original line number Diff line number Diff line
@@ -21,7 +21,7 @@ properties: 
  vlogic-supply: true



  interrupts:

    minItems: 1

    maxItems: 1

    description:

      Interrupt mapping for the trigger interrupt from the internal oscillator.

MAINTAINERS

+1 −0
Original line number Diff line number Diff line
@@ -5570,6 +5570,7 @@ T: git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git 
F:	drivers/char/

F:	drivers/misc/

F:	include/linux/miscdevice.h

F:	rust/kernel/miscdevice.rs

F:	samples/rust/rust_misc_device.rs

X:	drivers/char/agp/

X:	drivers/char/hw_random/

drivers/comedi/comedi_fops.c

+28 −2
Original line number Diff line number Diff line
@@ -1556,21 +1556,27 @@ static int do_insnlist_ioctl(struct comedi_device *dev, 
	}



	for (i = 0; i < n_insns; ++i) {

		unsigned int n = insns[i].n;



		if (insns[i].insn & INSN_MASK_WRITE) {

			if (copy_from_user(data, insns[i].data,

					   insns[i].n * sizeof(unsigned int))) {

					   n * sizeof(unsigned int))) {

				dev_dbg(dev->class_dev,

					"copy_from_user failed\n");

				ret = -EFAULT;

				goto error;

			}

			if (n < MIN_SAMPLES) {

				memset(&data[n], 0, (MIN_SAMPLES - n) *

						    sizeof(unsigned int));

			}

		}

		ret = parse_insn(dev, insns + i, data, file);

		if (ret < 0)

			goto error;

		if (insns[i].insn & INSN_MASK_READ) {

			if (copy_to_user(insns[i].data, data,

					 insns[i].n * sizeof(unsigned int))) {

					 n * sizeof(unsigned int))) {

				dev_dbg(dev->class_dev,

					"copy_to_user failed\n");

				ret = -EFAULT;
@@ -1589,6 +1595,16 @@ static int do_insnlist_ioctl(struct comedi_device *dev, 
	return i;

}



#define MAX_INSNS   MAX_SAMPLES

static int check_insnlist_len(struct comedi_device *dev, unsigned int n_insns)

{

	if (n_insns > MAX_INSNS) {

		dev_dbg(dev->class_dev, "insnlist length too large\n");

		return -EINVAL;

	}

	return 0;

}



/*

 * COMEDI_INSN ioctl

 * synchronous instruction
@@ -1633,6 +1649,10 @@ static int do_insn_ioctl(struct comedi_device *dev, 
			ret = -EFAULT;

			goto error;

		}

		if (insn->n < MIN_SAMPLES) {

			memset(&data[insn->n], 0,

			       (MIN_SAMPLES - insn->n) * sizeof(unsigned int));

		}

	}

	ret = parse_insn(dev, insn, data, file);

	if (ret < 0)
@@ -2239,6 +2259,9 @@ static long comedi_unlocked_ioctl(struct file *file, unsigned int cmd, 
			rc = -EFAULT;

			break;

		}

		rc = check_insnlist_len(dev, insnlist.n_insns);

		if (rc)

			break;

		insns = kcalloc(insnlist.n_insns, sizeof(*insns), GFP_KERNEL);

		if (!insns) {

			rc = -ENOMEM;
@@ -3142,6 +3165,9 @@ static int compat_insnlist(struct file *file, unsigned long arg) 
	if (copy_from_user(&insnlist32, compat_ptr(arg), sizeof(insnlist32)))

		return -EFAULT;



	rc = check_insnlist_len(dev, insnlist32.n_insns);

	if (rc)

		return rc;

	insns = kcalloc(insnlist32.n_insns, sizeof(*insns), GFP_KERNEL);

	if (!insns)

		return -ENOMEM;

drivers/comedi/drivers.c

+10 −7
Original line number Diff line number Diff line
@@ -339,10 +339,10 @@ int comedi_dio_insn_config(struct comedi_device *dev, 
			   unsigned int *data,

			   unsigned int mask)

{

	unsigned int chan_mask = 1 << CR_CHAN(insn->chanspec);

	unsigned int chan = CR_CHAN(insn->chanspec);



	if (!mask)

		mask = chan_mask;

	if (!mask && chan < 32)

		mask = 1U << chan;



	switch (data[0]) {

	case INSN_CONFIG_DIO_INPUT:
@@ -382,7 +382,7 @@ EXPORT_SYMBOL_GPL(comedi_dio_insn_config); 
unsigned int comedi_dio_update_state(struct comedi_subdevice *s,

				     unsigned int *data)

{

	unsigned int chanmask = (s->n_chan < 32) ? ((1 << s->n_chan) - 1)

	unsigned int chanmask = (s->n_chan < 32) ? ((1U << s->n_chan) - 1)

						 : 0xffffffff;

	unsigned int mask = data[0] & chanmask;

	unsigned int bits = data[1];
@@ -615,6 +615,9 @@ static int insn_rw_emulate_bits(struct comedi_device *dev, 
	unsigned int _data[2];

	int ret;



	if (insn->n == 0)

		return 0;



	memset(_data, 0, sizeof(_data));

	memset(&_insn, 0, sizeof(_insn));

	_insn.insn = INSN_BITS;
@@ -625,8 +628,8 @@ static int insn_rw_emulate_bits(struct comedi_device *dev, 
	if (insn->insn == INSN_WRITE) {

		if (!(s->subdev_flags & SDF_WRITABLE))

			return -EINVAL;

		_data[0] = 1 << (chan - base_chan);		    /* mask */

		_data[1] = data[0] ? (1 << (chan - base_chan)) : 0; /* bits */

		_data[0] = 1U << (chan - base_chan);		     /* mask */

		_data[1] = data[0] ? (1U << (chan - base_chan)) : 0; /* bits */

	}



	ret = s->insn_bits(dev, s, &_insn, _data);
@@ -709,7 +712,7 @@ static int __comedi_device_postconfig(struct comedi_device *dev) 


		if (s->type == COMEDI_SUBD_DO) {

			if (s->n_chan < 32)

				s->io_bits = (1 << s->n_chan) - 1;

				s->io_bits = (1U << s->n_chan) - 1;

			else

				s->io_bits = 0xffffffff;

		}