[PATCH 00/16] IIO: Introduce iio_push_to_buffers_with_ts() taking an input buffer length argument.

[PATCH 00/16] IIO: Introduce iio_push_to_buffers_with_ts() taking an input buffer length argument.

[Jonathan Cameron]

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

When using the IIO buffers, the length of each scan element is always known to
the IIO core (used for sizing kfifo elements etc) and depends on which channels
are enabled. Devices often use fixed size structures or arrays.

The core code previously had no way to check that the driver had provided a large
enough buffer, potentially leading to errors or to non sanitized data being presented
to userspace. In particular the iio_push_to_buffers_with_timestamp() helper
has the non obvious requirement for a larger buffer when timestamps are enabled
than that containing the rest of the channels (under the control of the driver).
This has lead to bugs in the past and this series aims to make that impossible
in the future by passing the size of the storage into a new variant of the helper
iio_push_to_buffers_with_ts() and performing a runtime check.

Once all drivers are converted, the expectation is the _with_timestamp()
version without this check will be removed.

The patches in this series use this helper for a large number of simple cases
and fix a few minor issues found during the conversion.  This does not cover
all drivers in each category, leaving more complex cases for future series.
Some of the remaining cases need substantial refactoring, others look to have
bugs that need more careful consideration than the cases in this series.

All comments welcome.  I haven't attempted to cc all the relevant driver
maintainers as that is a long list!

Jonathan Cameron (16):
  iio: introduced iio_push_to_buffers_with_ts() that takes a total_len
    argument.
  iio: dummy: Use a fixed structure to build up scan to push to buffers.
  iio: dummy: Switch to iio_push_to_buffers_with_ts() and provide size
    of storage
  iio: adc: ti-ads131e08: Use new iio_push_to_buffers_with_ts() to
    provide length sanity check.
  iio: adc: Use iio_push_to_buffers_with_ts() to provide length for
    runtime checks.
  iio: accel: Use iio_push_to_buffers_with_ts() to provide length for
    runtime checks.
  iio: accel: hid: Use iio_push_to_buffers_with_ts() to provide length
    for runtime checks.
  iio: chemical: Use iio_push_to_buffers_with_ts() to provide length for
    runtime checks.
  iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer.
  iio: temperature: Use iio_push_to_buffers_with_ts() to provide length
    for runtime checks.
  iio: resolver: Use iio_push_to_buffers_with_ts() to provide length for
    runtime checks.
  iio: proximity: irsd200: Use a struct for scan and
    iio_push_to_buffers_with_ts()
  iio: proximity: Use iio_push_to_buffers_with_ts() to provide length
    for runtime checks.
  iio: pressure: zpa2326: Use aligned_s64 for the timestamp
  iio: pressure: Use iio_push_to_buffers_with_ts() to provide length for
    runtime checks.
  iio: magnetometer: Use iio_push_to_buffers_with_ts() to provide length
    for runtime checks.

 drivers/iio/accel/adxl355_core.c              |  4 +--
 drivers/iio/accel/bma180.c                    |  3 ++-
 drivers/iio/accel/bma220_spi.c                |  4 +--
 drivers/iio/accel/bma400_core.c               |  5 ++--
 drivers/iio/accel/fxls8962af-core.c           |  4 +--
 drivers/iio/accel/hid-sensor-accel-3d.c       |  2 +-
 drivers/iio/accel/kxcjk-1013.c                |  4 +--
 drivers/iio/accel/kxsd9.c                     |  5 ++--
 drivers/iio/accel/mma7455_core.c              |  5 ++--
 drivers/iio/accel/mma8452.c                   |  5 ++--
 drivers/iio/accel/msa311.c                    |  4 +--
 drivers/iio/accel/mxc4005.c                   |  4 +--
 drivers/iio/accel/sca3300.c                   |  5 ++--
 drivers/iio/accel/stk8312.c                   |  2 +-
 drivers/iio/accel/stk8ba50.c                  |  4 +--
 drivers/iio/adc/ad4000.c                      |  3 ++-
 drivers/iio/adc/ad4030.c                      |  5 ++--
 drivers/iio/adc/ad4695.c                      |  3 ++-
 drivers/iio/adc/ad7266.c                      |  5 ++--
 drivers/iio/adc/ad7298.c                      |  5 ++--
 drivers/iio/adc/ad7380.c                      |  5 ++--
 drivers/iio/adc/ad7476.c                      |  4 +--
 drivers/iio/adc/ad7606.c                      |  4 +--
 drivers/iio/adc/ad7768-1.c                    |  5 ++--
 drivers/iio/adc/ad7779.c                      |  3 ++-
 drivers/iio/adc/ad7923.c                      |  4 +--
 drivers/iio/adc/dln2-adc.c                    |  4 +--
 drivers/iio/adc/ina2xx-adc.c                  |  3 ++-
 drivers/iio/adc/max1118.c                     |  2 +-
 drivers/iio/adc/max11410.c                    |  4 +--
 drivers/iio/adc/max1363.c                     |  4 +--
 drivers/iio/adc/mcp3911.c                     |  4 +--
 drivers/iio/adc/mxs-lradc-adc.c               |  3 ++-
 drivers/iio/adc/pac1921.c                     |  3 ++-
 drivers/iio/adc/rockchip_saradc.c             |  3 ++-
 drivers/iio/adc/rtq6056.c                     |  3 ++-
 drivers/iio/adc/stm32-adc.c                   |  4 +--
 drivers/iio/adc/ti-adc081c.c                  |  4 +--
 drivers/iio/adc/ti-adc0832.c                  |  4 +--
 drivers/iio/adc/ti-adc084s021.c               |  4 +--
 drivers/iio/adc/ti-adc12138.c                 |  4 +--
 drivers/iio/adc/ti-ads1015.c                  |  4 +--
 drivers/iio/adc/ti-ads1119.c                  |  4 +--
 drivers/iio/adc/ti-ads124s08.c                |  4 +--
 drivers/iio/adc/ti-ads131e08.c                |  5 ++--
 drivers/iio/adc/ti-ads8688.c                  |  4 +--
 drivers/iio/adc/ti-lmp92064.c                 |  4 +--
 drivers/iio/adc/ti-tlc4541.c                  |  4 +--
 drivers/iio/adc/ti-tsc2046.c                  |  5 ++--
 drivers/iio/adc/vf610_adc.c                   |  7 +++---
 drivers/iio/chemical/atlas-sensor.c           |  5 ++--
 drivers/iio/chemical/bme680_core.c            |  4 +--
 drivers/iio/chemical/ccs811.c                 |  4 +--
 drivers/iio/chemical/ens160_core.c            |  4 +--
 drivers/iio/chemical/pms7003.c                |  5 ++--
 drivers/iio/chemical/scd30_core.c             |  3 ++-
 drivers/iio/chemical/scd4x.c                  |  3 ++-
 drivers/iio/chemical/sps30.c                  |  4 +--
 drivers/iio/dummy/iio_simple_dummy_buffer.c   | 18 ++++++-------
 drivers/iio/magnetometer/af8133j.c            |  3 ++-
 drivers/iio/magnetometer/ak8974.c             |  5 ++--
 drivers/iio/magnetometer/ak8975.c             |  4 +--
 drivers/iio/magnetometer/als31300.c           |  4 +--
 drivers/iio/magnetometer/bmc150_magn.c        |  4 +--
 drivers/iio/magnetometer/hmc5843.h            |  2 +-
 drivers/iio/magnetometer/hmc5843_core.c       |  4 +--
 drivers/iio/magnetometer/mag3110.c            |  4 +--
 drivers/iio/magnetometer/rm3100-core.c        |  4 +--
 drivers/iio/magnetometer/yamaha-yas530.c      |  5 ++--
 drivers/iio/pressure/bmp280-core.c            | 25 +++++++++++--------
 drivers/iio/pressure/hid-sensor-press.c       |  5 ++--
 drivers/iio/pressure/hsc030pa.c               |  4 +--
 drivers/iio/pressure/mpl3115.c                |  4 +--
 drivers/iio/pressure/rohm-bm1390.c            |  3 ++-
 drivers/iio/pressure/zpa2326.c                |  6 ++---
 drivers/iio/proximity/as3935.c                |  4 +--
 drivers/iio/proximity/hx9023s.c               |  4 +--
 drivers/iio/proximity/irsd200.c               | 12 ++++++---
 drivers/iio/proximity/mb1232.c                |  4 +--
 .../iio/proximity/pulsedlight-lidar-lite-v2.c |  5 ++--
 drivers/iio/proximity/srf08.c                 |  4 +--
 drivers/iio/proximity/sx_common.c             |  4 +--
 drivers/iio/proximity/vl53l0x-i2c.c           |  4 +--
 drivers/iio/resolver/ad2s1210.c               |  3 ++-
 .../iio/temperature/hid-sensor-temperature.c  |  5 ++--
 drivers/iio/temperature/maxim_thermocouple.c  |  7 +++---
 drivers/iio/temperature/tmp006.c              |  4 +--
 include/linux/iio/buffer.h                    | 13 ++++++++++
 88 files changed, 230 insertions(+), 179 deletions(-)

-- 
2.48.1

[PATCH 01/16] iio: introduced iio_push_to_buffers_with_ts() that takes a total_len argument.

[Jonathan Cameron]

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

Check that total_len argument against iio_dev->scan_bytes.

The size needs to be at least as big as the scan. It can be larger,
which is typical if only part of fixed sized storage is used due to
a subset of channels being enabled.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
 include/linux/iio/buffer.h | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/include/linux/iio/buffer.h b/include/linux/iio/buffer.h
index 3b8d618bb3df..75d5e58b646b 100644
--- a/include/linux/iio/buffer.h
+++ b/include/linux/iio/buffer.h
@@ -45,6 +45,19 @@ static inline int iio_push_to_buffers_with_timestamp(struct iio_dev *indio_dev,
 	return iio_push_to_buffers(indio_dev, data);
 }
 
+static inline int iio_push_to_buffers_with_ts(struct iio_dev *indio_dev,
+					      void *data, size_t total_len,
+					      int64_t timestamp)
+{
+	if (total_len < indio_dev->scan_bytes) {
+		dev_err(&indio_dev->dev,
+			"Undersized storage pushed to buffer\n");
+		return -ENOSPC;
+	}
+
+	return iio_push_to_buffers_with_timestamp(indio_dev, data, timestamp);
+}
+
 int iio_push_to_buffers_with_ts_unaligned(struct iio_dev *indio_dev,
 					  const void *data, size_t data_sz,
 					  int64_t timestamp);
-- 
2.48.1

[PATCH 02/16] iio: dummy: Use a fixed structure to build up scan to push to buffers.

[Jonathan Cameron]

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

It has long been discouraged for drivers to make use of iio_dev->scan_bytes
directly as that is an implementation detail of the core. As such our
example driver should definitely not be doing so.

A simple anonymous structure definition suffices here as even though
we have a mixture of signed and unsigned channels only the signed ones
use the full storage so the unsigned channels can used signed types as
well.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
 drivers/iio/dummy/iio_simple_dummy_buffer.c | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/drivers/iio/dummy/iio_simple_dummy_buffer.c b/drivers/iio/dummy/iio_simple_dummy_buffer.c
index 288880346707..050dd993f012 100644
--- a/drivers/iio/dummy/iio_simple_dummy_buffer.c
+++ b/drivers/iio/dummy/iio_simple_dummy_buffer.c
@@ -46,11 +46,10 @@ static irqreturn_t iio_simple_dummy_trigger_h(int irq, void *p)
 	struct iio_poll_func *pf = p;
 	struct iio_dev *indio_dev = pf->indio_dev;
 	int i = 0, j;
-	u16 *data;
-
-	data = kzalloc(indio_dev->scan_bytes, GFP_KERNEL);
-	if (!data)
-		goto done;
+	struct {
+		s16 data[ARRAY_SIZE(fakedata)];
+		aligned_s64 timestamp;
+	} scan;
 
 	/*
 	 * Three common options here:
@@ -69,14 +68,11 @@ static irqreturn_t iio_simple_dummy_trigger_h(int irq, void *p)
 	 * constant table fakedata.
 	 */
 	iio_for_each_active_channel(indio_dev, j)
-		data[i++] = fakedata[j];
+		scan.data[i++] = fakedata[j];
 
-	iio_push_to_buffers_with_timestamp(indio_dev, data,
+	iio_push_to_buffers_with_timestamp(indio_dev, &scan,
 					   iio_get_time_ns(indio_dev));
 
-	kfree(data);
-
-done:
 	/*
 	 * Tell the core we are done with this trigger and ready for the
 	 * next one.
-- 
2.48.1

[PATCH 03/16] iio: dummy: Switch to iio_push_to_buffers_with_ts() and provide size of storage

[Jonathan Cameron]

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

Provide the storage size so that the helper can sanity check that it
is large enough for the configured channels.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
 drivers/iio/dummy/iio_simple_dummy_buffer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/dummy/iio_simple_dummy_buffer.c b/drivers/iio/dummy/iio_simple_dummy_buffer.c
index 050dd993f012..4f2281c5a930 100644
--- a/drivers/iio/dummy/iio_simple_dummy_buffer.c
+++ b/drivers/iio/dummy/iio_simple_dummy_buffer.c
@@ -70,8 +70,8 @@ static irqreturn_t iio_simple_dummy_trigger_h(int irq, void *p)
 	iio_for_each_active_channel(indio_dev, j)
 		scan.data[i++] = fakedata[j];
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &scan, sizeof(scan),
+				    iio_get_time_ns(indio_dev));
 
 	/*
 	 * Tell the core we are done with this trigger and ready for the
-- 
2.48.1

[PATCH 04/16] iio: adc: ti-ads131e08: Use new iio_push_to_buffers_with_ts() to provide length sanity check.

[Jonathan Cameron]

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

By providing the size of the buffer used, runtime checks can be performed
to ensure not overrun.

Also change the pushed data pointer to be that of the structure that also
contains the timestamp.  Not an actual bug but semantically incorrect
to push the channel data when we want the storage with the timestamp
as well.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
 drivers/iio/adc/ti-ads131e08.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/adc/ti-ads131e08.c b/drivers/iio/adc/ti-ads131e08.c
index c6096b64664e..6e83d370f0b5 100644
--- a/drivers/iio/adc/ti-ads131e08.c
+++ b/drivers/iio/adc/ti-ads131e08.c
@@ -664,8 +664,9 @@ static irqreturn_t ads131e08_trigger_handler(int irq, void *private)
 		i++;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, st->tmp_buf.data,
-		iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &st->tmp_buf,
+				    sizeof(st->tmp_buf),
+				    iio_get_time_ns(indio_dev));
 
 out:
 	iio_trigger_notify_done(indio_dev->trig);
-- 
2.48.1

[PATCH 05/16] iio: adc: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.

[Jonathan Cameron]

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

This new function allows us to perform debug checks in the helper to ensure
that the overrun does not occur.  Use it in all the simple cases where
either a static buffer or a structure is used in the drivers.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
 drivers/iio/adc/ad4000.c          | 3 ++-
 drivers/iio/adc/ad4030.c          | 5 +++--
 drivers/iio/adc/ad4695.c          | 3 ++-
 drivers/iio/adc/ad7266.c          | 5 +++--
 drivers/iio/adc/ad7298.c          | 5 +++--
 drivers/iio/adc/ad7380.c          | 5 +++--
 drivers/iio/adc/ad7476.c          | 4 ++--
 drivers/iio/adc/ad7606.c          | 4 ++--
 drivers/iio/adc/ad7768-1.c        | 5 +++--
 drivers/iio/adc/ad7779.c          | 3 ++-
 drivers/iio/adc/ad7923.c          | 4 ++--
 drivers/iio/adc/dln2-adc.c        | 4 ++--
 drivers/iio/adc/ina2xx-adc.c      | 3 ++-
 drivers/iio/adc/max1118.c         | 2 +-
 drivers/iio/adc/max11410.c        | 4 ++--
 drivers/iio/adc/max1363.c         | 4 ++--
 drivers/iio/adc/mcp3911.c         | 4 ++--
 drivers/iio/adc/mxs-lradc-adc.c   | 3 ++-
 drivers/iio/adc/pac1921.c         | 3 ++-
 drivers/iio/adc/rockchip_saradc.c | 3 ++-
 drivers/iio/adc/rtq6056.c         | 3 ++-
 drivers/iio/adc/stm32-adc.c       | 4 ++--
 drivers/iio/adc/ti-adc081c.c      | 4 ++--
 drivers/iio/adc/ti-adc0832.c      | 4 ++--
 drivers/iio/adc/ti-adc084s021.c   | 4 ++--
 drivers/iio/adc/ti-adc12138.c     | 4 ++--
 drivers/iio/adc/ti-ads1015.c      | 4 ++--
 drivers/iio/adc/ti-ads1119.c      | 4 ++--
 drivers/iio/adc/ti-ads124s08.c    | 4 ++--
 drivers/iio/adc/ti-ads8688.c      | 4 ++--
 drivers/iio/adc/ti-lmp92064.c     | 4 ++--
 drivers/iio/adc/ti-tlc4541.c      | 4 ++--
 drivers/iio/adc/ti-tsc2046.c      | 5 +++--
 drivers/iio/adc/vf610_adc.c       | 7 ++++---
 34 files changed, 75 insertions(+), 60 deletions(-)

diff --git a/drivers/iio/adc/ad4000.c b/drivers/iio/adc/ad4000.c
index 4fe8dee48da9..08ceaaafef50 100644
--- a/drivers/iio/adc/ad4000.c
+++ b/drivers/iio/adc/ad4000.c
@@ -645,7 +645,8 @@ static irqreturn_t ad4000_trigger_handler(int irq, void *p)
 	if (ret < 0)
 		goto err_out;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &st->scan, pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, &st->scan, sizeof(st->scan),
+				    pf->timestamp);
 
 err_out:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/adc/ad4030.c b/drivers/iio/adc/ad4030.c
index 9a020680885d..77c5dd414d36 100644
--- a/drivers/iio/adc/ad4030.c
+++ b/drivers/iio/adc/ad4030.c
@@ -706,8 +706,9 @@ static irqreturn_t ad4030_trigger_handler(int irq, void *p)
 	if (ret)
 		goto out;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, st->rx_data.raw,
-					   pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, st->rx_data.raw,
+				    sizeof(st->rx_data.raw),
+				    pf->timestamp);
 
 out:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/adc/ad4695.c b/drivers/iio/adc/ad4695.c
index 8222c8ab2940..68c6625db0d7 100644
--- a/drivers/iio/adc/ad4695.c
+++ b/drivers/iio/adc/ad4695.c
@@ -801,7 +801,8 @@ static irqreturn_t ad4695_trigger_handler(int irq, void *p)
 	if (ret)
 		goto out;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, st->buf, pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, st->buf, sizeof(st->buf),
+				    pf->timestamp);
 
 out:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/adc/ad7266.c b/drivers/iio/adc/ad7266.c
index 18559757f908..4217d3963455 100644
--- a/drivers/iio/adc/ad7266.c
+++ b/drivers/iio/adc/ad7266.c
@@ -87,8 +87,9 @@ static irqreturn_t ad7266_trigger_handler(int irq, void *p)
 
 	ret = spi_read(st->spi, st->data.sample, 4);
 	if (ret == 0) {
-		iio_push_to_buffers_with_timestamp(indio_dev, &st->data,
-			    pf->timestamp);
+		iio_push_to_buffers_with_ts(indio_dev, &st->data,
+					    sizeof(st->data),
+					    pf->timestamp);
 	}
 
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/adc/ad7298.c b/drivers/iio/adc/ad7298.c
index 28b88092b4aa..def5f91dc343 100644
--- a/drivers/iio/adc/ad7298.c
+++ b/drivers/iio/adc/ad7298.c
@@ -155,8 +155,9 @@ static irqreturn_t ad7298_trigger_handler(int irq, void *p)
 	if (b_sent)
 		goto done;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, st->rx_buf,
-		iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, st->rx_buf,
+				    sizeof(st->rx_buf),
+				    iio_get_time_ns(indio_dev));
 
 done:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/adc/ad7380.c b/drivers/iio/adc/ad7380.c
index 407930f1f5dd..80856d1a4d96 100644
--- a/drivers/iio/adc/ad7380.c
+++ b/drivers/iio/adc/ad7380.c
@@ -962,8 +962,9 @@ static irqreturn_t ad7380_trigger_handler(int irq, void *p)
 	if (ret)
 		goto out;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &st->scan_data,
-					   pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, &st->scan_data,
+				    sizeof(st->scan_data),
+				    pf->timestamp);
 
 out:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/adc/ad7476.c b/drivers/iio/adc/ad7476.c
index 37b0515cf4fc..ddb607ac1860 100644
--- a/drivers/iio/adc/ad7476.c
+++ b/drivers/iio/adc/ad7476.c
@@ -99,8 +99,8 @@ static irqreturn_t ad7476_trigger_handler(int irq, void  *p)
 	if (b_sent < 0)
 		goto done;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, st->data,
-		iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, st->data, sizeof(st->data),
+				    iio_get_time_ns(indio_dev));
 done:
 	iio_trigger_notify_done(indio_dev->trig);
 
diff --git a/drivers/iio/adc/ad7606.c b/drivers/iio/adc/ad7606.c
index 631e83717167..3ffa11b2e060 100644
--- a/drivers/iio/adc/ad7606.c
+++ b/drivers/iio/adc/ad7606.c
@@ -679,8 +679,8 @@ static irqreturn_t ad7606_trigger_handler(int irq, void *p)
 	if (ret)
 		goto error_ret;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &st->data,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &st->data, sizeof(st->data),
+				    iio_get_time_ns(indio_dev));
 error_ret:
 	iio_trigger_notify_done(indio_dev->trig);
 	/* The rising edge of the CONVST signal starts a new conversion. */
diff --git a/drivers/iio/adc/ad7768-1.c b/drivers/iio/adc/ad7768-1.c
index 5a863005aca6..4eb586d473ce 100644
--- a/drivers/iio/adc/ad7768-1.c
+++ b/drivers/iio/adc/ad7768-1.c
@@ -474,8 +474,9 @@ static irqreturn_t ad7768_trigger_handler(int irq, void *p)
 	if (ret < 0)
 		goto out;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &st->data.scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &st->data.scan,
+				    sizeof(st->data.scan),
+				    iio_get_time_ns(indio_dev));
 
 out:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/adc/ad7779.c b/drivers/iio/adc/ad7779.c
index a5d87faa5e12..845adc510239 100644
--- a/drivers/iio/adc/ad7779.c
+++ b/drivers/iio/adc/ad7779.c
@@ -595,7 +595,8 @@ static irqreturn_t ad7779_trigger_handler(int irq, void *p)
 		goto exit_handler;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &st->data, pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, &st->data, sizeof(st->data),
+				    pf->timestamp);
 
 exit_handler:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/adc/ad7923.c b/drivers/iio/adc/ad7923.c
index 87945efb940b..0369151c7db1 100644
--- a/drivers/iio/adc/ad7923.c
+++ b/drivers/iio/adc/ad7923.c
@@ -207,8 +207,8 @@ static irqreturn_t ad7923_trigger_handler(int irq, void *p)
 	if (b_sent)
 		goto done;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, st->rx_buf,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, st->rx_buf, sizeof(st->rx_buf),
+				    iio_get_time_ns(indio_dev));
 
 done:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/adc/dln2-adc.c b/drivers/iio/adc/dln2-adc.c
index a1e48a756a7b..5ffb4b5f5c99 100644
--- a/drivers/iio/adc/dln2-adc.c
+++ b/drivers/iio/adc/dln2-adc.c
@@ -488,8 +488,8 @@ static irqreturn_t dln2_adc_trigger_h(int irq, void *p)
 		       (void *)dev_data.values + t->from, t->length);
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &data, sizeof(data),
+				    iio_get_time_ns(indio_dev));
 
 done:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/adc/ina2xx-adc.c b/drivers/iio/adc/ina2xx-adc.c
index 40d14faa71c5..9a1a7749624b 100644
--- a/drivers/iio/adc/ina2xx-adc.c
+++ b/drivers/iio/adc/ina2xx-adc.c
@@ -766,7 +766,8 @@ static int ina2xx_work_buffer(struct iio_dev *indio_dev)
 		chip->scan.chan[i++] = val;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &chip->scan, time);
+	iio_push_to_buffers_with_ts(indio_dev, &chip->scan, sizeof(chip->scan),
+				    time);
 
 	return 0;
 };
diff --git a/drivers/iio/adc/max1118.c b/drivers/iio/adc/max1118.c
index 565ca2e21c0c..e140fa30a385 100644
--- a/drivers/iio/adc/max1118.c
+++ b/drivers/iio/adc/max1118.c
@@ -188,7 +188,7 @@ static irqreturn_t max1118_trigger_handler(int irq, void *p)
 		adc->scan.channels[i] = ret;
 		i++;
 	}
-	iio_push_to_buffers_with_timestamp(indio_dev, &adc->scan,
+	iio_push_to_buffers_with_ts(indio_dev, &adc->scan, sizeof(adc->scan),
 					   iio_get_time_ns(indio_dev));
 out:
 	mutex_unlock(&adc->lock);
diff --git a/drivers/iio/adc/max11410.c b/drivers/iio/adc/max11410.c
index 437d9f24b5a1..511b2f14dfaf 100644
--- a/drivers/iio/adc/max11410.c
+++ b/drivers/iio/adc/max11410.c
@@ -632,8 +632,8 @@ static irqreturn_t max11410_trigger_handler(int irq, void *p)
 		goto out;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &st->scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &st->scan, sizeof(st->scan),
+				    iio_get_time_ns(indio_dev));
 
 out:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/adc/max1363.c b/drivers/iio/adc/max1363.c
index 35717ec082ce..928c9ab04a4d 100644
--- a/drivers/iio/adc/max1363.c
+++ b/drivers/iio/adc/max1363.c
@@ -1498,8 +1498,8 @@ static irqreturn_t max1363_trigger_handler(int irq, void *p)
 	if (b_sent < 0)
 		goto done;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &st->data,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &st->data, sizeof(st->data),
+				    iio_get_time_ns(indio_dev));
 
 done:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/adc/mcp3911.c b/drivers/iio/adc/mcp3911.c
index 6748b44d568d..be18635ae616 100644
--- a/drivers/iio/adc/mcp3911.c
+++ b/drivers/iio/adc/mcp3911.c
@@ -516,8 +516,8 @@ static irqreturn_t mcp3911_trigger_handler(int irq, void *p)
 		adc->scan.channels[i] = get_unaligned_be24(&adc->rx_buf[scan_chan->channel * 3]);
 		i++;
 	}
-	iio_push_to_buffers_with_timestamp(indio_dev, &adc->scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &adc->scan, sizeof(adc->scan),
+				    iio_get_time_ns(indio_dev));
 out:
 	iio_trigger_notify_done(indio_dev->trig);
 
diff --git a/drivers/iio/adc/mxs-lradc-adc.c b/drivers/iio/adc/mxs-lradc-adc.c
index 8f1e6acea53b..92baf3f5f560 100644
--- a/drivers/iio/adc/mxs-lradc-adc.c
+++ b/drivers/iio/adc/mxs-lradc-adc.c
@@ -425,7 +425,8 @@ static irqreturn_t mxs_lradc_adc_trigger_handler(int irq, void *p)
 		j++;
 	}
 
-	iio_push_to_buffers_with_timestamp(iio, adc->buffer, pf->timestamp);
+	iio_push_to_buffers_with_ts(iio, adc->buffer, sizeof(adc->buffer),
+				    pf->timestamp);
 
 	iio_trigger_notify_done(iio->trig);
 
diff --git a/drivers/iio/adc/pac1921.c b/drivers/iio/adc/pac1921.c
index 1c28df132e9f..7c0787741e45 100644
--- a/drivers/iio/adc/pac1921.c
+++ b/drivers/iio/adc/pac1921.c
@@ -1044,7 +1044,8 @@ static irqreturn_t pac1921_trigger_handler(int irq, void *p)
 		priv->scan.chan[ch++] = val;
 	}
 
-	iio_push_to_buffers_with_timestamp(idev, &priv->scan, pf->timestamp);
+	iio_push_to_buffers_with_ts(idev, &priv->scan, sizeof(priv->scan),
+				    pf->timestamp);
 
 done:
 	iio_trigger_notify_done(idev->trig);
diff --git a/drivers/iio/adc/rockchip_saradc.c b/drivers/iio/adc/rockchip_saradc.c
index 9a099df79518..2162bff69913 100644
--- a/drivers/iio/adc/rockchip_saradc.c
+++ b/drivers/iio/adc/rockchip_saradc.c
@@ -425,7 +425,8 @@ static irqreturn_t rockchip_saradc_trigger_handler(int irq, void *p)
 		j++;
 	}
 
-	iio_push_to_buffers_with_timestamp(i_dev, &data, iio_get_time_ns(i_dev));
+	iio_push_to_buffers_with_ts(i_dev, &data, sizeof(data),
+				    iio_get_time_ns(i_dev));
 out:
 	mutex_unlock(&info->lock);
 
diff --git a/drivers/iio/adc/rtq6056.c b/drivers/iio/adc/rtq6056.c
index 54239df61d86..6ff47415a222 100644
--- a/drivers/iio/adc/rtq6056.c
+++ b/drivers/iio/adc/rtq6056.c
@@ -666,7 +666,8 @@ static irqreturn_t rtq6056_buffer_trigger_handler(int irq, void *p)
 		data.vals[i++] = raw;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data, iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &data, sizeof(data),
+				    iio_get_time_ns(indio_dev));
 
 out:
 	pm_runtime_mark_last_busy(dev);
diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
index 5dbf5f136768..32e7938b3892 100644
--- a/drivers/iio/adc/stm32-adc.c
+++ b/drivers/iio/adc/stm32-adc.c
@@ -1858,8 +1858,8 @@ static irqreturn_t stm32_adc_trigger_handler(int irq, void *p)
 
 	/* reset buffer index */
 	adc->bufi = 0;
-	iio_push_to_buffers_with_timestamp(indio_dev, adc->buffer,
-					   pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, adc->buffer, sizeof(adc->buffer),
+				    pf->timestamp);
 	iio_trigger_notify_done(indio_dev->trig);
 
 	/* re-enable eoc irq */
diff --git a/drivers/iio/adc/ti-adc081c.c b/drivers/iio/adc/ti-adc081c.c
index 1af9be071d8d..4f514db5c26e 100644
--- a/drivers/iio/adc/ti-adc081c.c
+++ b/drivers/iio/adc/ti-adc081c.c
@@ -140,8 +140,8 @@ static irqreturn_t adc081c_trigger_handler(int irq, void *p)
 	if (ret < 0)
 		goto out;
 	data->scan.channel = ret;
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &data->scan, sizeof(data->scan),
+				    iio_get_time_ns(indio_dev));
 out:
 	iio_trigger_notify_done(indio_dev->trig);
 	return IRQ_HANDLED;
diff --git a/drivers/iio/adc/ti-adc0832.c b/drivers/iio/adc/ti-adc0832.c
index e2dbd070c7c4..cfcdafbe284b 100644
--- a/drivers/iio/adc/ti-adc0832.c
+++ b/drivers/iio/adc/ti-adc0832.c
@@ -225,8 +225,8 @@ static irqreturn_t adc0832_trigger_handler(int irq, void *p)
 		adc->data[i] = ret;
 		i++;
 	}
-	iio_push_to_buffers_with_timestamp(indio_dev, adc->data,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, adc->data, sizeof(adc->data),
+				    iio_get_time_ns(indio_dev));
 out:
 	mutex_unlock(&adc->lock);
 
diff --git a/drivers/iio/adc/ti-adc084s021.c b/drivers/iio/adc/ti-adc084s021.c
index 9c845ee01697..50a474f4d9f5 100644
--- a/drivers/iio/adc/ti-adc084s021.c
+++ b/drivers/iio/adc/ti-adc084s021.c
@@ -151,8 +151,8 @@ static irqreturn_t adc084s021_buffer_trigger_handler(int irq, void *pollfunc)
 	if (adc084s021_adc_conversion(adc, adc->scan.channels) < 0)
 		dev_err(&adc->spi->dev, "Failed to read data\n");
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &adc->scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &adc->scan, sizeof(adc->scan),
+				    iio_get_time_ns(indio_dev));
 	mutex_unlock(&adc->lock);
 	iio_trigger_notify_done(indio_dev->trig);
 
diff --git a/drivers/iio/adc/ti-adc12138.c b/drivers/iio/adc/ti-adc12138.c
index 7f065f457b36..9dc465a10ffc 100644
--- a/drivers/iio/adc/ti-adc12138.c
+++ b/drivers/iio/adc/ti-adc12138.c
@@ -376,8 +376,8 @@ static irqreturn_t adc12138_trigger_handler(int irq, void *p)
 		}
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, adc->data,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, adc->data, sizeof(adc->data),
+				    iio_get_time_ns(indio_dev));
 out:
 	mutex_unlock(&adc->lock);
 
diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c
index 729977b611ec..2193379c4232 100644
--- a/drivers/iio/adc/ti-ads1015.c
+++ b/drivers/iio/adc/ti-ads1015.c
@@ -467,8 +467,8 @@ static irqreturn_t ads1015_trigger_handler(int irq, void *p)
 	scan.chan = res;
 	mutex_unlock(&data->lock);
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &scan, sizeof(scan),
+				    iio_get_time_ns(indio_dev));
 
 err:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/adc/ti-ads1119.c b/drivers/iio/adc/ti-ads1119.c
index f120e7e21cff..d280c949cf47 100644
--- a/drivers/iio/adc/ti-ads1119.c
+++ b/drivers/iio/adc/ti-ads1119.c
@@ -534,8 +534,8 @@ static irqreturn_t ads1119_trigger_handler(int irq, void *private)
 
 	scan.sample = ret;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &scan, sizeof(scan),
+				    iio_get_time_ns(indio_dev));
 done:
 	iio_trigger_notify_done(indio_dev->trig);
 	return IRQ_HANDLED;
diff --git a/drivers/iio/adc/ti-ads124s08.c b/drivers/iio/adc/ti-ads124s08.c
index 77c299bb4ebc..d068b6e71be4 100644
--- a/drivers/iio/adc/ti-ads124s08.c
+++ b/drivers/iio/adc/ti-ads124s08.c
@@ -297,8 +297,8 @@ static irqreturn_t ads124s_trigger_handler(int irq, void *p)
 		j++;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, priv->buffer,
-			pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, priv->buffer,
+				    sizeof(priv->buffer), pf->timestamp);
 
 	iio_trigger_notify_done(indio_dev->trig);
 
diff --git a/drivers/iio/adc/ti-ads8688.c b/drivers/iio/adc/ti-ads8688.c
index a31658b760a4..b0bf46cae0b6 100644
--- a/drivers/iio/adc/ti-ads8688.c
+++ b/drivers/iio/adc/ti-ads8688.c
@@ -389,8 +389,8 @@ static irqreturn_t ads8688_trigger_handler(int irq, void *p)
 		j++;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, buffer,
-			iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, buffer, sizeof(buffer),
+				    iio_get_time_ns(indio_dev));
 
 	iio_trigger_notify_done(indio_dev->trig);
 
diff --git a/drivers/iio/adc/ti-lmp92064.c b/drivers/iio/adc/ti-lmp92064.c
index 1e4a78677fe5..1fc2fe91a206 100644
--- a/drivers/iio/adc/ti-lmp92064.c
+++ b/drivers/iio/adc/ti-lmp92064.c
@@ -209,8 +209,8 @@ static irqreturn_t lmp92064_trigger_handler(int irq, void *p)
 	if (ret)
 		goto err;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &data, sizeof(data),
+				    iio_get_time_ns(indio_dev));
 
 err:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/adc/ti-tlc4541.c b/drivers/iio/adc/ti-tlc4541.c
index 5a138be983ed..f67945c62c99 100644
--- a/drivers/iio/adc/ti-tlc4541.c
+++ b/drivers/iio/adc/ti-tlc4541.c
@@ -99,8 +99,8 @@ static irqreturn_t tlc4541_trigger_handler(int irq, void *p)
 	if (ret < 0)
 		goto done;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, st->rx_buf,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, st->rx_buf, sizeof(st->rx_buf),
+				    iio_get_time_ns(indio_dev));
 
 done:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/adc/ti-tsc2046.c b/drivers/iio/adc/ti-tsc2046.c
index 7dde5713973f..1a3dd2b628a2 100644
--- a/drivers/iio/adc/ti-tsc2046.c
+++ b/drivers/iio/adc/ti-tsc2046.c
@@ -418,8 +418,9 @@ static int tsc2046_adc_scan(struct iio_dev *indio_dev)
 	for (group = 0; group < priv->groups; group++)
 		priv->scan_buf.data[group] = tsc2046_adc_get_val(priv, group);
 
-	ret = iio_push_to_buffers_with_timestamp(indio_dev, &priv->scan_buf,
-						 iio_get_time_ns(indio_dev));
+	ret = iio_push_to_buffers_with_ts(indio_dev, &priv->scan_buf,
+					  sizeof(priv->scan_buf),
+					  iio_get_time_ns(indio_dev));
 	/* If the consumer is kfifo, we may get a EBUSY here - ignore it. */
 	if (ret < 0 && ret != -EBUSY) {
 		dev_err_ratelimited(dev, "Failed to push scan buffer %pe\n",
diff --git a/drivers/iio/adc/vf610_adc.c b/drivers/iio/adc/vf610_adc.c
index f506ca4150b1..a67da9dd1811 100644
--- a/drivers/iio/adc/vf610_adc.c
+++ b/drivers/iio/adc/vf610_adc.c
@@ -592,9 +592,10 @@ static irqreturn_t vf610_adc_isr(int irq, void *dev_id)
 		info->value = vf610_adc_read_data(info);
 		if (iio_buffer_enabled(indio_dev)) {
 			info->scan.chan = info->value;
-			iio_push_to_buffers_with_timestamp(indio_dev,
-					&info->scan,
-					iio_get_time_ns(indio_dev));
+			iio_push_to_buffers_with_ts(indio_dev,
+						    &info->scan,
+						    sizeof(info->scan),
+						    iio_get_time_ns(indio_dev));
 			iio_trigger_notify_done(indio_dev->trig);
 		} else
 			complete(&info->completion);
-- 
2.48.1

[PATCH 06/16] iio: accel: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.

[Jonathan Cameron]

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

This new function allows us to perform debug checks in the helper to ensure
that the overrun does not occur.  Use it in all the simple cases where
either a static buffer or a structure is used in the drivers.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
 drivers/iio/accel/adxl355_core.c    | 4 ++--
 drivers/iio/accel/bma180.c          | 3 ++-
 drivers/iio/accel/bma220_spi.c      | 4 ++--
 drivers/iio/accel/bma400_core.c     | 5 +++--
 drivers/iio/accel/fxls8962af-core.c | 4 ++--
 drivers/iio/accel/kxcjk-1013.c      | 4 ++--
 drivers/iio/accel/kxsd9.c           | 5 ++---
 drivers/iio/accel/mma7455_core.c    | 5 +++--
 drivers/iio/accel/mma8452.c         | 5 +++--
 drivers/iio/accel/msa311.c          | 4 ++--
 drivers/iio/accel/mxc4005.c         | 4 ++--
 drivers/iio/accel/sca3300.c         | 5 +++--
 drivers/iio/accel/stk8312.c         | 2 +-
 drivers/iio/accel/stk8ba50.c        | 4 ++--
 14 files changed, 31 insertions(+), 27 deletions(-)

diff --git a/drivers/iio/accel/adxl355_core.c b/drivers/iio/accel/adxl355_core.c
index e8cd21fa77a6..ae949ada6db5 100644
--- a/drivers/iio/accel/adxl355_core.c
+++ b/drivers/iio/accel/adxl355_core.c
@@ -666,8 +666,8 @@ static irqreturn_t adxl355_trigger_handler(int irq, void *p)
 	if (ret)
 		goto out_unlock_notify;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->buffer,
-					   pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, &data->buffer,
+				    sizeof(data->buffer), pf->timestamp);
 
 out_unlock_notify:
 	mutex_unlock(&data->lock);
diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c
index aa664a923f91..a3af0026f679 100644
--- a/drivers/iio/accel/bma180.c
+++ b/drivers/iio/accel/bma180.c
@@ -887,7 +887,8 @@ static irqreturn_t bma180_trigger_handler(int irq, void *p)
 
 	mutex_unlock(&data->mutex);
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, time_ns);
+	iio_push_to_buffers_with_ts(indio_dev, &data->scan,
+				    sizeof(data->scan), time_ns);
 err:
 	iio_trigger_notify_done(indio_dev->trig);
 
diff --git a/drivers/iio/accel/bma220_spi.c b/drivers/iio/accel/bma220_spi.c
index 96ba028157ee..2d27a592a61e 100644
--- a/drivers/iio/accel/bma220_spi.c
+++ b/drivers/iio/accel/bma220_spi.c
@@ -103,8 +103,8 @@ static irqreturn_t bma220_trigger_handler(int irq, void *p)
 	if (ret < 0)
 		goto err;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
-					   pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, &data->scan, sizeof(data->scan),
+				    pf->timestamp);
 err:
 	mutex_unlock(&data->lock);
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/accel/bma400_core.c b/drivers/iio/accel/bma400_core.c
index 23f5e1ce9cc4..85e23badf733 100644
--- a/drivers/iio/accel/bma400_core.c
+++ b/drivers/iio/accel/bma400_core.c
@@ -1591,8 +1591,9 @@ static irqreturn_t bma400_trigger_handler(int irq, void *p)
 		data->buffer.temperature = temp;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->buffer,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &data->buffer,
+				    sizeof(data->buffer),
+				    iio_get_time_ns(indio_dev));
 
 	mutex_unlock(&data->mutex);
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/accel/fxls8962af-core.c b/drivers/iio/accel/fxls8962af-core.c
index 48e4282964a0..6d23da3e7aa2 100644
--- a/drivers/iio/accel/fxls8962af-core.c
+++ b/drivers/iio/accel/fxls8962af-core.c
@@ -983,8 +983,8 @@ static int fxls8962af_fifo_flush(struct iio_dev *indio_dev)
 			       sizeof(data->scan.channels[0]));
 		}
 
-		iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
-						   tstamp);
+		iio_push_to_buffers_with_ts(indio_dev, &data->scan,
+					    sizeof(data->scan), tstamp);
 
 		tstamp += sample_period;
 	}
diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
index f2496cad8ec2..971b76c98606 100644
--- a/drivers/iio/accel/kxcjk-1013.c
+++ b/drivers/iio/accel/kxcjk-1013.c
@@ -1253,8 +1253,8 @@ static irqreturn_t kxcjk1013_trigger_handler(int irq, void *p)
 	if (ret < 0)
 		goto err;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
-					   data->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, &data->scan, sizeof(data->scan),
+				    data->timestamp);
 err:
 	iio_trigger_notify_done(indio_dev->trig);
 
diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
index 0ededf8cfdca..558a79b48967 100644
--- a/drivers/iio/accel/kxsd9.c
+++ b/drivers/iio/accel/kxsd9.c
@@ -229,9 +229,8 @@ static irqreturn_t kxsd9_trigger_handler(int irq, void *p)
 		goto out;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev,
-					   &hw_values,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &hw_values, sizeof(hw_values),
+				    iio_get_time_ns(indio_dev));
 out:
 	iio_trigger_notify_done(indio_dev->trig);
 
diff --git a/drivers/iio/accel/mma7455_core.c b/drivers/iio/accel/mma7455_core.c
index 30746621052c..a2b5bdf14dde 100644
--- a/drivers/iio/accel/mma7455_core.c
+++ b/drivers/iio/accel/mma7455_core.c
@@ -103,8 +103,9 @@ static irqreturn_t mma7455_trigger_handler(int irq, void *p)
 	if (ret)
 		goto done;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &mma7455->scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &mma7455->scan,
+				    sizeof(mma7455->scan),
+				    iio_get_time_ns(indio_dev));
 
 done:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
index 05f5482f366e..aba444a980d9 100644
--- a/drivers/iio/accel/mma8452.c
+++ b/drivers/iio/accel/mma8452.c
@@ -1103,8 +1103,9 @@ static irqreturn_t mma8452_trigger_handler(int irq, void *p)
 	if (ret < 0)
 		goto done;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->buffer,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &data->buffer,
+				    sizeof(data->buffer),
+				    iio_get_time_ns(indio_dev));
 
 done:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/accel/msa311.c b/drivers/iio/accel/msa311.c
index d31c11fbbe68..c31c53abc3d0 100644
--- a/drivers/iio/accel/msa311.c
+++ b/drivers/iio/accel/msa311.c
@@ -919,8 +919,8 @@ static irqreturn_t msa311_buffer_thread(int irq, void *p)
 
 	mutex_unlock(&msa311->lock);
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &buf,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &buf, sizeof(buf),
+				    iio_get_time_ns(indio_dev));
 
 notify_done:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/accel/mxc4005.c b/drivers/iio/accel/mxc4005.c
index cb5c4e354fc0..e97026a18046 100644
--- a/drivers/iio/accel/mxc4005.c
+++ b/drivers/iio/accel/mxc4005.c
@@ -335,8 +335,8 @@ static irqreturn_t mxc4005_trigger_handler(int irq, void *private)
 	if (ret < 0)
 		goto err;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
-					   pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, &data->scan, sizeof(data->scan),
+				    pf->timestamp);
 
 err:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/accel/sca3300.c b/drivers/iio/accel/sca3300.c
index ca0ce83e42b2..b5f3e2175248 100644
--- a/drivers/iio/accel/sca3300.c
+++ b/drivers/iio/accel/sca3300.c
@@ -505,8 +505,9 @@ static irqreturn_t sca3300_trigger_handler(int irq, void *p)
 		channels[i++] = val;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, data->buffer,
+				    sizeof(data->buffer),
+				    iio_get_time_ns(indio_dev));
 out:
 	iio_trigger_notify_done(indio_dev->trig);
 
diff --git a/drivers/iio/accel/stk8312.c b/drivers/iio/accel/stk8312.c
index 471c154c3631..139234da82d4 100644
--- a/drivers/iio/accel/stk8312.c
+++ b/drivers/iio/accel/stk8312.c
@@ -460,7 +460,7 @@ static irqreturn_t stk8312_trigger_handler(int irq, void *p)
 	}
 	mutex_unlock(&data->lock);
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
+	iio_push_to_buffers_with_ts(indio_dev, &data->scan, sizeof(data->scan),
 					   pf->timestamp);
 err:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/accel/stk8ba50.c b/drivers/iio/accel/stk8ba50.c
index cab592a68622..a96324ef9869 100644
--- a/drivers/iio/accel/stk8ba50.c
+++ b/drivers/iio/accel/stk8ba50.c
@@ -340,8 +340,8 @@ static irqreturn_t stk8ba50_trigger_handler(int irq, void *p)
 			data->scan.chans[i++] = ret;
 		}
 	}
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
-					   pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, &data->scan, sizeof(data->scan),
+				    pf->timestamp);
 err:
 	mutex_unlock(&data->lock);
 	iio_trigger_notify_done(indio_dev->trig);
-- 
2.48.1

[PATCH 07/16] iio: accel: hid: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.

[Jonathan Cameron]

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

This new function allows us to perform debug checks in the helper to ensure
that the overrun does not occur. For this case, the length being provided
is already passed into the caller function so reuse that.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
 drivers/iio/accel/hid-sensor-accel-3d.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c
index 078fab2abb68..fe3ef3592e91 100644
--- a/drivers/iio/accel/hid-sensor-accel-3d.c
+++ b/drivers/iio/accel/hid-sensor-accel-3d.c
@@ -228,7 +228,7 @@ static void hid_sensor_push_data(struct iio_dev *indio_dev, void *data,
 				 int len, int64_t timestamp)
 {
 	dev_dbg(&indio_dev->dev, "hid_sensor_push_data\n");
-	iio_push_to_buffers_with_timestamp(indio_dev, data, timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, data, len, timestamp);
 }
 
 /* Callback handler to send event after all samples are received and captured */
-- 
2.48.1

[PATCH 08/16] iio: chemical: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.

[Jonathan Cameron]

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

This new function allows us to perform debug checks in the helper to ensure
that the overrun does not occur.  Use it in all the simple cases where
either a static buffer or a structure is used in the drivers.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
 drivers/iio/chemical/atlas-sensor.c | 5 +++--
 drivers/iio/chemical/bme680_core.c  | 4 ++--
 drivers/iio/chemical/ccs811.c       | 4 ++--
 drivers/iio/chemical/ens160_core.c  | 4 ++--
 drivers/iio/chemical/pms7003.c      | 5 +++--
 drivers/iio/chemical/scd30_core.c   | 3 ++-
 drivers/iio/chemical/scd4x.c        | 3 ++-
 drivers/iio/chemical/sps30.c        | 4 ++--
 8 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/drivers/iio/chemical/atlas-sensor.c b/drivers/iio/chemical/atlas-sensor.c
index 593b73ccbeb7..39181bb3e953 100644
--- a/drivers/iio/chemical/atlas-sensor.c
+++ b/drivers/iio/chemical/atlas-sensor.c
@@ -458,8 +458,9 @@ static irqreturn_t atlas_trigger_handler(int irq, void *private)
 			      &data->buffer, sizeof(__be32) * channels);
 
 	if (!ret)
-		iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
-				iio_get_time_ns(indio_dev));
+		iio_push_to_buffers_with_ts(indio_dev, data->buffer,
+					    sizeof(data->buffer),
+					    iio_get_time_ns(indio_dev));
 
 	iio_trigger_notify_done(indio_dev->trig);
 
diff --git a/drivers/iio/chemical/bme680_core.c b/drivers/iio/chemical/bme680_core.c
index 9d73fd2cf52c..3e850562ab00 100644
--- a/drivers/iio/chemical/bme680_core.c
+++ b/drivers/iio/chemical/bme680_core.c
@@ -1120,8 +1120,8 @@ static irqreturn_t bme680_trigger_handler(int irq, void *p)
 	gas_range = FIELD_GET(BME680_GAS_RANGE_MASK, gas_regs_val);
 	data->scan.chan[3] = bme680_compensate_gas(data, adc_gas_res, gas_range);
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &data->scan, sizeof(data->scan),
+				    iio_get_time_ns(indio_dev));
 out:
 	iio_trigger_notify_done(indio_dev->trig);
 	return IRQ_HANDLED;
diff --git a/drivers/iio/chemical/ccs811.c b/drivers/iio/chemical/ccs811.c
index 1eab256a1e00..998c9239c4c7 100644
--- a/drivers/iio/chemical/ccs811.c
+++ b/drivers/iio/chemical/ccs811.c
@@ -343,8 +343,8 @@ static irqreturn_t ccs811_trigger_handler(int irq, void *p)
 		goto err;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &data->scan, sizeof(data->scan),
+				    iio_get_time_ns(indio_dev));
 
 err:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/chemical/ens160_core.c b/drivers/iio/chemical/ens160_core.c
index 152f81ff57e3..6cec60074827 100644
--- a/drivers/iio/chemical/ens160_core.c
+++ b/drivers/iio/chemical/ens160_core.c
@@ -267,8 +267,8 @@ static irqreturn_t ens160_trigger_handler(int irq, void *p)
 	if (ret)
 		goto err;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
-					   pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, &data->scan, sizeof(data->scan),
+				    pf->timestamp);
 err:
 	iio_trigger_notify_done(indio_dev->trig);
 
diff --git a/drivers/iio/chemical/pms7003.c b/drivers/iio/chemical/pms7003.c
index d0bd94912e0a..d268d05cdec9 100644
--- a/drivers/iio/chemical/pms7003.c
+++ b/drivers/iio/chemical/pms7003.c
@@ -126,8 +126,9 @@ static irqreturn_t pms7003_trigger_handler(int irq, void *p)
 		pms7003_get_pm(frame->data + PMS7003_PM10_OFFSET);
 	mutex_unlock(&state->lock);
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &state->scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &state->scan,
+				    sizeof(state->scan),
+				    iio_get_time_ns(indio_dev));
 err:
 	iio_trigger_notify_done(indio_dev->trig);
 
diff --git a/drivers/iio/chemical/scd30_core.c b/drivers/iio/chemical/scd30_core.c
index 3fed6b63710f..8316720b1fa3 100644
--- a/drivers/iio/chemical/scd30_core.c
+++ b/drivers/iio/chemical/scd30_core.c
@@ -601,7 +601,8 @@ static irqreturn_t scd30_trigger_handler(int irq, void *p)
 	if (ret)
 		goto out;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &scan, iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &scan, sizeof(scan),
+				    iio_get_time_ns(indio_dev));
 out:
 	iio_trigger_notify_done(indio_dev->trig);
 	return IRQ_HANDLED;
diff --git a/drivers/iio/chemical/scd4x.c b/drivers/iio/chemical/scd4x.c
index 4877bd3e907b..2463149519b6 100644
--- a/drivers/iio/chemical/scd4x.c
+++ b/drivers/iio/chemical/scd4x.c
@@ -675,7 +675,8 @@ static irqreturn_t scd4x_trigger_handler(int irq, void *p)
 	if (ret)
 		goto out;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &scan, iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &scan, sizeof(scan),
+				    iio_get_time_ns(indio_dev));
 out:
 	iio_trigger_notify_done(indio_dev->trig);
 	return IRQ_HANDLED;
diff --git a/drivers/iio/chemical/sps30.c b/drivers/iio/chemical/sps30.c
index 6f4f2ba2c09d..2554ef74e141 100644
--- a/drivers/iio/chemical/sps30.c
+++ b/drivers/iio/chemical/sps30.c
@@ -117,8 +117,8 @@ static irqreturn_t sps30_trigger_handler(int irq, void *p)
 	if (ret)
 		goto err;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &scan, sizeof(scan),
+				    iio_get_time_ns(indio_dev));
 err:
 	iio_trigger_notify_done(indio_dev->trig);
 
-- 
2.48.1

[PATCH 09/16] iio: temp: maxim-thermocouple: Fix potential lack of DMA safe buffer.

[Jonathan Cameron]

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

The trick of using __aligned(IIO_DMA_MINALIGN) ensures that there is
no overlap between buffers used for DMA and those used for driver
state storage that are before the marking. It doesn't ensure
anything above state variables found after the marking. Hence
move this particular bit of state earlier in the structure.

Fixes: 10897f34309b ("iio: temp: maxim_thermocouple: Fix alignment for DMA safety")
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
 drivers/iio/temperature/maxim_thermocouple.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/temperature/maxim_thermocouple.c b/drivers/iio/temperature/maxim_thermocouple.c
index a13efde76397..db2149d5f78c 100644
--- a/drivers/iio/temperature/maxim_thermocouple.c
+++ b/drivers/iio/temperature/maxim_thermocouple.c
@@ -120,9 +120,9 @@ static const struct maxim_thermocouple_chip maxim_thermocouple_chips[] = {
 struct maxim_thermocouple_data {
 	struct spi_device *spi;
 	const struct maxim_thermocouple_chip *chip;
+	char tc_type;
 
 	u8 buffer[16] __aligned(IIO_DMA_MINALIGN);
-	char tc_type;
 };
 
 static int maxim_thermocouple_read(struct maxim_thermocouple_data *data,
-- 
2.48.1

[PATCH 10/16] iio: temperature: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.

[Jonathan Cameron]

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

This new function allows us to perform debug checks in the helper to ensure
that the overrun does not occur.  Use it in all the simple cases where
either a static buffer or a structure is used in the drivers.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
 drivers/iio/temperature/hid-sensor-temperature.c | 5 +++--
 drivers/iio/temperature/maxim_thermocouple.c     | 5 +++--
 drivers/iio/temperature/tmp006.c                 | 4 ++--
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/iio/temperature/hid-sensor-temperature.c b/drivers/iio/temperature/hid-sensor-temperature.c
index 692520e1c497..005106a9e03b 100644
--- a/drivers/iio/temperature/hid-sensor-temperature.c
+++ b/drivers/iio/temperature/hid-sensor-temperature.c
@@ -131,8 +131,9 @@ static int temperature_proc_event(struct hid_sensor_hub_device *hsdev,
 	struct temperature_state *temp_st = iio_priv(indio_dev);
 
 	if (atomic_read(&temp_st->common_attributes.data_ready))
-		iio_push_to_buffers_with_timestamp(indio_dev, &temp_st->scan,
-						   iio_get_time_ns(indio_dev));
+		iio_push_to_buffers_with_ts(indio_dev, &temp_st->scan,
+					    sizeof(temp_st->scan),
+					    iio_get_time_ns(indio_dev));
 
 	return 0;
 }
diff --git a/drivers/iio/temperature/maxim_thermocouple.c b/drivers/iio/temperature/maxim_thermocouple.c
index db2149d5f78c..2db13d381dbd 100644
--- a/drivers/iio/temperature/maxim_thermocouple.c
+++ b/drivers/iio/temperature/maxim_thermocouple.c
@@ -168,8 +168,9 @@ static irqreturn_t maxim_thermocouple_trigger_handler(int irq, void *private)
 
 	ret = spi_read(data->spi, data->buffer, data->chip->read_size);
 	if (!ret) {
-		iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
-						   iio_get_time_ns(indio_dev));
+		iio_push_to_buffers_with_ts(indio_dev, data->buffer,
+					    sizeof(data->buffer),
+					    iio_get_time_ns(indio_dev));
 	}
 
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c
index b5c94b7492f5..29bff9d8859d 100644
--- a/drivers/iio/temperature/tmp006.c
+++ b/drivers/iio/temperature/tmp006.c
@@ -269,8 +269,8 @@ static irqreturn_t tmp006_trigger_handler(int irq, void *p)
 		goto err;
 	scan.channels[1] = ret;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &scan, sizeof(scan),
+				    iio_get_time_ns(indio_dev));
 err:
 	iio_trigger_notify_done(indio_dev->trig);
 	return IRQ_HANDLED;
-- 
2.48.1

[PATCH 11/16] iio: resolver: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.

[Jonathan Cameron]

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

This new function allows us to perform debug checks in the helper to ensure
that the overrun does not occur.  Use it in all the simple cases where
either a static buffer or a structure is used in the drivers.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
 drivers/iio/resolver/ad2s1210.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/iio/resolver/ad2s1210.c b/drivers/iio/resolver/ad2s1210.c
index ab860cedecd1..f79399353b0c 100644
--- a/drivers/iio/resolver/ad2s1210.c
+++ b/drivers/iio/resolver/ad2s1210.c
@@ -1340,7 +1340,8 @@ static irqreturn_t ad2s1210_trigger_handler(int irq, void *p)
 	}
 
 	ad2s1210_push_events(indio_dev, st->sample.fault, pf->timestamp);
-	iio_push_to_buffers_with_timestamp(indio_dev, &st->scan, pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, &st->scan, sizeof(st->scan),
+				    pf->timestamp);
 
 error_ret:
 	iio_trigger_notify_done(indio_dev->trig);
-- 
2.48.1

[PATCH 12/16] iio: proximity: irsd200: Use a struct for scan and iio_push_to_buffers_with_ts()

[Jonathan Cameron]

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

The driver previously used an array of two s64, then type cast the
pointer to write an s16 to the start. The code is made more readable
using a structure.  At the same time switch to the new
iio_push_to_buffers_with_ts() helper to enable runtime checking of the
size of the source buffer.

Note that this approach uses a structure with holes, so use memset()
to ensure those do not contain old kernel data as this data is passed
to userspace.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
 drivers/iio/proximity/irsd200.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/iio/proximity/irsd200.c b/drivers/iio/proximity/irsd200.c
index b0ffd3574013..ed15c06c8ef8 100644
--- a/drivers/iio/proximity/irsd200.c
+++ b/drivers/iio/proximity/irsd200.c
@@ -760,15 +760,19 @@ static irqreturn_t irsd200_trigger_handler(int irq, void *pollf)
 {
 	struct iio_dev *indio_dev = ((struct iio_poll_func *)pollf)->indio_dev;
 	struct irsd200_data *data = iio_priv(indio_dev);
-	s64 buf[2] = {};
+	struct {
+		s16 channel;
+		aligned_s64 ts;
+	} scan;
 	int ret;
 
-	ret = irsd200_read_data(data, (s16 *)buf);
+	memset(&scan, 0, sizeof(scan));
+	ret = irsd200_read_data(data, &scan.channel);
 	if (ret)
 		goto end;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, buf,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &scan, sizeof(scan),
+				    iio_get_time_ns(indio_dev));
 
 end:
 	iio_trigger_notify_done(indio_dev->trig);
-- 
2.48.1

[PATCH 13/16] iio: proximity: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.

[Jonathan Cameron]

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

This new function allows us to perform debug checks in the helper to ensure
that the overrun does not occur. Use it in all the simple cases where
either a static buffer or a structure is used in the drivers.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
 drivers/iio/proximity/as3935.c                    | 4 ++--
 drivers/iio/proximity/hx9023s.c                   | 4 ++--
 drivers/iio/proximity/mb1232.c                    | 4 ++--
 drivers/iio/proximity/pulsedlight-lidar-lite-v2.c | 5 +++--
 drivers/iio/proximity/srf08.c                     | 4 ++--
 drivers/iio/proximity/sx_common.c                 | 4 ++--
 drivers/iio/proximity/vl53l0x-i2c.c               | 4 ++--
 7 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
index 9d3caf2bef18..d91a1fefe74e 100644
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -231,8 +231,8 @@ static irqreturn_t as3935_trigger_handler(int irq, void *private)
 		goto err_read;
 
 	st->scan.chan = val & AS3935_DATA_MASK;
-	iio_push_to_buffers_with_timestamp(indio_dev, &st->scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &st->scan, sizeof(st->scan),
+				    iio_get_time_ns(indio_dev));
 err_read:
 	iio_trigger_notify_done(indio_dev->trig);
 
diff --git a/drivers/iio/proximity/hx9023s.c b/drivers/iio/proximity/hx9023s.c
index 0ec6b4b28d08..15f9315e49b1 100644
--- a/drivers/iio/proximity/hx9023s.c
+++ b/drivers/iio/proximity/hx9023s.c
@@ -953,8 +953,8 @@ static irqreturn_t hx9023s_trigger_handler(int irq, void *private)
 		data->buffer.channels[i++] = cpu_to_le16(data->ch_data[index].diff);
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->buffer,
-					   pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, &data->buffer,
+				    sizeof(data->buffer), pf->timestamp);
 
 out:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/proximity/mb1232.c b/drivers/iio/proximity/mb1232.c
index cfc75d001f20..1c3a23b6dfe3 100644
--- a/drivers/iio/proximity/mb1232.c
+++ b/drivers/iio/proximity/mb1232.c
@@ -125,8 +125,8 @@ static irqreturn_t mb1232_trigger_handler(int irq, void *p)
 	if (data->scan.distance < 0)
 		goto err;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
-					   pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, &data->scan, sizeof(data->scan),
+				    pf->timestamp);
 
 err:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c
index fbf9f8513055..1deaf70e92ce 100644
--- a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c
+++ b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c
@@ -238,8 +238,9 @@ static irqreturn_t lidar_trigger_handler(int irq, void *private)
 
 	ret = lidar_get_measurement(data, &data->scan.chan);
 	if (!ret) {
-		iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
-						   iio_get_time_ns(indio_dev));
+		iio_push_to_buffers_with_ts(indio_dev, &data->scan,
+					    sizeof(data->scan),
+					    iio_get_time_ns(indio_dev));
 	} else if (ret != -EINVAL) {
 		dev_err(&data->client->dev, "cannot read LIDAR measurement");
 	}
diff --git a/drivers/iio/proximity/srf08.c b/drivers/iio/proximity/srf08.c
index 86cab113ef3d..694c943455aa 100644
--- a/drivers/iio/proximity/srf08.c
+++ b/drivers/iio/proximity/srf08.c
@@ -191,8 +191,8 @@ static irqreturn_t srf08_trigger_handler(int irq, void *p)
 	mutex_lock(&data->lock);
 
 	data->scan.chan = sensor_data;
-	iio_push_to_buffers_with_timestamp(indio_dev,
-					   &data->scan, pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, &data->scan, sizeof(data->scan),
+				    pf->timestamp);
 
 	mutex_unlock(&data->lock);
 err:
diff --git a/drivers/iio/proximity/sx_common.c b/drivers/iio/proximity/sx_common.c
index f70198a1f0d1..59b35e40739b 100644
--- a/drivers/iio/proximity/sx_common.c
+++ b/drivers/iio/proximity/sx_common.c
@@ -379,8 +379,8 @@ static irqreturn_t sx_common_trigger_handler(int irq, void *private)
 		data->buffer.channels[i++] = val;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->buffer,
-					   pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, &data->buffer,
+				    sizeof(data->buffer), pf->timestamp);
 
 out:
 	mutex_unlock(&data->mutex);
diff --git a/drivers/iio/proximity/vl53l0x-i2c.c b/drivers/iio/proximity/vl53l0x-i2c.c
index 87d10faaff9b..ef4aa7b2835e 100644
--- a/drivers/iio/proximity/vl53l0x-i2c.c
+++ b/drivers/iio/proximity/vl53l0x-i2c.c
@@ -94,8 +94,8 @@ static irqreturn_t vl53l0x_trigger_handler(int irq, void *priv)
 		return -EREMOTEIO;
 
 	data->scan.chan = get_unaligned_be16(&buffer[10]);
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
-					iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &data->scan, sizeof(data->scan),
+				    iio_get_time_ns(indio_dev));
 
 	iio_trigger_notify_done(indio_dev->trig);
 	vl53l0x_clear_irq(data);
-- 
2.48.1

[PATCH 14/16] iio: pressure: zpa2326: Use aligned_s64 for the timestamp

[Jonathan Cameron]

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

On x86_32 s64 fields are only aligned to 32 bits.  Hence force
the alignment of the field and padding in the structure by using
aligned_s64 instead.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
 drivers/iio/pressure/zpa2326.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/pressure/zpa2326.c b/drivers/iio/pressure/zpa2326.c
index 0a510d5fc1d4..30f007794f5b 100644
--- a/drivers/iio/pressure/zpa2326.c
+++ b/drivers/iio/pressure/zpa2326.c
@@ -582,7 +582,7 @@ static int zpa2326_fill_sample_buffer(struct iio_dev               *indio_dev,
 	struct {
 		u32 pressure;
 		u16 temperature;
-		u64 timestamp;
+		aligned_s64 timestamp;
 	}   sample;
 	int err;
 
-- 
2.48.1

[PATCH 15/16] iio: pressure: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.

[Jonathan Cameron]

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

This new function allows us to perform debug checks in the helper to ensure
that the overrun does not occur.  Use it in all the simple cases where
either a static buffer or a structure is used in the drivers.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
 drivers/iio/pressure/bmp280-core.c      | 25 +++++++++++++++----------
 drivers/iio/pressure/hid-sensor-press.c |  5 +++--
 drivers/iio/pressure/hsc030pa.c         |  4 ++--
 drivers/iio/pressure/mpl3115.c          |  4 ++--
 drivers/iio/pressure/rohm-bm1390.c      |  3 ++-
 drivers/iio/pressure/zpa2326.c          |  4 ++--
 6 files changed, 26 insertions(+), 19 deletions(-)

diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
index d44ab65c94cb..c20cc4a98c9c 100644
--- a/drivers/iio/pressure/bmp280-core.c
+++ b/drivers/iio/pressure/bmp280-core.c
@@ -1142,8 +1142,9 @@ static irqreturn_t bmp280_trigger_handler(int irq, void *p)
 	chans[0] = comp_press;
 	chans[1] = comp_temp;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, data->sensor_data,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, data->sensor_data,
+				    sizeof(data->sensor_data),
+				    iio_get_time_ns(indio_dev));
 
 out:
 	iio_trigger_notify_done(indio_dev->trig);
@@ -1273,8 +1274,9 @@ static irqreturn_t bme280_trigger_handler(int irq, void *p)
 	chans[1] = comp_temp;
 	chans[2] = comp_humidity;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, data->sensor_data,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, data->sensor_data,
+				    sizeof(data->sensor_data),
+				    iio_get_time_ns(indio_dev));
 
 out:
 	iio_trigger_notify_done(indio_dev->trig);
@@ -1936,8 +1938,9 @@ static irqreturn_t bmp380_trigger_handler(int irq, void *p)
 	chans[0] = comp_press;
 	chans[1] = comp_temp;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, data->sensor_data,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, data->sensor_data,
+				    sizeof(data->sensor_data),
+				    iio_get_time_ns(indio_dev));
 
 out:
 	iio_trigger_notify_done(indio_dev->trig);
@@ -2630,8 +2633,9 @@ static irqreturn_t bmp580_trigger_handler(int irq, void *p)
 	/* Temperature calculations */
 	memcpy(&data->sensor_data[offset], &data->buf[0], 3);
 
-	iio_push_to_buffers_with_timestamp(indio_dev, data->sensor_data,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, data->sensor_data,
+				    sizeof(data->sensor_data),
+				    iio_get_time_ns(indio_dev));
 
 out:
 	iio_trigger_notify_done(indio_dev->trig);
@@ -2969,8 +2973,9 @@ static irqreturn_t bmp180_trigger_handler(int irq, void *p)
 	chans[0] = comp_press;
 	chans[1] = comp_temp;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, data->sensor_data,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, data->sensor_data,
+				    sizeof(data->sensor_data),
+				    iio_get_time_ns(indio_dev));
 
 out:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/pressure/hid-sensor-press.c b/drivers/iio/pressure/hid-sensor-press.c
index f7273d30c5f0..a8561df9f666 100644
--- a/drivers/iio/pressure/hid-sensor-press.c
+++ b/drivers/iio/pressure/hid-sensor-press.c
@@ -176,8 +176,9 @@ static int press_proc_event(struct hid_sensor_hub_device *hsdev,
 		if (!press_state->timestamp)
 			press_state->timestamp = iio_get_time_ns(indio_dev);
 
-		iio_push_to_buffers_with_timestamp(
-			indio_dev, &press_state->scan, press_state->timestamp);
+		iio_push_to_buffers_with_ts(
+			indio_dev, &press_state->scan,
+			sizeof(press_state->scan), press_state->timestamp);
 	}
 
 	return 0;
diff --git a/drivers/iio/pressure/hsc030pa.c b/drivers/iio/pressure/hsc030pa.c
index 168245818cfe..2d00c0656259 100644
--- a/drivers/iio/pressure/hsc030pa.c
+++ b/drivers/iio/pressure/hsc030pa.c
@@ -314,8 +314,8 @@ static irqreturn_t hsc_trigger_handler(int irq, void *private)
 	memcpy(&data->scan.chan[0], &data->buffer[0], 2);
 	memcpy(&data->scan.chan[1], &data->buffer[2], 2);
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &data->scan, sizeof(data->scan),
+				    iio_get_time_ns(indio_dev));
 
 error:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/pressure/mpl3115.c b/drivers/iio/pressure/mpl3115.c
index 8397155555bd..d6715997f137 100644
--- a/drivers/iio/pressure/mpl3115.c
+++ b/drivers/iio/pressure/mpl3115.c
@@ -191,8 +191,8 @@ static irqreturn_t mpl3115_trigger_handler(int irq, void *p)
 	}
 	mutex_unlock(&data->lock);
 
-	iio_push_to_buffers_with_timestamp(indio_dev, buffer,
-		iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, buffer, sizeof(buffer),
+				    iio_get_time_ns(indio_dev));
 
 done:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/pressure/rohm-bm1390.c b/drivers/iio/pressure/rohm-bm1390.c
index c48231739f48..cf5f48874a68 100644
--- a/drivers/iio/pressure/rohm-bm1390.c
+++ b/drivers/iio/pressure/rohm-bm1390.c
@@ -652,7 +652,8 @@ static irqreturn_t bm1390_trigger_handler(int irq, void *p)
 		}
 	}
 
-	iio_push_to_buffers_with_timestamp(idev, &data->buf, data->timestamp);
+	iio_push_to_buffers_with_ts(idev, &data->buf, sizeof(data->buf),
+				    data->timestamp);
 	iio_trigger_notify_done(idev->trig);
 
 	return IRQ_HANDLED;
diff --git a/drivers/iio/pressure/zpa2326.c b/drivers/iio/pressure/zpa2326.c
index 30f007794f5b..1640aa3717ed 100644
--- a/drivers/iio/pressure/zpa2326.c
+++ b/drivers/iio/pressure/zpa2326.c
@@ -618,8 +618,8 @@ static int zpa2326_fill_sample_buffer(struct iio_dev               *indio_dev,
 	 */
 	zpa2326_dbg(indio_dev, "filling raw samples buffer");
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &sample,
-					   private->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, &sample, sizeof(sample),
+				    private->timestamp);
 
 	return 0;
 }
-- 
2.48.1

[PATCH 16/16] iio: magnetometer: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.

[Jonathan Cameron]

From: Jonathan Cameron <Jonathan.Cameron@huawei.com>

This new function allows us to perform debug checks in the helper to ensure
that the overrun does not occur.  Use it in all the simple cases where
either a static buffer or a structure is used in the drivers.

Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
 drivers/iio/magnetometer/af8133j.c       | 3 ++-
 drivers/iio/magnetometer/ak8974.c        | 5 +++--
 drivers/iio/magnetometer/ak8975.c        | 4 ++--
 drivers/iio/magnetometer/als31300.c      | 4 ++--
 drivers/iio/magnetometer/bmc150_magn.c   | 4 ++--
 drivers/iio/magnetometer/hmc5843.h       | 2 +-
 drivers/iio/magnetometer/hmc5843_core.c  | 4 ++--
 drivers/iio/magnetometer/mag3110.c       | 4 ++--
 drivers/iio/magnetometer/rm3100-core.c   | 4 ++--
 drivers/iio/magnetometer/yamaha-yas530.c | 5 +++--
 10 files changed, 21 insertions(+), 18 deletions(-)

diff --git a/drivers/iio/magnetometer/af8133j.c b/drivers/iio/magnetometer/af8133j.c
index c1fc339e85b4..192ba2da94e2 100644
--- a/drivers/iio/magnetometer/af8133j.c
+++ b/drivers/iio/magnetometer/af8133j.c
@@ -370,7 +370,8 @@ static irqreturn_t af8133j_trigger_handler(int irq, void *p)
 	if (ret)
 		goto out_done;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &sample, timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, &sample, sizeof(sample),
+				    timestamp);
 
 out_done:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/magnetometer/ak8974.c b/drivers/iio/magnetometer/ak8974.c
index 08975c60e325..4fba9f4ded28 100644
--- a/drivers/iio/magnetometer/ak8974.c
+++ b/drivers/iio/magnetometer/ak8974.c
@@ -673,8 +673,9 @@ static void ak8974_fill_buffer(struct iio_dev *indio_dev)
 		goto out_unlock;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &ak8974->scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &ak8974->scan,
+				    sizeof(ak8974->scan),
+				    iio_get_time_ns(indio_dev));
 
  out_unlock:
 	mutex_unlock(&ak8974->lock);
diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
index ef1363126cc2..abe9f4fccf00 100644
--- a/drivers/iio/magnetometer/ak8975.c
+++ b/drivers/iio/magnetometer/ak8975.c
@@ -882,8 +882,8 @@ static void ak8975_fill_buffer(struct iio_dev *indio_dev)
 	data->scan.channels[1] = clamp_t(s16, le16_to_cpu(fval[1]), -def->range, def->range);
 	data->scan.channels[2] = clamp_t(s16, le16_to_cpu(fval[2]), -def->range, def->range);
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &data->scan, sizeof(data->scan),
+				    iio_get_time_ns(indio_dev));
 
 	return;
 
diff --git a/drivers/iio/magnetometer/als31300.c b/drivers/iio/magnetometer/als31300.c
index 87b60c4e81fa..d5db4c8343ce 100644
--- a/drivers/iio/magnetometer/als31300.c
+++ b/drivers/iio/magnetometer/als31300.c
@@ -245,8 +245,8 @@ static irqreturn_t als31300_trigger_handler(int irq, void *p)
 	scan.channels[0] = x;
 	scan.channels[1] = y;
 	scan.channels[2] = z;
-	iio_push_to_buffers_with_timestamp(indio_dev, &scan,
-					   pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, &scan, sizeof(scan),
+				    pf->timestamp);
 
 trigger_out:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/magnetometer/bmc150_magn.c b/drivers/iio/magnetometer/bmc150_magn.c
index 88bb673e40d8..f9c51ceae011 100644
--- a/drivers/iio/magnetometer/bmc150_magn.c
+++ b/drivers/iio/magnetometer/bmc150_magn.c
@@ -678,8 +678,8 @@ static irqreturn_t bmc150_magn_trigger_handler(int irq, void *p)
 	if (ret < 0)
 		goto err;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
-					   pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, &data->scan, sizeof(data->scan),
+				    pf->timestamp);
 
 err:
 	mutex_unlock(&data->mutex);
diff --git a/drivers/iio/magnetometer/hmc5843.h b/drivers/iio/magnetometer/hmc5843.h
index ffd669b1ee7c..7a3faf7ffed4 100644
--- a/drivers/iio/magnetometer/hmc5843.h
+++ b/drivers/iio/magnetometer/hmc5843.h
@@ -34,7 +34,7 @@ enum hmc5843_ids {
  * @regmap:		hardware access register maps
  * @variant:		describe chip variants
  * @scan:		buffer to pack data for passing to
- *			iio_push_to_buffers_with_timestamp()
+ *			iio_push_to_buffers_with_ts()
  */
 struct hmc5843_data {
 	struct device *dev;
diff --git a/drivers/iio/magnetometer/hmc5843_core.c b/drivers/iio/magnetometer/hmc5843_core.c
index 2fc84310e2cc..fc16ebd314f7 100644
--- a/drivers/iio/magnetometer/hmc5843_core.c
+++ b/drivers/iio/magnetometer/hmc5843_core.c
@@ -452,8 +452,8 @@ static irqreturn_t hmc5843_trigger_handler(int irq, void *p)
 	if (ret < 0)
 		goto done;
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &data->scan, sizeof(data->scan),
+				    iio_get_time_ns(indio_dev));
 
 done:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/magnetometer/mag3110.c b/drivers/iio/magnetometer/mag3110.c
index 92d4511ed372..ff09250a06e7 100644
--- a/drivers/iio/magnetometer/mag3110.c
+++ b/drivers/iio/magnetometer/mag3110.c
@@ -404,8 +404,8 @@ static irqreturn_t mag3110_trigger_handler(int irq, void *p)
 		data->scan.temperature = ret;
 	}
 
-	iio_push_to_buffers_with_timestamp(indio_dev, &data->scan,
-		iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &data->scan, sizeof(data->scan),
+				    iio_get_time_ns(indio_dev));
 
 done:
 	iio_trigger_notify_done(indio_dev->trig);
diff --git a/drivers/iio/magnetometer/rm3100-core.c b/drivers/iio/magnetometer/rm3100-core.c
index e5162ee64e01..81da063fb38c 100644
--- a/drivers/iio/magnetometer/rm3100-core.c
+++ b/drivers/iio/magnetometer/rm3100-core.c
@@ -515,8 +515,8 @@ static irqreturn_t rm3100_trigger_handler(int irq, void *p)
 	 * Always using the same buffer so that we wouldn't need to set the
 	 * paddings to 0 in case of leaking any data.
 	 */
-	iio_push_to_buffers_with_timestamp(indio_dev, data->buffer,
-					   pf->timestamp);
+	iio_push_to_buffers_with_ts(indio_dev, data->buffer,
+				    sizeof(data->buffer), pf->timestamp);
 done:
 	iio_trigger_notify_done(indio_dev->trig);
 
diff --git a/drivers/iio/magnetometer/yamaha-yas530.c b/drivers/iio/magnetometer/yamaha-yas530.c
index 28012b20c64f..6ff34b3b6a62 100644
--- a/drivers/iio/magnetometer/yamaha-yas530.c
+++ b/drivers/iio/magnetometer/yamaha-yas530.c
@@ -674,8 +674,9 @@ static void yas5xx_fill_buffer(struct iio_dev *indio_dev)
 	yas5xx->scan.channels[1] = x;
 	yas5xx->scan.channels[2] = y;
 	yas5xx->scan.channels[3] = z;
-	iio_push_to_buffers_with_timestamp(indio_dev, &yas5xx->scan,
-					   iio_get_time_ns(indio_dev));
+	iio_push_to_buffers_with_ts(indio_dev, &yas5xx->scan,
+				    sizeof(yas5xx->scan),
+				    iio_get_time_ns(indio_dev));
 }
 
 static irqreturn_t yas5xx_handle_trigger(int irq, void *p)
-- 
2.48.1

Re: [PATCH 01/16] iio: introduced iio_push_to_buffers_with_ts() that takes a total_len argument.

[Nuno Sá]

On Sun, 2025-03-09 at 18:20 +0000, Jonathan Cameron wrote:
> From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> 
> Check that total_len argument against iio_dev->scan_bytes.
> 
> The size needs to be at least as big as the scan. It can be larger,
> which is typical if only part of fixed sized storage is used due to
> a subset of channels being enabled.
> 
> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> ---
>  include/linux/iio/buffer.h | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
> 
> diff --git a/include/linux/iio/buffer.h b/include/linux/iio/buffer.h
> index 3b8d618bb3df..75d5e58b646b 100644
> --- a/include/linux/iio/buffer.h
> +++ b/include/linux/iio/buffer.h
> @@ -45,6 +45,19 @@ static inline int iio_push_to_buffers_with_timestamp(struct
> iio_dev *indio_dev,
>  	return iio_push_to_buffers(indio_dev, data);
>  }
>  
> +static inline int iio_push_to_buffers_with_ts(struct iio_dev *indio_dev,
> +					      void *data, size_t total_len,
> +					      int64_t timestamp)
> +{

Kind of a nitpick but what about data_len as the size relate to *data?

> +	if (total_len < indio_dev->scan_bytes) {

Given this is to be called on a fastpath and that the above is clearly a bug,
what do you think about unlikely(total_len < indio_dev->scan_bytes) for some
micro optimization?

Anyways, this looks like a nice API improvement to me!

- Nuno Sá 
> 

Re: [PATCH 01/16] iio: introduced iio_push_to_buffers_with_ts() that takes a total_len argument.

[Jonathan Cameron]

On Mon, 10 Mar 2025 08:34:50 +0000
Nuno Sá <noname.nuno@gmail.com> wrote:

> On Sun, 2025-03-09 at 18:20 +0000, Jonathan Cameron wrote:
> > From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> > 
> > Check that total_len argument against iio_dev->scan_bytes.
> > 
> > The size needs to be at least as big as the scan. It can be larger,
> > which is typical if only part of fixed sized storage is used due to
> > a subset of channels being enabled.
> > 
> > Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> > ---
> >  include/linux/iio/buffer.h | 13 +++++++++++++
> >  1 file changed, 13 insertions(+)
> > 
> > diff --git a/include/linux/iio/buffer.h b/include/linux/iio/buffer.h
> > index 3b8d618bb3df..75d5e58b646b 100644
> > --- a/include/linux/iio/buffer.h
> > +++ b/include/linux/iio/buffer.h
> > @@ -45,6 +45,19 @@ static inline int iio_push_to_buffers_with_timestamp(struct
> > iio_dev *indio_dev,
> >  	return iio_push_to_buffers(indio_dev, data);
> >  }
> >  
> > +static inline int iio_push_to_buffers_with_ts(struct iio_dev *indio_dev,
> > +					      void *data, size_t total_len,
> > +					      int64_t timestamp)
> > +{  
> 
> Kind of a nitpick but what about data_len as the size relate to *data?
Maybe data_total_len? I kind of want to make people wonder what the total
is about and read the docs. Which I forgot to actually add :(
This has always been a quirky, non obvious interface.

> 
> > +	if (total_len < indio_dev->scan_bytes) {  
> 
> Given this is to be called on a fastpath and that the above is clearly a bug,
> what do you think about unlikely(total_len < indio_dev->scan_bytes) for some
> micro optimization?

Fair point.  Probably never matters as any branch predictor ought to get this
one quickly but it also acts as documentation so sure.

> 
> Anyways, this looks like a nice API improvement to me!
> 
> - Nuno Sá 
> >   

Re: [PATCH 02/16] iio: dummy: Use a fixed structure to build up scan to push to buffers.

[David Lechner]

On 3/9/25 1:20 PM, Jonathan Cameron wrote:
> From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> 
> It has long been discouraged for drivers to make use of iio_dev->scan_bytes
> directly as that is an implementation detail of the core. As such our
> example driver should definitely not be doing so.
> 
> A simple anonymous structure definition suffices here as even though
> we have a mixture of signed and unsigned channels only the signed ones
> use the full storage so the unsigned channels can used signed types as
> well.
> 
> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> ---
>  drivers/iio/dummy/iio_simple_dummy_buffer.c | 16 ++++++----------
>  1 file changed, 6 insertions(+), 10 deletions(-)
> 
> diff --git a/drivers/iio/dummy/iio_simple_dummy_buffer.c b/drivers/iio/dummy/iio_simple_dummy_buffer.c
> index 288880346707..050dd993f012 100644
> --- a/drivers/iio/dummy/iio_simple_dummy_buffer.c
> +++ b/drivers/iio/dummy/iio_simple_dummy_buffer.c
> @@ -46,11 +46,10 @@ static irqreturn_t iio_simple_dummy_trigger_h(int irq, void *p)
>  	struct iio_poll_func *pf = p;
>  	struct iio_dev *indio_dev = pf->indio_dev;
>  	int i = 0, j;
> -	u16 *data;
> -
> -	data = kzalloc(indio_dev->scan_bytes, GFP_KERNEL);
> -	if (!data)
> -		goto done;

Maybe worth a comment that stack allocated is only OK if not used with DMA?

> +	struct {
> +		s16 data[ARRAY_SIZE(fakedata)];
> +		aligned_s64 timestamp;
> +	} scan;
>  
>  	/*
>  	 * Three common options here:

Re: [PATCH 05/16] iio: adc: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.

[David Lechner]

On 3/9/25 1:20 PM, Jonathan Cameron wrote:
> From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> 
> This new function allows us to perform debug checks in the helper to ensure
> that the overrun does not occur.  Use it in all the simple cases where
> either a static buffer or a structure is used in the drivers.
> 
> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> ---

...

> diff --git a/drivers/iio/adc/ad4030.c b/drivers/iio/adc/ad4030.c
> index 9a020680885d..77c5dd414d36 100644
> --- a/drivers/iio/adc/ad4030.c
> +++ b/drivers/iio/adc/ad4030.c
> @@ -706,8 +706,9 @@ static irqreturn_t ad4030_trigger_handler(int irq, void *p)
>  	if (ret)
>  		goto out;
>  
> -	iio_push_to_buffers_with_timestamp(indio_dev, st->rx_data.raw,
> -					   pf->timestamp);
> +	iio_push_to_buffers_with_ts(indio_dev, st->rx_data.raw,

Would &st->rx_data be more correct? I guess it doesn't really matter in this case.

> +				    sizeof(st->rx_data.raw),
> +				    pf->timestamp);
>  
>  out:
>  	iio_trigger_notify_done(indio_dev->trig);

...

> diff --git a/drivers/iio/adc/ad7266.c b/drivers/iio/adc/ad7266.c
> index 18559757f908..4217d3963455 100644
> --- a/drivers/iio/adc/ad7266.c
> +++ b/drivers/iio/adc/ad7266.c
> @@ -87,8 +87,9 @@ static irqreturn_t ad7266_trigger_handler(int irq, void *p)
>  
>  	ret = spi_read(st->spi, st->data.sample, 4);
>  	if (ret == 0) {
> -		iio_push_to_buffers_with_timestamp(indio_dev, &st->data,
> -			    pf->timestamp);
> +		iio_push_to_buffers_with_ts(indio_dev, &st->data,
> +					    sizeof(st->data),

This one has `s64 timestamp;` which should be aligned_s64.

> +					    pf->timestamp);
>  	}
>  
>  	iio_trigger_notify_done(indio_dev->trig);
> diff --git a/drivers/iio/adc/ad7298.c b/drivers/iio/adc/ad7298.c
> index 28b88092b4aa..def5f91dc343 100644
> --- a/drivers/iio/adc/ad7298.c
> +++ b/drivers/iio/adc/ad7298.c
> @@ -155,8 +155,9 @@ static irqreturn_t ad7298_trigger_handler(int irq, void *p)
>  	if (b_sent)
>  		goto done;
>  
> -	iio_push_to_buffers_with_timestamp(indio_dev, st->rx_buf,
> -		iio_get_time_ns(indio_dev));
> +	iio_push_to_buffers_with_ts(indio_dev, st->rx_buf,

Does this one actually have enough room in rx_buf for 9 16-bit channels and a
an aligned timestamp?

__be16	rx_buf[12] __aligned(IIO_DMA_MINALIGN);


> +				    sizeof(st->rx_buf),
> +				    iio_get_time_ns(indio_dev));
>  
>  done:
>  	iio_trigger_notify_done(indio_dev->trig);

...

> diff --git a/drivers/iio/adc/ad7606.c b/drivers/iio/adc/ad7606.c
> index 631e83717167..3ffa11b2e060 100644
> --- a/drivers/iio/adc/ad7606.c
> +++ b/drivers/iio/adc/ad7606.c
> @@ -679,8 +679,8 @@ static irqreturn_t ad7606_trigger_handler(int irq, void *p)
>  	if (ret)
>  		goto error_ret;
>  
> -	iio_push_to_buffers_with_timestamp(indio_dev, &st->data,
> -					   iio_get_time_ns(indio_dev));
> +	iio_push_to_buffers_with_ts(indio_dev, &st->data, sizeof(st->data),

This one might need ALIGNED in the buffer declarations. I'm working on this
driver though, so can fix it up.

> +				    iio_get_time_ns(indio_dev));
>  error_ret:
>  	iio_trigger_notify_done(indio_dev->trig);
>  	/* The rising edge of the CONVST signal starts a new conversion. */
> diff --git a/drivers/iio/adc/ad7768-1.c b/drivers/iio/adc/ad7768-1.c
> index 5a863005aca6..4eb586d473ce 100644
> --- a/drivers/iio/adc/ad7768-1.c
> +++ b/drivers/iio/adc/ad7768-1.c
> @@ -474,8 +474,9 @@ static irqreturn_t ad7768_trigger_handler(int irq, void *p)
>  	if (ret < 0)
>  		goto out;
>  
> -	iio_push_to_buffers_with_timestamp(indio_dev, &st->data.scan,
> -					   iio_get_time_ns(indio_dev));
> +	iio_push_to_buffers_with_ts(indio_dev, &st->data.scan,
> +				    sizeof(st->data.scan),

This one could use aligned_s64 on the timestamp.

> +				    iio_get_time_ns(indio_dev));
>  
>  out:
>  	iio_trigger_notify_done(indio_dev->trig);

...

> diff --git a/drivers/iio/adc/ad7923.c b/drivers/iio/adc/ad7923.c
> index 87945efb940b..0369151c7db1 100644
> --- a/drivers/iio/adc/ad7923.c
> +++ b/drivers/iio/adc/ad7923.c
> @@ -207,8 +207,8 @@ static irqreturn_t ad7923_trigger_handler(int irq, void *p)
>  	if (b_sent)
>  		goto done;
>  
> -	iio_push_to_buffers_with_timestamp(indio_dev, st->rx_buf,
> -					   iio_get_time_ns(indio_dev));
> +	iio_push_to_buffers_with_ts(indio_dev, st->rx_buf, sizeof(st->rx_buf),

This one is similar to ad7298 but doesn't have a temperature channel, so
probably OK. Still could use ALIGNED in the buffer declaration to make it more
obvious that we have a timestamp.

> +				    iio_get_time_ns(indio_dev));
>  
>  done:
>  	iio_trigger_notify_done(indio_dev->trig);
> diff --git a/drivers/iio/adc/dln2-adc.c b/drivers/iio/adc/dln2-adc.c
> index a1e48a756a7b..5ffb4b5f5c99 100644
> --- a/drivers/iio/adc/dln2-adc.c
> +++ b/drivers/iio/adc/dln2-adc.c
> @@ -488,8 +488,8 @@ static irqreturn_t dln2_adc_trigger_h(int irq, void *p)
>  		       (void *)dev_data.values + t->from, t->length);
>  	}
>  
> -	iio_push_to_buffers_with_timestamp(indio_dev, &data,
> -					   iio_get_time_ns(indio_dev));
> +	iio_push_to_buffers_with_ts(indio_dev, &data, sizeof(data),

Could use aligned_s64 on timestamp_space.

> +				    iio_get_time_ns(indio_dev));
>  
>  done:
>  	iio_trigger_notify_done(indio_dev->trig);

...

> diff --git a/drivers/iio/adc/mxs-lradc-adc.c b/drivers/iio/adc/mxs-lradc-adc.c
> index 8f1e6acea53b..92baf3f5f560 100644
> --- a/drivers/iio/adc/mxs-lradc-adc.c
> +++ b/drivers/iio/adc/mxs-lradc-adc.c
> @@ -425,7 +425,8 @@ static irqreturn_t mxs_lradc_adc_trigger_handler(int irq, void *p)
>  		j++;
>  	}
>  
> -	iio_push_to_buffers_with_timestamp(iio, adc->buffer, pf->timestamp);
> +	iio_push_to_buffers_with_ts(iio, adc->buffer, sizeof(adc->buffer),

u32			buffer[10] __aligned(8);

Technically OK, but could use ALIGN. There are some other drivers like this
but I won't call all of them out since they should be OK.

> +				    pf->timestamp);
>  
>  	iio_trigger_notify_done(iio->trig);
>  

...

> diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
> index 5dbf5f136768..32e7938b3892 100644
> --- a/drivers/iio/adc/stm32-adc.c
> +++ b/drivers/iio/adc/stm32-adc.c
> @@ -1858,8 +1858,8 @@ static irqreturn_t stm32_adc_trigger_handler(int irq, void *p)
>  
>  	/* reset buffer index */
>  	adc->bufi = 0;
> -	iio_push_to_buffers_with_timestamp(indio_dev, adc->buffer,
> -					   pf->timestamp);
> +	iio_push_to_buffers_with_ts(indio_dev, adc->buffer, sizeof(adc->buffer),

u16			buffer[STM32_ADC_MAX_SQ + 4] __aligned(8);

Could use ALIGN for timestamp instead of assuming STM32_ADC_MAX_SQ * 2 is the
correct alignment. There are also a few more drivers like this that depend on
a macro being even or multiple of 4 to get the correct alignment, which seems
like it could be fragile, e.g. if a temperature channel was added.

> +				    pf->timestamp);
>  	iio_trigger_notify_done(indio_dev->trig);
>  
>  	/* re-enable eoc irq */

...

Re: [PATCH 04/16] iio: adc: ti-ads131e08: Use new iio_push_to_buffers_with_ts() to provide length sanity check.

[David Lechner]

On 3/9/25 1:20 PM, Jonathan Cameron wrote:
> From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> 
> By providing the size of the buffer used, runtime checks can be performed
> to ensure not overrun.
> 
> Also change the pushed data pointer to be that of the structure that also
> contains the timestamp.  Not an actual bug but semantically incorrect
> to push the channel data when we want the storage with the timestamp
> as well.
> 
> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> ---

Reviewed-by: David Lechner <dlechner@baylibre.com>

Re: [PATCH 01/16] iio: introduced iio_push_to_buffers_with_ts() that takes a total_len argument.

[Nuno Sá]

On Mon, 2025-03-10 at 20:04 +0000, Jonathan Cameron wrote:
> On Mon, 10 Mar 2025 08:34:50 +0000
> Nuno Sá <noname.nuno@gmail.com> wrote:
> 
> > On Sun, 2025-03-09 at 18:20 +0000, Jonathan Cameron wrote:
> > > From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> > > 
> > > Check that total_len argument against iio_dev->scan_bytes.
> > > 
> > > The size needs to be at least as big as the scan. It can be larger,
> > > which is typical if only part of fixed sized storage is used due to
> > > a subset of channels being enabled.
> > > 
> > > Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> > > ---
> > >  include/linux/iio/buffer.h | 13 +++++++++++++
> > >  1 file changed, 13 insertions(+)
> > > 
> > > diff --git a/include/linux/iio/buffer.h b/include/linux/iio/buffer.h
> > > index 3b8d618bb3df..75d5e58b646b 100644
> > > --- a/include/linux/iio/buffer.h
> > > +++ b/include/linux/iio/buffer.h
> > > @@ -45,6 +45,19 @@ static inline int iio_push_to_buffers_with_timestamp(struct
> > > iio_dev *indio_dev,
> > >  	return iio_push_to_buffers(indio_dev, data);
> > >  }
> > >  
> > > +static inline int iio_push_to_buffers_with_ts(struct iio_dev *indio_dev,
> > > +					      void *data, size_t total_len,
> > > +					      int64_t timestamp)
> > > +{  
> > 
> > Kind of a nitpick but what about data_len as the size relate to *data?
> Maybe data_total_len? I kind of want to make people wonder what the total

Fine by me... It is starting to get a bit verbose but I guess still on the acceptable
side of things.

- Nuno Sá

Re: [PATCH 06/16] iio: accel: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.

[David Lechner]

On 3/9/25 1:20 PM, Jonathan Cameron wrote:
> From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> 
> This new function allows us to perform debug checks in the helper to ensure
> that the overrun does not occur.  Use it in all the simple cases where
> either a static buffer or a structure is used in the drivers.
> 
> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> ---
>  drivers/iio/accel/adxl355_core.c    | 4 ++--
>  drivers/iio/accel/bma180.c          | 3 ++-
>  drivers/iio/accel/bma220_spi.c      | 4 ++--
>  drivers/iio/accel/bma400_core.c     | 5 +++--
>  drivers/iio/accel/fxls8962af-core.c | 4 ++--
>  drivers/iio/accel/kxcjk-1013.c      | 4 ++--
>  drivers/iio/accel/kxsd9.c           | 5 ++---
>  drivers/iio/accel/mma7455_core.c    | 5 +++--
>  drivers/iio/accel/mma8452.c         | 5 +++--
>  drivers/iio/accel/msa311.c          | 4 ++--
>  drivers/iio/accel/mxc4005.c         | 4 ++--
>  drivers/iio/accel/sca3300.c         | 5 +++--
>  drivers/iio/accel/stk8312.c         | 2 +-
>  drivers/iio/accel/stk8ba50.c        | 4 ++--
>  14 files changed, 31 insertions(+), 27 deletions(-)
> 
> diff --git a/drivers/iio/accel/adxl355_core.c b/drivers/iio/accel/adxl355_core.c
> index e8cd21fa77a6..ae949ada6db5 100644
> --- a/drivers/iio/accel/adxl355_core.c
> +++ b/drivers/iio/accel/adxl355_core.c
> @@ -666,8 +666,8 @@ static irqreturn_t adxl355_trigger_handler(int irq, void *p)
>  	if (ret)
>  		goto out_unlock_notify;
>  
> -	iio_push_to_buffers_with_timestamp(indio_dev, &data->buffer,
> -					   pf->timestamp);
> +	iio_push_to_buffers_with_ts(indio_dev, &data->buffer,

Could also use aligned_s64 in the declaration of buffer.ts.

> +				    sizeof(data->buffer), pf->timestamp);
>  
>  out_unlock_notify:
>  	mutex_unlock(&data->lock);

The rest check out.

Reviewed-by: David Lechner <dlechner@baylibre.com>

Re: [PATCH 07/16] iio: accel: hid: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.

[David Lechner]

On 3/9/25 1:20 PM, Jonathan Cameron wrote:
> From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> 
> This new function allows us to perform debug checks in the helper to ensure
> that the overrun does not occur. For this case, the length being provided
> is already passed into the caller function so reuse that.
> 
> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> ---

Reviewed-by: David Lechner <dlechner@baylibre.com>

Re: [PATCH 05/16] iio: adc: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.

[Jonathan Cameron]

On Mon, 10 Mar 2025 16:49:18 -0500
David Lechner <dlechner@baylibre.com> wrote:

> On 3/9/25 1:20 PM, Jonathan Cameron wrote:
> > From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> > 
> > This new function allows us to perform debug checks in the helper to ensure
> > that the overrun does not occur.  Use it in all the simple cases where
> > either a static buffer or a structure is used in the drivers.
> > 
> > Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> > ---  
> 
> ...
> 
> > diff --git a/drivers/iio/adc/ad4030.c b/drivers/iio/adc/ad4030.c
> > index 9a020680885d..77c5dd414d36 100644
> > --- a/drivers/iio/adc/ad4030.c
> > +++ b/drivers/iio/adc/ad4030.c
> > @@ -706,8 +706,9 @@ static irqreturn_t ad4030_trigger_handler(int irq, void *p)
> >  	if (ret)
> >  		goto out;
> >  
> > -	iio_push_to_buffers_with_timestamp(indio_dev, st->rx_data.raw,
> > -					   pf->timestamp);
> > +	iio_push_to_buffers_with_ts(indio_dev, st->rx_data.raw,  
> 
> Would &st->rx_data be more correct? I guess it doesn't really matter in this case.
Feels slightly more logical to use rx_data so changed.

> 
> > +				    sizeof(st->rx_data.raw),
> > +				    pf->timestamp);
> >  
> >  out:
> >  	iio_trigger_notify_done(indio_dev->trig);  
> 
> ...
> 
> > diff --git a/drivers/iio/adc/ad7266.c b/drivers/iio/adc/ad7266.c
> > index 18559757f908..4217d3963455 100644
> > --- a/drivers/iio/adc/ad7266.c
> > +++ b/drivers/iio/adc/ad7266.c
> > @@ -87,8 +87,9 @@ static irqreturn_t ad7266_trigger_handler(int irq, void *p)
> >  
> >  	ret = spi_read(st->spi, st->data.sample, 4);
> >  	if (ret == 0) {
> > -		iio_push_to_buffers_with_timestamp(indio_dev, &st->data,
> > -			    pf->timestamp);
> > +		iio_push_to_buffers_with_ts(indio_dev, &st->data,
> > +					    sizeof(st->data),  
> 
> This one has `s64 timestamp;` which should be aligned_s64.
Ah. That's an old bug!  Guess no one rand this on x86_32 :)

I'll add a precursor fix.
Note I didn't include some other drivers in this series because they are
also broken, but I missed this one. Good spot.
> 
> > +					    pf->timestamp);
> >  	}
> >  
> >  	iio_trigger_notify_done(indio_dev->trig);
> > diff --git a/drivers/iio/adc/ad7298.c b/drivers/iio/adc/ad7298.c
> > index 28b88092b4aa..def5f91dc343 100644
> > --- a/drivers/iio/adc/ad7298.c
> > +++ b/drivers/iio/adc/ad7298.c
> > @@ -155,8 +155,9 @@ static irqreturn_t ad7298_trigger_handler(int irq, void *p)
> >  	if (b_sent)
> >  		goto done;
> >  
> > -	iio_push_to_buffers_with_timestamp(indio_dev, st->rx_buf,
> > -		iio_get_time_ns(indio_dev));
> > +	iio_push_to_buffers_with_ts(indio_dev, st->rx_buf,  
> 
> Does this one actually have enough room in rx_buf for 9 16-bit channels and a
> an aligned timestamp?

Only 8 channels have scan_index != -1 so this is fine I think.
-1 is magic for don't allow this one to be used in buffered mode.

> 
> __be16	rx_buf[12] __aligned(IIO_DMA_MINALIGN);
> 
> 
> > +				    sizeof(st->rx_buf),
> > +				    iio_get_time_ns(indio_dev));
> >  
> >  done:
> >  	iio_trigger_notify_done(indio_dev->trig);  
> 
> ...
> 
> > diff --git a/drivers/iio/adc/ad7606.c b/drivers/iio/adc/ad7606.c
> > index 631e83717167..3ffa11b2e060 100644
> > --- a/drivers/iio/adc/ad7606.c
> > +++ b/drivers/iio/adc/ad7606.c
> > @@ -679,8 +679,8 @@ static irqreturn_t ad7606_trigger_handler(int irq, void *p)
> >  	if (ret)
> >  		goto error_ret;
> >  
> > -	iio_push_to_buffers_with_timestamp(indio_dev, &st->data,
> > -					   iio_get_time_ns(indio_dev));
> > +	iio_push_to_buffers_with_ts(indio_dev, &st->data, sizeof(st->data),  
> 
> This one might need ALIGNED in the buffer declarations. I'm working on this
> driver though, so can fix it up.
Corner case.  It's actually fine because IIO_DMA_MINALIGN is >= 8 but
that's not obvious and may not remain true for all future architectures so
indeed good to tidy that up at somepoint with the additional markings.

> 
> > +				    iio_get_time_ns(indio_dev));
> >  error_ret:
> >  	iio_trigger_notify_done(indio_dev->trig);
> >  	/* The rising edge of the CONVST signal starts a new conversion. */
> > diff --git a/drivers/iio/adc/ad7768-1.c b/drivers/iio/adc/ad7768-1.c
> > index 5a863005aca6..4eb586d473ce 100644
> > --- a/drivers/iio/adc/ad7768-1.c
> > +++ b/drivers/iio/adc/ad7768-1.c
> > @@ -474,8 +474,9 @@ static irqreturn_t ad7768_trigger_handler(int irq, void *p)
> >  	if (ret < 0)
> >  		goto out;
> >  
> > -	iio_push_to_buffers_with_timestamp(indio_dev, &st->data.scan,
> > -					   iio_get_time_ns(indio_dev));
> > +	iio_push_to_buffers_with_ts(indio_dev, &st->data.scan,
> > +				    sizeof(st->data.scan),  
> 
> This one could use aligned_s64 on the timestamp.
Definitely. Another bug I'll put a separate fix in for this.

> 
> > +				    iio_get_time_ns(indio_dev));
> >  
> >  out:
> >  	iio_trigger_notify_done(indio_dev->trig);  
> 
> ...
> 
> > diff --git a/drivers/iio/adc/ad7923.c b/drivers/iio/adc/ad7923.c
> > index 87945efb940b..0369151c7db1 100644
> > --- a/drivers/iio/adc/ad7923.c
> > +++ b/drivers/iio/adc/ad7923.c
> > @@ -207,8 +207,8 @@ static irqreturn_t ad7923_trigger_handler(int irq, void *p)
> >  	if (b_sent)
> >  		goto done;
> >  
> > -	iio_push_to_buffers_with_timestamp(indio_dev, st->rx_buf,
> > -					   iio_get_time_ns(indio_dev));
> > +	iio_push_to_buffers_with_ts(indio_dev, st->rx_buf, sizeof(st->rx_buf),  
> 
> This one is similar to ad7298 but doesn't have a temperature channel, so
> probably OK. Still could use ALIGNED in the buffer declaration to make it more
> obvious that we have a timestamp.

Also relies on IIO_DMA_MINALIGN >= 8
It's a bit messy to force alignment twice so I'll leave this for now.

> 
> > +				    iio_get_time_ns(indio_dev));
> >  
> >  done:
> >  	iio_trigger_notify_done(indio_dev->trig);
> > diff --git a/drivers/iio/adc/dln2-adc.c b/drivers/iio/adc/dln2-adc.c
> > index a1e48a756a7b..5ffb4b5f5c99 100644
> > --- a/drivers/iio/adc/dln2-adc.c
> > +++ b/drivers/iio/adc/dln2-adc.c
> > @@ -488,8 +488,8 @@ static irqreturn_t dln2_adc_trigger_h(int irq, void *p)
> >  		       (void *)dev_data.values + t->from, t->length);
> >  	}
> >  
> > -	iio_push_to_buffers_with_timestamp(indio_dev, &data,
> > -					   iio_get_time_ns(indio_dev));
> > +	iio_push_to_buffers_with_ts(indio_dev, &data, sizeof(data),  
> 
> Could use aligned_s64 on timestamp_space.

This one is more subtle as the structure is big enough but the overall
structure might be misaligned. I'll add a patch fixing it but not sure
it is suitable for a backport.

> 
> > +				    iio_get_time_ns(indio_dev));
> >  
> >  done:
> >  	iio_trigger_notify_done(indio_dev->trig);  
> 
> ...
> 
> > diff --git a/drivers/iio/adc/mxs-lradc-adc.c b/drivers/iio/adc/mxs-lradc-adc.c
> > index 8f1e6acea53b..92baf3f5f560 100644
> > --- a/drivers/iio/adc/mxs-lradc-adc.c
> > +++ b/drivers/iio/adc/mxs-lradc-adc.c
> > @@ -425,7 +425,8 @@ static irqreturn_t mxs_lradc_adc_trigger_handler(int irq, void *p)
> >  		j++;
> >  	}
> >  
> > -	iio_push_to_buffers_with_timestamp(iio, adc->buffer, pf->timestamp);
> > +	iio_push_to_buffers_with_ts(iio, adc->buffer, sizeof(adc->buffer),  
> 
> u32			buffer[10] __aligned(8);
> 
> Technically OK, but could use ALIGN. There are some other drivers like this
> but I won't call all of them out since they should be OK.

You mean to calculate the number of entrees in the array?

Jonathan

> 
> > +				    pf->timestamp);
> >  
> >  	iio_trigger_notify_done(iio->trig);
> >    
> 
> ...
> 
> > diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c
> > index 5dbf5f136768..32e7938b3892 100644
> > --- a/drivers/iio/adc/stm32-adc.c
> > +++ b/drivers/iio/adc/stm32-adc.c
> > @@ -1858,8 +1858,8 @@ static irqreturn_t stm32_adc_trigger_handler(int irq, void *p)
> >  
> >  	/* reset buffer index */
> >  	adc->bufi = 0;
> > -	iio_push_to_buffers_with_timestamp(indio_dev, adc->buffer,
> > -					   pf->timestamp);
> > +	iio_push_to_buffers_with_ts(indio_dev, adc->buffer, sizeof(adc->buffer),  
> 
> u16			buffer[STM32_ADC_MAX_SQ + 4] __aligned(8);
> 
> Could use ALIGN for timestamp instead of assuming STM32_ADC_MAX_SQ * 2 is the
> correct alignment. There are also a few more drivers like this that depend on
> a macro being even or multiple of 4 to get the correct alignment, which seems
> like it could be fragile, e.g. if a temperature channel was added.
> 
> > +				    pf->timestamp);
> >  	iio_trigger_notify_done(indio_dev->trig);
> >  
> >  	/* re-enable eoc irq */  
> 
> ...
> 
> 

Re: [PATCH 06/16] iio: accel: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.

[Jonathan Cameron]

On Mon, 10 Mar 2025 17:20:33 -0500
David Lechner <dlechner@baylibre.com> wrote:

> On 3/9/25 1:20 PM, Jonathan Cameron wrote:
> > From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> > 
> > This new function allows us to perform debug checks in the helper to ensure
> > that the overrun does not occur.  Use it in all the simple cases where
> > either a static buffer or a structure is used in the drivers.
> > 
> > Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> > ---
> >  drivers/iio/accel/adxl355_core.c    | 4 ++--
> >  drivers/iio/accel/bma180.c          | 3 ++-
> >  drivers/iio/accel/bma220_spi.c      | 4 ++--
> >  drivers/iio/accel/bma400_core.c     | 5 +++--
> >  drivers/iio/accel/fxls8962af-core.c | 4 ++--
> >  drivers/iio/accel/kxcjk-1013.c      | 4 ++--
> >  drivers/iio/accel/kxsd9.c           | 5 ++---
> >  drivers/iio/accel/mma7455_core.c    | 5 +++--
> >  drivers/iio/accel/mma8452.c         | 5 +++--
> >  drivers/iio/accel/msa311.c          | 4 ++--
> >  drivers/iio/accel/mxc4005.c         | 4 ++--
> >  drivers/iio/accel/sca3300.c         | 5 +++--
> >  drivers/iio/accel/stk8312.c         | 2 +-
> >  drivers/iio/accel/stk8ba50.c        | 4 ++--
> >  14 files changed, 31 insertions(+), 27 deletions(-)
> > 
> > diff --git a/drivers/iio/accel/adxl355_core.c b/drivers/iio/accel/adxl355_core.c
> > index e8cd21fa77a6..ae949ada6db5 100644
> > --- a/drivers/iio/accel/adxl355_core.c
> > +++ b/drivers/iio/accel/adxl355_core.c
> > @@ -666,8 +666,8 @@ static irqreturn_t adxl355_trigger_handler(int irq, void *p)
> >  	if (ret)
> >  		goto out_unlock_notify;
> >  
> > -	iio_push_to_buffers_with_timestamp(indio_dev, &data->buffer,
> > -					   pf->timestamp);
> > +	iio_push_to_buffers_with_ts(indio_dev, &data->buffer,  
> 
> Could also use aligned_s64 in the declaration of buffer.ts.
I think that's a bug given it might be 32 bit aligned (we love x86_32)
and the structure come up short.  

> 
> > +				    sizeof(data->buffer), pf->timestamp);
> >  
> >  out_unlock_notify:
> >  	mutex_unlock(&data->lock);  
> 
> The rest check out.
> 
> Reviewed-by: David Lechner <dlechner@baylibre.com>
> 
> 

Re: [PATCH 05/16] iio: adc: Use iio_push_to_buffers_with_ts() to provide length for runtime checks.

[David Lechner]

On 4/6/25 12:02 PM, Jonathan Cameron wrote:
> On Mon, 10 Mar 2025 16:49:18 -0500
> David Lechner <dlechner@baylibre.com> wrote:
> 
>> On 3/9/25 1:20 PM, Jonathan Cameron wrote:
>>> From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
>>>

...

>>> @@ -425,7 +425,8 @@ static irqreturn_t mxs_lradc_adc_trigger_handler(int irq, void *p)
>>>  		j++;
>>>  	}
>>>  
>>> -	iio_push_to_buffers_with_timestamp(iio, adc->buffer, pf->timestamp);
>>> +	iio_push_to_buffers_with_ts(iio, adc->buffer, sizeof(adc->buffer),  
>>
>> u32			buffer[10] __aligned(8);
>>
>> Technically OK, but could use ALIGN. There are some other drivers like this
>> but I won't call all of them out since they should be OK.
> 
> You mean to calculate the number of entrees in the array?
> 
> Jonathan
> 
>>

Most of the ones like this have comments explaining that the number
is X number of Y-byte samples plus 8-byte aligned timestamp.

Even though the ALIGN variant is a bit more verbose, it documents
the same thing in code instead of the comments.

So it's just a personal preference thing.