Commit 994d5dfa authored Feb 26, 2026 by Greg Kroah-Hartman

Merge tag 'iio-fixes-for-7.0a' of...

Merge tag 'iio-fixes-for-7.0a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into work-linus

Jonathan writes:

IIO: 1st set of fixes for the 7.0 cycle

Usual mixed bag of ancient bugs that have been discovered and more
recent stuff.

core
- Cleanup a wait_queue if a driver is removed at exacty the wrong
  moment.
adi,adf4377
- Check correct masks when waiting for reset to complete.
adi,adis
- Fix a NULL pointer dereference if ops not provided to adis_init()
bosch,bme680
- Fix typo in value used to calculate measurement wait duration.
infineon,tlv493d
- Drop incorrect shifting of some bits for x-axis
invensense,icm42600
- Fix corner case of output data rate being set to the value it already
  has which resulted in waiting for ever for a flag to say the update was
  completed.
- Fix a case where the buffer is turned off whilst ODR switch is in progress.
invensense,icm45600
- Interrupt 1 drive bit was inverted.
- Fix a underflow for regulator put warning if probe fails
invensense,mpu9150
- Work around a hardware quirk where reading from irq status is not sufficient
  to acknowledge an interrupt.
maxim,ds4424
- Reject -128 as a possible raw value as it's out of range with the sign
  / magnitude encoding used by this chip.
microchip,mcp4131
- Shift the wiper value only once.
rohm,bh1780
- Fix a runtime reference count issue on an error path.
sensiron,sps30
- Fix two buffer size issues due to sizeof() wrong thing.
tyhx,hx9023s
- Ensure count used by __counted_by is set before accessing the buffer.
- Avoid a potential division by zero.

* tag 'iio-fixes-for-7.0a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio:
  iio: imu: adis: Fix NULL pointer dereference in adis_init
  iio: imu: inv_icm45600: fix regulator put warning when probe fails
  iio: buffer: Fix wait_queue not being removed
  iio: gyro: mpu3050-core: fix pm_runtime error handling
  iio: gyro: mpu3050-i2c: fix pm_runtime error handling
  iio: adc: ad7768-1: Fix ERR_PTR dereference in ad7768_fill_scale_tbl
  iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()
  iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
  iio: magnetometer: tlv493d: remove erroneous shift in X-axis data
  iio: proximity: hx9023s: Protect against division by zero in set_samp_freq
  iio: proximity: hx9023s: fix assignment order for __counted_by
  iio: chemical: bme680: Fix measurement wait duration calculation
  iio: dac: ds4424: reject -128 RAW value
  iio: imu: inv_icm45600: fix INT1 drive bit inverted
  iio: potentiometer: mcp4131: fix double application of wiper shift
  iio: imu: inv-mpu9150: fix irq ack preventing irq storms
  iio: frequency: adf4377: Fix duplicated soft reset mask
  iio: light: bh1780: fix PM runtime leak on error path
  iio: imu: inv_icm42600: fix odr switch when turning buffer off
  iio: imu: inv_icm42600: fix odr switch to the same value

parents dceddeec 9990cd4f

drivers/iio/adc/ad7768-1.c

+11 −2

Original line number	Diff line number	Diff line
		@@ -531,7 +531,7 @@ static int ad7768_reg_access(struct iio_dev *indio_dev,
		return ret;
		}

		static void ad7768_fill_scale_tbl(struct iio_dev *dev)
		static int ad7768_fill_scale_tbl(struct iio_dev *dev)
		{
		struct ad7768_state *st = iio_priv(dev);
		const struct iio_scan_type *scan_type;
		@@ -541,6 +541,11 @@ static void ad7768_fill_scale_tbl(struct iio_dev *dev)
		u64 tmp2;

		scan_type = iio_get_current_scan_type(dev, &dev->channels[0]);
		if (IS_ERR(scan_type)) {
		dev_err(&st->spi->dev, "Failed to get scan type.\n");
		return PTR_ERR(scan_type);
		}

		if (scan_type->sign == 's')
		val2 = scan_type->realbits - 1;
		else
		@@ -565,6 +570,8 @@ static void ad7768_fill_scale_tbl(struct iio_dev *dev)
		st->scale_tbl[i][0] = tmp0; /* Integer part */
		st->scale_tbl[i][1] = abs(tmp1); /* Fractional part */
		}

		return 0;
		}

		static int ad7768_set_sinc3_dec_rate(struct ad7768_state *st,
		@@ -669,7 +676,9 @@ static int ad7768_configure_dig_fil(struct iio_dev *dev,
		}

		/* Update scale table: scale values vary according to the precision */
		ad7768_fill_scale_tbl(dev);
		ret = ad7768_fill_scale_tbl(dev);
		if (ret)
		return ret;

		ad7768_fill_samp_freq_tbl(st);

drivers/iio/chemical/bme680_core.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -613,7 +613,7 @@ static int bme680_wait_for_eoc(struct bme680_data *data)
		* + heater duration
		*/
		int wait_eoc_us = ((data->oversampling_temp + data->oversampling_press +
		data->oversampling_humid) * 1936) + (477 * 4) +
		data->oversampling_humid) * 1963) + (477 * 4) +
		(477 * 5) + 1000 + (data->heater_dur * 1000);

		fsleep(wait_eoc_us);

drivers/iio/chemical/sps30_i2c.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -171,7 +171,7 @@ static int sps30_i2c_read_meas(struct sps30_state state, __be32 meas, size_t n
		if (!sps30_i2c_meas_ready(state))
		return -ETIMEDOUT;

		return sps30_i2c_command(state, SPS30_I2C_READ_MEAS, NULL, 0, meas, sizeof(num) * num);
		return sps30_i2c_command(state, SPS30_I2C_READ_MEAS, NULL, 0, meas, sizeof(meas) num);
		}

		static int sps30_i2c_clean_fan(struct sps30_state *state)

drivers/iio/chemical/sps30_serial.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -303,7 +303,7 @@ static int sps30_serial_read_meas(struct sps30_state state, __be32 meas, size_
		if (msleep_interruptible(1000))
		return -EINTR;

		ret = sps30_serial_command(state, SPS30_SERIAL_READ_MEAS, NULL, 0, meas, num * sizeof(num));
		ret = sps30_serial_command(state, SPS30_SERIAL_READ_MEAS, NULL, 0, meas, num * sizeof(*meas));
		if (ret < 0)
		return ret;
		/* if measurements aren't ready sensor returns empty frame */

drivers/iio/dac/ds4424.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -140,7 +140,7 @@ static int ds4424_write_raw(struct iio_dev *indio_dev,

		switch (mask) {
		case IIO_CHAN_INFO_RAW:
		if (val < S8_MIN \|\| val > S8_MAX)
		if (val <= S8_MIN \|\| val > S8_MAX)
		return -EINVAL;

		if (val > 0) {