From: Greg Kroah-Hartman Date: Mon, 13 Jul 2026 12:57:25 +0000 (+0200) Subject: 6.18-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5be5dc997d9d77fe384b67ada9bb23b9b88bd78a;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: alsa-usx2y-us144mkii-fix-work-uaf-on-disconnect.patch alsa-virtio-add-missing-384-khz-pcm-rate-mapping.patch alsa-virtio-validate-control-metadata-from-the-device.patch alsa-ymfpci-check-snd_ctl_new1-return-value.patch iio-accel-bmc150-clamp-the-device-reported-fifo-frame-count.patch iio-accel-kxsd9-fix-runtime-pm-imbalance-on-write_raw-error.patch iio-adc-ad7380-select-regmap.patch iio-adc-ad7768-1-select-gpiolib.patch iio-adc-ad7779-add-missing-select-iio_triggered_buffer-to-kconfig.patch iio-adc-ad_sigma_delta-fix-clear_pending_event-for-registerless-devices.patch iio-adc-ad_sigma_delta-fix-cs-held-asserted-and-state-leaks.patch iio-adc-lpc32xx-initialize-completion-before-requesting-irq.patch iio-adc-spear-initialize-completion-before-requesting-irq.patch iio-adc-ti-ads1119-fix-pm-reference-leak-in-buffer-preenable.patch iio-adc-ti-ads124s08-return-reset-gpio-lookup-errors.patch iio-backend-fix-uninitialized-data-in-debugfs.patch iio-chemical-scd30-cleanup-initializations-and-fix-sign-extension-bug.patch iio-common-st_sensors-honour-channel-endianness-in-read_axis_data.patch iio-core-fix-uninitialized-data-in-debugfs.patch iio-dac-ad3552r-hs-fix-uninitialized-data-ni-ad3552r_hs_write_data_source.patch iio-event-fix-event-fifo-reset-race.patch iio-gyro-bmg160-bail-out-when-bandwidth-filter-is-not-in-table.patch iio-gyro-bmg160-wait-full-startup-time-after-mode-change-at-probe.patch iio-imu-adis-add-irqf_no_thread-to-non-fifo-trigger-irq.patch iio-imu-bmi160-add-irqf_no_thread-to-data-ready-trigger-irq.patch iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch iio-imu-inv_icm42600-fix-timestamping-by-limiting-fifo-reading.patch iio-imu-st_lsm6dsx-deselect-shub-page-before-reading-whoami.patch iio-light-al3000a-add-missing-regmap_i2c-to-kconfig.patch iio-light-al3010-add-missing-regmap_i2c-to-kconfig.patch iio-light-al3010-fix-incorrect-scale-for-the-highest-gain-range.patch iio-light-al3010-read-both-als-adc-registers-again.patch iio-light-al3320a-add-missing-regmap_i2c-to-kconfig.patch iio-light-al3320a-read-both-als-adc-registers-again.patch iio-light-gp2ap002-fix-runtime-pm-leak-on-read-error.patch iio-light-opt3001-fix-missing-state-reset-on-timeout.patch iio-light-tsl2591-return-actual-error-from-probe-irq-failure.patch iio-light-veml6030-fix-channel-type-when-pushing-events.patch iio-magnetometer-ak8975-add-missed-pm_runtime_put_autosuspend-call.patch iio-pressure-bmp280-zero-init-bmp580-trigger-handler-buffer.patch iio-pressure-mpl115-fix-runtime-pm-leak-on-read-error.patch iio-proximity-vl53l0x-notify-trigger-and-clear-irq-on-error-paths.patch iio-resolver-ad2s1210-notify-trigger-and-clear-state-on-fault-read-error.patch iio-temperature-build-mlx90635-with-config_mlx90635.patch iio-temperature-ltc2983-fix-n_wires-default-bypassing-rotation-check.patch iio-temperature-ltc2983-fix-reinit_completion-called-after-conversion-start.patch iio-temperature-tmp006-use-devm_iio_trigger_register.patch usb-gadget-function-rndis-add-length-check-for-header.patch usb-gadget-function-rndis-add-length-check-to-response-query.patch --- diff --git a/queue-6.18/alsa-usx2y-us144mkii-fix-work-uaf-on-disconnect.patch b/queue-6.18/alsa-usx2y-us144mkii-fix-work-uaf-on-disconnect.patch new file mode 100644 index 0000000000..abb0a32a6c --- /dev/null +++ b/queue-6.18/alsa-usx2y-us144mkii-fix-work-uaf-on-disconnect.patch @@ -0,0 +1,71 @@ +From 147996e7e7c9e8339c0e04f6fa7ccb3e4d448ff7 Mon Sep 17 00:00:00 2001 +From: HyeongJun An +Date: Wed, 1 Jul 2026 18:52:31 +0900 +Subject: ALSA: usx2y: us144mkii: fix work UAF on disconnect + +From: HyeongJun An + +commit 147996e7e7c9e8339c0e04f6fa7ccb3e4d448ff7 upstream. + +tascam_disconnect() cancels capture_work and midi_in_work before +usb_kill_anchored_urbs() kills the capture/MIDI-in URBs. Those URBs +self-resubmit, and their completion handlers reschedule the work. + +A URB that completes in the small window between cancel_work_sync() and +usb_kill_anchored_urbs() therefore re-arms the work after its only +cancel. Nothing cancels it again before snd_card_free() frees the +card-private tascam structure, so the work handler then runs on freed +memory. + +Kill the anchored URBs before cancelling the work; once the work is +cancelled no remaining URB can complete to re-arm it. + +Fixes: c1bb0c13e430 ("ALSA: usb-audio: us144mkii: Implement audio capture and decoding") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-8 +Signed-off-by: HyeongJun An +Link: https://patch.msgid.link/20260701095231.1020811-1-sammiee5311@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/usx2y/us144mkii.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/sound/usb/usx2y/us144mkii.c b/sound/usb/usx2y/us144mkii.c +index 94553b61013c..58ef23146f20 100644 +--- a/sound/usb/usx2y/us144mkii.c ++++ b/sound/usb/usx2y/us144mkii.c +@@ -585,19 +585,24 @@ static void tascam_disconnect(struct usb_interface *intf) + return; + + if (intf->cur_altsetting->desc.bInterfaceNumber == 0) { +- /* Ensure all deferred work is complete before freeing resources */ + snd_card_disconnect(tascam->card); +- cancel_work_sync(&tascam->stop_work); +- cancel_work_sync(&tascam->capture_work); +- cancel_work_sync(&tascam->midi_in_work); +- cancel_work_sync(&tascam->midi_out_work); +- cancel_work_sync(&tascam->stop_pcm_work); + ++ /* ++ * Kill the URBs before cancelling the work, so a late URB ++ * completion cannot re-arm a work that then runs after ++ * snd_card_free(). ++ */ + usb_kill_anchored_urbs(&tascam->playback_anchor); + usb_kill_anchored_urbs(&tascam->capture_anchor); + usb_kill_anchored_urbs(&tascam->feedback_anchor); + usb_kill_anchored_urbs(&tascam->midi_in_anchor); + usb_kill_anchored_urbs(&tascam->midi_out_anchor); ++ ++ cancel_work_sync(&tascam->stop_work); ++ cancel_work_sync(&tascam->capture_work); ++ cancel_work_sync(&tascam->midi_in_work); ++ cancel_work_sync(&tascam->midi_out_work); ++ cancel_work_sync(&tascam->stop_pcm_work); + timer_delete_sync(&tascam->error_timer); + tascam_free_urbs(tascam); + snd_card_free(tascam->card); +-- +2.55.0 + diff --git a/queue-6.18/alsa-virtio-add-missing-384-khz-pcm-rate-mapping.patch b/queue-6.18/alsa-virtio-add-missing-384-khz-pcm-rate-mapping.patch new file mode 100644 index 0000000000..73808f8f42 --- /dev/null +++ b/queue-6.18/alsa-virtio-add-missing-384-khz-pcm-rate-mapping.patch @@ -0,0 +1,59 @@ +From 83fbbcb7935ec6d2c8ba3bc133e8a0ead2ab0b2d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Fri, 15 May 2026 10:32:25 -0300 +Subject: ALSA: virtio: Add missing 384 kHz PCM rate mapping +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit 83fbbcb7935ec6d2c8ba3bc133e8a0ead2ab0b2d upstream. + +The VirtIO sound UAPI defines VIRTIO_SND_PCM_RATE_384000, and ALSA +has SNDRV_PCM_RATE_384000. However, virtio-snd's rate conversion +tables stop at 192 kHz. + +A device advertising only 384 kHz is rejected as having no supported +PCM frame rates. A device advertising 384 kHz together with lower rates +does not expose 384 kHz through the ALSA hardware constraints. The +selected ALSA rate also needs a reverse mapping for SET_PARAMS. + +Add the missing 384 kHz entries to both conversion tables. + +Fixes: 29b96bf50ba9 ("ALSA: virtio: build PCM devices and substream hardware descriptors") +Fixes: da76e9f3e43a ("ALSA: virtio: PCM substream operators") +Cc: stable@vger.kernel.org +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260515-alsa-virtio-384k-rate-v1-1-35ecb5df835c@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/virtio/virtio_pcm.c | 3 ++- + sound/virtio/virtio_pcm_ops.c | 3 ++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- a/sound/virtio/virtio_pcm.c ++++ b/sound/virtio/virtio_pcm.c +@@ -77,7 +77,8 @@ static const struct virtsnd_v2a_rate g_v + [VIRTIO_SND_PCM_RATE_88200] = { SNDRV_PCM_RATE_88200, 88200 }, + [VIRTIO_SND_PCM_RATE_96000] = { SNDRV_PCM_RATE_96000, 96000 }, + [VIRTIO_SND_PCM_RATE_176400] = { SNDRV_PCM_RATE_176400, 176400 }, +- [VIRTIO_SND_PCM_RATE_192000] = { SNDRV_PCM_RATE_192000, 192000 } ++ [VIRTIO_SND_PCM_RATE_192000] = { SNDRV_PCM_RATE_192000, 192000 }, ++ [VIRTIO_SND_PCM_RATE_384000] = { SNDRV_PCM_RATE_384000, 384000 } + }; + + /** +--- a/sound/virtio/virtio_pcm_ops.c ++++ b/sound/virtio/virtio_pcm_ops.c +@@ -90,7 +90,8 @@ static const struct virtsnd_a2v_rate g_a + { 88200, VIRTIO_SND_PCM_RATE_88200 }, + { 96000, VIRTIO_SND_PCM_RATE_96000 }, + { 176400, VIRTIO_SND_PCM_RATE_176400 }, +- { 192000, VIRTIO_SND_PCM_RATE_192000 } ++ { 192000, VIRTIO_SND_PCM_RATE_192000 }, ++ { 384000, VIRTIO_SND_PCM_RATE_384000 } + }; + + static int virtsnd_pcm_sync_stop(struct snd_pcm_substream *substream); diff --git a/queue-6.18/alsa-virtio-validate-control-metadata-from-the-device.patch b/queue-6.18/alsa-virtio-validate-control-metadata-from-the-device.patch new file mode 100644 index 0000000000..7eac2c262d --- /dev/null +++ b/queue-6.18/alsa-virtio-validate-control-metadata-from-the-device.patch @@ -0,0 +1,109 @@ +From c77a6cbb36ff8cbc1f084d94f8dcda5250935271 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= +Date: Thu, 7 May 2026 11:28:30 -0300 +Subject: ALSA: virtio: Validate control metadata from the device +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cássio Gabriel + +commit c77a6cbb36ff8cbc1f084d94f8dcda5250935271 upstream. + +virtio-snd control handling trusts the device-provided control type and +value count returned by the device. + +That metadata is then used directly to index g_v2a_type_map[] in +virtsnd_kctl_info(), and to size loops and memcpy() operations in +virtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size +virtio_snd_ctl_value and snd_ctl_elem_value arrays. + +A buggy or malicious device can therefore trigger out-of-bounds access by +advertising an invalid control type or an oversized value count. + +Validate control type and count once in virtsnd_kctl_parse_cfg(), before +querying enumerated items or exposing the control to ALSA. + +Fixes: d6568e3de42d ("ALSA: virtio: add support for audio controls") +Cc: stable@vger.kernel.org +Signed-off-by: Cássio Gabriel +Link: https://patch.msgid.link/20260507-alsa-virtio-validate-kctl-info-v1-1-7404fb12ec37@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/virtio/virtio_kctl.c | 50 +++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 50 insertions(+) + +--- a/sound/virtio/virtio_kctl.c ++++ b/sound/virtio/virtio_kctl.c +@@ -18,6 +18,21 @@ static const snd_ctl_elem_type_t g_v2a_t + [VIRTIO_SND_CTL_TYPE_IEC958] = SNDRV_CTL_ELEM_TYPE_IEC958 + }; + ++/* Map for converting VirtIO types to maximum value counts. */ ++static const unsigned int g_v2a_count_map[] = { ++ [VIRTIO_SND_CTL_TYPE_BOOLEAN] = ++ ARRAY_SIZE(((struct virtio_snd_ctl_value *)0)->value.integer), ++ [VIRTIO_SND_CTL_TYPE_INTEGER] = ++ ARRAY_SIZE(((struct virtio_snd_ctl_value *)0)->value.integer), ++ [VIRTIO_SND_CTL_TYPE_INTEGER64] = ++ ARRAY_SIZE(((struct virtio_snd_ctl_value *)0)->value.integer64), ++ [VIRTIO_SND_CTL_TYPE_ENUMERATED] = ++ ARRAY_SIZE(((struct virtio_snd_ctl_value *)0)->value.enumerated), ++ [VIRTIO_SND_CTL_TYPE_BYTES] = ++ ARRAY_SIZE(((struct virtio_snd_ctl_value *)0)->value.bytes), ++ [VIRTIO_SND_CTL_TYPE_IEC958] = 1 ++}; ++ + /* Map for converting VirtIO access rights to ALSA access rights. */ + static const unsigned int g_v2a_access_map[] = { + [VIRTIO_SND_CTL_ACCESS_READ] = SNDRV_CTL_ELEM_ACCESS_READ, +@@ -36,6 +51,37 @@ static const unsigned int g_v2a_mask_map + [VIRTIO_SND_CTL_EVT_MASK_TLV] = SNDRV_CTL_EVENT_MASK_TLV + }; + ++static int virtsnd_kctl_validate_info(struct virtio_snd *snd, u32 cid, ++ struct virtio_snd_ctl_info *kinfo) ++{ ++ struct virtio_device *vdev = snd->vdev; ++ unsigned int type = le32_to_cpu(kinfo->type); ++ unsigned int count = le32_to_cpu(kinfo->count); ++ ++ if (type >= ARRAY_SIZE(g_v2a_type_map)) { ++ dev_err(&vdev->dev, "control #%u: unknown type %u\n", ++ cid, type); ++ return -EINVAL; ++ } ++ ++ if (count > g_v2a_count_map[type] || ++ (type == VIRTIO_SND_CTL_TYPE_IEC958 && count != 1)) { ++ dev_err(&vdev->dev, "control #%u: invalid count %u for type %u\n", ++ cid, count, type); ++ return -EINVAL; ++ } ++ ++ if (type == VIRTIO_SND_CTL_TYPE_ENUMERATED && ++ !le32_to_cpu(kinfo->value.enumerated.items)) { ++ dev_err(&vdev->dev, ++ "control #%u: no items for enumerated control\n", ++ cid); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + /** + * virtsnd_kctl_info() - Returns information about the control. + * @kcontrol: ALSA control element. +@@ -385,6 +431,10 @@ int virtsnd_kctl_parse_cfg(struct virtio + struct virtio_snd_ctl_info *kinfo = &snd->kctl_infos[i]; + unsigned int type = le32_to_cpu(kinfo->type); + ++ rc = virtsnd_kctl_validate_info(snd, i, kinfo); ++ if (rc) ++ return rc; ++ + if (type == VIRTIO_SND_CTL_TYPE_ENUMERATED) { + rc = virtsnd_kctl_get_enum_items(snd, i); + if (rc) diff --git a/queue-6.18/alsa-ymfpci-check-snd_ctl_new1-return-value.patch b/queue-6.18/alsa-ymfpci-check-snd_ctl_new1-return-value.patch new file mode 100644 index 0000000000..e3cab99735 --- /dev/null +++ b/queue-6.18/alsa-ymfpci-check-snd_ctl_new1-return-value.patch @@ -0,0 +1,53 @@ +From e64d170346d00b580c0043de3e5ccb3e331c47d4 Mon Sep 17 00:00:00 2001 +From: Zhao Dongdong +Date: Wed, 27 May 2026 20:09:12 +0800 +Subject: ALSA: ymfpci: check snd_ctl_new1() return value + +From: Zhao Dongdong + +commit e64d170346d00b580c0043de3e5ccb3e331c47d4 upstream. + +snd_ctl_new1() can return NULL when memory allocation fails. +snd_ymfpci_create_spdif_controls() does not check the return value +before dereferencing kctl->id.device, which can lead to a NULL pointer +dereference. + +Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any +fails. + +Assisted-by: Opencode:DeepSeek-V4-Flash +Cc: stable@vger.kernel.org +Fixes: c9b83ae4a160 ("ALSA: ymfpci: Fix kctl->id initialization") +Signed-off-by: Zhao Dongdong +Link: https://patch.msgid.link/tencent_4745C5DC2333325C0EDAB1EFC88A136E6809@qq.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/ymfpci/ymfpci_main.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/sound/pci/ymfpci/ymfpci_main.c ++++ b/sound/pci/ymfpci/ymfpci_main.c +@@ -1781,16 +1781,22 @@ int snd_ymfpci_mixer(struct snd_ymfpci * + if (snd_BUG_ON(!chip->pcm_spdif)) + return -ENXIO; + kctl = snd_ctl_new1(&snd_ymfpci_spdif_default, chip); ++ if (!kctl) ++ return -ENOMEM; + kctl->id.device = chip->pcm_spdif->device; + err = snd_ctl_add(chip->card, kctl); + if (err < 0) + return err; + kctl = snd_ctl_new1(&snd_ymfpci_spdif_mask, chip); ++ if (!kctl) ++ return -ENOMEM; + kctl->id.device = chip->pcm_spdif->device; + err = snd_ctl_add(chip->card, kctl); + if (err < 0) + return err; + kctl = snd_ctl_new1(&snd_ymfpci_spdif_stream, chip); ++ if (!kctl) ++ return -ENOMEM; + kctl->id.device = chip->pcm_spdif->device; + err = snd_ctl_add(chip->card, kctl); + if (err < 0) diff --git a/queue-6.18/iio-accel-bmc150-clamp-the-device-reported-fifo-frame-count.patch b/queue-6.18/iio-accel-bmc150-clamp-the-device-reported-fifo-frame-count.patch new file mode 100644 index 0000000000..491bcb7b33 --- /dev/null +++ b/queue-6.18/iio-accel-bmc150-clamp-the-device-reported-fifo-frame-count.patch @@ -0,0 +1,64 @@ +From ce0e1cae26096fe959a0da5563a6d6d5a801d5fb Mon Sep 17 00:00:00 2001 +From: Bryam Vargas +Date: Sat, 13 Jun 2026 02:18:39 -0500 +Subject: iio: accel: bmc150: clamp the device-reported FIFO frame count + +From: Bryam Vargas + +commit ce0e1cae26096fe959a0da5563a6d6d5a801d5fb upstream. + +__bmc150_accel_fifo_flush() copies the number of samples the device +reports in its hardware FIFO into an on-stack buffer + + u16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3]; + +which is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The +frame count is read from the FIFO_STATUS register and only masked to its +7 valid bits: + + count = val & 0x7F; + +so it can be 0..127. The only other limit applied to it is the optional +caller-supplied sample budget: + + if (samples && count > samples) + count = samples; + +which does not constrain count on the flush-all path (samples == 0), and +leaves it well above 32 whenever samples is larger. count samples are +then transferred into buffer[]: + + bmc150_accel_fifo_transfer(data, (u8 *)buffer, count); + +bmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a +malfunctioning, malicious or counterfeit accelerometer (or an attacker +tampering with the I2C/SPI bus) that reports up to 127 frames writes up +to 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up +to 570 bytes that clobbers the stack canary, saved registers and the +return address. + +Clamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[] +is sized for, before the transfer, mirroring the watermark clamp already +done in bmc150_accel_set_watermark(). A well-formed flush reports at most +BMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected. + +Fixes: 3bbec9773389 ("iio: bmc150_accel: add support for hardware fifo") +Cc: stable@vger.kernel.org +Signed-off-by: Bryam Vargas +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/accel/bmc150-accel-core.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/iio/accel/bmc150-accel-core.c ++++ b/drivers/iio/accel/bmc150-accel-core.c +@@ -991,6 +991,8 @@ static int __bmc150_accel_fifo_flush(str + if (samples && count > samples) + count = samples; + ++ count = min_t(u8, count, BMC150_ACCEL_FIFO_LENGTH); ++ + ret = bmc150_accel_fifo_transfer(data, (u8 *)buffer, count); + if (ret) + return ret; diff --git a/queue-6.18/iio-accel-kxsd9-fix-runtime-pm-imbalance-on-write_raw-error.patch b/queue-6.18/iio-accel-kxsd9-fix-runtime-pm-imbalance-on-write_raw-error.patch new file mode 100644 index 0000000000..50c524a3df --- /dev/null +++ b/queue-6.18/iio-accel-kxsd9-fix-runtime-pm-imbalance-on-write_raw-error.patch @@ -0,0 +1,42 @@ +From 44a5fd874bb6873bdaec59f722c1d57832fbc9df Mon Sep 17 00:00:00 2001 +From: Biren Pandya +Date: Sun, 14 Jun 2026 12:45:46 +0530 +Subject: iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error + +From: Biren Pandya + +commit 44a5fd874bb6873bdaec59f722c1d57832fbc9df upstream. + +kxsd9_write_raw() takes a runtime PM reference with pm_runtime_get_sync() +but returns -EINVAL directly when a scale with a non-zero integer part is +requested, skipping the matching pm_runtime_put_autosuspend(). This leaks +a runtime PM usage-counter reference on every such write, after which the +device can no longer autosuspend. + +Set the error code and fall through to the existing put instead of +returning early. + +Fixes: 9a9a369d6178 ("iio: accel: kxsd9: Deploy system and runtime PM") +Signed-off-by: Biren Pandya +Assisted-by: Claude:claude-opus-4-8 coccinelle +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/accel/kxsd9.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/iio/accel/kxsd9.c ++++ b/drivers/iio/accel/kxsd9.c +@@ -147,8 +147,9 @@ static int kxsd9_write_raw(struct iio_de + if (mask == IIO_CHAN_INFO_SCALE) { + /* Check no integer component */ + if (val) +- return -EINVAL; +- ret = kxsd9_write_scale(indio_dev, val2); ++ ret = -EINVAL; ++ else ++ ret = kxsd9_write_scale(indio_dev, val2); + } + + pm_runtime_put_autosuspend(st->dev); diff --git a/queue-6.18/iio-adc-ad7380-select-regmap.patch b/queue-6.18/iio-adc-ad7380-select-regmap.patch new file mode 100644 index 0000000000..414cf608f8 --- /dev/null +++ b/queue-6.18/iio-adc-ad7380-select-regmap.patch @@ -0,0 +1,40 @@ +From 6697091b386a4e2830bdd38512c87a4befff2b32 Mon Sep 17 00:00:00 2001 +From: Samuel Moelius +Date: Tue, 2 Jun 2026 16:45:39 +0000 +Subject: iio: adc: ad7380: select REGMAP +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Samuel Moelius + +commit 6697091b386a4e2830bdd38512c87a4befff2b32 upstream. + +The AD7380 driver uses generic regmap types and APIs. However, its +Kconfig entry does not select REGMAP. + +As a result, AD7380 can be enabled from an allnoconfig-derived config +with SPI_MASTER=y while REGMAP remains unset, causing ad7380.o to fail +to build. + +Fixes: b095217c104b ("iio: adc: ad7380: new driver for AD7380 ADCs") +Signed-off-by: Samuel Moelius +Reviewed-by: Andy Shevchenko +Reviewed-by: Nuno Sá +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/adc/Kconfig ++++ b/drivers/iio/adc/Kconfig +@@ -282,6 +282,7 @@ config AD7298 + config AD7380 + tristate "Analog Devices AD7380 ADC driver" + depends on SPI_MASTER ++ select REGMAP + select SPI_OFFLOAD + select IIO_BUFFER + select IIO_BUFFER_DMAENGINE diff --git a/queue-6.18/iio-adc-ad7768-1-select-gpiolib.patch b/queue-6.18/iio-adc-ad7768-1-select-gpiolib.patch new file mode 100644 index 0000000000..0ca15cd09e --- /dev/null +++ b/queue-6.18/iio-adc-ad7768-1-select-gpiolib.patch @@ -0,0 +1,38 @@ +From 5a9c90350be4f6f175bdd193e8bd60a7aedfb4d2 Mon Sep 17 00:00:00 2001 +From: Jonathan Cameron +Date: Sun, 11 Jan 2026 16:55:28 +0000 +Subject: iio: adc: ad7768-1: Select GPIOLIB + +From: Jonathan Cameron + +commit 5a9c90350be4f6f175bdd193e8bd60a7aedfb4d2 upstream. + +This driver provides a gpio chip a some related functions are not +stubbed if GPIOLIB is not built. + +ad7768-1.c:420: undefined reference to `gpiochip_get_data' +ad7768-1.c:498: undefined reference to `devm_gpiochip_add_data_with_key' + +Dual sign off reflects change of affiliation whilst this was under review. + +Fixes: d569ae0f052e ("iio: adc: ad7768-1: Add GPIO controller support") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202512271235.WwAmAbOa-lkp@intel.com/ +Signed-off-by: Jonathan Cameron +Cc: Stable@vger.kernel.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/adc/Kconfig ++++ b/drivers/iio/adc/Kconfig +@@ -386,6 +386,7 @@ config AD7766 + config AD7768_1 + tristate "Analog Devices AD7768-1 ADC driver" + depends on SPI ++ select GPIOLIB + select REGULATOR + select REGMAP_SPI + select IIO_BUFFER diff --git a/queue-6.18/iio-adc-ad7779-add-missing-select-iio_triggered_buffer-to-kconfig.patch b/queue-6.18/iio-adc-ad7779-add-missing-select-iio_triggered_buffer-to-kconfig.patch new file mode 100644 index 0000000000..93902d8859 --- /dev/null +++ b/queue-6.18/iio-adc-ad7779-add-missing-select-iio_triggered_buffer-to-kconfig.patch @@ -0,0 +1,33 @@ +From fd354554af1d2b33232ca6c8a3d79ed82413d715 Mon Sep 17 00:00:00 2001 +From: Joshua Crofts +Date: Wed, 1 Jul 2026 21:21:47 +0200 +Subject: iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig + +From: Joshua Crofts + +commit fd354554af1d2b33232ca6c8a3d79ed82413d715 upstream. + +The Kconfig entry for the AD7779 is missing a +'select IIO_TRIGGERED_BUFFER' parameter, causing build failures. + +Fixes: c9a3f8c7bfcb ("drivers: iio: adc: add support for ad777x family") +Cc: stable@vger.kernel.org +Signed-off-by: Joshua Crofts +Tested-by: Andy Shevchenko +Reviewed-by: Andy Shevchenko +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/adc/Kconfig ++++ b/drivers/iio/adc/Kconfig +@@ -404,6 +404,7 @@ config AD7779 + depends on SPI + select CRC8 + select IIO_BUFFER ++ select IIO_TRIGGERED_BUFFER + select IIO_BACKEND + help + Say yes here to build support for Analog Devices AD777X family diff --git a/queue-6.18/iio-adc-ad_sigma_delta-fix-clear_pending_event-for-registerless-devices.patch b/queue-6.18/iio-adc-ad_sigma_delta-fix-clear_pending_event-for-registerless-devices.patch new file mode 100644 index 0000000000..60babdf6d7 --- /dev/null +++ b/queue-6.18/iio-adc-ad_sigma_delta-fix-clear_pending_event-for-registerless-devices.patch @@ -0,0 +1,109 @@ +From 91bc6767a4f55dc470d8a56b55b9f2ea09094efe Mon Sep 17 00:00:00 2001 +From: Radu Sabau +Date: Wed, 27 May 2026 12:38:39 +0300 +Subject: iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Radu Sabau + +commit 91bc6767a4f55dc470d8a56b55b9f2ea09094efe upstream. + +ad_sigma_delta_clear_pending_event() falls through to the status register +read path for devices with has_registers = false and no rdy_gpiod. For +such devices, ad_sd_read_reg() skips the address byte entirely and clocks +raw MISO bytes with no address phase — making it byte-for-byte identical +to reading conversion data. If a pending conversion result is present, +this partially consumes it and corrupts the data stream for the subsequent +ad_sd_read_reg() call in ad_sigma_delta_single_conversion(). + +Furthermore, with num_resetclks = 0 on these devices, data_read_len +evaluates to 0. If the clocked byte has bit 7 clear, pending_event is set +and the code attempts memset(data + 2, 0xff, 0 - 1), overflowing to +SIZE_MAX and corrupting the heap. + +Fix by returning 0 immediately when neither rdy_gpiod nor has_registers +is set. This is safe for all current registerless devices: ad7191 and +ad7780 (with powerdown GPIO) are reset between conversions by CS +deassertion, so there is no stale result to drain; ad7780 (without +powerdown GPIO) and max11205 are continuously-converting and cycle ~DRDY +at the output data rate regardless of whether the previous result was +read, so the next falling edge fires naturally. + +A future registerless device that holds ~DRDY asserted until data is read +would be broken by this early return and would require either +num_resetclks set or a rdy-gpio. + +The same heap corruption is reachable on any device with rdy_gpiod set +but num_resetclks = 0: if the GPIO indicates a pending event, the drain +path executes memset(data + 2, 0xff, 0 - 1) regardless of has_registers. +Add an explicit data_read_len == 0 guard after the pending event check; +the stale result is then consumed by the first ad_sd_read_reg() call in +ad_sigma_delta_single_conversion(). + +Fixes: 132d44dc6966 ("iio: adc: ad_sigma_delta: Check for previous ready signals") +Signed-off-by: Radu Sabau +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad_sigma_delta.c | 31 +++++++++++++++++++++++++++++-- + 1 file changed, 29 insertions(+), 2 deletions(-) + +--- a/drivers/iio/adc/ad_sigma_delta.c ++++ b/drivers/iio/adc/ad_sigma_delta.c +@@ -260,11 +260,25 @@ static int ad_sigma_delta_clear_pending_ + + /* + * Read R̅D̅Y̅ pin (if possible) or status register to check if there is an +- * old event. ++ * old event. For devices with neither an RDY GPIO nor registers, ++ * ad_sd_read_reg() transmits no address byte and clocks raw MISO bytes, ++ * which is indistinguishable from reading conversion data and would ++ * partially consume a pending result. Skip the check for such devices. ++ * ++ * This is safe for all current registerless devices: ad7191 and ad7780 ++ * (with powerdown GPIO) are reset between conversions by CS deassertion, ++ * so there is no stale result to drain; ad7780 (without powerdown GPIO) ++ * and max11205 are continuously-converting and cycle ~DRDY at the output ++ * data rate regardless of whether the previous result was read, so the ++ * next falling edge fires naturally. ++ * ++ * A future registerless device that holds ~DRDY asserted until data is ++ * read would be broken by this early return and would need either ++ * num_resetclks set or a rdy-gpio. + */ + if (sigma_delta->rdy_gpiod) { + pending_event = gpiod_get_value(sigma_delta->rdy_gpiod); +- } else { ++ } else if (sigma_delta->info->has_registers) { + unsigned int status_reg; + + ret = ad_sd_read_reg(sigma_delta, AD_SD_REG_STATUS, 1, &status_reg); +@@ -272,12 +286,25 @@ static int ad_sigma_delta_clear_pending_ + return ret; + + pending_event = !(status_reg & AD_SD_REG_STATUS_RDY); ++ } else { ++ return 0; + } + + if (!pending_event) + return 0; + + /* ++ * With num_resetclks = 0, data_read_len is 0 and the drain sequence ++ * below would compute memset(data + 2, 0xff, 0 - 1), underflowing to ++ * SIZE_MAX and corrupting the heap. There is no safe way to drain the ++ * stale result without knowing the data register size; it will be ++ * consumed by the first ad_sd_read_reg() call in ++ * ad_sigma_delta_single_conversion(). ++ */ ++ if (!data_read_len) ++ return 0; ++ ++ /* + * In general the size of the data register is unknown. It varies from + * device to device, might be one byte longer if CONTROL.DATA_STATUS is + * set and even varies on some devices depending on which input is diff --git a/queue-6.18/iio-adc-ad_sigma_delta-fix-cs-held-asserted-and-state-leaks.patch b/queue-6.18/iio-adc-ad_sigma_delta-fix-cs-held-asserted-and-state-leaks.patch new file mode 100644 index 0000000000..a9bf4514d6 --- /dev/null +++ b/queue-6.18/iio-adc-ad_sigma_delta-fix-cs-held-asserted-and-state-leaks.patch @@ -0,0 +1,69 @@ +From c72da0688575e5ef39c36bb44fed53aa18f8ae65 Mon Sep 17 00:00:00 2001 +From: Radu Sabau +Date: Wed, 27 May 2026 12:38:38 +0300 +Subject: iio: adc: ad_sigma_delta: fix CS held asserted and state leaks + +From: Radu Sabau + +commit c72da0688575e5ef39c36bb44fed53aa18f8ae65 upstream. + +In ad_sigma_delta_single_conversion(), set_mode(AD_SD_MODE_IDLE) and +disable_one() were called from the out: block while keep_cs_asserted +was still true. This caused any SPI transfer issued by those callbacks +to carry cs_change=1, leaving CS permanently asserted after the +conversion. Fix by moving both calls into the out_unlock: block, after +keep_cs_asserted is cleared, matching the pattern already used in +ad_sd_calibrate(). + +In the error path of ad_sd_buffer_postenable(), if an operation fails +after set_mode(AD_SD_MODE_CONTINUOUS) has already succeeded (e.g. +spi_offload_trigger_enable()), the device is left in continuous +conversion mode with CS physically asserted. Additionally, +bus_locked remaining true after spi_bus_unlock() causes subsequent +SPI operations to call spi_sync_locked() without the bus lock actually +held, allowing concurrent SPI access. + +Fix the error path by clearing keep_cs_asserted first, then calling +set_mode(AD_SD_MODE_IDLE) to revert the device mode and deassert CS, +then clearing bus_locked before releasing the bus. + +For devices that implement neither set_mode nor disable_one (such as +MAX11205, which has no physical CS pin), no SPI transfer is issued +during cleanup and the cs_change flag has no effect on any physical +line. + +Fixes: 132d44dc6966 ("iio: adc: ad_sigma_delta: Check for previous ready signals") +Signed-off-by: Radu Sabau +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad_sigma_delta.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/iio/adc/ad_sigma_delta.c ++++ b/drivers/iio/adc/ad_sigma_delta.c +@@ -466,11 +466,10 @@ int ad_sigma_delta_single_conversion(str + out: + ad_sd_disable_irq(sigma_delta); + +- ad_sigma_delta_set_mode(sigma_delta, AD_SD_MODE_IDLE); +- ad_sigma_delta_disable_one(sigma_delta, chan->address); +- + out_unlock: + sigma_delta->keep_cs_asserted = false; ++ ad_sigma_delta_set_mode(sigma_delta, AD_SD_MODE_IDLE); ++ ad_sigma_delta_disable_one(sigma_delta, chan->address); + sigma_delta->bus_locked = false; + spi_bus_unlock(sigma_delta->spi->controller); + out_release: +@@ -603,6 +602,9 @@ static int ad_sd_buffer_postenable(struc + return 0; + + err_unlock: ++ sigma_delta->keep_cs_asserted = false; ++ ad_sigma_delta_set_mode(sigma_delta, AD_SD_MODE_IDLE); ++ sigma_delta->bus_locked = false; + spi_bus_unlock(sigma_delta->spi->controller); + spi_unoptimize_message(&sigma_delta->sample_msg); + diff --git a/queue-6.18/iio-adc-lpc32xx-initialize-completion-before-requesting-irq.patch b/queue-6.18/iio-adc-lpc32xx-initialize-completion-before-requesting-irq.patch new file mode 100644 index 0000000000..c18194a4bd --- /dev/null +++ b/queue-6.18/iio-adc-lpc32xx-initialize-completion-before-requesting-irq.patch @@ -0,0 +1,73 @@ +From e561b35633f450ee607e87a6401d97f156a0cd54 Mon Sep 17 00:00:00 2001 +From: Maxwell Doose +Date: Fri, 12 Jun 2026 19:58:10 -0500 +Subject: iio: adc: lpc32xx: Initialize completion before requesting IRQ + +From: Maxwell Doose + +commit e561b35633f450ee607e87a6401d97f156a0cd54 upstream. + +In the report from Jaeyoung Chung: + +"lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its +interrupt handler with devm_request_irq() before it initializes +st->completion with init_completion(). If an interrupt arrives after +devm_request_irq() and before init_completion(), the handler calls +complete() on an uninitialized completion, causing a kernel panic. + +The probe path, in lpc32xx_adc_probe(): + + iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */ + ... + retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0, + LPC32XXAD_NAME, st); /* register handler */ + ... + init_completion(&st->completion); /* initialize completion */ + +lpc32xx_adc_isr() calls complete(): + + complete(&st->completion); + +If the device raises an interrupt before init_completion() runs, +complete() acquires the uninitialized wait.lock and walks the zeroed +task_list in swake_up_locked(). The zeroed task_list makes list_empty() +return false, so swake_up_locked() dereferences a NULL list entry, +triggering a KASAN wild-memory-access." + +Fix the chance of a spurious IRQ causing an uninitialized pointer +dereference by moving init_completion() above devm_request_irq(). + +Fixes: 7901b2a1453e ("staging:iio:adc:lpc32xx rename local state structure to _state") +Reported-by: Sangyun Kim +Reported-by: Kyungwook Boo +Reported-by: Jaeyoung Chung +Closes: https://lore.kernel.org/linux-iio/20260610115700.774689-1-jjy600901@snu.ac.kr/ +Signed-off-by: Maxwell Doose +Reviewed-by: Vladimir Zapolskiy +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/lpc32xx_adc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/iio/adc/lpc32xx_adc.c ++++ b/drivers/iio/adc/lpc32xx_adc.c +@@ -179,6 +179,8 @@ static int lpc32xx_adc_probe(struct plat + if (irq < 0) + return irq; + ++ init_completion(&st->completion); ++ + retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0, + LPC32XXAD_NAME, st); + if (retval < 0) { +@@ -197,8 +199,6 @@ static int lpc32xx_adc_probe(struct plat + + platform_set_drvdata(pdev, iodev); + +- init_completion(&st->completion); +- + iodev->name = LPC32XXAD_NAME; + iodev->info = &lpc32xx_adc_iio_info; + iodev->modes = INDIO_DIRECT_MODE; diff --git a/queue-6.18/iio-adc-spear-initialize-completion-before-requesting-irq.patch b/queue-6.18/iio-adc-spear-initialize-completion-before-requesting-irq.patch new file mode 100644 index 0000000000..d406ed1d03 --- /dev/null +++ b/queue-6.18/iio-adc-spear-initialize-completion-before-requesting-irq.patch @@ -0,0 +1,72 @@ +From 3ee2128b6f0eb0be7b6cb8f6e0f1f113a65201a0 Mon Sep 17 00:00:00 2001 +From: Maxwell Doose +Date: Fri, 12 Jun 2026 19:58:11 -0500 +Subject: iio: adc: spear: Initialize completion before requesting IRQ + +From: Maxwell Doose + +commit 3ee2128b6f0eb0be7b6cb8f6e0f1f113a65201a0 upstream. + +In the report from Jaeyoung Chung: + +"spear_adc_probe() in drivers/iio/adc/spear_adc.c registers its +interrupt handler with devm_request_irq() before it initializes +st->completion with init_completion(). If an interrupt arrives after +devm_request_irq() and before init_completion(), the handler calls +complete() on an uninitialized completion, causing a kernel panic. + +The probe path, in spear_adc_probe(): + + iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */ + ... + retval = devm_request_irq(&pdev->dev, irq, spear_adc_isr, 0, + LPC32XXAD_NAME, st); /* register handler */ + ... + init_completion(&st->completion); /* initialize completion */ + +spear_adc_isr() calls complete(): + + complete(&st->completion); + +If the device raises an interrupt before init_completion() runs, +complete() acquires the uninitialized wait.lock and walks the zeroed +task_list in swake_up_locked(). The zeroed task_list makes list_empty() +return false, so swake_up_locked() dereferences a NULL list entry, +triggering a KASAN wild-memory-access." + +Fix the chance of a spurious IRQ causing an uninitialized pointer +dereference by moving init_completion() above devm_request_irq(). + +Fixes: b586e5d9eee0 ("staging:iio:adc:spear rename device specific state structure to _state") +Reported-by: Sangyun Kim +Reported-by: Kyungwook Boo +Reported-by: Jaeyoung Chung +Closes: https://lore.kernel.org/linux-iio/20260610115700.774689-1-jjy600901@snu.ac.kr/ +Signed-off-by: Maxwell Doose +Reviewed-by: Vladimir Zapolskiy +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/spear_adc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/iio/adc/spear_adc.c ++++ b/drivers/iio/adc/spear_adc.c +@@ -280,6 +280,7 @@ static int spear_adc_probe(struct platfo + st = iio_priv(indio_dev); + st->dev = dev; + ++ init_completion(&st->completion); + mutex_init(&st->lock); + + /* +@@ -326,8 +327,6 @@ static int spear_adc_probe(struct platfo + + spear_adc_configure(st); + +- init_completion(&st->completion); +- + indio_dev->name = SPEAR_ADC_MOD_NAME; + indio_dev->info = &spear_adc_info; + indio_dev->modes = INDIO_DIRECT_MODE; diff --git a/queue-6.18/iio-adc-ti-ads1119-fix-pm-reference-leak-in-buffer-preenable.patch b/queue-6.18/iio-adc-ti-ads1119-fix-pm-reference-leak-in-buffer-preenable.patch new file mode 100644 index 0000000000..0f608df708 --- /dev/null +++ b/queue-6.18/iio-adc-ti-ads1119-fix-pm-reference-leak-in-buffer-preenable.patch @@ -0,0 +1,44 @@ +From adf4bc07f814da8329278d32600147f5a150938c Mon Sep 17 00:00:00 2001 +From: Guangshuo Li +Date: Wed, 3 Jun 2026 20:16:40 +0800 +Subject: iio: adc: ti-ads1119: fix PM reference leak in buffer preenable + +From: Guangshuo Li + +commit adf4bc07f814da8329278d32600147f5a150938c upstream. + +ads1119_triggered_buffer_preenable() resumes the device with +pm_runtime_resume_and_get() before starting a conversion. + +If i2c_smbus_write_byte() fails, the function returns the error directly +and leaves the runtime PM usage counter elevated. The matching +postdisable callback is not called when preenable fails, so the reference +is leaked and the device may remain runtime-active indefinitely. + +Store the I2C transfer result in ret and drop the runtime PM reference on +failure before returning the error. + +Fixes: a9306887eba41 ("iio: adc: ti-ads1119: Add driver") +Signed-off-by: Guangshuo Li +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ti-ads1119.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/iio/adc/ti-ads1119.c ++++ b/drivers/iio/adc/ti-ads1119.c +@@ -459,7 +459,11 @@ static int ads1119_triggered_buffer_pree + if (ret) + return ret; + +- return i2c_smbus_write_byte(st->client, ADS1119_CMD_START_SYNC); ++ ret = i2c_smbus_write_byte(st->client, ADS1119_CMD_START_SYNC); ++ if (ret) ++ pm_runtime_put_autosuspend(dev); ++ ++ return ret; + } + + static int ads1119_triggered_buffer_postdisable(struct iio_dev *indio_dev) diff --git a/queue-6.18/iio-adc-ti-ads124s08-return-reset-gpio-lookup-errors.patch b/queue-6.18/iio-adc-ti-ads124s08-return-reset-gpio-lookup-errors.patch new file mode 100644 index 0000000000..fb4aea3de4 --- /dev/null +++ b/queue-6.18/iio-adc-ti-ads124s08-return-reset-gpio-lookup-errors.patch @@ -0,0 +1,43 @@ +From 7dc4de2aa6316f1d044cde21f5acfec5f3ec6b47 Mon Sep 17 00:00:00 2001 +From: Pengpeng Hou +Date: Thu, 25 Jun 2026 13:44:07 +0800 +Subject: iio: adc: ti-ads124s08: Return reset GPIO lookup errors + +From: Pengpeng Hou + +commit 7dc4de2aa6316f1d044cde21f5acfec5f3ec6b47 upstream. + +devm_gpiod_get_optional() returns NULL when the optional GPIO is absent, +but returns an ERR_PTR when the GPIO provider lookup fails, including +probe deferral. + +Probe currently logs the ERR_PTR case as if the reset GPIO were simply +absent and keeps the error pointer in reset_gpio. Later ads124s_reset() +treats any non-NULL reset_gpio as a valid descriptor and passes it to +gpiod_set_value_cansleep(). + +Return the lookup error instead of retaining the ERR_PTR. + +Fixes: e717f8c6dfec ("iio: adc: Add the TI ads124s08 ADC code") +Cc: stable@vger.kernel.org +Reviewed-by: Joshua Crofts +Signed-off-by: Pengpeng Hou +Reviewed-by: Andy Shevchenko +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ti-ads124s08.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/iio/adc/ti-ads124s08.c ++++ b/drivers/iio/adc/ti-ads124s08.c +@@ -321,7 +321,8 @@ static int ads124s_probe(struct spi_devi + ads124s_priv->reset_gpio = devm_gpiod_get_optional(&spi->dev, + "reset", GPIOD_OUT_LOW); + if (IS_ERR(ads124s_priv->reset_gpio)) +- dev_info(&spi->dev, "Reset GPIO not defined\n"); ++ return dev_err_probe(&spi->dev, PTR_ERR(ads124s_priv->reset_gpio), ++ "Failed to get reset GPIO\n"); + + ads124s_priv->chip_info = &ads124s_chip_info_tbl[spi_id->driver_data]; + diff --git a/queue-6.18/iio-backend-fix-uninitialized-data-in-debugfs.patch b/queue-6.18/iio-backend-fix-uninitialized-data-in-debugfs.patch new file mode 100644 index 0000000000..aa6e29dad4 --- /dev/null +++ b/queue-6.18/iio-backend-fix-uninitialized-data-in-debugfs.patch @@ -0,0 +1,34 @@ +From a6e8b14a4897d0b6df9744f33d0a30e6b92368eb Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 25 May 2026 10:16:11 +0300 +Subject: iio: backend: fix uninitialized data in debugfs + +From: Dan Carpenter + +commit a6e8b14a4897d0b6df9744f33d0a30e6b92368eb upstream. + +If the *ppos value is non-zero then simple_write_to_buffer() will not +initialize the start of the buf[] buffer. Non-zero ppos values aren't +going to work at all. Check for that at the start of the function and +return -ENOSPC. + +Fixes: cdf01e0809a4 ("iio: backend: add debugFs interface") +Signed-off-by: Dan Carpenter +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/industrialio-backend.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/industrialio-backend.c ++++ b/drivers/iio/industrialio-backend.c +@@ -155,7 +155,7 @@ static ssize_t iio_backend_debugfs_write + ssize_t rc; + int ret; + +- if (count >= sizeof(buf)) ++ if (*ppos != 0 || count >= sizeof(buf)) + return -ENOSPC; + + rc = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, userbuf, count); diff --git a/queue-6.18/iio-chemical-scd30-cleanup-initializations-and-fix-sign-extension-bug.patch b/queue-6.18/iio-chemical-scd30-cleanup-initializations-and-fix-sign-extension-bug.patch new file mode 100644 index 0000000000..4f64aa94d1 --- /dev/null +++ b/queue-6.18/iio-chemical-scd30-cleanup-initializations-and-fix-sign-extension-bug.patch @@ -0,0 +1,76 @@ +From 60d877910a43c305b5165131b258a17b1d772d57 Mon Sep 17 00:00:00 2001 +From: Maxwell Doose +Date: Tue, 26 May 2026 17:55:24 -0500 +Subject: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug + +From: Maxwell Doose + +commit 60d877910a43c305b5165131b258a17b1d772d57 upstream. + +Include linux/bitfield.h for FIELD_GET(). + +Create new macros for bit manipulation in combination with manual bit +manipulation being replaced with FIELD_GET(). + +The current variable declaration and initializations are barely readable +and use comma separations across multiple lines. Refactor the +initializations so that mantissa and exp have separate declarations and +sign gets initialized later. + +In addition (and due to the nature of the cleanup), fix a sign-extension +bug where, float32 would get bitwise anded with ~BIT(31) +(which is 0xFFFFFFFF7FFFFFFF) which corrupted the exponent. + +Fixes: 64b3d8b1b0f5c ("iio: chemical: scd30: add core driver") +Reported-by: sashiko +Closes: https://sashiko.dev/#/patchset/20260524020309.18618-1-m32285159%40gmail.com +Signed-off-by: Maxwell Doose +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/chemical/scd30_core.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +--- a/drivers/iio/chemical/scd30_core.c ++++ b/drivers/iio/chemical/scd30_core.c +@@ -4,6 +4,8 @@ + * + * Copyright (c) 2020 Tomasz Duszynski + */ ++ ++#include + #include + #include + #include +@@ -43,6 +45,11 @@ + #define SCD30_TEMP_OFFSET_MAX 655360 + #define SCD30_EXTRA_TIMEOUT_PER_S 250 + ++/* Floating point arithmetic macros */ ++#define SCD30_FLOAT_MANTISSA_MSK GENMASK(22, 0) ++#define SCD30_FLOAT_EXP_MSK GENMASK(30, 23) ++#define SCD30_FLOAT_SIGN_MSK BIT(31) ++ + enum { + SCD30_CONC, + SCD30_TEMP, +@@ -89,10 +96,14 @@ static int scd30_reset(struct scd30_stat + /* simplified float to fixed point conversion with a scaling factor of 0.01 */ + static int scd30_float_to_fp(int float32) + { +- int fraction, shift, +- mantissa = float32 & GENMASK(22, 0), +- sign = (float32 & BIT(31)) ? -1 : 1, +- exp = (float32 & ~BIT(31)) >> 23; ++ int fraction, shift, sign; ++ int mantissa = FIELD_GET(SCD30_FLOAT_MANTISSA_MSK, float32); ++ int exp = FIELD_GET(SCD30_FLOAT_EXP_MSK, float32); ++ ++ if (float32 & SCD30_FLOAT_SIGN_MSK) ++ sign = -1; ++ else ++ sign = 1; + + /* special case 0 */ + if (!exp && !mantissa) diff --git a/queue-6.18/iio-common-st_sensors-honour-channel-endianness-in-read_axis_data.patch b/queue-6.18/iio-common-st_sensors-honour-channel-endianness-in-read_axis_data.patch new file mode 100644 index 0000000000..cbcdc82dfd --- /dev/null +++ b/queue-6.18/iio-common-st_sensors-honour-channel-endianness-in-read_axis_data.patch @@ -0,0 +1,108 @@ +From 55052184ac9011db2ea983e54d6c21f0b1079a12 Mon Sep 17 00:00:00 2001 +From: Herman van Hazendonk +Date: Tue, 16 Jun 2026 15:02:04 +0200 +Subject: iio: common: st_sensors: honour channel endianness in read_axis_data +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Herman van Hazendonk + +commit 55052184ac9011db2ea983e54d6c21f0b1079a12 upstream. + +st_sensors_read_axis_data() unconditionally decoded multi-byte +results with get_unaligned_le16() / get_unaligned_le24() regardless +of the channel's declared scan_type.endianness. + +For every ST sensor that has used this helper since it was introduced +this happened to be fine because the ST IMU/accel/gyro/pressure +families publish their data registers as little-endian and the +channel specs in those drivers declare IIO_LE accordingly. + +The LSM303DLH magnetometer however publishes its X/Y/Z output as a +pair of big-endian bytes (the H register sits at the lower address, +0x03/0x05/0x07, and the L register immediately after), and its +channel specs in st_magn_core.c correctly declare IIO_BE -- but +read_axis_data() ignored that and decoded as little-endian, swapping +the high and low bytes of every magnetometer sample. The LSM303DLHC +and LSM303DLM share the same st_magn_16bit_channels (IIO_BE) and +were therefore byte-swapped by the same bug; users of those parts +will see different in_magn_*_raw values after this fix lands. + +The bug is most visible on a stationary chip: in earth's field the +true X reading is small and the high byte sits at 0x00, so swapping +the bytes pins sysfs X at exactly the low byte's pattern (e.g. 0x00F0 += 240). Y and Z still appear "to vary" because their magnitudes are +larger and the noise in the low byte produces big swings in the +swapped high byte: + + before (LSM303DLH flat, sysfs in_magn_*_raw): + X=240 (stuck), Y= 12032..23296, Z=-16128..-9728 + + after (direct i2c-dev big-endian decode, same chip same orientation): + X≈-4096, Y≈210, Z≈80 (sensible values reflecting earth's + ambient field at low gauss range) + +Fix read_axis_data() to dispatch on ch->scan_type.endianness and +call get_unaligned_be16() / get_unaligned_be24() when the channel +declares IIO_BE. Existing IIO_LE consumers (st_accel, st_gyro, +st_pressure, st_lsm6dsx and others) are unaffected because their +channel specs already declare IIO_LE and the LE path is unchanged. + +While restructuring the branches, replace the previously implicit +silent-success-with-uninitialised-*data fall-through for +byte_for_channel outside 1..3 with an explicit return -EINVAL. No +in-tree ST sensor publishes such a channel, but the new behaviour +is strictly safer than handing userspace garbage. + +Fixes: 23491b513bcd ("iio:common: Add STMicroelectronics common library") +Cc: stable@vger.kernel.org +Assisted-by: Claude:claude-opus-4-7 sparse smatch clang-analyzer coccinelle checkpatch +Assisted-by: Sashiko:claude-opus-4-7 +Signed-off-by: Herman van Hazendonk +Reviewed-by: Andy Shevchenko +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/common/st_sensors/st_sensors_core.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +--- a/drivers/iio/common/st_sensors/st_sensors_core.c ++++ b/drivers/iio/common/st_sensors/st_sensors_core.c +@@ -498,6 +498,7 @@ static int st_sensors_read_axis_data(str + u8 *outdata; + struct st_sensor_data *sdata = iio_priv(indio_dev); + unsigned int byte_for_channel; ++ u32 tmp; + + byte_for_channel = DIV_ROUND_UP(ch->scan_type.realbits + + ch->scan_type.shift, 8); +@@ -510,12 +511,22 @@ static int st_sensors_read_axis_data(str + if (err < 0) + goto st_sensors_free_memory; + +- if (byte_for_channel == 1) +- *data = (s8)*outdata; +- else if (byte_for_channel == 2) +- *data = (s16)get_unaligned_le16(outdata); +- else if (byte_for_channel == 3) +- *data = (s32)sign_extend32(get_unaligned_le24(outdata), 23); ++ if (byte_for_channel == 1) { ++ tmp = *outdata; ++ } else if (byte_for_channel == 2) { ++ if (ch->scan_type.endianness == IIO_BE) ++ tmp = get_unaligned_be16(outdata); ++ else ++ tmp = get_unaligned_le16(outdata); ++ } else if (byte_for_channel == 3) { ++ if (ch->scan_type.endianness == IIO_BE) ++ tmp = get_unaligned_be24(outdata); ++ else ++ tmp = get_unaligned_le24(outdata); ++ } else { ++ return -EINVAL; ++ } ++ *data = sign_extend32(tmp, BYTES_TO_BITS(byte_for_channel) - 1); + + st_sensors_free_memory: + kfree(outdata); diff --git a/queue-6.18/iio-core-fix-uninitialized-data-in-debugfs.patch b/queue-6.18/iio-core-fix-uninitialized-data-in-debugfs.patch new file mode 100644 index 0000000000..0a933739fe --- /dev/null +++ b/queue-6.18/iio-core-fix-uninitialized-data-in-debugfs.patch @@ -0,0 +1,34 @@ +From ab92ed206d41fd171ebd37bc46360d9f2140d043 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 25 May 2026 10:16:27 +0300 +Subject: iio: core: fix uninitialized data in debugfs + +From: Dan Carpenter + +commit ab92ed206d41fd171ebd37bc46360d9f2140d043 upstream. + +If *ppos is non-zero then simple_write_to_buffer() will not initialize +the start of buf[]. Non zero values for *ppos aren't going to work +anyway. Test for them at the start of the function and return -EINVAL. + +Fixes: 6d5dd486c715 ("iio: core: make use of simple_write_to_buffer()") +Signed-off-by: Dan Carpenter +Reviewed-by: Maxwell Doose +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/industrialio-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/industrialio-core.c ++++ b/drivers/iio/industrialio-core.c +@@ -418,7 +418,7 @@ static ssize_t iio_debugfs_write_reg(str + char buf[80]; + int ret; + +- if (count >= sizeof(buf)) ++ if (*ppos != 0 || count >= sizeof(buf)) + return -EINVAL; + + ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, userbuf, diff --git a/queue-6.18/iio-dac-ad3552r-hs-fix-uninitialized-data-ni-ad3552r_hs_write_data_source.patch b/queue-6.18/iio-dac-ad3552r-hs-fix-uninitialized-data-ni-ad3552r_hs_write_data_source.patch new file mode 100644 index 0000000000..512f7b24bd --- /dev/null +++ b/queue-6.18/iio-dac-ad3552r-hs-fix-uninitialized-data-ni-ad3552r_hs_write_data_source.patch @@ -0,0 +1,35 @@ +From eaaa7eef181892ef7ba56c6295b81f0ae4492c13 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 25 May 2026 10:15:46 +0300 +Subject: iio: dac: ad3552r-hs: fix uninitialized data ni ad3552r_hs_write_data_source() + +From: Dan Carpenter + +commit eaaa7eef181892ef7ba56c6295b81f0ae4492c13 upstream. + +If the *ppos value is non-zero then the simple_write_to_buffer() function +won't initialized the start of the buf[] buffer. Non-zero values for +*ppos won't work here generally, so just test for them and return -ENOSPC +at the start of the function. + +Fixes: b1c5d68ea66e ("iio: dac: ad3552r-hs: add support for internal ramp") +Signed-off-by: Dan Carpenter +Reviewed-by: Angelo Dureghello +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/ad3552r-hs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/dac/ad3552r-hs.c ++++ b/drivers/iio/dac/ad3552r-hs.c +@@ -549,7 +549,7 @@ static ssize_t ad3552r_hs_write_data_sou + + guard(mutex)(&st->lock); + +- if (count >= sizeof(buf)) ++ if (*ppos != 0 || count >= sizeof(buf)) + return -ENOSPC; + + ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, userbuf, diff --git a/queue-6.18/iio-event-fix-event-fifo-reset-race.patch b/queue-6.18/iio-event-fix-event-fifo-reset-race.patch new file mode 100644 index 0000000000..2b45dcd17e --- /dev/null +++ b/queue-6.18/iio-event-fix-event-fifo-reset-race.patch @@ -0,0 +1,76 @@ +From af791d295737ea6b6ff2c8d8488462a49c14af01 Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Mon, 6 Jul 2026 21:48:26 -0700 +Subject: iio: event: Fix event FIFO reset race +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lars-Peter Clausen + +commit af791d295737ea6b6ff2c8d8488462a49c14af01 upstream. + +`iio_event_getfd()` creates the event file descriptor with +`anon_inode_getfd()`, which allocates a new fd, creates the anonymous +file and installs it in the process fd table before returning to the +caller. + +The IIO code resets the event FIFO after `anon_inode_getfd()` has returned, +but before `IIO_GET_EVENT_FD_IOCTL` has copied the fd number to userspace. +But since fd tables are shared between threads, another thread can guess +the newly allocated fd number and issue a `read()` on it as soon as the fd +has been installed. + +This means the `kfifo_to_user()` in `iio_event_chrdev_read()` can run in +parallel with the `kfifo_reset_out()` in `iio_event_getfd()`. + +The kfifo documentation says that `kfifo_reset_out()` is only safe when it +is called from the reader thread and there is only one concurrent reader. +Otherwise it is dangerous and must be handled in the same way as +`kfifo_reset()`. + +If that happens, `kfifo_to_user()` can advance the FIFO `out` index based +on state from before the reset, after the reset has already moved the `out` +index to the current `in` index. That can leave the FIFO with an `out` +index past the `in` index. A later `read()` can then see an underflowed +FIFO length and copy more data than the event FIFO buffer contains. This +can result in an out-of-bounds read and leak adjacent kernel memory to +userspace. + +Move the FIFO reset before `anon_inode_getfd()`. At that point the event fd is +marked busy, but the new fd has not been installed yet, so userspace cannot +access it while the FIFO is reset. + +Fixes: b91accafbb10 ("iio:event: Fix and cleanup locking") +Reported-by: Codex:gpt-5.5 +Signed-off-by: Lars-Peter Clausen +Reviewed-by: Nuno Sá +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/industrialio-event.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/iio/industrialio-event.c ++++ b/drivers/iio/industrialio-event.c +@@ -207,6 +207,8 @@ static int iio_event_getfd(struct iio_de + goto unlock; + } + ++ kfifo_reset_out(&ev_int->det_events); ++ + iio_device_get(indio_dev); + + fd = anon_inode_getfd("iio:event", &iio_event_chrdev_fileops, +@@ -214,10 +216,7 @@ static int iio_event_getfd(struct iio_de + if (fd < 0) { + clear_bit(IIO_BUSY_BIT_POS, &ev_int->flags); + iio_device_put(indio_dev); +- } else { +- kfifo_reset_out(&ev_int->det_events); + } +- + unlock: + mutex_unlock(&iio_dev_opaque->mlock); + return fd; diff --git a/queue-6.18/iio-gyro-bmg160-bail-out-when-bandwidth-filter-is-not-in-table.patch b/queue-6.18/iio-gyro-bmg160-bail-out-when-bandwidth-filter-is-not-in-table.patch new file mode 100644 index 0000000000..a0f18c8906 --- /dev/null +++ b/queue-6.18/iio-gyro-bmg160-bail-out-when-bandwidth-filter-is-not-in-table.patch @@ -0,0 +1,68 @@ +From 8320c77e67382d5d55d77043a5f60a867d408a2b Mon Sep 17 00:00:00 2001 +From: Stepan Ionichev +Date: Sun, 10 May 2026 07:35:00 +0500 +Subject: iio: gyro: bmg160: bail out when bandwidth/filter is not in table + +From: Stepan Ionichev + +commit 8320c77e67382d5d55d77043a5f60a867d408a2b upstream. + +bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry +matching the bw_bits value read from the chip: + + for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) { + if (bmg160_samp_freq_table[i].bw_bits == bw_bits) + break; + } + *val = bmg160_samp_freq_table[i].filter; + +If no entry matches, i ends up equal to the array size and the next line +reads one slot past the end. bmg160_set_filter() has the same shape, driven +by 'val' instead of bw_bits. + +smatch flags both: + + drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error: + buffer overflow 'bmg160_samp_freq_table' 7 <= 7 + drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error: + buffer overflow 'bmg160_samp_freq_table' 7 <= 7 + +Return -EINVAL when no entry matches. + +The set_filter() path is reachable from userspace via the sysfs +in_anglvel_filter_low_pass_3db_frequency interface, so userspace can +trivially trigger the out-of-bounds read with a value that is not in +bmg160_samp_freq_table[].filter. + +Fixes: 22b46c45fb9b ("iio:gyro:bmg160 Gyro Sensor driver") +Signed-off-by: Stepan Ionichev +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/gyro/bmg160_core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/iio/gyro/bmg160_core.c ++++ b/drivers/iio/gyro/bmg160_core.c +@@ -201,6 +201,9 @@ static int bmg160_get_filter(struct bmg1 + break; + } + ++ if (i == ARRAY_SIZE(bmg160_samp_freq_table)) ++ return -EINVAL; ++ + *val = bmg160_samp_freq_table[i].filter; + + return ret ? ret : IIO_VAL_INT; +@@ -218,6 +221,9 @@ static int bmg160_set_filter(struct bmg1 + break; + } + ++ if (i == ARRAY_SIZE(bmg160_samp_freq_table)) ++ return -EINVAL; ++ + ret = regmap_write(data->regmap, BMG160_REG_PMU_BW, + bmg160_samp_freq_table[i].bw_bits); + if (ret < 0) { diff --git a/queue-6.18/iio-gyro-bmg160-wait-full-startup-time-after-mode-change-at-probe.patch b/queue-6.18/iio-gyro-bmg160-wait-full-startup-time-after-mode-change-at-probe.patch new file mode 100644 index 0000000000..96ff83afb6 --- /dev/null +++ b/queue-6.18/iio-gyro-bmg160-wait-full-startup-time-after-mode-change-at-probe.patch @@ -0,0 +1,52 @@ +From 088fcb9b567f8723074ad9eb1bf5cb46f8a0096b Mon Sep 17 00:00:00 2001 +From: Stepan Ionichev +Date: Mon, 11 May 2026 11:40:20 +0500 +Subject: iio: gyro: bmg160: wait full startup time after mode change at probe + +From: Stepan Ionichev + +commit 088fcb9b567f8723074ad9eb1bf5cb46f8a0096b upstream. + +bmg160_chip_init() calls bmg160_set_mode(BMG160_MODE_NORMAL) and +then waits only 500-1000 us. Per the BMG160 datasheet +(BST-BMG160-DS000-07 Rev. 1.0, May 2013), the start-up and wake-up +times (tsu, twusm) are 30 ms. + +The same file already waits BMG160_MAX_STARTUP_TIME_MS (80 ms) +in bmg160_runtime_resume() after the same set_mode(NORMAL) +operation. The 500 us value at probe was likely a unit mix-up; +the old comment said "500 ms" while the code used microseconds. + +Reuse the same constant via msleep() and add a code comment +explaining the datasheet basis for the wait. Without this, +register writes that follow the mode change can hit the chip +before it is ready. + +Fixes: 22b46c45fb9b ("iio:gyro:bmg160 Gyro Sensor driver") +Signed-off-by: Stepan Ionichev +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/gyro/bmg160_core.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/iio/gyro/bmg160_core.c ++++ b/drivers/iio/gyro/bmg160_core.c +@@ -264,8 +264,14 @@ static int bmg160_chip_init(struct bmg16 + if (ret < 0) + return ret; + +- /* Wait upto 500 ms to be ready after changing mode */ +- usleep_range(500, 1000); ++ /* ++ * Wait for the chip to be ready after switching to normal mode. ++ * The BMG160 datasheet (BST-BMG160-DS000-07 Rev. 1.0, May 2013) ++ * specifies a start-up / wake-up time (tsu, twusm) of 30 ms; use ++ * BMG160_MAX_STARTUP_TIME_MS (80 ms) as a safety margin, matching ++ * what bmg160_runtime_resume() already does. ++ */ ++ msleep(BMG160_MAX_STARTUP_TIME_MS); + + /* Set Bandwidth */ + ret = bmg160_set_bw(data, BMG160_DEF_BW); diff --git a/queue-6.18/iio-imu-adis-add-irqf_no_thread-to-non-fifo-trigger-irq.patch b/queue-6.18/iio-imu-adis-add-irqf_no_thread-to-non-fifo-trigger-irq.patch new file mode 100644 index 0000000000..f96b71558e --- /dev/null +++ b/queue-6.18/iio-imu-adis-add-irqf_no_thread-to-non-fifo-trigger-irq.patch @@ -0,0 +1,45 @@ +From 6e1b9bff1202da55c464e36bd34a2b6863d7fe30 Mon Sep 17 00:00:00 2001 +From: Runyu Xiao +Date: Thu, 4 Jun 2026 09:42:46 +0800 +Subject: iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ + +From: Runyu Xiao + +commit 6e1b9bff1202da55c464e36bd34a2b6863d7fe30 upstream. + +devm_adis_probe_trigger() registers iio_trigger_generic_data_rdy_poll() +through devm_request_irq() on the non-FIFO path, but it does not add +IRQF_NO_THREAD to the IRQ flags. + +When the kernel is booted with forced IRQ threading, the parent IRQ can +otherwise be threaded by the IRQ core and the subsequent IIO trigger +child IRQ is then dispatched from irq/... thread context instead of +hardirq context. Because iio_trigger_generic_data_rdy_poll() +immediately drives iio_trigger_poll(), this violates the hardirq-only +IIO trigger helper contract and can push downstream trigger consumers +through the wrong execution context. + +Add IRQF_NO_THREAD on top of the existing adis->irq_flag value for the +non-FIFO request_irq() path, while preserving the current trigger +polarity and IRQF_NO_AUTOEN behavior. + +Fixes: fec86c6b8369 ("iio: imu: adis: Add Managed device functions") +Cc: stable@vger.kernel.org +Signed-off-by: Runyu Xiao +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/adis_trigger.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/imu/adis_trigger.c ++++ b/drivers/iio/imu/adis_trigger.c +@@ -94,7 +94,7 @@ int devm_adis_probe_trigger(struct adis + else + ret = devm_request_irq(&adis->spi->dev, adis->spi->irq, + &iio_trigger_generic_data_rdy_poll, +- adis->irq_flag, ++ adis->irq_flag | IRQF_NO_THREAD, + indio_dev->name, + adis->trig); + if (ret) diff --git a/queue-6.18/iio-imu-bmi160-add-irqf_no_thread-to-data-ready-trigger-irq.patch b/queue-6.18/iio-imu-bmi160-add-irqf_no_thread-to-data-ready-trigger-irq.patch new file mode 100644 index 0000000000..993ed87223 --- /dev/null +++ b/queue-6.18/iio-imu-bmi160-add-irqf_no_thread-to-data-ready-trigger-irq.patch @@ -0,0 +1,45 @@ +From cd5a6a5096b246e10600da3ac47a1274ce9573c8 Mon Sep 17 00:00:00 2001 +From: Runyu Xiao +Date: Thu, 4 Jun 2026 09:42:47 +0800 +Subject: iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ + +From: Runyu Xiao + +commit cd5a6a5096b246e10600da3ac47a1274ce9573c8 upstream. + +bmi160_probe_trigger() registers iio_trigger_generic_data_rdy_poll() +through devm_request_irq(), but it passes only irq_type and does not add +IRQF_NO_THREAD. + +When the kernel is booted with forced IRQ threading, the parent IRQ can +otherwise be threaded by the IRQ core and the subsequent IIO trigger +child IRQ is dispatched from irq/... thread context instead of hardirq +context. Because the handler immediately pushes the event into +iio_trigger_poll(), this violates the hardirq-only IIO trigger helper +contract and can drive downstream trigger consumers through the wrong +execution context. + +Add IRQF_NO_THREAD on top of irq_type when registering the BMI160 data- +ready trigger handler. + +Fixes: 895bf81e6bbf ("iio:bmi160: add drdy interrupt support") +Cc: stable@vger.kernel.org +Signed-off-by: Runyu Xiao +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/bmi160/bmi160_core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/iio/imu/bmi160/bmi160_core.c ++++ b/drivers/iio/imu/bmi160/bmi160_core.c +@@ -788,7 +788,8 @@ int bmi160_probe_trigger(struct iio_dev + + ret = devm_request_irq(&indio_dev->dev, irq, + &iio_trigger_generic_data_rdy_poll, +- irq_type, "bmi160", data->trig); ++ irq_type | IRQF_NO_THREAD, ++ "bmi160", data->trig); + if (ret) + return ret; + diff --git a/queue-6.18/iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch b/queue-6.18/iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch new file mode 100644 index 0000000000..dc2e076c7a --- /dev/null +++ b/queue-6.18/iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch @@ -0,0 +1,55 @@ +From 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 Mon Sep 17 00:00:00 2001 +From: Jean-Baptiste Maneyrol +Date: Tue, 23 Jun 2026 16:22:15 +0200 +Subject: iio: imu: inv_icm42600: fix timestamp clock period by using lower value + +From: Jean-Baptiste Maneyrol + +commit 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 upstream. + +Clock period value is used for computing periods of sampling. There is +no need for it to be higher than the maximum odr, otherwise we are +losing precision in the computation for nothing. + +Switch clock period value to maximum odr period (8kHz). + +Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic") +Cc: stable@vger.kernel.org +Signed-off-by: Jean-Baptiste Maneyrol +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 4 ++-- + drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c +@@ -1170,10 +1170,10 @@ struct iio_dev *inv_icm42600_accel_init( + accel_st->filter = INV_ICM42600_FILTER_AVG_16X; + + /* +- * clock period is 32kHz (31250ns) ++ * clock period is 8kHz (125000ns) + * jitter is +/- 2% (20 per mille) + */ +- ts_chip.clock_period = 31250; ++ ts_chip.clock_period = 125000; + ts_chip.jitter = 20; + ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr); + inv_sensors_timestamp_init(&accel_st->ts, &ts_chip); +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c +@@ -755,10 +755,10 @@ struct iio_dev *inv_icm42600_gyro_init(s + } + + /* +- * clock period is 32kHz (31250ns) ++ * clock period is 8kHz (125000ns) + * jitter is +/- 2% (20 per mille) + */ +- ts_chip.clock_period = 31250; ++ ts_chip.clock_period = 125000; + ts_chip.jitter = 20; + ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr); + inv_sensors_timestamp_init(&gyro_st->ts, &ts_chip); diff --git a/queue-6.18/iio-imu-inv_icm42600-fix-timestamping-by-limiting-fifo-reading.patch b/queue-6.18/iio-imu-inv_icm42600-fix-timestamping-by-limiting-fifo-reading.patch new file mode 100644 index 0000000000..229b28c583 --- /dev/null +++ b/queue-6.18/iio-imu-inv_icm42600-fix-timestamping-by-limiting-fifo-reading.patch @@ -0,0 +1,68 @@ +From affe3f077d7a4eeb25937f5323ff059a54b4712c Mon Sep 17 00:00:00 2001 +From: Jean-Baptiste Maneyrol +Date: Mon, 29 Jun 2026 21:51:55 +0200 +Subject: iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading + +From: Jean-Baptiste Maneyrol + +commit affe3f077d7a4eeb25937f5323ff059a54b4712c upstream. + +Timestamps are made by measuring the chip clock using the watermark +interrupts. If we read more than watermark samples as done today, we +are reducing the period between interrupts and distort the time +measurement. Fix that by reading only watermark samples in the +interrupt case. + +Fixes: 7f85e42a6c54 ("iio: imu: inv_icm42600: add buffer support in iio devices") +Cc: stable@vger.kernel.org +Signed-off-by: Jean-Baptiste Maneyrol +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 9 +++++---- + drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h | 1 + + 2 files changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c +@@ -248,6 +248,7 @@ int inv_icm42600_buffer_update_watermark + + /* compute watermark value in bytes */ + wm_size = watermark * packet_size; ++ st->fifo.watermark.value = watermark; + + /* changing FIFO watermark requires to turn off watermark interrupt */ + ret = regmap_update_bits_check(st->map, INV_ICM42600_REG_INT_SOURCE0, +@@ -454,11 +455,10 @@ int inv_icm42600_buffer_fifo_read(struct + st->fifo.nb.accel = 0; + st->fifo.nb.total = 0; + +- /* compute maximum FIFO read size */ ++ /* compute maximum FIFO read size (watermark for max = 0 interrupt case) */ + if (max == 0) +- max_count = sizeof(st->fifo.data); +- else +- max_count = max * inv_icm42600_get_packet_size(st->fifo.en); ++ max = st->fifo.watermark.value; ++ max_count = max * inv_icm42600_get_packet_size(st->fifo.en); + + /* read FIFO count value */ + raw_fifo_count = (__be16 *)st->buffer; +@@ -574,6 +574,7 @@ int inv_icm42600_buffer_init(struct inv_ + + st->fifo.watermark.eff_gyro = 1; + st->fifo.watermark.eff_accel = 1; ++ st->fifo.watermark.value = 1; + + /* + * Default FIFO configuration (bits 7 to 5) +--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h ++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h +@@ -34,6 +34,7 @@ struct inv_icm42600_fifo { + unsigned int accel; + unsigned int eff_gyro; + unsigned int eff_accel; ++ unsigned int value; + } watermark; + size_t count; + struct { diff --git a/queue-6.18/iio-imu-st_lsm6dsx-deselect-shub-page-before-reading-whoami.patch b/queue-6.18/iio-imu-st_lsm6dsx-deselect-shub-page-before-reading-whoami.patch new file mode 100644 index 0000000000..3f968bbd41 --- /dev/null +++ b/queue-6.18/iio-imu-st_lsm6dsx-deselect-shub-page-before-reading-whoami.patch @@ -0,0 +1,85 @@ +From aede83625ff5d9539508582036df30c809d51058 Mon Sep 17 00:00:00 2001 +From: Andreas Kempe +Date: Thu, 2 Jul 2026 10:41:23 +0000 +Subject: iio: imu: st_lsm6dsx: deselect shub page before reading whoami + +From: Andreas Kempe + +commit aede83625ff5d9539508582036df30c809d51058 upstream. + +As part of driver initialization, e.g. st_lsm6dsx_init_shub() selects +the shub register page using st_lsm6dsx_set_page(). Selecting the shub +register page shadows the regular register space so whoami, among other +registers, is no longer accessible. + +In applications where the IMU is permanently powered separately from the +processor, there is a window where a reset of the CPU leaves the IMU in +the shub register page. Once this occurs, any subsequent probe attempt +fails because of the register shadowing. + +Using the ism330dlc, the error typically looks like + + st_lsm6dsx_i2c 3-006a: unsupported whoami [10] + +with the unknown whoami read from a reserved register in the shub page. + +The reset register is also shadowed by the page select, preventing a +reset from recovering the chip. + +Unconditionally clear the shub page before the whoami readout to ensure +normal register access and allow the initialization to proceed. + +Place the fix in st_lsm6dsx_check_whoami() before the whoami check +because hw->settings, which st_lsm6dsx_set_page() relies on, is first +assigned in that function. + +Placing the fix in a more logical place than the whoami check would +require a bigger restructuring of the code. + +Fixes: c91c1c844ebd ("iio: imu: st_lsm6dsx: add i2c embedded controller support") +Signed-off-by: Andreas Kempe +Acked-by: Lorenzo Bianconi +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 21 ++++++++++++++++++++- + 1 file changed, 20 insertions(+), 1 deletion(-) + +--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c ++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +@@ -1597,6 +1597,26 @@ static int st_lsm6dsx_check_whoami(struc + return -ENODEV; + } + ++ hw->settings = &st_lsm6dsx_sensor_settings[i]; ++ ++ if (hw->settings->shub_settings.page_mux.addr) { ++ /* ++ * If the IMU has the shub page selected on init, for example ++ * after a CPU watchdog reset while the page is selected, the ++ * regular register space is shadowed. While the regular ++ * register space is shadowed, the registers needed for ++ * initializing the IMU are not available. ++ * ++ * Unconditionally clear the shub page selection to ensure ++ * normal register access. ++ */ ++ err = st_lsm6dsx_set_page(hw, false); ++ if (err < 0) { ++ dev_err(hw->dev, "failed to clear shub page\n"); ++ return err; ++ } ++ } ++ + err = regmap_read(hw->regmap, ST_LSM6DSX_REG_WHOAMI_ADDR, &data); + if (err < 0) { + dev_err(hw->dev, "failed to read whoami register\n"); +@@ -1609,7 +1629,6 @@ static int st_lsm6dsx_check_whoami(struc + } + + *name = st_lsm6dsx_sensor_settings[i].id[j].name; +- hw->settings = &st_lsm6dsx_sensor_settings[i]; + + return 0; + } diff --git a/queue-6.18/iio-light-al3000a-add-missing-regmap_i2c-to-kconfig.patch b/queue-6.18/iio-light-al3000a-add-missing-regmap_i2c-to-kconfig.patch new file mode 100644 index 0000000000..06a4527f77 --- /dev/null +++ b/queue-6.18/iio-light-al3000a-add-missing-regmap_i2c-to-kconfig.patch @@ -0,0 +1,33 @@ +From a2d30022b7c316ad845d1b696e724058b88e5a4e Mon Sep 17 00:00:00 2001 +From: Joshua Crofts +Date: Thu, 25 Jun 2026 21:38:08 +0200 +Subject: iio: light: al3000a: add missing REGMAP_I2C to Kconfig + +From: Joshua Crofts + +commit a2d30022b7c316ad845d1b696e724058b88e5a4e upstream. + +The KConfig entry for the al3000a is missing a `select REGMAP_I2C`, +causing build failures. + +Fixes: d531b9f78949 ("iio: light: Add support for AL3000a illuminance sensor") +Signed-off-by: Joshua Crofts +Reviewed-by: Andy Shevchenko +Reviewed-by: David Heidelberg +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/light/Kconfig ++++ b/drivers/iio/light/Kconfig +@@ -45,6 +45,7 @@ config ADUX1020 + + config AL3000A + tristate "AL3000a ambient light sensor" ++ select REGMAP_I2C + depends on I2C + help + Say Y here if you want to build a driver for the Dyna Image AL3000a diff --git a/queue-6.18/iio-light-al3010-add-missing-regmap_i2c-to-kconfig.patch b/queue-6.18/iio-light-al3010-add-missing-regmap_i2c-to-kconfig.patch new file mode 100644 index 0000000000..5849bdab3a --- /dev/null +++ b/queue-6.18/iio-light-al3010-add-missing-regmap_i2c-to-kconfig.patch @@ -0,0 +1,33 @@ +From 84486e3bbda18a2df1ed74ca78e1e14bde9a941b Mon Sep 17 00:00:00 2001 +From: Joshua Crofts +Date: Thu, 25 Jun 2026 21:38:09 +0200 +Subject: iio: light: al3010: add missing REGMAP_I2C to Kconfig + +From: Joshua Crofts + +commit 84486e3bbda18a2df1ed74ca78e1e14bde9a941b upstream. + +The KConfig entry for the AL3010 is missing a `select REGMAP_I2C`, +causing build failures. + +Fixes: 0e5e21e23dd6 ("iio: light: al3010: Implement regmap support") +Signed-off-by: Joshua Crofts +Reviewed-by: Andy Shevchenko +Reviewed-by: David Heidelberg +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/light/Kconfig ++++ b/drivers/iio/light/Kconfig +@@ -56,6 +56,7 @@ config AL3000A + + config AL3010 + tristate "AL3010 ambient light sensor" ++ select REGMAP_I2C + depends on I2C + help + Say Y here if you want to build a driver for the Dyna Image AL3010 diff --git a/queue-6.18/iio-light-al3010-fix-incorrect-scale-for-the-highest-gain-range.patch b/queue-6.18/iio-light-al3010-fix-incorrect-scale-for-the-highest-gain-range.patch new file mode 100644 index 0000000000..cde1f79309 --- /dev/null +++ b/queue-6.18/iio-light-al3010-fix-incorrect-scale-for-the-highest-gain-range.patch @@ -0,0 +1,41 @@ +From aa411adc6ce40ad1a55ebc965f255a4cfc0005f8 Mon Sep 17 00:00:00 2001 +From: Vidhu Sarwal +Date: Sat, 4 Jul 2026 17:22:45 +0530 +Subject: iio: light: al3010: fix incorrect scale for the highest gain range + +From: Vidhu Sarwal + +commit aa411adc6ce40ad1a55ebc965f255a4cfc0005f8 upstream. + +al3010_scales[] encodes the highest gain range as {0, 1187200}. +For IIO_VAL_INT_PLUS_MICRO, the fractional part must be less than +1000000, so the scale 1.1872 should instead be represented as +{ 1, 187200 }. + +Since write_raw() compares the value from userspace against this +table, writing the advertised 1.1872 scale never matches the malformed +entry and returns -EINVAL. As a result, the highest gain range cannot +be selected. Reading the scale in that state also reports the malformed +value. + +Fixes: c36b5195ab70 ("iio: light: add Dyna-Image AL3010 driver") +Signed-off-by: Vidhu Sarwal +Reviewed-by: Andy Shevchenko +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/al3010.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/light/al3010.c ++++ b/drivers/iio/light/al3010.c +@@ -42,7 +42,7 @@ enum al3xxxx_range { + }; + + static const int al3010_scales[][2] = { +- {0, 1187200}, {0, 296800}, {0, 74200}, {0, 18600} ++ { 1, 187200 }, { 0, 296800 }, { 0, 74200 }, { 0, 18600 }, + }; + + static const struct regmap_config al3010_regmap_config = { diff --git a/queue-6.18/iio-light-al3010-read-both-als-adc-registers-again.patch b/queue-6.18/iio-light-al3010-read-both-als-adc-registers-again.patch new file mode 100644 index 0000000000..656031b2b4 --- /dev/null +++ b/queue-6.18/iio-light-al3010-read-both-als-adc-registers-again.patch @@ -0,0 +1,50 @@ +From ee78fae068f52a5582aaf448d9414f826855c106 Mon Sep 17 00:00:00 2001 +From: "Alexander A. Klimov" +Date: Sat, 23 May 2026 13:44:57 +0200 +Subject: iio: light: al3010: read both ALS ADC registers again + +From: Alexander A. Klimov + +commit ee78fae068f52a5582aaf448d9414f826855c106 upstream. + +al3010_read_raw() used to read two adjacent registers +until the driver was modernized using the regmap framework. +That cleanup accidentally replaced the 16-bit word read +with a single byte read. I'm reverting latter. + +Fixes: 0e5e21e23dd6 ("iio: light: al3010: Implement regmap support") +Signed-off-by: Alexander A. Klimov +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/al3010.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/iio/light/al3010.c ++++ b/drivers/iio/light/al3010.c +@@ -111,7 +111,8 @@ static int al3010_read_raw(struct iio_de + int *val2, long mask) + { + struct al3010_data *data = iio_priv(indio_dev); +- int ret, gain, raw; ++ int ret, gain; ++ __le16 raw; + + switch (mask) { + case IIO_CHAN_INFO_RAW: +@@ -120,11 +121,12 @@ static int al3010_read_raw(struct iio_de + * - low byte of output is stored at AL3010_REG_DATA_LOW + * - high byte of output is stored at AL3010_REG_DATA_LOW + 1 + */ +- ret = regmap_read(data->regmap, AL3010_REG_DATA_LOW, &raw); ++ ret = regmap_bulk_read(data->regmap, AL3010_REG_DATA_LOW, ++ &raw, sizeof(raw)); + if (ret) + return ret; + +- *val = raw; ++ *val = le16_to_cpu(raw); + + return IIO_VAL_INT; + case IIO_CHAN_INFO_SCALE: diff --git a/queue-6.18/iio-light-al3320a-add-missing-regmap_i2c-to-kconfig.patch b/queue-6.18/iio-light-al3320a-add-missing-regmap_i2c-to-kconfig.patch new file mode 100644 index 0000000000..2323e0ab7b --- /dev/null +++ b/queue-6.18/iio-light-al3320a-add-missing-regmap_i2c-to-kconfig.patch @@ -0,0 +1,33 @@ +From 9efcc9ba9b2e940cc01e63d132ae741e4c5d09c7 Mon Sep 17 00:00:00 2001 +From: Joshua Crofts +Date: Thu, 25 Jun 2026 21:38:10 +0200 +Subject: iio: light: al3320a: add missing REGMAP_I2C to Kconfig + +From: Joshua Crofts + +commit 9efcc9ba9b2e940cc01e63d132ae741e4c5d09c7 upstream. + +The Kconfig entry for the al3320a is missing a `select REGMAP_I2C`, +causing build failures. + +Fixes: 1850e6ae7f91 ("iio: light: al3320a: Implement regmap support") +Signed-off-by: Joshua Crofts +Reviewed-by: Andy Shevchenko +Reviewed-by: David Heidelberg +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/light/Kconfig ++++ b/drivers/iio/light/Kconfig +@@ -67,6 +67,7 @@ config AL3010 + + config AL3320A + tristate "AL3320A ambient light sensor" ++ select REGMAP_I2C + depends on I2C + help + Say Y here if you want to build a driver for the Dyna Image AL3320A diff --git a/queue-6.18/iio-light-al3320a-read-both-als-adc-registers-again.patch b/queue-6.18/iio-light-al3320a-read-both-als-adc-registers-again.patch new file mode 100644 index 0000000000..2026c447b9 --- /dev/null +++ b/queue-6.18/iio-light-al3320a-read-both-als-adc-registers-again.patch @@ -0,0 +1,50 @@ +From 744bccc2647c6b2206290e8e40890a23812116b3 Mon Sep 17 00:00:00 2001 +From: "Alexander A. Klimov" +Date: Sat, 23 May 2026 13:44:58 +0200 +Subject: iio: light: al3320a: read both ALS ADC registers again + +From: Alexander A. Klimov + +commit 744bccc2647c6b2206290e8e40890a23812116b3 upstream. + +al3320a_read_raw() used to read two adjacent registers +until the driver was modernized using the regmap framework. +That cleanup accidentally replaced the 16-bit word read +with a single byte read. I'm reverting latter. + +Fixes: 1850e6ae7f91 ("iio: light: al3320a: Implement regmap support") +Signed-off-by: Alexander A. Klimov +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/al3320a.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/iio/light/al3320a.c ++++ b/drivers/iio/light/al3320a.c +@@ -135,7 +135,8 @@ static int al3320a_read_raw(struct iio_d + int *val2, long mask) + { + struct al3320a_data *data = iio_priv(indio_dev); +- int ret, gain, raw; ++ int ret, gain; ++ __le16 raw; + + switch (mask) { + case IIO_CHAN_INFO_RAW: +@@ -144,11 +145,12 @@ static int al3320a_read_raw(struct iio_d + * - low byte of output is stored at AL3320A_REG_DATA_LOW + * - high byte of output is stored at AL3320A_REG_DATA_LOW + 1 + */ +- ret = regmap_read(data->regmap, AL3320A_REG_DATA_LOW, &raw); ++ ret = regmap_bulk_read(data->regmap, AL3320A_REG_DATA_LOW, ++ &raw, sizeof(raw)); + if (ret) + return ret; + +- *val = raw; ++ *val = le16_to_cpu(raw); + + return IIO_VAL_INT; + case IIO_CHAN_INFO_SCALE: diff --git a/queue-6.18/iio-light-gp2ap002-fix-runtime-pm-leak-on-read-error.patch b/queue-6.18/iio-light-gp2ap002-fix-runtime-pm-leak-on-read-error.patch new file mode 100644 index 0000000000..7d4dcdffef --- /dev/null +++ b/queue-6.18/iio-light-gp2ap002-fix-runtime-pm-leak-on-read-error.patch @@ -0,0 +1,38 @@ +From 38b72267b7e22768a1f26d9935de4e1752a1dc85 Mon Sep 17 00:00:00 2001 +From: Biren Pandya +Date: Sun, 14 Jun 2026 12:45:49 +0530 +Subject: iio: light: gp2ap002: fix runtime PM leak on read error + +From: Biren Pandya + +commit 38b72267b7e22768a1f26d9935de4e1752a1dc85 upstream. + +gp2ap002_read_raw() calls pm_runtime_get_sync() before reading the +lux value, but if gp2ap002_get_lux() fails, it returns directly. This +skips the pm_runtime_put_autosuspend() call at the "out" label, +permanently leaking a runtime PM reference and preventing the device +from autosuspending. + +Replace the direct return with a "goto out" to ensure the reference +is properly dropped on the error path. + +Fixes: f6dbf83c17cb ("iio: light: gp2ap002: Take runtime PM reference on light read") +Signed-off-by: Biren Pandya +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/gp2ap002.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/light/gp2ap002.c ++++ b/drivers/iio/light/gp2ap002.c +@@ -258,7 +258,7 @@ static int gp2ap002_read_raw(struct iio_ + case IIO_LIGHT: + ret = gp2ap002_get_lux(gp2ap002); + if (ret < 0) +- return ret; ++ goto out; + *val = ret; + ret = IIO_VAL_INT; + goto out; diff --git a/queue-6.18/iio-light-opt3001-fix-missing-state-reset-on-timeout.patch b/queue-6.18/iio-light-opt3001-fix-missing-state-reset-on-timeout.patch new file mode 100644 index 0000000000..0cc8d360b2 --- /dev/null +++ b/queue-6.18/iio-light-opt3001-fix-missing-state-reset-on-timeout.patch @@ -0,0 +1,44 @@ +From c123ca6ee26ad98f70a866ff428b08145c5a24fe Mon Sep 17 00:00:00 2001 +From: Joshua Crofts +Date: Tue, 26 May 2026 13:15:29 +0200 +Subject: iio: light: opt3001: fix missing state reset on timeout + +From: Joshua Crofts + +commit c123ca6ee26ad98f70a866ff428b08145c5a24fe upstream. + +Currently in the function opt3001_get_processed(), there is a check +that directly returns -ETIMEDOUT if the conversion IRQ times out, +completely bypassing the err label, leaving ok_to_ignore_lock +permanently true, potentially breaking the device's falling threshold +interrupt detection. + +Assign -ETIMEDOUT to the return variable and jump to the error label +to ensure ok_to_ignore_lock is properly reset. + +Fixes: 26d90b559057 ("iio: light: opt3001: Fixed timeout error when 0 lux") +Reported-by: Sashiko +Closes: https://sashiko.dev/#/patchset/20260525-opt3001-cleanup-v4-0-65b36a174f78%40gmail.com?part=1 +Signed-off-by: Joshua Crofts +Cc: stable@vger.kernel.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/opt3001.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/iio/light/opt3001.c ++++ b/drivers/iio/light/opt3001.c +@@ -366,8 +366,10 @@ static int opt3001_get_processed(struct + ret = wait_event_timeout(opt->result_ready_queue, + opt->result_ready, + msecs_to_jiffies(OPT3001_RESULT_READY_LONG)); +- if (ret == 0) +- return -ETIMEDOUT; ++ if (ret == 0) { ++ ret = -ETIMEDOUT; ++ goto err; ++ } + } else { + /* Sleep for result ready time */ + timeout = (opt->int_time == OPT3001_INT_TIME_SHORT) ? diff --git a/queue-6.18/iio-light-tsl2591-return-actual-error-from-probe-irq-failure.patch b/queue-6.18/iio-light-tsl2591-return-actual-error-from-probe-irq-failure.patch new file mode 100644 index 0000000000..dd6ecd7621 --- /dev/null +++ b/queue-6.18/iio-light-tsl2591-return-actual-error-from-probe-irq-failure.patch @@ -0,0 +1,39 @@ +From a00ffd15674bfaf8b906503c1600e3d8709af56c Mon Sep 17 00:00:00 2001 +From: Stepan Ionichev +Date: Mon, 18 May 2026 14:43:11 +0500 +Subject: iio: light: tsl2591: return actual error from probe IRQ failure + +From: Stepan Ionichev + +commit a00ffd15674bfaf8b906503c1600e3d8709af56c upstream. + +When devm_request_threaded_irq() fails, probe logs the error and +then returns -EINVAL, dropping the real error code and breaking the +deferred-probe flow for -EPROBE_DEFER. + +Return ret directly; the IRQ subsystem already prints on failure. + +Fixes: 2335f0d7c790 ("iio: light: Added AMS tsl2591 driver implementation") +Cc: stable@vger.kernel.org +Signed-off-by: Stepan Ionichev +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/tsl2591.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/iio/light/tsl2591.c ++++ b/drivers/iio/light/tsl2591.c +@@ -1137,10 +1137,8 @@ static int tsl2591_probe(struct i2c_clie + NULL, tsl2591_event_handler, + IRQF_TRIGGER_FALLING | IRQF_ONESHOT, + "tsl2591_irq", indio_dev); +- if (ret) { +- dev_err_probe(&client->dev, ret, "IRQ request error\n"); +- return -EINVAL; +- } ++ if (ret) ++ return ret; + indio_dev->info = &tsl2591_info; + } else { + indio_dev->info = &tsl2591_info_no_irq; diff --git a/queue-6.18/iio-light-veml6030-fix-channel-type-when-pushing-events.patch b/queue-6.18/iio-light-veml6030-fix-channel-type-when-pushing-events.patch new file mode 100644 index 0000000000..12dbf19b1b --- /dev/null +++ b/queue-6.18/iio-light-veml6030-fix-channel-type-when-pushing-events.patch @@ -0,0 +1,40 @@ +From c52bb33b641ebaae3e209f97714cb1758206f7d9 Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Thu, 14 May 2026 14:01:11 +1300 +Subject: iio: light: veml6030: fix channel type when pushing events + +From: Javier Carrasco + +commit c52bb33b641ebaae3e209f97714cb1758206f7d9 upstream. + +The events are registered for IIO_LIGHT and not for IIO_INTENSITY. +Use the correct channel type. + +When at it, fix minor checkpatch code style warning (alignment). + +Cc: stable@vger.kernel.org +Fixes: 7b779f573c48 ("iio: light: add driver for veml6030 ambient light sensor") +Signed-off-by: Javier Carrasco +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/light/veml6030.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/iio/light/veml6030.c ++++ b/drivers/iio/light/veml6030.c +@@ -875,9 +875,11 @@ static irqreturn_t veml6030_event_handle + else + evtdir = IIO_EV_DIR_FALLING; + +- iio_push_event(indio_dev, IIO_UNMOD_EVENT_CODE(IIO_INTENSITY, +- 0, IIO_EV_TYPE_THRESH, evtdir), +- iio_get_time_ns(indio_dev)); ++ iio_push_event(indio_dev, IIO_UNMOD_EVENT_CODE(IIO_LIGHT, ++ 0, ++ IIO_EV_TYPE_THRESH, ++ evtdir), ++ iio_get_time_ns(indio_dev)); + + return IRQ_HANDLED; + } diff --git a/queue-6.18/iio-magnetometer-ak8975-add-missed-pm_runtime_put_autosuspend-call.patch b/queue-6.18/iio-magnetometer-ak8975-add-missed-pm_runtime_put_autosuspend-call.patch new file mode 100644 index 0000000000..ad8237e23a --- /dev/null +++ b/queue-6.18/iio-magnetometer-ak8975-add-missed-pm_runtime_put_autosuspend-call.patch @@ -0,0 +1,34 @@ +From e94944d7364d3ddb273539492f9bd9c9a622549a Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Wed, 6 May 2026 10:27:55 +0200 +Subject: iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call + +From: Andy Shevchenko + +commit e94944d7364d3ddb273539492f9bd9c9a622549a upstream. + +On the failure in the ak8975_read_axis() the PM runtime gets unbalanced. +Balance it by calling pm_runtime_put_autosuspend() on error path as well. + +Fixes: cde4cb5dd422 ("iio: magn: ak8975: deploy runtime and system PM") +Reported-by: Sashiko +Closes: https://sashiko.dev/#/patchset/20260505-magnetometer-fixes-v5-0-831b9b5550fc%40gmail.com +Signed-off-by: Andy Shevchenko +Reviewed-by: Joshua Crofts +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/magnetometer/ak8975.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/magnetometer/ak8975.c ++++ b/drivers/iio/magnetometer/ak8975.c +@@ -784,6 +784,7 @@ static int ak8975_read_axis(struct iio_d + + exit: + mutex_unlock(&data->lock); ++ pm_runtime_put_autosuspend(&data->client->dev); + dev_err(&client->dev, "Error in reading axis\n"); + return ret; + } diff --git a/queue-6.18/iio-pressure-bmp280-zero-init-bmp580-trigger-handler-buffer.patch b/queue-6.18/iio-pressure-bmp280-zero-init-bmp580-trigger-handler-buffer.patch new file mode 100644 index 0000000000..8bdc67a3d5 --- /dev/null +++ b/queue-6.18/iio-pressure-bmp280-zero-init-bmp580-trigger-handler-buffer.patch @@ -0,0 +1,46 @@ +From 1172160f2a2de7bade3bec64b8c5ecf945cde5ed Mon Sep 17 00:00:00 2001 +From: David Carlier +Date: Tue, 5 May 2026 18:34:55 +0100 +Subject: iio: pressure: bmp280: zero-init bmp580 trigger handler buffer + +From: David Carlier + +commit 1172160f2a2de7bade3bec64b8c5ecf945cde5ed upstream. + +bmp580_trigger_handler() builds an on-stack scan buffer containing +two __le32 fields and an aligned_s64 timestamp, and pushes it to +userspace via iio_push_to_buffers_with_ts(). However, only the low +3 bytes of each __le32 field are populated by the device data: + + memcpy(&buffer.comp_press, &data->buf[3], 3); + memcpy(&buffer.comp_temp, &data->buf[0], 3); + +The high byte of each field is left uninitialised on the stack. +The bmp580 channels declare storagebits = 32, so the IIO core +transports all four bytes per sample to userspace as part of the +scan element, leaking two bytes of kernel stack per scan. + +Zero-initialise the buffer before populating it, mirroring the fix +applied to bme280_trigger_handler() in commit 018f50909e66 ("iio: +bmp280: zero-init buffer"). + +Fixes: 872c8014e05e ("iio: pressure: bmp280: drop sensor_data array") +Cc: stable@vger.kernel.org +Signed-off-by: David Carlier +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/pressure/bmp280-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/pressure/bmp280-core.c ++++ b/drivers/iio/pressure/bmp280-core.c +@@ -1910,7 +1910,7 @@ static irqreturn_t bmp380_trigger_handle + u32 comp_press; + s32 comp_temp; + aligned_s64 timestamp; +- } buffer; ++ } buffer = { }; + int ret; + + guard(mutex)(&data->lock); diff --git a/queue-6.18/iio-pressure-mpl115-fix-runtime-pm-leak-on-read-error.patch b/queue-6.18/iio-pressure-mpl115-fix-runtime-pm-leak-on-read-error.patch new file mode 100644 index 0000000000..4beadcfaf1 --- /dev/null +++ b/queue-6.18/iio-pressure-mpl115-fix-runtime-pm-leak-on-read-error.patch @@ -0,0 +1,51 @@ +From fbe67ff37a6fd855a6c097f84f3738bd13d0a898 Mon Sep 17 00:00:00 2001 +From: Biren Pandya +Date: Sun, 14 Jun 2026 12:45:48 +0530 +Subject: iio: pressure: mpl115: fix runtime PM leak on read error + +From: Biren Pandya + +commit fbe67ff37a6fd855a6c097f84f3738bd13d0a898 upstream. + +mpl115_read_raw() takes a runtime PM reference with pm_runtime_get_sync() +before reading the processed pressure or raw temperature, but on the read +error path it returns without calling pm_runtime_put_autosuspend(). Each +failed read therefore leaks a runtime PM reference and prevents the device +from autosuspending. + +Drop the reference before checking the return value so both the success +and error paths are balanced. + +Fixes: 0c3a333524a3 ("iio: pressure: mpl115: Implementing low power mode by shutdown gpio") +Signed-off-by: Biren Pandya +Assisted-by: Claude:claude-opus-4-8 coccinelle +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/pressure/mpl115.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/iio/pressure/mpl115.c ++++ b/drivers/iio/pressure/mpl115.c +@@ -106,18 +106,18 @@ static int mpl115_read_raw(struct iio_de + case IIO_CHAN_INFO_PROCESSED: + pm_runtime_get_sync(data->dev); + ret = mpl115_comp_pressure(data, val, val2); ++ pm_runtime_put_autosuspend(data->dev); + if (ret < 0) + return ret; +- pm_runtime_put_autosuspend(data->dev); + + return IIO_VAL_INT_PLUS_MICRO; + case IIO_CHAN_INFO_RAW: + pm_runtime_get_sync(data->dev); + /* temperature -5.35 C / LSB, 472 LSB is 25 C */ + ret = mpl115_read_temp(data); ++ pm_runtime_put_autosuspend(data->dev); + if (ret < 0) + return ret; +- pm_runtime_put_autosuspend(data->dev); + *val = ret >> 6; + + return IIO_VAL_INT; diff --git a/queue-6.18/iio-proximity-vl53l0x-notify-trigger-and-clear-irq-on-error-paths.patch b/queue-6.18/iio-proximity-vl53l0x-notify-trigger-and-clear-irq-on-error-paths.patch new file mode 100644 index 0000000000..339a22e4aa --- /dev/null +++ b/queue-6.18/iio-proximity-vl53l0x-notify-trigger-and-clear-irq-on-error-paths.patch @@ -0,0 +1,60 @@ +From be843b0579f872ec7590d825e2c9a656d4790c4b Mon Sep 17 00:00:00 2001 +From: Stepan Ionichev +Date: Thu, 14 May 2026 19:37:10 +0500 +Subject: iio: proximity: vl53l0x: notify trigger and clear IRQ on error paths + +From: Stepan Ionichev + +commit be843b0579f872ec7590d825e2c9a656d4790c4b upstream. + +vl53l0x_trigger_handler() returns directly on the I2C read failure +paths without calling iio_trigger_notify_done() or vl53l0x_clear_irq(). + +A single transient i2c_smbus_read_i2c_block_data() failure (negative +errno or a short read) therefore leaves two pieces of state behind: + + - iio_trigger_notify_done() never decrements the trigger's use_count, + so iio_trigger_poll_nested() silently drops further dispatches + (see industrialio-trigger.c, the !atomic_read(&trig->use_count) + guard); + - vl53l0x_clear_irq() never writes SYSTEM_INTERRUPT_CLEAR, so the + chip keeps the DRDY interrupt asserted. + +The sensor's buffer mode stays wedged from then on, recoverable only +by re-binding the driver. The sibling driver vl53l1x-i2c.c handles +exactly the same case correctly by jumping to a "notify_and_clear_irq" +label that always calls both helpers; mirror that here. + +The bogus negative-int return value cast to irqreturn_t also goes +away as a side effect. + +Fixes: 762186c6e7b1 ("iio: proximity: vl53l0x-i2c: Added continuous mode support") +Signed-off-by: Stepan Ionichev +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/proximity/vl53l0x-i2c.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/iio/proximity/vl53l0x-i2c.c ++++ b/drivers/iio/proximity/vl53l0x-i2c.c +@@ -87,15 +87,14 @@ static irqreturn_t vl53l0x_trigger_handl + ret = i2c_smbus_read_i2c_block_data(data->client, + VL_REG_RESULT_RANGE_STATUS, + sizeof(buffer), buffer); +- if (ret < 0) +- return ret; +- else if (ret != 12) +- return -EREMOTEIO; ++ if (ret != 12) ++ goto done; + + scan.chan = get_unaligned_be16(&buffer[10]); + iio_push_to_buffers_with_ts(indio_dev, &scan, sizeof(scan), + iio_get_time_ns(indio_dev)); + ++done: + iio_trigger_notify_done(indio_dev->trig); + vl53l0x_clear_irq(data); + diff --git a/queue-6.18/iio-resolver-ad2s1210-notify-trigger-and-clear-state-on-fault-read-error.patch b/queue-6.18/iio-resolver-ad2s1210-notify-trigger-and-clear-state-on-fault-read-error.patch new file mode 100644 index 0000000000..103b33dc27 --- /dev/null +++ b/queue-6.18/iio-resolver-ad2s1210-notify-trigger-and-clear-state-on-fault-read-error.patch @@ -0,0 +1,58 @@ +From 70247658d0e783c93b48fcbc3b81d99e992ff478 Mon Sep 17 00:00:00 2001 +From: Stepan Ionichev +Date: Fri, 15 May 2026 18:31:38 +0500 +Subject: iio: resolver: ad2s1210: notify trigger and clear state on fault read error + +From: Stepan Ionichev + +commit 70247658d0e783c93b48fcbc3b81d99e992ff478 upstream. + +ad2s1210_trigger_handler() walks several scan-mask branches and uses +"goto error_ret" to land on the iio_trigger_notify_done() teardown at +the bottom of the function for every I/O error -- except the +MOD_CONFIG fault-register read, which uses a bare "return ret": + + if (st->fixed_mode == MOD_CONFIG) { + unsigned int reg_val; + + ret = regmap_read(st->regmap, AD2S1210_REG_FAULT, ®_val); + if (ret < 0) + return ret; + ... + } + +Two problems on that path: + + - the handler returns a negative errno where the prototype expects + an irqreturn_t (IRQ_HANDLED / IRQ_NONE), so the caller in the + IIO core sees a value outside the enum; + - iio_trigger_notify_done() is skipped, leaving the trigger + busy-flag set. A single transient SPI/regmap error on the fault + read then wedges the trigger so subsequent samples are dropped + until the consumer is detached. + +Convert the error path to "goto error_ret" so the failure path goes +through the same notify_done() teardown as every other error in the +handler. + +Fixes: f9b9ff95be8c ("iio: resolver: ad2s1210: add support for adi,fixed-mode") +Signed-off-by: Stepan Ionichev +Reviewed-by: David Lechner +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/resolver/ad2s1210.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/resolver/ad2s1210.c ++++ b/drivers/iio/resolver/ad2s1210.c +@@ -1334,7 +1334,7 @@ static irqreturn_t ad2s1210_trigger_hand + + ret = regmap_read(st->regmap, AD2S1210_REG_FAULT, ®_val); + if (ret < 0) +- return ret; ++ goto error_ret; + + st->sample.fault = reg_val; + } diff --git a/queue-6.18/iio-temperature-build-mlx90635-with-config_mlx90635.patch b/queue-6.18/iio-temperature-build-mlx90635-with-config_mlx90635.patch new file mode 100644 index 0000000000..e5c53fd0d8 --- /dev/null +++ b/queue-6.18/iio-temperature-build-mlx90635-with-config_mlx90635.patch @@ -0,0 +1,40 @@ +From 63a76e3a587c4143e8e24e8a6b0c232fa0676034 Mon Sep 17 00:00:00 2001 +From: Pengpeng Hou +Date: Thu, 25 Jun 2026 13:42:59 +0800 +Subject: iio: temperature: Build mlx90635 with CONFIG_MLX90635 + +From: Pengpeng Hou + +commit 63a76e3a587c4143e8e24e8a6b0c232fa0676034 upstream. + +drivers/iio/temperature/Kconfig has a dedicated MLX90635 option, but +the Makefile currently builds mlx90635.o under CONFIG_MLX90632. + +This means enabling CONFIG_MLX90635 alone does not carry its provider +object into the build, while enabling CONFIG_MLX90632 unexpectedly also +builds mlx90635.o. + +Gate mlx90635.o on the matching generated Kconfig symbol. + +Fixes: a1d1ba5e1c28 ("iio: temperature: mlx90635 MLX90635 IR Temperature sensor") +Cc: stable@vger.kernel.org +Signed-off-by: Pengpeng Hou +Reviewed-by: Andy Shevchenko +Acked-by: Crt Mori +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/temperature/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/temperature/Makefile ++++ b/drivers/iio/temperature/Makefile +@@ -13,7 +13,7 @@ obj-$(CONFIG_MAX31865) += max31865.o + obj-$(CONFIG_MCP9600) += mcp9600.o + obj-$(CONFIG_MLX90614) += mlx90614.o + obj-$(CONFIG_MLX90632) += mlx90632.o +-obj-$(CONFIG_MLX90632) += mlx90635.o ++obj-$(CONFIG_MLX90635) += mlx90635.o + obj-$(CONFIG_TMP006) += tmp006.o + obj-$(CONFIG_TMP007) += tmp007.o + obj-$(CONFIG_TMP117) += tmp117.o diff --git a/queue-6.18/iio-temperature-ltc2983-fix-n_wires-default-bypassing-rotation-check.patch b/queue-6.18/iio-temperature-ltc2983-fix-n_wires-default-bypassing-rotation-check.patch new file mode 100644 index 0000000000..ef6d8936a5 --- /dev/null +++ b/queue-6.18/iio-temperature-ltc2983-fix-n_wires-default-bypassing-rotation-check.patch @@ -0,0 +1,38 @@ +From 434c150752675f44dc52c384a7fa22e5176bc35a Mon Sep 17 00:00:00 2001 +From: Liviu Stan +Date: Mon, 25 May 2026 19:39:28 +0300 +Subject: iio: temperature: ltc2983: Fix n_wires default bypassing rotation check + +From: Liviu Stan + +commit 434c150752675f44dc52c384a7fa22e5176bc35a upstream. + +When adi,number-of-wires is absent, n_wires is left at 0. The binding +documents a default of 2 wires, matching the hardware default. However +the current-rotate validation checks n_wires == 2 || n_wires == 3, so +with n_wires = 0 the guard is bypassed and adi,current-rotate is accepted +for a 2-wire RTD. + +Initialize n_wires = 2 to match the binding default and ensure the +rotation check fires correctly when the property is absent. + +Fixes: f110f3188e56 ("iio: temperature: Add support for LTC2983") +Signed-off-by: Liviu Stan +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/temperature/ltc2983.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/temperature/ltc2983.c ++++ b/drivers/iio/temperature/ltc2983.c +@@ -741,7 +741,7 @@ ltc2983_rtd_new(const struct fwnode_hand + struct ltc2983_rtd *rtd; + int ret = 0; + struct device *dev = &st->spi->dev; +- u32 excitation_current = 0, n_wires = 0; ++ u32 excitation_current = 0, n_wires = 2; + + rtd = devm_kzalloc(dev, sizeof(*rtd), GFP_KERNEL); + if (!rtd) diff --git a/queue-6.18/iio-temperature-ltc2983-fix-reinit_completion-called-after-conversion-start.patch b/queue-6.18/iio-temperature-ltc2983-fix-reinit_completion-called-after-conversion-start.patch new file mode 100644 index 0000000000..05503deca9 --- /dev/null +++ b/queue-6.18/iio-temperature-ltc2983-fix-reinit_completion-called-after-conversion-start.patch @@ -0,0 +1,41 @@ +From 5cb9fdb446bfc3ae0524496f53fb68e67051701b Mon Sep 17 00:00:00 2001 +From: Liviu Stan +Date: Mon, 25 May 2026 19:39:29 +0300 +Subject: iio: temperature: ltc2983: Fix reinit_completion() called after conversion start + +From: Liviu Stan + +commit 5cb9fdb446bfc3ae0524496f53fb68e67051701b upstream. + +reinit_completion() was called after regmap_write() initiated the hardware +conversion, creating a race window where the interrupt could fire and call +complete() before reinit_completion() reset the completion. + +Move reinit_completion() before the regmap_write() to close the race. +ltc2983_eeprom_cmd() already does it in the correct order. + +Fixes: f110f3188e56 ("iio: temperature: Add support for LTC2983") +Signed-off-by: Liviu Stan +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/temperature/ltc2983.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/iio/temperature/ltc2983.c ++++ b/drivers/iio/temperature/ltc2983.c +@@ -1177,12 +1177,11 @@ static int ltc2983_chan_read(struct ltc2 + start_conversion |= LTC2983_STATUS_CHAN_SEL(sensor->chan); + dev_dbg(&st->spi->dev, "Start conversion on chan:%d, status:%02X\n", + sensor->chan, start_conversion); ++ reinit_completion(&st->completion); + /* start conversion */ + ret = regmap_write(st->regmap, LTC2983_STATUS_REG, start_conversion); + if (ret) + return ret; +- +- reinit_completion(&st->completion); + /* + * wait for conversion to complete. + * 300 ms should be more than enough to complete the conversion. diff --git a/queue-6.18/iio-temperature-tmp006-use-devm_iio_trigger_register.patch b/queue-6.18/iio-temperature-tmp006-use-devm_iio_trigger_register.patch new file mode 100644 index 0000000000..394156f313 --- /dev/null +++ b/queue-6.18/iio-temperature-tmp006-use-devm_iio_trigger_register.patch @@ -0,0 +1,38 @@ +From 3c5eed894efd93d68d7f6a359a81ddef0e928774 Mon Sep 17 00:00:00 2001 +From: Stepan Ionichev +Date: Sun, 17 May 2026 23:26:13 +0500 +Subject: iio: temperature: tmp006: use devm_iio_trigger_register + +From: Stepan Ionichev + +commit 3c5eed894efd93d68d7f6a359a81ddef0e928774 upstream. + +tmp006_probe() allocates the DRDY trigger with devm_iio_trigger_alloc() +but registers it with plain iio_trigger_register(). The driver has no +.remove() callback, so on module unload the trigger stays in the global +trigger list while its memory is freed by devm, leaving a dangling +entry. + +Switch to devm_iio_trigger_register() so the registration is undone in +the same devm scope as the allocation. + +Fixes: 91f75ccf9f03 ("iio: temperature: tmp006: add triggered buffer support") +Cc: stable@vger.kernel.org +Signed-off-by: Stepan Ionichev +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/temperature/tmp006.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/temperature/tmp006.c ++++ b/drivers/iio/temperature/tmp006.c +@@ -350,7 +350,7 @@ static int tmp006_probe(struct i2c_clien + + data->drdy_trig->ops = &tmp006_trigger_ops; + iio_trigger_set_drvdata(data->drdy_trig, indio_dev); +- ret = iio_trigger_register(data->drdy_trig); ++ ret = devm_iio_trigger_register(&client->dev, data->drdy_trig); + if (ret) + return ret; + diff --git a/queue-6.18/series b/queue-6.18/series index 9efc790bf6..0d9be69b74 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -43,3 +43,52 @@ perf-core-detach-event-groups-during-remove_on_exec.patch rust-kasan-kasan-rust-requires-clang.patch fscrypt-fix-key-setup-in-edge-case-with-multiple-dat.patch fscrypt-replace-mk_users-keyring-with-simple-list.patch +usb-gadget-function-rndis-add-length-check-to-response-query.patch +usb-gadget-function-rndis-add-length-check-for-header.patch +iio-accel-bmc150-clamp-the-device-reported-fifo-frame-count.patch +iio-accel-kxsd9-fix-runtime-pm-imbalance-on-write_raw-error.patch +iio-adc-ad7380-select-regmap.patch +iio-adc-ad7768-1-select-gpiolib.patch +iio-adc-ad7779-add-missing-select-iio_triggered_buffer-to-kconfig.patch +iio-adc-ad_sigma_delta-fix-clear_pending_event-for-registerless-devices.patch +iio-adc-ad_sigma_delta-fix-cs-held-asserted-and-state-leaks.patch +iio-adc-lpc32xx-initialize-completion-before-requesting-irq.patch +iio-adc-spear-initialize-completion-before-requesting-irq.patch +iio-adc-ti-ads1119-fix-pm-reference-leak-in-buffer-preenable.patch +iio-adc-ti-ads124s08-return-reset-gpio-lookup-errors.patch +iio-backend-fix-uninitialized-data-in-debugfs.patch +iio-chemical-scd30-cleanup-initializations-and-fix-sign-extension-bug.patch +iio-common-st_sensors-honour-channel-endianness-in-read_axis_data.patch +iio-core-fix-uninitialized-data-in-debugfs.patch +iio-dac-ad3552r-hs-fix-uninitialized-data-ni-ad3552r_hs_write_data_source.patch +iio-event-fix-event-fifo-reset-race.patch +iio-gyro-bmg160-bail-out-when-bandwidth-filter-is-not-in-table.patch +iio-gyro-bmg160-wait-full-startup-time-after-mode-change-at-probe.patch +iio-imu-adis-add-irqf_no_thread-to-non-fifo-trigger-irq.patch +iio-imu-bmi160-add-irqf_no_thread-to-data-ready-trigger-irq.patch +iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch +iio-imu-inv_icm42600-fix-timestamping-by-limiting-fifo-reading.patch +iio-imu-st_lsm6dsx-deselect-shub-page-before-reading-whoami.patch +iio-light-al3000a-add-missing-regmap_i2c-to-kconfig.patch +iio-light-al3010-add-missing-regmap_i2c-to-kconfig.patch +iio-light-al3010-fix-incorrect-scale-for-the-highest-gain-range.patch +iio-light-al3010-read-both-als-adc-registers-again.patch +iio-light-al3320a-add-missing-regmap_i2c-to-kconfig.patch +iio-light-al3320a-read-both-als-adc-registers-again.patch +iio-light-gp2ap002-fix-runtime-pm-leak-on-read-error.patch +iio-light-opt3001-fix-missing-state-reset-on-timeout.patch +iio-light-tsl2591-return-actual-error-from-probe-irq-failure.patch +iio-light-veml6030-fix-channel-type-when-pushing-events.patch +iio-magnetometer-ak8975-add-missed-pm_runtime_put_autosuspend-call.patch +iio-pressure-bmp280-zero-init-bmp580-trigger-handler-buffer.patch +iio-pressure-mpl115-fix-runtime-pm-leak-on-read-error.patch +iio-proximity-vl53l0x-notify-trigger-and-clear-irq-on-error-paths.patch +iio-resolver-ad2s1210-notify-trigger-and-clear-state-on-fault-read-error.patch +iio-temperature-build-mlx90635-with-config_mlx90635.patch +iio-temperature-ltc2983-fix-n_wires-default-bypassing-rotation-check.patch +iio-temperature-ltc2983-fix-reinit_completion-called-after-conversion-start.patch +iio-temperature-tmp006-use-devm_iio_trigger_register.patch +alsa-usx2y-us144mkii-fix-work-uaf-on-disconnect.patch +alsa-virtio-add-missing-384-khz-pcm-rate-mapping.patch +alsa-virtio-validate-control-metadata-from-the-device.patch +alsa-ymfpci-check-snd_ctl_new1-return-value.patch diff --git a/queue-6.18/usb-gadget-function-rndis-add-length-check-for-header.patch b/queue-6.18/usb-gadget-function-rndis-add-length-check-for-header.patch new file mode 100644 index 0000000000..01ea678969 --- /dev/null +++ b/queue-6.18/usb-gadget-function-rndis-add-length-check-for-header.patch @@ -0,0 +1,37 @@ +From 21b5bf155435008e0fb0736795289788e63d426f Mon Sep 17 00:00:00 2001 +From: Griffin Kroah-Hartman +Date: Wed, 8 Jul 2026 13:08:59 +0200 +Subject: usb: gadget: function: rndis: add length check for header + +From: Griffin Kroah-Hartman + +commit 21b5bf155435008e0fb0736795289788e63d426f upstream. + +Add a length check for the rndis header in rndis_rm_hdr, to ensure that +MessageType, MessageLength, DataOffset, and DataLength fields are +present before they are accessed. + +Assisted-by: gkh_clanker_2000 +Cc: stable +Signed-off-by: Griffin Kroah-Hartman +Link: https://patch.msgid.link/20260708-usb-gadget-rndis-v1-2-e77e026dcc6a@kroah.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/rndis.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/gadget/function/rndis.c ++++ b/drivers/usb/gadget/function/rndis.c +@@ -1080,6 +1080,12 @@ int rndis_rm_hdr(struct gether *port, + /* tmp points to a struct rndis_packet_msg_type */ + __le32 *tmp = (void *)skb->data; + ++ /* Need at least MessageType, MessageLength, DataOffset, DataLength */ ++ if (skb->len < 16) { ++ dev_kfree_skb_any(skb); ++ return -EINVAL; ++ } ++ + /* MessageType, MessageLength */ + if (cpu_to_le32(RNDIS_MSG_PACKET) + != get_unaligned(tmp++)) { diff --git a/queue-6.18/usb-gadget-function-rndis-add-length-check-to-response-query.patch b/queue-6.18/usb-gadget-function-rndis-add-length-check-to-response-query.patch new file mode 100644 index 0000000000..9f29e278a7 --- /dev/null +++ b/queue-6.18/usb-gadget-function-rndis-add-length-check-to-response-query.patch @@ -0,0 +1,60 @@ +From 95f90eea070837f7c72207d5520f805bdefc3bc5 Mon Sep 17 00:00:00 2001 +From: Griffin Kroah-Hartman +Date: Wed, 8 Jul 2026 13:08:58 +0200 +Subject: usb: gadget: function: rndis: add length check to response query + +From: Griffin Kroah-Hartman + +commit 95f90eea070837f7c72207d5520f805bdefc3bc5 upstream. + +Add variable representations for BufLength and BufOffset in +rndis_query_response(), and perform a length check on them. + +This is identical to how rndis_set_response() handles these parameters. + +Assisted-by: gkh_clanker_2000 +Cc: stable +Signed-off-by: Griffin Kroah-Hartman +Link: https://patch.msgid.link/20260708-usb-gadget-rndis-v1-1-e77e026dcc6a@kroah.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/rndis.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/usb/gadget/function/rndis.c ++++ b/drivers/usb/gadget/function/rndis.c +@@ -591,6 +591,7 @@ static int rndis_init_response(struct rn + static int rndis_query_response(struct rndis_params *params, + rndis_query_msg_type *buf) + { ++ u32 BufLength, BufOffset; + rndis_query_cmplt_type *resp; + rndis_resp_t *r; + +@@ -598,6 +599,13 @@ static int rndis_query_response(struct r + if (!params->dev) + return -ENOTSUPP; + ++ BufLength = le32_to_cpu(buf->InformationBufferLength); ++ BufOffset = le32_to_cpu(buf->InformationBufferOffset); ++ if ((BufLength > RNDIS_MAX_TOTAL_SIZE) || ++ (BufOffset > RNDIS_MAX_TOTAL_SIZE) || ++ (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE)) ++ return -EINVAL; ++ + /* + * we need more memory: + * gen_ndis_query_resp expects enough space for +@@ -614,10 +622,8 @@ static int rndis_query_response(struct r + resp->RequestID = buf->RequestID; /* Still LE in msg buffer */ + + if (gen_ndis_query_resp(params, le32_to_cpu(buf->OID), +- le32_to_cpu(buf->InformationBufferOffset) +- + 8 + (u8 *)buf, +- le32_to_cpu(buf->InformationBufferLength), +- r)) { ++ BufOffset + 8 + (u8 *)buf, ++ BufLength, r)) { + /* OID not supported */ + resp->Status = cpu_to_le32(RNDIS_STATUS_NOT_SUPPORTED); + resp->MessageLength = cpu_to_le32(sizeof *resp);