kernel/git/stable/linux-stable.git/drivers/iio/accel, branch linux-7.1.y

iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error

2026-07-18T14:55:17+00:00

commit 44a5fd874bb6873bdaec59f722c1d57832fbc9df upstream. kxsd9_write_raw() takes a runtime PM reference with pm_runtime_get_sync() but returns -EINVAL directly when a scale with a non-zero integer part is requested, skipping the matching pm_runtime_put_autosuspend(). This leaks a runtime PM usage-counter reference on every such write, after which the device can no longer autosuspend. Set the error code and fall through to the existing put instead of returning early. Fixes: 9a9a369d6178 ("iio: accel: kxsd9: Deploy system and runtime PM") Signed-off-by: Biren Pandya Assisted-by: Claude:claude-opus-4-8 coccinelle Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman

iio: accel: bmc150: clamp the device-reported FIFO frame count

2026-07-18T14:55:17+00:00

commit ce0e1cae26096fe959a0da5563a6d6d5a801d5fb upstream. __bmc150_accel_fifo_flush() copies the number of samples the device reports in its hardware FIFO into an on-stack buffer u16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3]; which is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The frame count is read from the FIFO_STATUS register and only masked to its 7 valid bits: count = val & 0x7F; so it can be 0..127. The only other limit applied to it is the optional caller-supplied sample budget: if (samples && count > samples) count = samples; which does not constrain count on the flush-all path (samples == 0), and leaves it well above 32 whenever samples is larger. count samples are then transferred into buffer[]: bmc150_accel_fifo_transfer(data, (u8 *)buffer, count); bmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a malfunctioning, malicious or counterfeit accelerometer (or an attacker tampering with the I2C/SPI bus) that reports up to 127 frames writes up to 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up to 570 bytes that clobbers the stack canary, saved registers and the return address. Clamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[] is sized for, before the transfer, mirroring the watermark clamp already done in bmc150_accel_set_watermark(). A well-formed flush reports at most BMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected. Fixes: 3bbec9773389 ("iio: bmc150_accel: add support for hardware fifo") Cc: stable@vger.kernel.org Signed-off-by: Bryam Vargas Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman

Merge tag 'v7.0-rc7' into char-misc-next

2026-04-06T07:04:53+00:00

We need the char/misc/iio/comedi fixes in here as well for testing Signed-off-by: Greg Kroah-Hartman

iio: accel: bmc150-accel-core: use sysfs_emit() in show functions

2026-03-25T20:23:06+00:00

Replace sprintf() with sysfs_emit() in sysfs attribute show callbacks. sysfs_emit() is the preferred API as it is aware of the sysfs buffer page size limit. Signed-off-by: Gabriel Rondon Signed-off-by: Jonathan Cameron

iio: accel: adxl380: fix typo in PART_ID register macro

2026-03-25T16:33:36+00:00

Fix a typo in the ADXL380_PART_ID_REG macro name where it was incorrectly defined as ADLX380_PART_ID_REG. Also update its usage in adxl380_setup(). Signed-off-by: Nikhil Gautam Signed-off-by: Jonathan Cameron

iio: accel: adxl313: add missing error check in predisable

2026-03-22T11:48:12+00:00

Check the return value of the FIFO bypass regmap_write() before proceeding to disable interrupts. Fixes: ff8093fa6ba4 ("iio: accel: adxl313: add buffered FIFO watermark with interrupt handling") Signed-off-by: Antoniu Miclaus Reviewed-by: Andy Shevchenko Cc: Signed-off-by: Jonathan Cameron

iio: accel: fix ADXL355 temperature signature value

2026-03-22T11:43:00+00:00

Temperature was wrongly represented as 12-bit signed, confirmed by checking the datasheet. Even if the temperature is negative, the value in the register stays unsigned. Fixes: 12ed27863ea3 iio: accel: Add driver support for ADXL355 Signed-off-by: Valek Andrej Cc: Signed-off-by: Jonathan Cameron

iio: accel: fix typo celcius to Celsius

2026-03-21T19:09:41+00:00

Fix incorrect spelling in comments - celcius -> Celsius Signed-off-by: Shi Hao Signed-off-by: Jonathan Cameron

iio: accel: adxl372: add support for ADXL371

2026-03-21T11:22:43+00:00

Add support for the Analog Devices ADXL371, a +-200g 3-axis MEMS accelerometer sharing the same register map as the ADXL372 but with different ODR values (320/640/1280/2560/5120 Hz vs 400/800/1600/3200/ 6400 Hz), different bandwidth values, and different timer scale factors for activity/inactivity detection. Due to a silicon anomaly (er001) causing FIFO data misalignment on all current ADXL371 silicon, FIFO and triggered buffer support is disabled for the ADXL371 - only direct mode reads are supported. Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron

iio: accel: adxl372: factor out buffer and trigger setup

2026-03-21T11:22:34+00:00

Extract the triggered buffer, trigger allocation, and IRQ request logic from adxl372_probe() into a dedicated adxl372_buffer_setup() helper. This reduces the probe function complexity and prepares for conditionally disabling buffer support on device variants with known FIFO issues. No functional change intended. Signed-off-by: Antoniu Miclaus Signed-off-by: Jonathan Cameron