6.16-stable patches

added patches:
	fpga-zynq_fpga-fix-the-wrong-usage-of-dma_map_sgtable.patch
	iio-accel-sca3300-fix-uninitialized-iio-scan-data.patch
	iio-adc-ad7380-fix-missing-max_conversion_rate_hz-on-adaq4381-4.patch

diff --git a/queue-6.16/fpga-zynq_fpga-fix-the-wrong-usage-of-dma_map_sgtable.patch b/queue-6.16/fpga-zynq_fpga-fix-the-wrong-usage-of-dma_map_sgtable.patch
new file mode 100644 (file)
index 0000000..f0821be
--- /dev/null
+++ b/queue-6.16/fpga-zynq_fpga-fix-the-wrong-usage-of-dma_map_sgtable.patch
@@ -0,0 +1,44 @@
+From 1ca61060de92a4320d73adfe5dc8d335653907ac Mon Sep 17 00:00:00 2001
+From: Xu Yilun <yilun.xu@linux.intel.com>
+Date: Wed, 6 Aug 2025 15:06:05 +0800
+Subject: fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
+
+From: Xu Yilun <yilun.xu@linux.intel.com>
+
+commit 1ca61060de92a4320d73adfe5dc8d335653907ac upstream.
+
+dma_map_sgtable() returns only 0 or the error code. Read sgt->nents to
+get the number of mapped segments.
+
+Fixes: 37e00703228a ("zynq_fpga: use sgtable-based scatterlist wrappers")
+Reported-by: Pavel Pisa <pisa@fel.cvut.cz>
+Closes: https://lore.kernel.org/linux-fpga/202508041548.22955.pisa@fel.cvut.cz/
+Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
+Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
+Tested-by: Pavel Pisa <pisa@fel.cvut.cz>
+Link: https://lore.kernel.org/r/20250806070605.1920909-2-yilun.xu@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/fpga/zynq-fpga.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/fpga/zynq-fpga.c
++++ b/drivers/fpga/zynq-fpga.c
+@@ -405,12 +405,12 @@ static int zynq_fpga_ops_write(struct fp
+               }
+       }
+ 
+-      priv->dma_nelms =
+-          dma_map_sgtable(mgr->dev.parent, sgt, DMA_TO_DEVICE, 0);
+-      if (priv->dma_nelms == 0) {
++      err = dma_map_sgtable(mgr->dev.parent, sgt, DMA_TO_DEVICE, 0);
++      if (err) {
+               dev_err(&mgr->dev, "Unable to DMA map (TO_DEVICE)\n");
+-              return -ENOMEM;
++              return err;
+       }
++      priv->dma_nelms = sgt->nents;
+ 
+       /* enable clock */
+       err = clk_enable(priv->clk);

diff --git a/queue-6.16/iio-accel-sca3300-fix-uninitialized-iio-scan-data.patch b/queue-6.16/iio-accel-sca3300-fix-uninitialized-iio-scan-data.patch
new file mode 100644 (file)
index 0000000..4028a38
--- /dev/null
+++ b/queue-6.16/iio-accel-sca3300-fix-uninitialized-iio-scan-data.patch
@@ -0,0 +1,32 @@
+From 4e5b705cc6147f0b9173c6219079f41416bdd3c0 Mon Sep 17 00:00:00 2001
+From: David Lechner <dlechner@baylibre.com>
+Date: Wed, 23 Jul 2025 10:29:12 -0500
+Subject: iio: accel: sca3300: fix uninitialized iio scan data
+
+From: David Lechner <dlechner@baylibre.com>
+
+commit 4e5b705cc6147f0b9173c6219079f41416bdd3c0 upstream.
+
+Fix potential leak of uninitialized stack data to userspace by ensuring
+that the `channels` array is zeroed before use.
+
+Fixes: edeb67fbbf4b ("iio: accel: sca3300: use IIO_DECLARE_BUFFER_WITH_TS")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Link: https://patch.msgid.link/20250723-iio-accel-sca3300-fix-uninitialized-iio-scan-data-v1-1-12dbfb3307b7@baylibre.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/accel/sca3300.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/accel/sca3300.c
++++ b/drivers/iio/accel/sca3300.c
+@@ -479,7 +479,7 @@ static irqreturn_t sca3300_trigger_handl
+       struct iio_dev *indio_dev = pf->indio_dev;
+       struct sca3300_data *data = iio_priv(indio_dev);
+       int bit, ret, val, i = 0;
+-      IIO_DECLARE_BUFFER_WITH_TS(s16, channels, SCA3300_SCAN_MAX);
++      IIO_DECLARE_BUFFER_WITH_TS(s16, channels, SCA3300_SCAN_MAX) = { };
+ 
+       iio_for_each_active_channel(indio_dev, bit) {
+               ret = sca3300_read_reg(data, indio_dev->channels[bit].address, &val);

diff --git a/queue-6.16/iio-adc-ad7380-fix-missing-max_conversion_rate_hz-on-adaq4381-4.patch b/queue-6.16/iio-adc-ad7380-fix-missing-max_conversion_rate_hz-on-adaq4381-4.patch
new file mode 100644 (file)
index 0000000..ff11a9d
--- /dev/null
+++ b/queue-6.16/iio-adc-ad7380-fix-missing-max_conversion_rate_hz-on-adaq4381-4.patch
@@ -0,0 +1,38 @@
+From b04e4551893fb8a06106a175ed7055d41a9279c4 Mon Sep 17 00:00:00 2001
+From: David Lechner <dlechner@baylibre.com>
+Date: Mon, 11 Aug 2025 13:32:31 -0500
+Subject: iio: adc: ad7380: fix missing max_conversion_rate_hz on adaq4381-4
+
+From: David Lechner <dlechner@baylibre.com>
+
+commit b04e4551893fb8a06106a175ed7055d41a9279c4 upstream.
+
+Add max_conversion_rate_hz to the chip info for "adaq4381-4". Without
+this, the driver fails to probe because it tries to set the initial
+sample rate to 0 Hz, which is not valid.
+
+Fixes: bbeaec81a03e ("iio: ad7380: add support for SPI offload")
+Signed-off-by: David Lechner <dlechner@baylibre.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Link: https://patch.msgid.link/20250811-iio-adc-ad7380-fix-missing-max_conversion_rate_hs-on-ad4381-4-v1-1-ffb728d7a71c@baylibre.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ad7380.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/iio/adc/ad7380.c b/drivers/iio/adc/ad7380.c
+index 6f7034b6c266..fa251dc1aae6 100644
+--- a/drivers/iio/adc/ad7380.c
++++ b/drivers/iio/adc/ad7380.c
+@@ -873,6 +873,7 @@ static const struct ad7380_chip_info adaq4381_4_chip_info = {
+       .has_hardware_gain = true,
+       .available_scan_masks = ad7380_4_channel_scan_masks,
+       .timing_specs = &ad7380_4_timing,
++      .max_conversion_rate_hz = 4 * MEGA,
+ };
+ 
+ static const struct spi_offload_config ad7380_offload_config = {
+-- 
+2.50.1
+

diff --git a/queue-6.16/series b/queue-6.16/series
index 5b9fc7ab3cb30cf2801181a51f87ddbd6fb656ae..132ada9f7c92487c645aa48ecf29601a1b9f4025 100644 (file)
--- a/queue-6.16/series
+++ b/queue-6.16/series
@@ -294,3 +294,6 @@ iommu-remove-ops.pgsize_bitmap-from-drivers-that-don-t-use-it.patch
 iommu-virtio-make-instance-lookup-robust.patch
 drm-amd-restore-cached-manual-clock-settings-during-resume.patch
 drm-dp-change-aux-dpcd-probe-address-from-dpcd_rev-to-lane0_1_status.patch
+fpga-zynq_fpga-fix-the-wrong-usage-of-dma_map_sgtable.patch
+iio-adc-ad7380-fix-missing-max_conversion_rate_hz-on-adaq4381-4.patch
+iio-accel-sca3300-fix-uninitialized-iio-scan-data.patch