--- /dev/null
+From e972b08b91ef48488bae9789f03cfedb148667fb Mon Sep 17 00:00:00 2001
+From: Omar Sandoval <osandov@fb.com>
+Date: Tue, 15 Oct 2024 10:59:46 -0700
+Subject: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race
+
+From: Omar Sandoval <osandov@fb.com>
+
+commit e972b08b91ef48488bae9789f03cfedb148667fb upstream.
+
+We're seeing crashes from rq_qos_wake_function that look like this:
+
+ BUG: unable to handle page fault for address: ffffafe180a40084
+ #PF: supervisor write access in kernel mode
+ #PF: error_code(0x0002) - not-present page
+ PGD 100000067 P4D 100000067 PUD 10027c067 PMD 10115d067 PTE 0
+ Oops: Oops: 0002 [#1] PREEMPT SMP PTI
+ CPU: 17 UID: 0 PID: 0 Comm: swapper/17 Not tainted 6.12.0-rc3-00013-geca631b8fe80 #11
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
+ RIP: 0010:_raw_spin_lock_irqsave+0x1d/0x40
+ Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 9c 41 5c fa 65 ff 05 62 97 30 4c 31 c0 ba 01 00 00 00 <f0> 0f b1 17 75 0a 4c 89 e0 41 5c c3 cc cc cc cc 89 c6 e8 2c 0b 00
+ RSP: 0018:ffffafe180580ca0 EFLAGS: 00010046
+ RAX: 0000000000000000 RBX: ffffafe180a3f7a8 RCX: 0000000000000011
+ RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffffafe180a40084
+ RBP: 0000000000000000 R08: 00000000001e7240 R09: 0000000000000011
+ R10: 0000000000000028 R11: 0000000000000888 R12: 0000000000000002
+ R13: ffffafe180a40084 R14: 0000000000000000 R15: 0000000000000003
+ FS: 0000000000000000(0000) GS:ffff9aaf1f280000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: ffffafe180a40084 CR3: 000000010e428002 CR4: 0000000000770ef0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ PKRU: 55555554
+ Call Trace:
+ <IRQ>
+ try_to_wake_up+0x5a/0x6a0
+ rq_qos_wake_function+0x71/0x80
+ __wake_up_common+0x75/0xa0
+ __wake_up+0x36/0x60
+ scale_up.part.0+0x50/0x110
+ wb_timer_fn+0x227/0x450
+ ...
+
+So rq_qos_wake_function() calls wake_up_process(data->task), which calls
+try_to_wake_up(), which faults in raw_spin_lock_irqsave(&p->pi_lock).
+
+p comes from data->task, and data comes from the waitqueue entry, which
+is stored on the waiter's stack in rq_qos_wait(). Analyzing the core
+dump with drgn, I found that the waiter had already woken up and moved
+on to a completely unrelated code path, clobbering what was previously
+data->task. Meanwhile, the waker was passing the clobbered garbage in
+data->task to wake_up_process(), leading to the crash.
+
+What's happening is that in between rq_qos_wake_function() deleting the
+waitqueue entry and calling wake_up_process(), rq_qos_wait() is finding
+that it already got a token and returning. The race looks like this:
+
+rq_qos_wait() rq_qos_wake_function()
+==============================================================
+prepare_to_wait_exclusive()
+ data->got_token = true;
+ list_del_init(&curr->entry);
+if (data.got_token)
+ break;
+finish_wait(&rqw->wait, &data.wq);
+ ^- returns immediately because
+ list_empty_careful(&wq_entry->entry)
+ is true
+... return, go do something else ...
+ wake_up_process(data->task)
+ (NO LONGER VALID!)-^
+
+Normally, finish_wait() is supposed to synchronize against the waker.
+But, as noted above, it is returning immediately because the waitqueue
+entry has already been removed from the waitqueue.
+
+The bug is that rq_qos_wake_function() is accessing the waitqueue entry
+AFTER deleting it. Note that autoremove_wake_function() wakes the waiter
+and THEN deletes the waitqueue entry, which is the proper order.
+
+Fix it by swapping the order. We also need to use
+list_del_init_careful() to match the list_empty_careful() in
+finish_wait().
+
+Fixes: 38cfb5a45ee0 ("blk-wbt: improve waking of tasks")
+Cc: stable@vger.kernel.org
+Signed-off-by: Omar Sandoval <osandov@fb.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Link: https://lore.kernel.org/r/d3bee2463a67b1ee597211823bf7ad3721c26e41.1729014591.git.osandov@fb.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-rq-qos.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/block/blk-rq-qos.c
++++ b/block/blk-rq-qos.c
+@@ -225,8 +225,8 @@ static int rq_qos_wake_function(struct w
+
+ data->got_token = true;
+ smp_wmb();
+- list_del_init(&curr->entry);
+ wake_up_process(data->task);
++ list_del_init_careful(&curr->entry);
+ return 1;
+ }
+
--- /dev/null
+From 28127dba64d8ae1a0b737b973d6d029908599611 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Mon, 14 Oct 2024 19:09:36 +0300
+Subject: drm/radeon: Fix encoder->possible_clones
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 28127dba64d8ae1a0b737b973d6d029908599611 upstream.
+
+Include the encoder itself in its possible_clones bitmask.
+In the past nothing validated that drivers were populating
+possible_clones correctly, but that changed in commit
+74d2aacbe840 ("drm: Validate encoder->possible_clones").
+Looks like radeon never got the memo and is still not
+following the rules 100% correctly.
+
+This results in some warnings during driver initialization:
+Bogus possible_clones: [ENCODER:46:TV-46] possible_clones=0x4 (full encoder mask=0x7)
+WARNING: CPU: 0 PID: 170 at drivers/gpu/drm/drm_mode_config.c:615 drm_mode_config_validate+0x113/0x39c
+...
+
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: amd-gfx@lists.freedesktop.org
+Fixes: 74d2aacbe840 ("drm: Validate encoder->possible_clones")
+Reported-by: Erhard Furtner <erhard_f@mailbox.org>
+Closes: https://lore.kernel.org/dri-devel/20241009000321.418e4294@yea/
+Tested-by: Erhard Furtner <erhard_f@mailbox.org>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 3b6e7d40649c0d75572039aff9d0911864c689db)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/radeon_encoders.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_encoders.c
++++ b/drivers/gpu/drm/radeon/radeon_encoders.c
+@@ -41,7 +41,7 @@ static uint32_t radeon_encoder_clones(st
+ struct radeon_device *rdev = dev->dev_private;
+ struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+ struct drm_encoder *clone_encoder;
+- uint32_t index_mask = 0;
++ uint32_t index_mask = drm_encoder_mask(encoder);
+ int count;
+
+ /* DIG routing gets problematic */
--- /dev/null
+From 26498b8d54373d31a621d7dec95c4bd842563b3b Mon Sep 17 00:00:00 2001
+From: Nikolay Kuratov <kniv@yandex-team.ru>
+Date: Wed, 2 Oct 2024 15:24:29 +0300
+Subject: drm/vmwgfx: Handle surface check failure correctly
+
+From: Nikolay Kuratov <kniv@yandex-team.ru>
+
+commit 26498b8d54373d31a621d7dec95c4bd842563b3b upstream.
+
+Currently if condition (!bo and !vmw_kms_srf_ok()) was met
+we go to err_out with ret == 0.
+err_out dereferences vfb if ret == 0, but in our case vfb is still NULL.
+
+Fix this by assigning sensible error to ret.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE
+
+Signed-off-by: Nikolay Kuratov <kniv@yandex-team.ru>
+Cc: stable@vger.kernel.org
+Fixes: 810b3e1683d0 ("drm/vmwgfx: Support topology greater than texture size")
+Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241002122429.1981822-1-kniv@yandex-team.ru
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+@@ -1417,6 +1417,7 @@ static struct drm_framebuffer *vmw_kms_f
+ DRM_ERROR("Surface size cannot exceed %dx%d\n",
+ dev_priv->texture_max_width,
+ dev_priv->texture_max_height);
++ ret = -EINVAL;
+ goto err_out;
+ }
+
--- /dev/null
+From eb143d05def52bc6d193e813018e5fa1a0e47c77 Mon Sep 17 00:00:00 2001
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Date: Thu, 3 Oct 2024 23:04:49 +0200
+Subject: iio: adc: ti-ads124s08: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+commit eb143d05def52bc6d193e813018e5fa1a0e47c77 upstream.
+
+This driver makes use of triggered buffers, but does not select the
+required modules.
+
+Add the missing 'select IIO_BUFFER' and 'select IIO_TRIGGERED_BUFFER'.
+
+Fixes: e717f8c6dfec ("iio: adc: Add the TI ads124s08 ADC code")
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Link: https://patch.msgid.link/20241003-iio-select-v1-3-67c0385197cd@gmail.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/Kconfig | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/iio/adc/Kconfig
++++ b/drivers/iio/adc/Kconfig
+@@ -1143,6 +1143,8 @@ config TI_ADS8688
+ config TI_ADS124S08
+ tristate "Texas Instruments ADS124S08"
+ depends on SPI && OF
++ select IIO_BUFFER
++ select IIO_TRIGGERED_BUFFER
+ help
+ If you say yes here you get support for Texas Instruments ADS124S08
+ and ADS124S06 ADC chips
--- /dev/null
+From 4c4834fd8696a949d1b1f1c2c5b96e1ad2083b02 Mon Sep 17 00:00:00 2001
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Date: Thu, 3 Oct 2024 23:04:50 +0200
+Subject: iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+commit 4c4834fd8696a949d1b1f1c2c5b96e1ad2083b02 upstream.
+
+This driver makes use of triggered buffers, but does not select the
+required modules.
+
+Fixes: 2a86487786b5 ("iio: adc: ti-ads8688: add trigger and buffer support")
+Add the missing 'select IIO_BUFFER' and 'select IIO_TRIGGERED_BUFFER'.
+
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Reviewed-by: Sean Nyekjaer <sean@geanix.com>
+Link: https://patch.msgid.link/20241003-iio-select-v1-4-67c0385197cd@gmail.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/Kconfig | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/iio/adc/Kconfig
++++ b/drivers/iio/adc/Kconfig
+@@ -1131,6 +1131,8 @@ config TI_ADS8344
+ config TI_ADS8688
+ tristate "Texas Instruments ADS8688"
+ depends on SPI && OF
++ select IIO_BUFFER
++ select IIO_TRIGGERED_BUFFER
+ help
+ If you say yes here you get support for Texas Instruments ADS8684 and
+ and ADS8688 ADC chips
--- /dev/null
+From bcdab6f74c91cda19714354fd4e9e3ef3c9a78b3 Mon Sep 17 00:00:00 2001
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Date: Thu, 3 Oct 2024 18:49:38 +0200
+Subject: iio: dac: ad5770r: add missing select REGMAP_SPI in Kconfig
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+commit bcdab6f74c91cda19714354fd4e9e3ef3c9a78b3 upstream.
+
+This driver makes use of regmap_spi, but does not select the required
+module.
+Add the missing 'select REGMAP_SPI'.
+
+Fixes: cbbb819837f6 ("iio: dac: ad5770r: Add AD5770R support")
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Link: https://patch.msgid.link/20241003-ad2s1210-select-v1-6-4019453f8c33@gmail.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/dac/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iio/dac/Kconfig
++++ b/drivers/iio/dac/Kconfig
+@@ -203,6 +203,7 @@ config AD5766
+ config AD5770R
+ tristate "Analog Devices AD5770R IDAC driver"
+ depends on SPI_MASTER
++ select REGMAP_SPI
+ help
+ Say yes here to build support for Analog Devices AD5770R Digital to
+ Analog Converter.
--- /dev/null
+From 252ff06a4cb4e572cb3c7fcfa697db96b08a7781 Mon Sep 17 00:00:00 2001
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Date: Thu, 3 Oct 2024 18:49:39 +0200
+Subject: iio: dac: ltc1660: add missing select REGMAP_SPI in Kconfig
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+commit 252ff06a4cb4e572cb3c7fcfa697db96b08a7781 upstream.
+
+This driver makes use of regmap_spi, but does not select the required
+module.
+Add the missing 'select REGMAP_SPI'.
+
+Fixes: 8316cebd1e59 ("iio: dac: add support for ltc1660")
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Link: https://patch.msgid.link/20241003-ad2s1210-select-v1-7-4019453f8c33@gmail.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/dac/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iio/dac/Kconfig
++++ b/drivers/iio/dac/Kconfig
+@@ -284,6 +284,7 @@ config LPC18XX_DAC
+ config LTC1660
+ tristate "Linear Technology LTC1660/LTC1665 DAC SPI driver"
+ depends on SPI
++ select REGMAP_SPI
+ help
+ Say yes here to build support for Linear Technology
+ LTC1660 and LTC1665 Digital to Analog Converters.
--- /dev/null
+From 27b6aa68a68105086aef9f0cb541cd688e5edea8 Mon Sep 17 00:00:00 2001
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Date: Thu, 3 Oct 2024 18:49:40 +0200
+Subject: iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+commit 27b6aa68a68105086aef9f0cb541cd688e5edea8 upstream.
+
+This driver makes use of regmap_mmio, but does not select the required
+module.
+Add the missing 'select REGMAP_MMIO'.
+
+Fixes: 4d4b30526eb8 ("iio: dac: add support for stm32 DAC")
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Link: https://patch.msgid.link/20241003-ad2s1210-select-v1-8-4019453f8c33@gmail.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/dac/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iio/dac/Kconfig
++++ b/drivers/iio/dac/Kconfig
+@@ -371,6 +371,7 @@ config STM32_DAC
+
+ config STM32_DAC_CORE
+ tristate
++ select REGMAP_MMIO
+
+ config TI_DAC082S085
+ tristate "Texas Instruments 8/10/12-bit 2/4-channel DAC driver"
--- /dev/null
+From 3a29b84cf7fbf912a6ab1b9c886746f02b74ea25 Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Thu, 3 Oct 2024 20:41:12 +0200
+Subject: iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit 3a29b84cf7fbf912a6ab1b9c886746f02b74ea25 upstream.
+
+If hid_sensor_set_report_latency() fails, the error code should be returned
+instead of a value likely to be interpreted as 'success'.
+
+Fixes: 138bc7969c24 ("iio: hid-sensor-hub: Implement batch mode")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Link: https://patch.msgid.link/c50640665f091a04086e5092cf50f73f2055107a.1727980825.git.christophe.jaillet@wanadoo.fr
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
++++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+@@ -32,7 +32,7 @@ static ssize_t _hid_sensor_set_report_la
+ latency = integer * 1000 + fract / 1000;
+ ret = hid_sensor_set_report_latency(attrb, latency);
+ if (ret < 0)
+- return len;
++ return ret;
+
+ attrb->latency_ms = hid_sensor_get_report_latency(attrb);
+
--- /dev/null
+From 530688e39c644543b71bdd9cb45fdfb458a28eaa Mon Sep 17 00:00:00 2001
+From: Emil Gedenryd <emil.gedenryd@axis.com>
+Date: Fri, 13 Sep 2024 11:57:02 +0200
+Subject: iio: light: opt3001: add missing full-scale range value
+
+From: Emil Gedenryd <emil.gedenryd@axis.com>
+
+commit 530688e39c644543b71bdd9cb45fdfb458a28eaa upstream.
+
+The opt3001 driver uses predetermined full-scale range values to
+determine what exponent to use for event trigger threshold values.
+The problem is that one of the values specified in the datasheet is
+missing from the implementation. This causes larger values to be
+scaled down to an incorrect exponent, effectively reducing the
+maximum settable threshold value by a factor of 2.
+
+Add missing full-scale range array value.
+
+Fixes: 94a9b7b1809f ("iio: light: add support for TI's opt3001 light sensor")
+Signed-off-by: Emil Gedenryd <emil.gedenryd@axis.com>
+Cc: <Stable@vger.kernel.org>
+Link: https://patch.msgid.link/20240913-add_opt3002-v2-1-69e04f840360@axis.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/light/opt3001.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/iio/light/opt3001.c
++++ b/drivers/iio/light/opt3001.c
+@@ -139,6 +139,10 @@ static const struct opt3001_scale opt300
+ .val2 = 400000,
+ },
+ {
++ .val = 41932,
++ .val2 = 800000,
++ },
++ {
+ .val = 83865,
+ .val2 = 600000,
+ },
--- /dev/null
+From c9e9746f275c45108f2b0633a4855d65d9ae0736 Mon Sep 17 00:00:00 2001
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Date: Mon, 23 Sep 2024 00:17:49 +0200
+Subject: iio: light: veml6030: fix ALS sensor resolution
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+commit c9e9746f275c45108f2b0633a4855d65d9ae0736 upstream.
+
+The driver still uses the sensor resolution provided in the datasheet
+until Rev. 1.6, 28-Apr-2022, which was updated with Rev 1.7,
+28-Nov-2023. The original ambient light resolution has been updated from
+0.0036 lx/ct to 0.0042 lx/ct, which is the value that can be found in
+the current device datasheet.
+
+Update the default resolution for IT = 100 ms and GAIN = 1/8 from the
+original 4608 mlux/cnt to the current value from the "Resolution and
+maximum detection range" table (Application Note 84367, page 5), 5376
+mlux/cnt.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 7b779f573c48 ("iio: light: add driver for veml6030 ambient light sensor")
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Link: https://patch.msgid.link/20240923-veml6035-v2-1-58c72a0df31c@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/light/veml6030.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/light/veml6030.c
++++ b/drivers/iio/light/veml6030.c
+@@ -780,7 +780,7 @@ static int veml6030_hw_init(struct iio_d
+
+ /* Cache currently active measurement parameters */
+ data->cur_gain = 3;
+- data->cur_resolution = 4608;
++ data->cur_resolution = 5376;
+ data->cur_integration_time = 3;
+
+ return ret;
--- /dev/null
+From c7c44e57750c31de43906d97813273fdffcf7d02 Mon Sep 17 00:00:00 2001
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Date: Fri, 13 Sep 2024 15:18:58 +0200
+Subject: iio: light: veml6030: fix IIO device retrieval from embedded device
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+commit c7c44e57750c31de43906d97813273fdffcf7d02 upstream.
+
+The dev pointer that is received as an argument in the
+in_illuminance_period_available_show function references the device
+embedded in the IIO device, not in the i2c client.
+
+dev_to_iio_dev() must be used to accessthe right data. The current
+implementation leads to a segmentation fault on every attempt to read
+the attribute because indio_dev gets a NULL assignment.
+
+This bug has been present since the first appearance of the driver,
+apparently since the last version (V6) before getting applied. A
+constant attribute was used until then, and the last modifications might
+have not been tested again.
+
+Cc: stable@vger.kernel.org
+Fixes: 7b779f573c48 ("iio: light: add driver for veml6030 ambient light sensor")
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Link: https://patch.msgid.link/20240913-veml6035-v1-3-0b09c0c90418@gmail.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/light/veml6030.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/iio/light/veml6030.c
++++ b/drivers/iio/light/veml6030.c
+@@ -99,9 +99,8 @@ static const char * const period_values[
+ static ssize_t in_illuminance_period_available_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
++ struct veml6030_data *data = iio_priv(dev_to_iio_dev(dev));
+ int ret, reg, x;
+- struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev));
+- struct veml6030_data *data = iio_priv(indio_dev);
+
+ ret = regmap_read(data->regmap, VEML6030_REG_ALS_CONF, ®);
+ if (ret) {
--- /dev/null
+From 75461a0b15d7c026924d0001abce0476bbc7eda8 Mon Sep 17 00:00:00 2001
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Date: Thu, 3 Oct 2024 23:04:59 +0200
+Subject: iio: proximity: mb1232: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+commit 75461a0b15d7c026924d0001abce0476bbc7eda8 upstream.
+
+This driver makes use of triggered buffers, but does not select the
+required modules.
+
+Add the missing 'select IIO_BUFFER' and 'select IIO_TRIGGERED_BUFFER'.
+
+Fixes: 16b05261537e ("mb1232.c: add distance iio sensor with i2c")
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Link: https://patch.msgid.link/20241003-iio-select-v1-13-67c0385197cd@gmail.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/proximity/Kconfig | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/iio/proximity/Kconfig
++++ b/drivers/iio/proximity/Kconfig
+@@ -60,6 +60,8 @@ config LIDAR_LITE_V2
+ config MB1232
+ tristate "MaxSonar I2CXL family ultrasonic sensors"
+ depends on I2C
++ select IIO_BUFFER
++ select IIO_TRIGGERED_BUFFER
+ help
+ Say Y to build a driver for the ultrasonic sensors I2CXL of
+ MaxBotix which have an i2c interface. It can be used to measure
--- /dev/null
+From 28aabffae6be54284869a91cd8bccd3720041129 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Tue, 15 Oct 2024 08:58:25 -0600
+Subject: io_uring/sqpoll: close race on waiting for sqring entries
+
+From: Jens Axboe <axboe@kernel.dk>
+
+commit 28aabffae6be54284869a91cd8bccd3720041129 upstream.
+
+When an application uses SQPOLL, it must wait for the SQPOLL thread to
+consume SQE entries, if it fails to get an sqe when calling
+io_uring_get_sqe(). It can do so by calling io_uring_enter(2) with the
+flag value of IORING_ENTER_SQ_WAIT. In liburing, this is generally done
+with io_uring_sqring_wait(). There's a natural expectation that once
+this call returns, a new SQE entry can be retrieved, filled out, and
+submitted. However, the kernel uses the cached sq head to determine if
+the SQRING is full or not. If the SQPOLL thread is currently in the
+process of submitting SQE entries, it may have updated the cached sq
+head, but not yet committed it to the SQ ring. Hence the kernel may find
+that there are SQE entries ready to be consumed, and return successfully
+to the application. If the SQPOLL thread hasn't yet committed the SQ
+ring entries by the time the application returns to userspace and
+attempts to get a new SQE, it will fail getting a new SQE.
+
+Fix this by having io_sqring_full() always use the user visible SQ ring
+head entry, rather than the internally cached one.
+
+Cc: stable@vger.kernel.org # 5.10+
+Link: https://github.com/axboe/liburing/discussions/1267
+Reported-by: Benedek Thaler <thaler@thaler.hu>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/io_uring.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/io_uring/io_uring.c
++++ b/io_uring/io_uring.c
+@@ -1583,7 +1583,14 @@ static inline bool io_sqring_full(struct
+ {
+ struct io_rings *r = ctx->rings;
+
+- return READ_ONCE(r->sq.tail) - ctx->cached_sq_head == ctx->sq_entries;
++ /*
++ * SQPOLL must use the actual sqring head, as using the cached_sq_head
++ * is race prone if the SQPOLL thread has grabbed entries but not yet
++ * committed them to the ring. For !SQPOLL, this doesn't matter, but
++ * since this helper is just used for SQPOLL sqring waits (or POLLOUT),
++ * just read the actual sqring head unconditionally.
++ */
++ return READ_ONCE(r->sq.tail) - READ_ONCE(r->sq.head) == ctx->sq_entries;
+ }
+
+ static inline unsigned int __io_cqring_events(struct io_ring_ctx *ctx)
x86-entry-have-entry_ibpb-invalidate-return-predictions.patch
x86-bugs-skip-rsb-fill-at-vmexit.patch
x86-bugs-do-not-use-untrain_ret-with-ibpb-on-entry.patch
+blk-rq-qos-fix-crash-on-rq_qos_wait-vs.-rq_qos_wake_function-race.patch
+io_uring-sqpoll-close-race-on-waiting-for-sqring-entries.patch
+drm-radeon-fix-encoder-possible_clones.patch
+drm-vmwgfx-handle-surface-check-failure-correctly.patch
+iio-dac-ad5770r-add-missing-select-regmap_spi-in-kconfig.patch
+iio-dac-ltc1660-add-missing-select-regmap_spi-in-kconfig.patch
+iio-dac-stm32-dac-core-add-missing-select-regmap_mmio-in-kconfig.patch
+iio-adc-ti-ads8688-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch
+iio-hid-sensors-fix-an-error-handling-path-in-_hid_sensor_set_report_latency.patch
+iio-light-veml6030-fix-als-sensor-resolution.patch
+iio-light-veml6030-fix-iio-device-retrieval-from-embedded-device.patch
+iio-light-opt3001-add-missing-full-scale-range-value.patch
+iio-proximity-mb1232-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch
+iio-adc-ti-ads124s08-add-missing-select-iio_-triggered_-buffer-in-kconfig.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
