From: Greg Kroah-Hartman Date: Sat, 23 Aug 2025 15:41:14 +0000 (+0200) Subject: 6.16-stable patches X-Git-Tag: v5.4.297~58 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1a970b8a0bfc4e49e5f8b145f944b3c9e8f5edeb;p=thirdparty%2Fkernel%2Fstable-queue.git 6.16-stable patches added patches: fpga-zynq_fpga-fix-the-wrong-usage-of-dma_map_sgtable.patch iio-accel-sca3300-fix-uninitialized-iio-scan-data.patch iio-adc-ad7380-fix-missing-max_conversion_rate_hz-on-adaq4381-4.patch --- diff --git a/queue-6.16/fpga-zynq_fpga-fix-the-wrong-usage-of-dma_map_sgtable.patch b/queue-6.16/fpga-zynq_fpga-fix-the-wrong-usage-of-dma_map_sgtable.patch new file mode 100644 index 0000000000..f0821be9fc --- /dev/null +++ b/queue-6.16/fpga-zynq_fpga-fix-the-wrong-usage-of-dma_map_sgtable.patch @@ -0,0 +1,44 @@ +From 1ca61060de92a4320d73adfe5dc8d335653907ac Mon Sep 17 00:00:00 2001 +From: Xu Yilun +Date: Wed, 6 Aug 2025 15:06:05 +0800 +Subject: fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() + +From: Xu Yilun + +commit 1ca61060de92a4320d73adfe5dc8d335653907ac upstream. + +dma_map_sgtable() returns only 0 or the error code. Read sgt->nents to +get the number of mapped segments. + +Fixes: 37e00703228a ("zynq_fpga: use sgtable-based scatterlist wrappers") +Reported-by: Pavel Pisa +Closes: https://lore.kernel.org/linux-fpga/202508041548.22955.pisa@fel.cvut.cz/ +Reviewed-by: Jason Gunthorpe +Reviewed-by: Marek Szyprowski +Signed-off-by: Xu Yilun +Tested-by: Pavel Pisa +Link: https://lore.kernel.org/r/20250806070605.1920909-2-yilun.xu@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/fpga/zynq-fpga.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/fpga/zynq-fpga.c ++++ b/drivers/fpga/zynq-fpga.c +@@ -405,12 +405,12 @@ static int zynq_fpga_ops_write(struct fp + } + } + +- priv->dma_nelms = +- dma_map_sgtable(mgr->dev.parent, sgt, DMA_TO_DEVICE, 0); +- if (priv->dma_nelms == 0) { ++ err = dma_map_sgtable(mgr->dev.parent, sgt, DMA_TO_DEVICE, 0); ++ if (err) { + dev_err(&mgr->dev, "Unable to DMA map (TO_DEVICE)\n"); +- return -ENOMEM; ++ return err; + } ++ priv->dma_nelms = sgt->nents; + + /* enable clock */ + err = clk_enable(priv->clk); diff --git a/queue-6.16/iio-accel-sca3300-fix-uninitialized-iio-scan-data.patch b/queue-6.16/iio-accel-sca3300-fix-uninitialized-iio-scan-data.patch new file mode 100644 index 0000000000..4028a38037 --- /dev/null +++ b/queue-6.16/iio-accel-sca3300-fix-uninitialized-iio-scan-data.patch @@ -0,0 +1,32 @@ +From 4e5b705cc6147f0b9173c6219079f41416bdd3c0 Mon Sep 17 00:00:00 2001 +From: David Lechner +Date: Wed, 23 Jul 2025 10:29:12 -0500 +Subject: iio: accel: sca3300: fix uninitialized iio scan data + +From: David Lechner + +commit 4e5b705cc6147f0b9173c6219079f41416bdd3c0 upstream. + +Fix potential leak of uninitialized stack data to userspace by ensuring +that the `channels` array is zeroed before use. + +Fixes: edeb67fbbf4b ("iio: accel: sca3300: use IIO_DECLARE_BUFFER_WITH_TS") +Signed-off-by: David Lechner +Link: https://patch.msgid.link/20250723-iio-accel-sca3300-fix-uninitialized-iio-scan-data-v1-1-12dbfb3307b7@baylibre.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/accel/sca3300.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/accel/sca3300.c ++++ b/drivers/iio/accel/sca3300.c +@@ -479,7 +479,7 @@ static irqreturn_t sca3300_trigger_handl + struct iio_dev *indio_dev = pf->indio_dev; + struct sca3300_data *data = iio_priv(indio_dev); + int bit, ret, val, i = 0; +- IIO_DECLARE_BUFFER_WITH_TS(s16, channels, SCA3300_SCAN_MAX); ++ IIO_DECLARE_BUFFER_WITH_TS(s16, channels, SCA3300_SCAN_MAX) = { }; + + iio_for_each_active_channel(indio_dev, bit) { + ret = sca3300_read_reg(data, indio_dev->channels[bit].address, &val); diff --git a/queue-6.16/iio-adc-ad7380-fix-missing-max_conversion_rate_hz-on-adaq4381-4.patch b/queue-6.16/iio-adc-ad7380-fix-missing-max_conversion_rate_hz-on-adaq4381-4.patch new file mode 100644 index 0000000000..ff11a9df94 --- /dev/null +++ b/queue-6.16/iio-adc-ad7380-fix-missing-max_conversion_rate_hz-on-adaq4381-4.patch @@ -0,0 +1,38 @@ +From b04e4551893fb8a06106a175ed7055d41a9279c4 Mon Sep 17 00:00:00 2001 +From: David Lechner +Date: Mon, 11 Aug 2025 13:32:31 -0500 +Subject: iio: adc: ad7380: fix missing max_conversion_rate_hz on adaq4381-4 + +From: David Lechner + +commit b04e4551893fb8a06106a175ed7055d41a9279c4 upstream. + +Add max_conversion_rate_hz to the chip info for "adaq4381-4". Without +this, the driver fails to probe because it tries to set the initial +sample rate to 0 Hz, which is not valid. + +Fixes: bbeaec81a03e ("iio: ad7380: add support for SPI offload") +Signed-off-by: David Lechner +Reviewed-by: Andy Shevchenko +Link: https://patch.msgid.link/20250811-iio-adc-ad7380-fix-missing-max_conversion_rate_hs-on-ad4381-4-v1-1-ffb728d7a71c@baylibre.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad7380.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/iio/adc/ad7380.c b/drivers/iio/adc/ad7380.c +index 6f7034b6c266..fa251dc1aae6 100644 +--- a/drivers/iio/adc/ad7380.c ++++ b/drivers/iio/adc/ad7380.c +@@ -873,6 +873,7 @@ static const struct ad7380_chip_info adaq4381_4_chip_info = { + .has_hardware_gain = true, + .available_scan_masks = ad7380_4_channel_scan_masks, + .timing_specs = &ad7380_4_timing, ++ .max_conversion_rate_hz = 4 * MEGA, + }; + + static const struct spi_offload_config ad7380_offload_config = { +-- +2.50.1 + diff --git a/queue-6.16/series b/queue-6.16/series index 5b9fc7ab3c..132ada9f7c 100644 --- a/queue-6.16/series +++ b/queue-6.16/series @@ -294,3 +294,6 @@ iommu-remove-ops.pgsize_bitmap-from-drivers-that-don-t-use-it.patch iommu-virtio-make-instance-lookup-robust.patch drm-amd-restore-cached-manual-clock-settings-during-resume.patch drm-dp-change-aux-dpcd-probe-address-from-dpcd_rev-to-lane0_1_status.patch +fpga-zynq_fpga-fix-the-wrong-usage-of-dma_map_sgtable.patch +iio-adc-ad7380-fix-missing-max_conversion_rate_hz-on-adaq4381-4.patch +iio-accel-sca3300-fix-uninitialized-iio-scan-data.patch