iio-fixes-for-7.a IIO: 1st set of fixes for the 7.1 cycle

Usual mixed bag of ancient issues and more recent.
 Lots of new contributors this cycle and some of that work has
 uncovered bugs in the code they were looking at.
 
 core,buffer
 - Add missing dma_fence_put()
 - hw-consumer - Fix a use after free in cleaning up a list.
   core,inkern
 - Fix return value  handling in iio_read_channel_processed_scale() that
   meant a correct result was treated as an error.
 
 adi,ad3530r
 - Fix powerdown mode strings for AD3531 and AD3531R.
 adi,ad4695
 - Fix ordering so by the time device transitions to offload mode
   all setup transfers are done. This avoids issues with offload
   controllers that cannot handle normal transfers after offload has
   begun.
 adi,ad5686
 - Fix wrong initialization of reference bit for single channel parts.
 - Fix off by one in check on input raw value
 adi,adis16260
 - Fix division by zero triggerable from sysfs.
 adi,adis16550
 - Fix a stack leak to userspace.
 amlogic,meson-adc
 - Fix a buffer allocation leak in an error path.
 bosch,bmp280
 - Fix a stack leak to userspace.
 capella,cm3323
 - Fix wrong return value rather than register value being written
   data->reg_conf on write.
 maxim,max5821
 - Check correct length i2c_master_send() in max5821_sync_powerdown_mode().
 mediatek,mt6359
 - Fix potential uninitialized value.
 nuvoton,npcm_adc
 - Fix unbalance clk_disable_unprepare()
 nxp,sar-adc
 - Avoid a division by zero if the common clock framework is disabled.
 - Fix a division by zero triggerable from sysfs.
 - Ensure all of struct dma_slave_config is initialized.
 qcom,spmi-adc-gen3
 - Fix an off by one that leads to an out of bounds array read.
 samsung,ssp_sensors
 - Ensure work is cancelled during remove to avoid use after free.
 sensiron,scd30
 - Fix a division by zero triggerable from sysfs.
 st,lsm6dsx
 - Fix a stack leak to userspace.
 st,magn
 - Fix default value for data ready pin selection for devices that
   have no data ready pin selection.
 vishay,veml6070
 - Close a resource leak in an error path.
 winsen,mhz19b
 - Reject over-sized serial messages from device.
 xilinx,xadc
 - Fix sequencer handling for dual MUX cases
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEbilms4eEBlKRJoGxVIU0mcT0FogFAmoG/rkRHGppYzIzQGtl
 cm5lbC5vcmcACgkQVIU0mcT0FohZ9w//c9Hycnr8BDjluSDZ0hlGzv1CTO3FeHwM
 OgW/IXCLFK0y66xDkD08w8pwkn8Ol/wCrXoFitGinUhNc3MdK7lNtvvALiFnvU2f
 OP4wAvlCWjJlMb1Q8BCAtl/0W2rlb9gpm13pyBH4401IoGnf9sMdVkNortCEse3P
 0uH/0UdpFoN8Ke5WvwnC22gZiCF4SaJtyShcR9INyHz70uA8WUOXVCHloWuUZEeC
 WrXRwBollXwa7mLiYkDRr6lle71+xQPFVi+1tTUBAFaXZtJlEA3vWMkKHX1I0ywy
 6oANSvW/VQJkkZwgRUmANbqBffCL/CyOoLDC7plzELqMQXTh52Jw8Zxt+Xf/nq8u
 dSYVxJ4tt7RGxCYGekQdGc1bKz2HwvIXGBUigGbxzZKj6z7rrqbfHq9sXs1FTi3n
 PwF3rC43v3LAgtJ7yoS9U3KvZ08B/ydDkfvPlWEHXOveLWLpyVeMQf76JI9O2M7j
 4baK99ngEQmrjwSHM9ZVS/cx/alLQjwegkmpsa/OOkuIHBTyECBerIAirwF52eOC
 kGo7fcAHazGp3te20/51FNBgilD2RIlMtwEGXsxDOcN/nnA3e0tQVpDJeCXepP8t
 8AzeRsMMII5GiLkqqwg/bGpJ0qNWCqqoNse5x/LXbKXGSCCffe3xahZFIzxP5FxK
 y4lj71MPAS8=
 =Ja6W
 -----END PGP SIGNATURE-----

Merge tag 'iio-fixes-for-7.1a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus

Jonathan writes:

iio-fixes-for-7.a IIO: 1st set of fixes for the 7.1 cycle

Usual mixed bag of ancient issues and more recent.
Lots of new contributors this cycle and some of that work has
uncovered bugs in the code they were looking at.

core,buffer
- Add missing dma_fence_put()
- hw-consumer - Fix a use after free in cleaning up a list.
  core,inkern
- Fix return value  handling in iio_read_channel_processed_scale() that
  meant a correct result was treated as an error.

adi,ad3530r
- Fix powerdown mode strings for AD3531 and AD3531R.
adi,ad4695
- Fix ordering so by the time device transitions to offload mode
  all setup transfers are done. This avoids issues with offload
  controllers that cannot handle normal transfers after offload has
  begun.
adi,ad5686
- Fix wrong initialization of reference bit for single channel parts.
- Fix off by one in check on input raw value
adi,adis16260
- Fix division by zero triggerable from sysfs.
adi,adis16550
- Fix a stack leak to userspace.
amlogic,meson-adc
- Fix a buffer allocation leak in an error path.
bosch,bmp280
- Fix a stack leak to userspace.
capella,cm3323
- Fix wrong return value rather than register value being written
  data->reg_conf on write.
maxim,max5821
- Check correct length i2c_master_send() in max5821_sync_powerdown_mode().
mediatek,mt6359
- Fix potential uninitialized value.
nuvoton,npcm_adc
- Fix unbalance clk_disable_unprepare()
nxp,sar-adc
- Avoid a division by zero if the common clock framework is disabled.
- Fix a division by zero triggerable from sysfs.
- Ensure all of struct dma_slave_config is initialized.
qcom,spmi-adc-gen3
- Fix an off by one that leads to an out of bounds array read.
samsung,ssp_sensors
- Ensure work is cancelled during remove to avoid use after free.
sensiron,scd30
- Fix a division by zero triggerable from sysfs.
st,lsm6dsx
- Fix a stack leak to userspace.
st,magn
- Fix default value for data ready pin selection for devices that
  have no data ready pin selection.
vishay,veml6070
- Close a resource leak in an error path.
winsen,mhz19b
- Reject over-sized serial messages from device.
xilinx,xadc
- Fix sequencer handling for dual MUX cases

* tag 'iio-fixes-for-7.1a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (31 commits)
  iio: adc: viperboard: Fix error handling in vprbrd_iio_read_raw
  iio: gyro: itg3200: fix i2c read into the wrong stack location
  iio: dac: ad5686: fix powerdown control on dual-channel devices
  iio: dac: ad5686: acquire lock when doing powerdown control
  iio: temperature: tsys01: fix broken PROM checksum validation
  iio: dac: ad3530r: Fix AD3531/AD3531R powerdown mode strings
  iio: buffer: hw-consumer: fix use-after-free in error path
  iio: dac: ad5686: fix input raw value check
  iio: dac: ad5686: fix ref bit initialization for single-channel parts
  iio: ssp_sensors: cancel delayed work_refresh on remove
  iio: adc: meson-saradc: fix calibration buffer leak on error
  iio: dac: max5821: fix return value check in powerdown sync
  iio: adc: mt6359: fix unchecked return value in mt6358_read_imp
  iio: adc: qcom-spmi-adc5-gen3: Fix off by one in adc5_gen3_get_fw_channel_data()
  iio: imu: adis16550: fix stack leak in trigger handler
  iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer
  iio: pressure: bmp280: fix stack leak in bmp580 trigger handler
  iio: adc: nxp-sar-adc: zero-initialize dma_slave_config
  iio: light: cm3323: fix reg_conf not being initialized correctly
  iio: magnetometer: st_magn: fix default DRDY pin selection for LIS2MDL
  ...
This commit is contained in:
Greg Kroah-Hartman 2026-05-15 13:45:33 +02:00
commit 329db447f8
27 changed files with 194 additions and 96 deletions