--- /dev/null
+From 83fbbcb7935ec6d2c8ba3bc133e8a0ead2ab0b2d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Fri, 15 May 2026 10:32:25 -0300
+Subject: ALSA: virtio: Add missing 384 kHz PCM rate mapping
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit 83fbbcb7935ec6d2c8ba3bc133e8a0ead2ab0b2d upstream.
+
+The VirtIO sound UAPI defines VIRTIO_SND_PCM_RATE_384000, and ALSA
+has SNDRV_PCM_RATE_384000. However, virtio-snd's rate conversion
+tables stop at 192 kHz.
+
+A device advertising only 384 kHz is rejected as having no supported
+PCM frame rates. A device advertising 384 kHz together with lower rates
+does not expose 384 kHz through the ALSA hardware constraints. The
+selected ALSA rate also needs a reverse mapping for SET_PARAMS.
+
+Add the missing 384 kHz entries to both conversion tables.
+
+Fixes: 29b96bf50ba9 ("ALSA: virtio: build PCM devices and substream hardware descriptors")
+Fixes: da76e9f3e43a ("ALSA: virtio: PCM substream operators")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Link: https://patch.msgid.link/20260515-alsa-virtio-384k-rate-v1-1-35ecb5df835c@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/virtio/virtio_pcm.c | 3 ++-
+ sound/virtio/virtio_pcm_ops.c | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/sound/virtio/virtio_pcm.c
++++ b/sound/virtio/virtio_pcm.c
+@@ -77,7 +77,8 @@ static const struct virtsnd_v2a_rate g_v
+ [VIRTIO_SND_PCM_RATE_88200] = { SNDRV_PCM_RATE_88200, 88200 },
+ [VIRTIO_SND_PCM_RATE_96000] = { SNDRV_PCM_RATE_96000, 96000 },
+ [VIRTIO_SND_PCM_RATE_176400] = { SNDRV_PCM_RATE_176400, 176400 },
+- [VIRTIO_SND_PCM_RATE_192000] = { SNDRV_PCM_RATE_192000, 192000 }
++ [VIRTIO_SND_PCM_RATE_192000] = { SNDRV_PCM_RATE_192000, 192000 },
++ [VIRTIO_SND_PCM_RATE_384000] = { SNDRV_PCM_RATE_384000, 384000 }
+ };
+
+ /**
+--- a/sound/virtio/virtio_pcm_ops.c
++++ b/sound/virtio/virtio_pcm_ops.c
+@@ -90,7 +90,8 @@ static const struct virtsnd_a2v_rate g_a
+ { 88200, VIRTIO_SND_PCM_RATE_88200 },
+ { 96000, VIRTIO_SND_PCM_RATE_96000 },
+ { 176400, VIRTIO_SND_PCM_RATE_176400 },
+- { 192000, VIRTIO_SND_PCM_RATE_192000 }
++ { 192000, VIRTIO_SND_PCM_RATE_192000 },
++ { 384000, VIRTIO_SND_PCM_RATE_384000 }
+ };
+
+ static int virtsnd_pcm_sync_stop(struct snd_pcm_substream *substream);
--- /dev/null
+From c77a6cbb36ff8cbc1f084d94f8dcda5250935271 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A1ssio=20Gabriel?= <cassiogabrielcontato@gmail.com>
+Date: Thu, 7 May 2026 11:28:30 -0300
+Subject: ALSA: virtio: Validate control metadata from the device
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+
+commit c77a6cbb36ff8cbc1f084d94f8dcda5250935271 upstream.
+
+virtio-snd control handling trusts the device-provided control type and
+value count returned by the device.
+
+That metadata is then used directly to index g_v2a_type_map[] in
+virtsnd_kctl_info(), and to size loops and memcpy() operations in
+virtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size
+virtio_snd_ctl_value and snd_ctl_elem_value arrays.
+
+A buggy or malicious device can therefore trigger out-of-bounds access by
+advertising an invalid control type or an oversized value count.
+
+Validate control type and count once in virtsnd_kctl_parse_cfg(), before
+querying enumerated items or exposing the control to ALSA.
+
+Fixes: d6568e3de42d ("ALSA: virtio: add support for audio controls")
+Cc: stable@vger.kernel.org
+Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
+Link: https://patch.msgid.link/20260507-alsa-virtio-validate-kctl-info-v1-1-7404fb12ec37@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/virtio/virtio_kctl.c | 50 +++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 50 insertions(+)
+
+--- a/sound/virtio/virtio_kctl.c
++++ b/sound/virtio/virtio_kctl.c
+@@ -18,6 +18,21 @@ static const snd_ctl_elem_type_t g_v2a_t
+ [VIRTIO_SND_CTL_TYPE_IEC958] = SNDRV_CTL_ELEM_TYPE_IEC958
+ };
+
++/* Map for converting VirtIO types to maximum value counts. */
++static const unsigned int g_v2a_count_map[] = {
++ [VIRTIO_SND_CTL_TYPE_BOOLEAN] =
++ ARRAY_SIZE(((struct virtio_snd_ctl_value *)0)->value.integer),
++ [VIRTIO_SND_CTL_TYPE_INTEGER] =
++ ARRAY_SIZE(((struct virtio_snd_ctl_value *)0)->value.integer),
++ [VIRTIO_SND_CTL_TYPE_INTEGER64] =
++ ARRAY_SIZE(((struct virtio_snd_ctl_value *)0)->value.integer64),
++ [VIRTIO_SND_CTL_TYPE_ENUMERATED] =
++ ARRAY_SIZE(((struct virtio_snd_ctl_value *)0)->value.enumerated),
++ [VIRTIO_SND_CTL_TYPE_BYTES] =
++ ARRAY_SIZE(((struct virtio_snd_ctl_value *)0)->value.bytes),
++ [VIRTIO_SND_CTL_TYPE_IEC958] = 1
++};
++
+ /* Map for converting VirtIO access rights to ALSA access rights. */
+ static const unsigned int g_v2a_access_map[] = {
+ [VIRTIO_SND_CTL_ACCESS_READ] = SNDRV_CTL_ELEM_ACCESS_READ,
+@@ -36,6 +51,37 @@ static const unsigned int g_v2a_mask_map
+ [VIRTIO_SND_CTL_EVT_MASK_TLV] = SNDRV_CTL_EVENT_MASK_TLV
+ };
+
++static int virtsnd_kctl_validate_info(struct virtio_snd *snd, u32 cid,
++ struct virtio_snd_ctl_info *kinfo)
++{
++ struct virtio_device *vdev = snd->vdev;
++ unsigned int type = le32_to_cpu(kinfo->type);
++ unsigned int count = le32_to_cpu(kinfo->count);
++
++ if (type >= ARRAY_SIZE(g_v2a_type_map)) {
++ dev_err(&vdev->dev, "control #%u: unknown type %u\n",
++ cid, type);
++ return -EINVAL;
++ }
++
++ if (count > g_v2a_count_map[type] ||
++ (type == VIRTIO_SND_CTL_TYPE_IEC958 && count != 1)) {
++ dev_err(&vdev->dev, "control #%u: invalid count %u for type %u\n",
++ cid, count, type);
++ return -EINVAL;
++ }
++
++ if (type == VIRTIO_SND_CTL_TYPE_ENUMERATED &&
++ !le32_to_cpu(kinfo->value.enumerated.items)) {
++ dev_err(&vdev->dev,
++ "control #%u: no items for enumerated control\n",
++ cid);
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ /**
+ * virtsnd_kctl_info() - Returns information about the control.
+ * @kcontrol: ALSA control element.
+@@ -385,6 +431,10 @@ int virtsnd_kctl_parse_cfg(struct virtio
+ struct virtio_snd_ctl_info *kinfo = &snd->kctl_infos[i];
+ unsigned int type = le32_to_cpu(kinfo->type);
+
++ rc = virtsnd_kctl_validate_info(snd, i, kinfo);
++ if (rc)
++ return rc;
++
+ if (type == VIRTIO_SND_CTL_TYPE_ENUMERATED) {
+ rc = virtsnd_kctl_get_enum_items(snd, i);
+ if (rc)
--- /dev/null
+From e64d170346d00b580c0043de3e5ccb3e331c47d4 Mon Sep 17 00:00:00 2001
+From: Zhao Dongdong <zhaodongdong@kylinos.cn>
+Date: Wed, 27 May 2026 20:09:12 +0800
+Subject: ALSA: ymfpci: check snd_ctl_new1() return value
+
+From: Zhao Dongdong <zhaodongdong@kylinos.cn>
+
+commit e64d170346d00b580c0043de3e5ccb3e331c47d4 upstream.
+
+snd_ctl_new1() can return NULL when memory allocation fails.
+snd_ymfpci_create_spdif_controls() does not check the return value
+before dereferencing kctl->id.device, which can lead to a NULL pointer
+dereference.
+
+Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any
+fails.
+
+Assisted-by: Opencode:DeepSeek-V4-Flash
+Cc: stable@vger.kernel.org
+Fixes: c9b83ae4a160 ("ALSA: ymfpci: Fix kctl->id initialization")
+Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
+Link: https://patch.msgid.link/tencent_4745C5DC2333325C0EDAB1EFC88A136E6809@qq.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/ymfpci/ymfpci_main.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/sound/pci/ymfpci/ymfpci_main.c
++++ b/sound/pci/ymfpci/ymfpci_main.c
+@@ -1822,16 +1822,22 @@ int snd_ymfpci_mixer(struct snd_ymfpci *
+ if (snd_BUG_ON(!chip->pcm_spdif))
+ return -ENXIO;
+ kctl = snd_ctl_new1(&snd_ymfpci_spdif_default, chip);
++ if (!kctl)
++ return -ENOMEM;
+ kctl->id.device = chip->pcm_spdif->device;
+ err = snd_ctl_add(chip->card, kctl);
+ if (err < 0)
+ return err;
+ kctl = snd_ctl_new1(&snd_ymfpci_spdif_mask, chip);
++ if (!kctl)
++ return -ENOMEM;
+ kctl->id.device = chip->pcm_spdif->device;
+ err = snd_ctl_add(chip->card, kctl);
+ if (err < 0)
+ return err;
+ kctl = snd_ctl_new1(&snd_ymfpci_spdif_stream, chip);
++ if (!kctl)
++ return -ENOMEM;
+ kctl->id.device = chip->pcm_spdif->device;
+ err = snd_ctl_add(chip->card, kctl);
+ if (err < 0)
--- /dev/null
+From ce0e1cae26096fe959a0da5563a6d6d5a801d5fb Mon Sep 17 00:00:00 2001
+From: Bryam Vargas <hexlabsecurity@proton.me>
+Date: Sat, 13 Jun 2026 02:18:39 -0500
+Subject: iio: accel: bmc150: clamp the device-reported FIFO frame count
+
+From: Bryam Vargas <hexlabsecurity@proton.me>
+
+commit ce0e1cae26096fe959a0da5563a6d6d5a801d5fb upstream.
+
+__bmc150_accel_fifo_flush() copies the number of samples the device
+reports in its hardware FIFO into an on-stack buffer
+
+ u16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3];
+
+which is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The
+frame count is read from the FIFO_STATUS register and only masked to its
+7 valid bits:
+
+ count = val & 0x7F;
+
+so it can be 0..127. The only other limit applied to it is the optional
+caller-supplied sample budget:
+
+ if (samples && count > samples)
+ count = samples;
+
+which does not constrain count on the flush-all path (samples == 0), and
+leaves it well above 32 whenever samples is larger. count samples are
+then transferred into buffer[]:
+
+ bmc150_accel_fifo_transfer(data, (u8 *)buffer, count);
+
+bmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a
+malfunctioning, malicious or counterfeit accelerometer (or an attacker
+tampering with the I2C/SPI bus) that reports up to 127 frames writes up
+to 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up
+to 570 bytes that clobbers the stack canary, saved registers and the
+return address.
+
+Clamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[]
+is sized for, before the transfer, mirroring the watermark clamp already
+done in bmc150_accel_set_watermark(). A well-formed flush reports at most
+BMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected.
+
+Fixes: 3bbec9773389 ("iio: bmc150_accel: add support for hardware fifo")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/accel/bmc150-accel-core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/iio/accel/bmc150-accel-core.c
++++ b/drivers/iio/accel/bmc150-accel-core.c
+@@ -997,6 +997,8 @@ static int __bmc150_accel_fifo_flush(str
+ if (samples && count > samples)
+ count = samples;
+
++ count = min_t(u8, count, BMC150_ACCEL_FIFO_LENGTH);
++
+ ret = bmc150_accel_fifo_transfer(data, (u8 *)buffer, count);
+ if (ret)
+ return ret;
--- /dev/null
+From 44a5fd874bb6873bdaec59f722c1d57832fbc9df Mon Sep 17 00:00:00 2001
+From: Biren Pandya <birenpandya@gmail.com>
+Date: Sun, 14 Jun 2026 12:45:46 +0530
+Subject: iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
+
+From: Biren Pandya <birenpandya@gmail.com>
+
+commit 44a5fd874bb6873bdaec59f722c1d57832fbc9df upstream.
+
+kxsd9_write_raw() takes a runtime PM reference with pm_runtime_get_sync()
+but returns -EINVAL directly when a scale with a non-zero integer part is
+requested, skipping the matching pm_runtime_put_autosuspend(). This leaks
+a runtime PM usage-counter reference on every such write, after which the
+device can no longer autosuspend.
+
+Set the error code and fall through to the existing put instead of
+returning early.
+
+Fixes: 9a9a369d6178 ("iio: accel: kxsd9: Deploy system and runtime PM")
+Signed-off-by: Biren Pandya <birenpandya@gmail.com>
+Assisted-by: Claude:claude-opus-4-8 coccinelle
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/accel/kxsd9.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/accel/kxsd9.c
++++ b/drivers/iio/accel/kxsd9.c
+@@ -146,8 +146,9 @@ static int kxsd9_write_raw(struct iio_de
+ if (mask == IIO_CHAN_INFO_SCALE) {
+ /* Check no integer component */
+ if (val)
+- return -EINVAL;
+- ret = kxsd9_write_scale(indio_dev, val2);
++ ret = -EINVAL;
++ else
++ ret = kxsd9_write_scale(indio_dev, val2);
+ }
+
+ pm_runtime_mark_last_busy(st->dev);
--- /dev/null
+From e561b35633f450ee607e87a6401d97f156a0cd54 Mon Sep 17 00:00:00 2001
+From: Maxwell Doose <m32285159@gmail.com>
+Date: Fri, 12 Jun 2026 19:58:10 -0500
+Subject: iio: adc: lpc32xx: Initialize completion before requesting IRQ
+
+From: Maxwell Doose <m32285159@gmail.com>
+
+commit e561b35633f450ee607e87a6401d97f156a0cd54 upstream.
+
+In the report from Jaeyoung Chung:
+
+"lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its
+interrupt handler with devm_request_irq() before it initializes
+st->completion with init_completion(). If an interrupt arrives after
+devm_request_irq() and before init_completion(), the handler calls
+complete() on an uninitialized completion, causing a kernel panic.
+
+The probe path, in lpc32xx_adc_probe():
+
+ iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */
+ ...
+ retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0,
+ LPC32XXAD_NAME, st); /* register handler */
+ ...
+ init_completion(&st->completion); /* initialize completion */
+
+lpc32xx_adc_isr() calls complete():
+
+ complete(&st->completion);
+
+If the device raises an interrupt before init_completion() runs,
+complete() acquires the uninitialized wait.lock and walks the zeroed
+task_list in swake_up_locked(). The zeroed task_list makes list_empty()
+return false, so swake_up_locked() dereferences a NULL list entry,
+triggering a KASAN wild-memory-access."
+
+Fix the chance of a spurious IRQ causing an uninitialized pointer
+dereference by moving init_completion() above devm_request_irq().
+
+Fixes: 7901b2a1453e ("staging:iio:adc:lpc32xx rename local state structure to _state")
+Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
+Reported-by: Kyungwook Boo <bookyungwook@gmail.com>
+Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
+Closes: https://lore.kernel.org/linux-iio/20260610115700.774689-1-jjy600901@snu.ac.kr/
+Signed-off-by: Maxwell Doose <m32285159@gmail.com>
+Reviewed-by: Vladimir Zapolskiy <vz@kernel.org>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/lpc32xx_adc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/adc/lpc32xx_adc.c
++++ b/drivers/iio/adc/lpc32xx_adc.c
+@@ -179,6 +179,8 @@ static int lpc32xx_adc_probe(struct plat
+ if (irq < 0)
+ return irq;
+
++ init_completion(&st->completion);
++
+ retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0,
+ LPC32XXAD_NAME, st);
+ if (retval < 0) {
+@@ -197,8 +199,6 @@ static int lpc32xx_adc_probe(struct plat
+
+ platform_set_drvdata(pdev, iodev);
+
+- init_completion(&st->completion);
+-
+ iodev->name = LPC32XXAD_NAME;
+ iodev->info = &lpc32xx_adc_iio_info;
+ iodev->modes = INDIO_DIRECT_MODE;
--- /dev/null
+From 3ee2128b6f0eb0be7b6cb8f6e0f1f113a65201a0 Mon Sep 17 00:00:00 2001
+From: Maxwell Doose <m32285159@gmail.com>
+Date: Fri, 12 Jun 2026 19:58:11 -0500
+Subject: iio: adc: spear: Initialize completion before requesting IRQ
+
+From: Maxwell Doose <m32285159@gmail.com>
+
+commit 3ee2128b6f0eb0be7b6cb8f6e0f1f113a65201a0 upstream.
+
+In the report from Jaeyoung Chung:
+
+"spear_adc_probe() in drivers/iio/adc/spear_adc.c registers its
+interrupt handler with devm_request_irq() before it initializes
+st->completion with init_completion(). If an interrupt arrives after
+devm_request_irq() and before init_completion(), the handler calls
+complete() on an uninitialized completion, causing a kernel panic.
+
+The probe path, in spear_adc_probe():
+
+ iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */
+ ...
+ retval = devm_request_irq(&pdev->dev, irq, spear_adc_isr, 0,
+ LPC32XXAD_NAME, st); /* register handler */
+ ...
+ init_completion(&st->completion); /* initialize completion */
+
+spear_adc_isr() calls complete():
+
+ complete(&st->completion);
+
+If the device raises an interrupt before init_completion() runs,
+complete() acquires the uninitialized wait.lock and walks the zeroed
+task_list in swake_up_locked(). The zeroed task_list makes list_empty()
+return false, so swake_up_locked() dereferences a NULL list entry,
+triggering a KASAN wild-memory-access."
+
+Fix the chance of a spurious IRQ causing an uninitialized pointer
+dereference by moving init_completion() above devm_request_irq().
+
+Fixes: b586e5d9eee0 ("staging:iio:adc:spear rename device specific state structure to _state")
+Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
+Reported-by: Kyungwook Boo <bookyungwook@gmail.com>
+Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
+Closes: https://lore.kernel.org/linux-iio/20260610115700.774689-1-jjy600901@snu.ac.kr/
+Signed-off-by: Maxwell Doose <m32285159@gmail.com>
+Reviewed-by: Vladimir Zapolskiy <vz@kernel.org>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/spear_adc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/iio/adc/spear_adc.c
++++ b/drivers/iio/adc/spear_adc.c
+@@ -281,6 +281,7 @@ static int spear_adc_probe(struct platfo
+ st = iio_priv(indio_dev);
+ st->dev = dev;
+
++ init_completion(&st->completion);
+ mutex_init(&st->lock);
+
+ /*
+@@ -327,8 +328,6 @@ static int spear_adc_probe(struct platfo
+
+ spear_adc_configure(st);
+
+- init_completion(&st->completion);
+-
+ indio_dev->name = SPEAR_ADC_MOD_NAME;
+ indio_dev->info = &spear_adc_info;
+ indio_dev->modes = INDIO_DIRECT_MODE;
--- /dev/null
+From adf4bc07f814da8329278d32600147f5a150938c Mon Sep 17 00:00:00 2001
+From: Guangshuo Li <lgs201920130244@gmail.com>
+Date: Wed, 3 Jun 2026 20:16:40 +0800
+Subject: iio: adc: ti-ads1119: fix PM reference leak in buffer preenable
+
+From: Guangshuo Li <lgs201920130244@gmail.com>
+
+commit adf4bc07f814da8329278d32600147f5a150938c upstream.
+
+ads1119_triggered_buffer_preenable() resumes the device with
+pm_runtime_resume_and_get() before starting a conversion.
+
+If i2c_smbus_write_byte() fails, the function returns the error directly
+and leaves the runtime PM usage counter elevated. The matching
+postdisable callback is not called when preenable fails, so the reference
+is leaked and the device may remain runtime-active indefinitely.
+
+Store the I2C transfer result in ret and drop the runtime PM reference on
+failure before returning the error.
+
+Fixes: a9306887eba41 ("iio: adc: ti-ads1119: Add driver")
+Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ti-ads1119.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/ti-ads1119.c
++++ b/drivers/iio/adc/ti-ads1119.c
+@@ -455,7 +455,11 @@ static int ads1119_triggered_buffer_pree
+ if (ret)
+ return ret;
+
+- return i2c_smbus_write_byte(st->client, ADS1119_CMD_START_SYNC);
++ ret = i2c_smbus_write_byte(st->client, ADS1119_CMD_START_SYNC);
++ if (ret)
++ pm_runtime_put_autosuspend(dev);
++
++ return ret;
+ }
+
+ static int ads1119_triggered_buffer_postdisable(struct iio_dev *indio_dev)
--- /dev/null
+From 7dc4de2aa6316f1d044cde21f5acfec5f3ec6b47 Mon Sep 17 00:00:00 2001
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Date: Thu, 25 Jun 2026 13:44:07 +0800
+Subject: iio: adc: ti-ads124s08: Return reset GPIO lookup errors
+
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+
+commit 7dc4de2aa6316f1d044cde21f5acfec5f3ec6b47 upstream.
+
+devm_gpiod_get_optional() returns NULL when the optional GPIO is absent,
+but returns an ERR_PTR when the GPIO provider lookup fails, including
+probe deferral.
+
+Probe currently logs the ERR_PTR case as if the reset GPIO were simply
+absent and keeps the error pointer in reset_gpio. Later ads124s_reset()
+treats any non-NULL reset_gpio as a valid descriptor and passes it to
+gpiod_set_value_cansleep().
+
+Return the lookup error instead of retaining the ERR_PTR.
+
+Fixes: e717f8c6dfec ("iio: adc: Add the TI ads124s08 ADC code")
+Cc: stable@vger.kernel.org
+Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
+Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ti-ads124s08.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/ti-ads124s08.c
++++ b/drivers/iio/adc/ti-ads124s08.c
+@@ -321,7 +321,8 @@ static int ads124s_probe(struct spi_devi
+ ads124s_priv->reset_gpio = devm_gpiod_get_optional(&spi->dev,
+ "reset", GPIOD_OUT_LOW);
+ if (IS_ERR(ads124s_priv->reset_gpio))
+- dev_info(&spi->dev, "Reset GPIO not defined\n");
++ return dev_err_probe(&spi->dev, PTR_ERR(ads124s_priv->reset_gpio),
++ "Failed to get reset GPIO\n");
+
+ ads124s_priv->chip_info = &ads124s_chip_info_tbl[spi_id->driver_data];
+
--- /dev/null
+From a6e8b14a4897d0b6df9744f33d0a30e6b92368eb Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <error27@gmail.com>
+Date: Mon, 25 May 2026 10:16:11 +0300
+Subject: iio: backend: fix uninitialized data in debugfs
+
+From: Dan Carpenter <error27@gmail.com>
+
+commit a6e8b14a4897d0b6df9744f33d0a30e6b92368eb upstream.
+
+If the *ppos value is non-zero then simple_write_to_buffer() will not
+initialize the start of the buf[] buffer. Non-zero ppos values aren't
+going to work at all. Check for that at the start of the function and
+return -ENOSPC.
+
+Fixes: cdf01e0809a4 ("iio: backend: add debugFs interface")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/industrialio-backend.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/industrialio-backend.c
++++ b/drivers/iio/industrialio-backend.c
+@@ -155,7 +155,7 @@ static ssize_t iio_backend_debugfs_write
+ ssize_t rc;
+ int ret;
+
+- if (count >= sizeof(buf))
++ if (*ppos != 0 || count >= sizeof(buf))
+ return -ENOSPC;
+
+ rc = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, userbuf, count);
--- /dev/null
+From 60d877910a43c305b5165131b258a17b1d772d57 Mon Sep 17 00:00:00 2001
+From: Maxwell Doose <m32285159@gmail.com>
+Date: Tue, 26 May 2026 17:55:24 -0500
+Subject: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
+
+From: Maxwell Doose <m32285159@gmail.com>
+
+commit 60d877910a43c305b5165131b258a17b1d772d57 upstream.
+
+Include linux/bitfield.h for FIELD_GET().
+
+Create new macros for bit manipulation in combination with manual bit
+manipulation being replaced with FIELD_GET().
+
+The current variable declaration and initializations are barely readable
+and use comma separations across multiple lines. Refactor the
+initializations so that mantissa and exp have separate declarations and
+sign gets initialized later.
+
+In addition (and due to the nature of the cleanup), fix a sign-extension
+bug where, float32 would get bitwise anded with ~BIT(31)
+(which is 0xFFFFFFFF7FFFFFFF) which corrupted the exponent.
+
+Fixes: 64b3d8b1b0f5c ("iio: chemical: scd30: add core driver")
+Reported-by: sashiko <sashiko-bot@kernel.org>
+Closes: https://sashiko.dev/#/patchset/20260524020309.18618-1-m32285159%40gmail.com
+Signed-off-by: Maxwell Doose <m32285159@gmail.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/chemical/scd30_core.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+--- a/drivers/iio/chemical/scd30_core.c
++++ b/drivers/iio/chemical/scd30_core.c
+@@ -4,6 +4,8 @@
+ *
+ * Copyright (c) 2020 Tomasz Duszynski <tomasz.duszynski@octakon.com>
+ */
++
++#include <linux/bitfield.h>
+ #include <linux/bits.h>
+ #include <linux/cleanup.h>
+ #include <linux/completion.h>
+@@ -43,6 +45,11 @@
+ #define SCD30_TEMP_OFFSET_MAX 655360
+ #define SCD30_EXTRA_TIMEOUT_PER_S 250
+
++/* Floating point arithmetic macros */
++#define SCD30_FLOAT_MANTISSA_MSK GENMASK(22, 0)
++#define SCD30_FLOAT_EXP_MSK GENMASK(30, 23)
++#define SCD30_FLOAT_SIGN_MSK BIT(31)
++
+ enum {
+ SCD30_CONC,
+ SCD30_TEMP,
+@@ -89,10 +96,14 @@ static int scd30_reset(struct scd30_stat
+ /* simplified float to fixed point conversion with a scaling factor of 0.01 */
+ static int scd30_float_to_fp(int float32)
+ {
+- int fraction, shift,
+- mantissa = float32 & GENMASK(22, 0),
+- sign = (float32 & BIT(31)) ? -1 : 1,
+- exp = (float32 & ~BIT(31)) >> 23;
++ int fraction, shift, sign;
++ int mantissa = FIELD_GET(SCD30_FLOAT_MANTISSA_MSK, float32);
++ int exp = FIELD_GET(SCD30_FLOAT_EXP_MSK, float32);
++
++ if (float32 & SCD30_FLOAT_SIGN_MSK)
++ sign = -1;
++ else
++ sign = 1;
+
+ /* special case 0 */
+ if (!exp && !mantissa)
--- /dev/null
+From 55052184ac9011db2ea983e54d6c21f0b1079a12 Mon Sep 17 00:00:00 2001
+From: Herman van Hazendonk <github.com@herrie.org>
+Date: Tue, 16 Jun 2026 15:02:04 +0200
+Subject: iio: common: st_sensors: honour channel endianness in read_axis_data
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Herman van Hazendonk <github.com@herrie.org>
+
+commit 55052184ac9011db2ea983e54d6c21f0b1079a12 upstream.
+
+st_sensors_read_axis_data() unconditionally decoded multi-byte
+results with get_unaligned_le16() / get_unaligned_le24() regardless
+of the channel's declared scan_type.endianness.
+
+For every ST sensor that has used this helper since it was introduced
+this happened to be fine because the ST IMU/accel/gyro/pressure
+families publish their data registers as little-endian and the
+channel specs in those drivers declare IIO_LE accordingly.
+
+The LSM303DLH magnetometer however publishes its X/Y/Z output as a
+pair of big-endian bytes (the H register sits at the lower address,
+0x03/0x05/0x07, and the L register immediately after), and its
+channel specs in st_magn_core.c correctly declare IIO_BE -- but
+read_axis_data() ignored that and decoded as little-endian, swapping
+the high and low bytes of every magnetometer sample. The LSM303DLHC
+and LSM303DLM share the same st_magn_16bit_channels (IIO_BE) and
+were therefore byte-swapped by the same bug; users of those parts
+will see different in_magn_*_raw values after this fix lands.
+
+The bug is most visible on a stationary chip: in earth's field the
+true X reading is small and the high byte sits at 0x00, so swapping
+the bytes pins sysfs X at exactly the low byte's pattern (e.g. 0x00F0
+= 240). Y and Z still appear "to vary" because their magnitudes are
+larger and the noise in the low byte produces big swings in the
+swapped high byte:
+
+ before (LSM303DLH flat, sysfs in_magn_*_raw):
+ X=240 (stuck), Y= 12032..23296, Z=-16128..-9728
+
+ after (direct i2c-dev big-endian decode, same chip same orientation):
+ X≈-4096, Y≈210, Z≈80 (sensible values reflecting earth's
+ ambient field at low gauss range)
+
+Fix read_axis_data() to dispatch on ch->scan_type.endianness and
+call get_unaligned_be16() / get_unaligned_be24() when the channel
+declares IIO_BE. Existing IIO_LE consumers (st_accel, st_gyro,
+st_pressure, st_lsm6dsx and others) are unaffected because their
+channel specs already declare IIO_LE and the LE path is unchanged.
+
+While restructuring the branches, replace the previously implicit
+silent-success-with-uninitialised-*data fall-through for
+byte_for_channel outside 1..3 with an explicit return -EINVAL. No
+in-tree ST sensor publishes such a channel, but the new behaviour
+is strictly safer than handing userspace garbage.
+
+Fixes: 23491b513bcd ("iio:common: Add STMicroelectronics common library")
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4-7 sparse smatch clang-analyzer coccinelle checkpatch
+Assisted-by: Sashiko:claude-opus-4-7
+Signed-off-by: Herman van Hazendonk <github.com@herrie.org>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/common/st_sensors/st_sensors_core.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+--- a/drivers/iio/common/st_sensors/st_sensors_core.c
++++ b/drivers/iio/common/st_sensors/st_sensors_core.c
+@@ -498,6 +498,7 @@ static int st_sensors_read_axis_data(str
+ u8 *outdata;
+ struct st_sensor_data *sdata = iio_priv(indio_dev);
+ unsigned int byte_for_channel;
++ u32 tmp;
+
+ byte_for_channel = DIV_ROUND_UP(ch->scan_type.realbits +
+ ch->scan_type.shift, 8);
+@@ -510,12 +511,22 @@ static int st_sensors_read_axis_data(str
+ if (err < 0)
+ goto st_sensors_free_memory;
+
+- if (byte_for_channel == 1)
+- *data = (s8)*outdata;
+- else if (byte_for_channel == 2)
+- *data = (s16)get_unaligned_le16(outdata);
+- else if (byte_for_channel == 3)
+- *data = (s32)sign_extend32(get_unaligned_le24(outdata), 23);
++ if (byte_for_channel == 1) {
++ tmp = *outdata;
++ } else if (byte_for_channel == 2) {
++ if (ch->scan_type.endianness == IIO_BE)
++ tmp = get_unaligned_be16(outdata);
++ else
++ tmp = get_unaligned_le16(outdata);
++ } else if (byte_for_channel == 3) {
++ if (ch->scan_type.endianness == IIO_BE)
++ tmp = get_unaligned_be24(outdata);
++ else
++ tmp = get_unaligned_le24(outdata);
++ } else {
++ return -EINVAL;
++ }
++ *data = sign_extend32(tmp, BYTES_TO_BITS(byte_for_channel) - 1);
+
+ st_sensors_free_memory:
+ kfree(outdata);
--- /dev/null
+From af791d295737ea6b6ff2c8d8488462a49c14af01 Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Mon, 6 Jul 2026 21:48:26 -0700
+Subject: iio: event: Fix event FIFO reset race
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit af791d295737ea6b6ff2c8d8488462a49c14af01 upstream.
+
+`iio_event_getfd()` creates the event file descriptor with
+`anon_inode_getfd()`, which allocates a new fd, creates the anonymous
+file and installs it in the process fd table before returning to the
+caller.
+
+The IIO code resets the event FIFO after `anon_inode_getfd()` has returned,
+but before `IIO_GET_EVENT_FD_IOCTL` has copied the fd number to userspace.
+But since fd tables are shared between threads, another thread can guess
+the newly allocated fd number and issue a `read()` on it as soon as the fd
+has been installed.
+
+This means the `kfifo_to_user()` in `iio_event_chrdev_read()` can run in
+parallel with the `kfifo_reset_out()` in `iio_event_getfd()`.
+
+The kfifo documentation says that `kfifo_reset_out()` is only safe when it
+is called from the reader thread and there is only one concurrent reader.
+Otherwise it is dangerous and must be handled in the same way as
+`kfifo_reset()`.
+
+If that happens, `kfifo_to_user()` can advance the FIFO `out` index based
+on state from before the reset, after the reset has already moved the `out`
+index to the current `in` index. That can leave the FIFO with an `out`
+index past the `in` index. A later `read()` can then see an underflowed
+FIFO length and copy more data than the event FIFO buffer contains. This
+can result in an out-of-bounds read and leak adjacent kernel memory to
+userspace.
+
+Move the FIFO reset before `anon_inode_getfd()`. At that point the event fd is
+marked busy, but the new fd has not been installed yet, so userspace cannot
+access it while the FIFO is reset.
+
+Fixes: b91accafbb10 ("iio:event: Fix and cleanup locking")
+Reported-by: Codex:gpt-5.5
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/industrialio-event.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/iio/industrialio-event.c
++++ b/drivers/iio/industrialio-event.c
+@@ -207,6 +207,8 @@ static int iio_event_getfd(struct iio_de
+ goto unlock;
+ }
+
++ kfifo_reset_out(&ev_int->det_events);
++
+ iio_device_get(indio_dev);
+
+ fd = anon_inode_getfd("iio:event", &iio_event_chrdev_fileops,
+@@ -214,10 +216,7 @@ static int iio_event_getfd(struct iio_de
+ if (fd < 0) {
+ clear_bit(IIO_BUSY_BIT_POS, &ev_int->flags);
+ iio_device_put(indio_dev);
+- } else {
+- kfifo_reset_out(&ev_int->det_events);
+ }
+-
+ unlock:
+ mutex_unlock(&iio_dev_opaque->mlock);
+ return fd;
--- /dev/null
+From 8320c77e67382d5d55d77043a5f60a867d408a2b Mon Sep 17 00:00:00 2001
+From: Stepan Ionichev <sozdayvek@gmail.com>
+Date: Sun, 10 May 2026 07:35:00 +0500
+Subject: iio: gyro: bmg160: bail out when bandwidth/filter is not in table
+
+From: Stepan Ionichev <sozdayvek@gmail.com>
+
+commit 8320c77e67382d5d55d77043a5f60a867d408a2b upstream.
+
+bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry
+matching the bw_bits value read from the chip:
+
+ for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) {
+ if (bmg160_samp_freq_table[i].bw_bits == bw_bits)
+ break;
+ }
+ *val = bmg160_samp_freq_table[i].filter;
+
+If no entry matches, i ends up equal to the array size and the next line
+reads one slot past the end. bmg160_set_filter() has the same shape, driven
+by 'val' instead of bw_bits.
+
+smatch flags both:
+
+ drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error:
+ buffer overflow 'bmg160_samp_freq_table' 7 <= 7
+ drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error:
+ buffer overflow 'bmg160_samp_freq_table' 7 <= 7
+
+Return -EINVAL when no entry matches.
+
+The set_filter() path is reachable from userspace via the sysfs
+in_anglvel_filter_low_pass_3db_frequency interface, so userspace can
+trivially trigger the out-of-bounds read with a value that is not in
+bmg160_samp_freq_table[].filter.
+
+Fixes: 22b46c45fb9b ("iio:gyro:bmg160 Gyro Sensor driver")
+Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/gyro/bmg160_core.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/iio/gyro/bmg160_core.c
++++ b/drivers/iio/gyro/bmg160_core.c
+@@ -204,6 +204,9 @@ static int bmg160_get_filter(struct bmg1
+ break;
+ }
+
++ if (i == ARRAY_SIZE(bmg160_samp_freq_table))
++ return -EINVAL;
++
+ *val = bmg160_samp_freq_table[i].filter;
+
+ return ret ? ret : IIO_VAL_INT;
+@@ -221,6 +224,9 @@ static int bmg160_set_filter(struct bmg1
+ break;
+ }
+
++ if (i == ARRAY_SIZE(bmg160_samp_freq_table))
++ return -EINVAL;
++
+ ret = regmap_write(data->regmap, BMG160_REG_PMU_BW,
+ bmg160_samp_freq_table[i].bw_bits);
+ if (ret < 0) {
--- /dev/null
+From 088fcb9b567f8723074ad9eb1bf5cb46f8a0096b Mon Sep 17 00:00:00 2001
+From: Stepan Ionichev <sozdayvek@gmail.com>
+Date: Mon, 11 May 2026 11:40:20 +0500
+Subject: iio: gyro: bmg160: wait full startup time after mode change at probe
+
+From: Stepan Ionichev <sozdayvek@gmail.com>
+
+commit 088fcb9b567f8723074ad9eb1bf5cb46f8a0096b upstream.
+
+bmg160_chip_init() calls bmg160_set_mode(BMG160_MODE_NORMAL) and
+then waits only 500-1000 us. Per the BMG160 datasheet
+(BST-BMG160-DS000-07 Rev. 1.0, May 2013), the start-up and wake-up
+times (tsu, twusm) are 30 ms.
+
+The same file already waits BMG160_MAX_STARTUP_TIME_MS (80 ms)
+in bmg160_runtime_resume() after the same set_mode(NORMAL)
+operation. The 500 us value at probe was likely a unit mix-up;
+the old comment said "500 ms" while the code used microseconds.
+
+Reuse the same constant via msleep() and add a code comment
+explaining the datasheet basis for the wait. Without this,
+register writes that follow the mode change can hit the chip
+before it is ready.
+
+Fixes: 22b46c45fb9b ("iio:gyro:bmg160 Gyro Sensor driver")
+Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/gyro/bmg160_core.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/gyro/bmg160_core.c
++++ b/drivers/iio/gyro/bmg160_core.c
+@@ -267,8 +267,14 @@ static int bmg160_chip_init(struct bmg16
+ if (ret < 0)
+ return ret;
+
+- /* Wait upto 500 ms to be ready after changing mode */
+- usleep_range(500, 1000);
++ /*
++ * Wait for the chip to be ready after switching to normal mode.
++ * The BMG160 datasheet (BST-BMG160-DS000-07 Rev. 1.0, May 2013)
++ * specifies a start-up / wake-up time (tsu, twusm) of 30 ms; use
++ * BMG160_MAX_STARTUP_TIME_MS (80 ms) as a safety margin, matching
++ * what bmg160_runtime_resume() already does.
++ */
++ msleep(BMG160_MAX_STARTUP_TIME_MS);
+
+ /* Set Bandwidth */
+ ret = bmg160_set_bw(data, BMG160_DEF_BW);
--- /dev/null
+From 6e1b9bff1202da55c464e36bd34a2b6863d7fe30 Mon Sep 17 00:00:00 2001
+From: Runyu Xiao <runyu.xiao@seu.edu.cn>
+Date: Thu, 4 Jun 2026 09:42:46 +0800
+Subject: iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
+
+From: Runyu Xiao <runyu.xiao@seu.edu.cn>
+
+commit 6e1b9bff1202da55c464e36bd34a2b6863d7fe30 upstream.
+
+devm_adis_probe_trigger() registers iio_trigger_generic_data_rdy_poll()
+through devm_request_irq() on the non-FIFO path, but it does not add
+IRQF_NO_THREAD to the IRQ flags.
+
+When the kernel is booted with forced IRQ threading, the parent IRQ can
+otherwise be threaded by the IRQ core and the subsequent IIO trigger
+child IRQ is then dispatched from irq/... thread context instead of
+hardirq context. Because iio_trigger_generic_data_rdy_poll()
+immediately drives iio_trigger_poll(), this violates the hardirq-only
+IIO trigger helper contract and can push downstream trigger consumers
+through the wrong execution context.
+
+Add IRQF_NO_THREAD on top of the existing adis->irq_flag value for the
+non-FIFO request_irq() path, while preserving the current trigger
+polarity and IRQF_NO_AUTOEN behavior.
+
+Fixes: fec86c6b8369 ("iio: imu: adis: Add Managed device functions")
+Cc: stable@vger.kernel.org
+Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/adis_trigger.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/imu/adis_trigger.c
++++ b/drivers/iio/imu/adis_trigger.c
+@@ -94,7 +94,7 @@ int devm_adis_probe_trigger(struct adis
+ else
+ ret = devm_request_irq(&adis->spi->dev, adis->spi->irq,
+ &iio_trigger_generic_data_rdy_poll,
+- adis->irq_flag,
++ adis->irq_flag | IRQF_NO_THREAD,
+ indio_dev->name,
+ adis->trig);
+ if (ret)
--- /dev/null
+From cd5a6a5096b246e10600da3ac47a1274ce9573c8 Mon Sep 17 00:00:00 2001
+From: Runyu Xiao <runyu.xiao@seu.edu.cn>
+Date: Thu, 4 Jun 2026 09:42:47 +0800
+Subject: iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
+
+From: Runyu Xiao <runyu.xiao@seu.edu.cn>
+
+commit cd5a6a5096b246e10600da3ac47a1274ce9573c8 upstream.
+
+bmi160_probe_trigger() registers iio_trigger_generic_data_rdy_poll()
+through devm_request_irq(), but it passes only irq_type and does not add
+IRQF_NO_THREAD.
+
+When the kernel is booted with forced IRQ threading, the parent IRQ can
+otherwise be threaded by the IRQ core and the subsequent IIO trigger
+child IRQ is dispatched from irq/... thread context instead of hardirq
+context. Because the handler immediately pushes the event into
+iio_trigger_poll(), this violates the hardirq-only IIO trigger helper
+contract and can drive downstream trigger consumers through the wrong
+execution context.
+
+Add IRQF_NO_THREAD on top of irq_type when registering the BMI160 data-
+ready trigger handler.
+
+Fixes: 895bf81e6bbf ("iio:bmi160: add drdy interrupt support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/bmi160/bmi160_core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/imu/bmi160/bmi160_core.c
++++ b/drivers/iio/imu/bmi160/bmi160_core.c
+@@ -797,7 +797,8 @@ int bmi160_probe_trigger(struct iio_dev
+
+ ret = devm_request_irq(&indio_dev->dev, irq,
+ &iio_trigger_generic_data_rdy_poll,
+- irq_type, "bmi160", data->trig);
++ irq_type | IRQF_NO_THREAD,
++ "bmi160", data->trig);
+ if (ret)
+ return ret;
+
--- /dev/null
+From 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 Mon Sep 17 00:00:00 2001
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Date: Tue, 23 Jun 2026 16:22:15 +0200
+Subject: iio: imu: inv_icm42600: fix timestamp clock period by using lower value
+
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+
+commit 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 upstream.
+
+Clock period value is used for computing periods of sampling. There is
+no need for it to be higher than the maximum odr, otherwise we are
+losing precision in the computation for nothing.
+
+Switch clock period value to maximum odr period (8kHz).
+
+Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 4 ++--
+ drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
+@@ -868,10 +868,10 @@ struct iio_dev *inv_icm42600_accel_init(
+ accel_st->filter = INV_ICM42600_FILTER_AVG_16X;
+
+ /*
+- * clock period is 32kHz (31250ns)
++ * clock period is 8kHz (125000ns)
+ * jitter is +/- 2% (20 per mille)
+ */
+- ts_chip.clock_period = 31250;
++ ts_chip.clock_period = 125000;
+ ts_chip.jitter = 20;
+ ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr);
+ inv_sensors_timestamp_init(&accel_st->ts, &ts_chip);
+--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
+@@ -771,10 +771,10 @@ struct iio_dev *inv_icm42600_gyro_init(s
+ }
+
+ /*
+- * clock period is 32kHz (31250ns)
++ * clock period is 8kHz (125000ns)
+ * jitter is +/- 2% (20 per mille)
+ */
+- ts_chip.clock_period = 31250;
++ ts_chip.clock_period = 125000;
+ ts_chip.jitter = 20;
+ ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr);
+ inv_sensors_timestamp_init(&gyro_st->ts, &ts_chip);
--- /dev/null
+From affe3f077d7a4eeb25937f5323ff059a54b4712c Mon Sep 17 00:00:00 2001
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Date: Mon, 29 Jun 2026 21:51:55 +0200
+Subject: iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
+
+From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+
+commit affe3f077d7a4eeb25937f5323ff059a54b4712c upstream.
+
+Timestamps are made by measuring the chip clock using the watermark
+interrupts. If we read more than watermark samples as done today, we
+are reducing the period between interrupts and distort the time
+measurement. Fix that by reading only watermark samples in the
+interrupt case.
+
+Fixes: 7f85e42a6c54 ("iio: imu: inv_icm42600: add buffer support in iio devices")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 9 +++++----
+ drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h | 1 +
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
+@@ -257,6 +257,7 @@ int inv_icm42600_buffer_update_watermark
+
+ /* compute watermark value in bytes */
+ wm_size = watermark * packet_size;
++ st->fifo.watermark.value = watermark;
+
+ /* changing FIFO watermark requires to turn off watermark interrupt */
+ ret = regmap_update_bits_check(st->map, INV_ICM42600_REG_INT_SOURCE0,
+@@ -473,11 +474,10 @@ int inv_icm42600_buffer_fifo_read(struct
+ st->fifo.nb.accel = 0;
+ st->fifo.nb.total = 0;
+
+- /* compute maximum FIFO read size */
++ /* compute maximum FIFO read size (watermark for max = 0 interrupt case) */
+ if (max == 0)
+- max_count = sizeof(st->fifo.data);
+- else
+- max_count = max * inv_icm42600_get_packet_size(st->fifo.en);
++ max = st->fifo.watermark.value;
++ max_count = max * inv_icm42600_get_packet_size(st->fifo.en);
+
+ /* read FIFO count value */
+ raw_fifo_count = (__be16 *)st->buffer;
+@@ -593,6 +593,7 @@ int inv_icm42600_buffer_init(struct inv_
+
+ st->fifo.watermark.eff_gyro = 1;
+ st->fifo.watermark.eff_accel = 1;
++ st->fifo.watermark.value = 1;
+
+ /*
+ * Default FIFO configuration (bits 7 to 5)
+--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h
++++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h
+@@ -34,6 +34,7 @@ struct inv_icm42600_fifo {
+ unsigned int accel;
+ unsigned int eff_gyro;
+ unsigned int eff_accel;
++ unsigned int value;
+ } watermark;
+ size_t count;
+ struct {
--- /dev/null
+From aede83625ff5d9539508582036df30c809d51058 Mon Sep 17 00:00:00 2001
+From: Andreas Kempe <andreas.kempe@actia.se>
+Date: Thu, 2 Jul 2026 10:41:23 +0000
+Subject: iio: imu: st_lsm6dsx: deselect shub page before reading whoami
+
+From: Andreas Kempe <andreas.kempe@actia.se>
+
+commit aede83625ff5d9539508582036df30c809d51058 upstream.
+
+As part of driver initialization, e.g. st_lsm6dsx_init_shub() selects
+the shub register page using st_lsm6dsx_set_page(). Selecting the shub
+register page shadows the regular register space so whoami, among other
+registers, is no longer accessible.
+
+In applications where the IMU is permanently powered separately from the
+processor, there is a window where a reset of the CPU leaves the IMU in
+the shub register page. Once this occurs, any subsequent probe attempt
+fails because of the register shadowing.
+
+Using the ism330dlc, the error typically looks like
+
+ st_lsm6dsx_i2c 3-006a: unsupported whoami [10]
+
+with the unknown whoami read from a reserved register in the shub page.
+
+The reset register is also shadowed by the page select, preventing a
+reset from recovering the chip.
+
+Unconditionally clear the shub page before the whoami readout to ensure
+normal register access and allow the initialization to proceed.
+
+Place the fix in st_lsm6dsx_check_whoami() before the whoami check
+because hw->settings, which st_lsm6dsx_set_page() relies on, is first
+assigned in that function.
+
+Placing the fix in a more logical place than the whoami check would
+require a bigger restructuring of the code.
+
+Fixes: c91c1c844ebd ("iio: imu: st_lsm6dsx: add i2c embedded controller support")
+Signed-off-by: Andreas Kempe <andreas.kempe@actia.se>
+Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
+@@ -1597,6 +1597,26 @@ static int st_lsm6dsx_check_whoami(struc
+ return -ENODEV;
+ }
+
++ hw->settings = &st_lsm6dsx_sensor_settings[i];
++
++ if (hw->settings->shub_settings.page_mux.addr) {
++ /*
++ * If the IMU has the shub page selected on init, for example
++ * after a CPU watchdog reset while the page is selected, the
++ * regular register space is shadowed. While the regular
++ * register space is shadowed, the registers needed for
++ * initializing the IMU are not available.
++ *
++ * Unconditionally clear the shub page selection to ensure
++ * normal register access.
++ */
++ err = st_lsm6dsx_set_page(hw, false);
++ if (err < 0) {
++ dev_err(hw->dev, "failed to clear shub page\n");
++ return err;
++ }
++ }
++
+ err = regmap_read(hw->regmap, ST_LSM6DSX_REG_WHOAMI_ADDR, &data);
+ if (err < 0) {
+ dev_err(hw->dev, "failed to read whoami register\n");
+@@ -1609,7 +1629,6 @@ static int st_lsm6dsx_check_whoami(struc
+ }
+
+ *name = st_lsm6dsx_sensor_settings[i].id[j].name;
+- hw->settings = &st_lsm6dsx_sensor_settings[i];
+
+ return 0;
+ }
--- /dev/null
+From aa411adc6ce40ad1a55ebc965f255a4cfc0005f8 Mon Sep 17 00:00:00 2001
+From: Vidhu Sarwal <vidhu.linux@gmail.com>
+Date: Sat, 4 Jul 2026 17:22:45 +0530
+Subject: iio: light: al3010: fix incorrect scale for the highest gain range
+
+From: Vidhu Sarwal <vidhu.linux@gmail.com>
+
+commit aa411adc6ce40ad1a55ebc965f255a4cfc0005f8 upstream.
+
+al3010_scales[] encodes the highest gain range as {0, 1187200}.
+For IIO_VAL_INT_PLUS_MICRO, the fractional part must be less than
+1000000, so the scale 1.1872 should instead be represented as
+{ 1, 187200 }.
+
+Since write_raw() compares the value from userspace against this
+table, writing the advertised 1.1872 scale never matches the malformed
+entry and returns -EINVAL. As a result, the highest gain range cannot
+be selected. Reading the scale in that state also reports the malformed
+value.
+
+Fixes: c36b5195ab70 ("iio: light: add Dyna-Image AL3010 driver")
+Signed-off-by: Vidhu Sarwal <vidhu.linux@gmail.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/light/al3010.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/light/al3010.c
++++ b/drivers/iio/light/al3010.c
+@@ -43,7 +43,7 @@ enum al3xxxx_range {
+ };
+
+ static const int al3010_scales[][2] = {
+- {0, 1187200}, {0, 296800}, {0, 74200}, {0, 18600}
++ { 1, 187200 }, { 0, 296800 }, { 0, 74200 }, { 0, 18600 },
+ };
+
+ struct al3010_data {
--- /dev/null
+From 38b72267b7e22768a1f26d9935de4e1752a1dc85 Mon Sep 17 00:00:00 2001
+From: Biren Pandya <birenpandya@gmail.com>
+Date: Sun, 14 Jun 2026 12:45:49 +0530
+Subject: iio: light: gp2ap002: fix runtime PM leak on read error
+
+From: Biren Pandya <birenpandya@gmail.com>
+
+commit 38b72267b7e22768a1f26d9935de4e1752a1dc85 upstream.
+
+gp2ap002_read_raw() calls pm_runtime_get_sync() before reading the
+lux value, but if gp2ap002_get_lux() fails, it returns directly. This
+skips the pm_runtime_put_autosuspend() call at the "out" label,
+permanently leaking a runtime PM reference and preventing the device
+from autosuspending.
+
+Replace the direct return with a "goto out" to ensure the reference
+is properly dropped on the error path.
+
+Fixes: f6dbf83c17cb ("iio: light: gp2ap002: Take runtime PM reference on light read")
+Signed-off-by: Biren Pandya <birenpandya@gmail.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/light/gp2ap002.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/light/gp2ap002.c
++++ b/drivers/iio/light/gp2ap002.c
+@@ -258,7 +258,7 @@ static int gp2ap002_read_raw(struct iio_
+ case IIO_LIGHT:
+ ret = gp2ap002_get_lux(gp2ap002);
+ if (ret < 0)
+- return ret;
++ goto out;
+ *val = ret;
+ ret = IIO_VAL_INT;
+ goto out;
--- /dev/null
+From c123ca6ee26ad98f70a866ff428b08145c5a24fe Mon Sep 17 00:00:00 2001
+From: Joshua Crofts <joshua.crofts1@gmail.com>
+Date: Tue, 26 May 2026 13:15:29 +0200
+Subject: iio: light: opt3001: fix missing state reset on timeout
+
+From: Joshua Crofts <joshua.crofts1@gmail.com>
+
+commit c123ca6ee26ad98f70a866ff428b08145c5a24fe upstream.
+
+Currently in the function opt3001_get_processed(), there is a check
+that directly returns -ETIMEDOUT if the conversion IRQ times out,
+completely bypassing the err label, leaving ok_to_ignore_lock
+permanently true, potentially breaking the device's falling threshold
+interrupt detection.
+
+Assign -ETIMEDOUT to the return variable and jump to the error label
+to ensure ok_to_ignore_lock is properly reset.
+
+Fixes: 26d90b559057 ("iio: light: opt3001: Fixed timeout error when 0 lux")
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Closes: https://sashiko.dev/#/patchset/20260525-opt3001-cleanup-v4-0-65b36a174f78%40gmail.com?part=1
+Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/light/opt3001.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/light/opt3001.c
++++ b/drivers/iio/light/opt3001.c
+@@ -280,8 +280,10 @@ static int opt3001_get_lux(struct opt300
+ ret = wait_event_timeout(opt->result_ready_queue,
+ opt->result_ready,
+ msecs_to_jiffies(OPT3001_RESULT_READY_LONG));
+- if (ret == 0)
+- return -ETIMEDOUT;
++ if (ret == 0) {
++ ret = -ETIMEDOUT;
++ goto err;
++ }
+ } else {
+ /* Sleep for result ready time */
+ timeout = (opt->int_time == OPT3001_INT_TIME_SHORT) ?
--- /dev/null
+From a00ffd15674bfaf8b906503c1600e3d8709af56c Mon Sep 17 00:00:00 2001
+From: Stepan Ionichev <sozdayvek@gmail.com>
+Date: Mon, 18 May 2026 14:43:11 +0500
+Subject: iio: light: tsl2591: return actual error from probe IRQ failure
+
+From: Stepan Ionichev <sozdayvek@gmail.com>
+
+commit a00ffd15674bfaf8b906503c1600e3d8709af56c upstream.
+
+When devm_request_threaded_irq() fails, probe logs the error and
+then returns -EINVAL, dropping the real error code and breaking the
+deferred-probe flow for -EPROBE_DEFER.
+
+Return ret directly; the IRQ subsystem already prints on failure.
+
+Fixes: 2335f0d7c790 ("iio: light: Added AMS tsl2591 driver implementation")
+Cc: stable@vger.kernel.org
+Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/light/tsl2591.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/iio/light/tsl2591.c
++++ b/drivers/iio/light/tsl2591.c
+@@ -1139,10 +1139,8 @@ static int tsl2591_probe(struct i2c_clie
+ NULL, tsl2591_event_handler,
+ IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+ "tsl2591_irq", indio_dev);
+- if (ret) {
+- dev_err_probe(&client->dev, ret, "IRQ request error\n");
+- return -EINVAL;
+- }
++ if (ret)
++ return ret;
+ indio_dev->info = &tsl2591_info;
+ } else {
+ indio_dev->info = &tsl2591_info_no_irq;
--- /dev/null
+From c52bb33b641ebaae3e209f97714cb1758206f7d9 Mon Sep 17 00:00:00 2001
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Date: Thu, 14 May 2026 14:01:11 +1300
+Subject: iio: light: veml6030: fix channel type when pushing events
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+commit c52bb33b641ebaae3e209f97714cb1758206f7d9 upstream.
+
+The events are registered for IIO_LIGHT and not for IIO_INTENSITY.
+Use the correct channel type.
+
+When at it, fix minor checkpatch code style warning (alignment).
+
+Cc: stable@vger.kernel.org
+Fixes: 7b779f573c48 ("iio: light: add driver for veml6030 ambient light sensor")
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/light/veml6030.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/iio/light/veml6030.c
++++ b/drivers/iio/light/veml6030.c
+@@ -710,9 +710,11 @@ static irqreturn_t veml6030_event_handle
+ else
+ evtdir = IIO_EV_DIR_FALLING;
+
+- iio_push_event(indio_dev, IIO_UNMOD_EVENT_CODE(IIO_INTENSITY,
+- 0, IIO_EV_TYPE_THRESH, evtdir),
+- iio_get_time_ns(indio_dev));
++ iio_push_event(indio_dev, IIO_UNMOD_EVENT_CODE(IIO_LIGHT,
++ 0,
++ IIO_EV_TYPE_THRESH,
++ evtdir),
++ iio_get_time_ns(indio_dev));
+
+ return IRQ_HANDLED;
+ }
--- /dev/null
+From e94944d7364d3ddb273539492f9bd9c9a622549a Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Wed, 6 May 2026 10:27:55 +0200
+Subject: iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit e94944d7364d3ddb273539492f9bd9c9a622549a upstream.
+
+On the failure in the ak8975_read_axis() the PM runtime gets unbalanced.
+Balance it by calling pm_runtime_put_autosuspend() on error path as well.
+
+Fixes: cde4cb5dd422 ("iio: magn: ak8975: deploy runtime and system PM")
+Reported-by: Sashiko <sashiko-bot@kernel.org>
+Closes: https://sashiko.dev/#/patchset/20260505-magnetometer-fixes-v5-0-831b9b5550fc%40gmail.com
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/magnetometer/ak8975.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iio/magnetometer/ak8975.c
++++ b/drivers/iio/magnetometer/ak8975.c
+@@ -785,6 +785,7 @@ static int ak8975_read_axis(struct iio_d
+
+ exit:
+ mutex_unlock(&data->lock);
++ pm_runtime_put_autosuspend(&data->client->dev);
+ dev_err(&client->dev, "Error in reading axis\n");
+ return ret;
+ }
--- /dev/null
+From 70247658d0e783c93b48fcbc3b81d99e992ff478 Mon Sep 17 00:00:00 2001
+From: Stepan Ionichev <sozdayvek@gmail.com>
+Date: Fri, 15 May 2026 18:31:38 +0500
+Subject: iio: resolver: ad2s1210: notify trigger and clear state on fault read error
+
+From: Stepan Ionichev <sozdayvek@gmail.com>
+
+commit 70247658d0e783c93b48fcbc3b81d99e992ff478 upstream.
+
+ad2s1210_trigger_handler() walks several scan-mask branches and uses
+"goto error_ret" to land on the iio_trigger_notify_done() teardown at
+the bottom of the function for every I/O error -- except the
+MOD_CONFIG fault-register read, which uses a bare "return ret":
+
+ if (st->fixed_mode == MOD_CONFIG) {
+ unsigned int reg_val;
+
+ ret = regmap_read(st->regmap, AD2S1210_REG_FAULT, ®_val);
+ if (ret < 0)
+ return ret;
+ ...
+ }
+
+Two problems on that path:
+
+ - the handler returns a negative errno where the prototype expects
+ an irqreturn_t (IRQ_HANDLED / IRQ_NONE), so the caller in the
+ IIO core sees a value outside the enum;
+ - iio_trigger_notify_done() is skipped, leaving the trigger
+ busy-flag set. A single transient SPI/regmap error on the fault
+ read then wedges the trigger so subsequent samples are dropped
+ until the consumer is detached.
+
+Convert the error path to "goto error_ret" so the failure path goes
+through the same notify_done() teardown as every other error in the
+handler.
+
+Fixes: f9b9ff95be8c ("iio: resolver: ad2s1210: add support for adi,fixed-mode")
+Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/resolver/ad2s1210.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/resolver/ad2s1210.c
++++ b/drivers/iio/resolver/ad2s1210.c
+@@ -1334,7 +1334,7 @@ static irqreturn_t ad2s1210_trigger_hand
+
+ ret = regmap_read(st->regmap, AD2S1210_REG_FAULT, ®_val);
+ if (ret < 0)
+- return ret;
++ goto error_ret;
+
+ st->sample.fault = reg_val;
+ }
--- /dev/null
+From 63a76e3a587c4143e8e24e8a6b0c232fa0676034 Mon Sep 17 00:00:00 2001
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Date: Thu, 25 Jun 2026 13:42:59 +0800
+Subject: iio: temperature: Build mlx90635 with CONFIG_MLX90635
+
+From: Pengpeng Hou <pengpeng@iscas.ac.cn>
+
+commit 63a76e3a587c4143e8e24e8a6b0c232fa0676034 upstream.
+
+drivers/iio/temperature/Kconfig has a dedicated MLX90635 option, but
+the Makefile currently builds mlx90635.o under CONFIG_MLX90632.
+
+This means enabling CONFIG_MLX90635 alone does not carry its provider
+object into the build, while enabling CONFIG_MLX90632 unexpectedly also
+builds mlx90635.o.
+
+Gate mlx90635.o on the matching generated Kconfig symbol.
+
+Fixes: a1d1ba5e1c28 ("iio: temperature: mlx90635 MLX90635 IR Temperature sensor")
+Cc: stable@vger.kernel.org
+Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Acked-by: Crt Mori <cmo@melexis.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/temperature/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/temperature/Makefile
++++ b/drivers/iio/temperature/Makefile
+@@ -13,7 +13,7 @@ obj-$(CONFIG_MAX31865) += max31865.o
+ obj-$(CONFIG_MCP9600) += mcp9600.o
+ obj-$(CONFIG_MLX90614) += mlx90614.o
+ obj-$(CONFIG_MLX90632) += mlx90632.o
+-obj-$(CONFIG_MLX90632) += mlx90635.o
++obj-$(CONFIG_MLX90635) += mlx90635.o
+ obj-$(CONFIG_TMP006) += tmp006.o
+ obj-$(CONFIG_TMP007) += tmp007.o
+ obj-$(CONFIG_TMP117) += tmp117.o
--- /dev/null
+From 434c150752675f44dc52c384a7fa22e5176bc35a Mon Sep 17 00:00:00 2001
+From: Liviu Stan <liviu.stan@analog.com>
+Date: Mon, 25 May 2026 19:39:28 +0300
+Subject: iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
+
+From: Liviu Stan <liviu.stan@analog.com>
+
+commit 434c150752675f44dc52c384a7fa22e5176bc35a upstream.
+
+When adi,number-of-wires is absent, n_wires is left at 0. The binding
+documents a default of 2 wires, matching the hardware default. However
+the current-rotate validation checks n_wires == 2 || n_wires == 3, so
+with n_wires = 0 the guard is bypassed and adi,current-rotate is accepted
+for a 2-wire RTD.
+
+Initialize n_wires = 2 to match the binding default and ensure the
+rotation check fires correctly when the property is absent.
+
+Fixes: f110f3188e56 ("iio: temperature: Add support for LTC2983")
+Signed-off-by: Liviu Stan <liviu.stan@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/temperature/ltc2983.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/temperature/ltc2983.c
++++ b/drivers/iio/temperature/ltc2983.c
+@@ -741,7 +741,7 @@ ltc2983_rtd_new(const struct fwnode_hand
+ struct ltc2983_rtd *rtd;
+ int ret = 0;
+ struct device *dev = &st->spi->dev;
+- u32 excitation_current = 0, n_wires = 0;
++ u32 excitation_current = 0, n_wires = 2;
+
+ rtd = devm_kzalloc(dev, sizeof(*rtd), GFP_KERNEL);
+ if (!rtd)
--- /dev/null
+From 5cb9fdb446bfc3ae0524496f53fb68e67051701b Mon Sep 17 00:00:00 2001
+From: Liviu Stan <liviu.stan@analog.com>
+Date: Mon, 25 May 2026 19:39:29 +0300
+Subject: iio: temperature: ltc2983: Fix reinit_completion() called after conversion start
+
+From: Liviu Stan <liviu.stan@analog.com>
+
+commit 5cb9fdb446bfc3ae0524496f53fb68e67051701b upstream.
+
+reinit_completion() was called after regmap_write() initiated the hardware
+conversion, creating a race window where the interrupt could fire and call
+complete() before reinit_completion() reset the completion.
+
+Move reinit_completion() before the regmap_write() to close the race.
+ltc2983_eeprom_cmd() already does it in the correct order.
+
+Fixes: f110f3188e56 ("iio: temperature: Add support for LTC2983")
+Signed-off-by: Liviu Stan <liviu.stan@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/temperature/ltc2983.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/iio/temperature/ltc2983.c
++++ b/drivers/iio/temperature/ltc2983.c
+@@ -1177,12 +1177,11 @@ static int ltc2983_chan_read(struct ltc2
+ start_conversion |= LTC2983_STATUS_CHAN_SEL(sensor->chan);
+ dev_dbg(&st->spi->dev, "Start conversion on chan:%d, status:%02X\n",
+ sensor->chan, start_conversion);
++ reinit_completion(&st->completion);
+ /* start conversion */
+ ret = regmap_write(st->regmap, LTC2983_STATUS_REG, start_conversion);
+ if (ret)
+ return ret;
+-
+- reinit_completion(&st->completion);
+ /*
+ * wait for conversion to complete.
+ * 300 ms should be more than enough to complete the conversion.
perf-core-detach-event-groups-during-remove_on_exec.patch
rust-kasan-kasan-rust-requires-clang.patch
drm-i915-ensure-segment-offset-never-exceeds-allowed.patch
+usb-gadget-function-rndis-add-length-check-to-response-query.patch
+usb-gadget-function-rndis-add-length-check-for-header.patch
+iio-accel-bmc150-clamp-the-device-reported-fifo-frame-count.patch
+iio-accel-kxsd9-fix-runtime-pm-imbalance-on-write_raw-error.patch
+iio-adc-lpc32xx-initialize-completion-before-requesting-irq.patch
+iio-adc-spear-initialize-completion-before-requesting-irq.patch
+iio-adc-ti-ads1119-fix-pm-reference-leak-in-buffer-preenable.patch
+iio-adc-ti-ads124s08-return-reset-gpio-lookup-errors.patch
+iio-backend-fix-uninitialized-data-in-debugfs.patch
+iio-chemical-scd30-cleanup-initializations-and-fix-sign-extension-bug.patch
+iio-common-st_sensors-honour-channel-endianness-in-read_axis_data.patch
+iio-event-fix-event-fifo-reset-race.patch
+iio-gyro-bmg160-bail-out-when-bandwidth-filter-is-not-in-table.patch
+iio-gyro-bmg160-wait-full-startup-time-after-mode-change-at-probe.patch
+iio-imu-adis-add-irqf_no_thread-to-non-fifo-trigger-irq.patch
+iio-imu-bmi160-add-irqf_no_thread-to-data-ready-trigger-irq.patch
+iio-imu-inv_icm42600-fix-timestamp-clock-period-by-using-lower-value.patch
+iio-imu-inv_icm42600-fix-timestamping-by-limiting-fifo-reading.patch
+iio-imu-st_lsm6dsx-deselect-shub-page-before-reading-whoami.patch
+iio-light-al3010-fix-incorrect-scale-for-the-highest-gain-range.patch
+iio-light-gp2ap002-fix-runtime-pm-leak-on-read-error.patch
+iio-light-opt3001-fix-missing-state-reset-on-timeout.patch
+iio-light-tsl2591-return-actual-error-from-probe-irq-failure.patch
+iio-light-veml6030-fix-channel-type-when-pushing-events.patch
+iio-magnetometer-ak8975-add-missed-pm_runtime_put_autosuspend-call.patch
+iio-resolver-ad2s1210-notify-trigger-and-clear-state-on-fault-read-error.patch
+iio-temperature-build-mlx90635-with-config_mlx90635.patch
+iio-temperature-ltc2983-fix-n_wires-default-bypassing-rotation-check.patch
+iio-temperature-ltc2983-fix-reinit_completion-called-after-conversion-start.patch
+alsa-virtio-add-missing-384-khz-pcm-rate-mapping.patch
+alsa-virtio-validate-control-metadata-from-the-device.patch
+alsa-ymfpci-check-snd_ctl_new1-return-value.patch
--- /dev/null
+From 21b5bf155435008e0fb0736795289788e63d426f Mon Sep 17 00:00:00 2001
+From: Griffin Kroah-Hartman <griffin@kroah.com>
+Date: Wed, 8 Jul 2026 13:08:59 +0200
+Subject: usb: gadget: function: rndis: add length check for header
+
+From: Griffin Kroah-Hartman <griffin@kroah.com>
+
+commit 21b5bf155435008e0fb0736795289788e63d426f upstream.
+
+Add a length check for the rndis header in rndis_rm_hdr, to ensure that
+MessageType, MessageLength, DataOffset, and DataLength fields are
+present before they are accessed.
+
+Assisted-by: gkh_clanker_2000
+Cc: stable <stable@kernel.org>
+Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
+Link: https://patch.msgid.link/20260708-usb-gadget-rndis-v1-2-e77e026dcc6a@kroah.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/rndis.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/gadget/function/rndis.c
++++ b/drivers/usb/gadget/function/rndis.c
+@@ -1080,6 +1080,12 @@ int rndis_rm_hdr(struct gether *port,
+ /* tmp points to a struct rndis_packet_msg_type */
+ __le32 *tmp = (void *)skb->data;
+
++ /* Need at least MessageType, MessageLength, DataOffset, DataLength */
++ if (skb->len < 16) {
++ dev_kfree_skb_any(skb);
++ return -EINVAL;
++ }
++
+ /* MessageType, MessageLength */
+ if (cpu_to_le32(RNDIS_MSG_PACKET)
+ != get_unaligned(tmp++)) {
--- /dev/null
+From 95f90eea070837f7c72207d5520f805bdefc3bc5 Mon Sep 17 00:00:00 2001
+From: Griffin Kroah-Hartman <griffin@kroah.com>
+Date: Wed, 8 Jul 2026 13:08:58 +0200
+Subject: usb: gadget: function: rndis: add length check to response query
+
+From: Griffin Kroah-Hartman <griffin@kroah.com>
+
+commit 95f90eea070837f7c72207d5520f805bdefc3bc5 upstream.
+
+Add variable representations for BufLength and BufOffset in
+rndis_query_response(), and perform a length check on them.
+
+This is identical to how rndis_set_response() handles these parameters.
+
+Assisted-by: gkh_clanker_2000
+Cc: stable <stable@kernel.org>
+Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
+Link: https://patch.msgid.link/20260708-usb-gadget-rndis-v1-1-e77e026dcc6a@kroah.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/rndis.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/gadget/function/rndis.c
++++ b/drivers/usb/gadget/function/rndis.c
+@@ -591,6 +591,7 @@ static int rndis_init_response(struct rn
+ static int rndis_query_response(struct rndis_params *params,
+ rndis_query_msg_type *buf)
+ {
++ u32 BufLength, BufOffset;
+ rndis_query_cmplt_type *resp;
+ rndis_resp_t *r;
+
+@@ -598,6 +599,13 @@ static int rndis_query_response(struct r
+ if (!params->dev)
+ return -ENOTSUPP;
+
++ BufLength = le32_to_cpu(buf->InformationBufferLength);
++ BufOffset = le32_to_cpu(buf->InformationBufferOffset);
++ if ((BufLength > RNDIS_MAX_TOTAL_SIZE) ||
++ (BufOffset > RNDIS_MAX_TOTAL_SIZE) ||
++ (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE))
++ return -EINVAL;
++
+ /*
+ * we need more memory:
+ * gen_ndis_query_resp expects enough space for
+@@ -614,10 +622,8 @@ static int rndis_query_response(struct r
+ resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
+
+ if (gen_ndis_query_resp(params, le32_to_cpu(buf->OID),
+- le32_to_cpu(buf->InformationBufferOffset)
+- + 8 + (u8 *)buf,
+- le32_to_cpu(buf->InformationBufferLength),
+- r)) {
++ BufOffset + 8 + (u8 *)buf,
++ BufLength, r)) {
+ /* OID not supported */
+ resp->Status = cpu_to_le32(RNDIS_STATUS_NOT_SUPPORTED);
+ resp->MessageLength = cpu_to_le32(sizeof *resp);
projects / thirdparty / kernel / stable-queue.git / commitdiff
