Linux Kernel
Contributions.

The al3010 ambient light sensor driver encoded the highest gain range scale as {0, 1187200}, but IIO_VAL_INT_PLUS_MICRO requires the micro part to be below 1,000,000. The malformed entry caused writes to return -EINVAL, making the top gain range impossible to select from userspace and reporting a bogus value on read. Fixed by re-encoding as {1, 187200}. Marked for backport to stable.

ipu7_init_fw_code_region_by_sys() called pm_runtime_get_sync(), which increments the runtime-PM usage counter even when resume fails. The error path returned without a matching pm_runtime_put(), leaking a reference on every failed resume and eventually preventing the device from ever suspending. Fixed by switching to pm_runtime_resume_and_get(), which drops the reference automatically on failure — consistent with the sibling ipu6 driver.

A second pm_runtime refcount bug in the IPU7 driver: ipu7_resume() called pm_runtime_get_sync() and returned without restoring the counter on error, leaking the reference on every failed resume. Fixed with pm_runtime_resume_and_get() while preserving the intentional return-0-on-error behaviour — resume callbacks should not propagate failures to the PM core. Part of a two-patch series with the companion fix above.

ltrf216a_get_lux() acquires a runtime PM reference via ltrf216a_set_power_state(data, true) but returns early without releasing it when ltrf216a_read_data() fails. Every failed read leaks one PM reference, eventually preventing the device from autosuspending. Fixed by adding the matching ltrf216a_set_power_state(data, false) in the error branch so the usage count is balanced on both success and failure paths.

write_raw() for IIO_CHAN_INFO_INT_TIME uses IIO_VAL_INT_PLUS_MICRO encoding (val + val2×10⁻⁶), but only examines val2 and never validates val. All legal integration times for this chip have a seconds part of zero, so any non-zero val is by definition invalid — yet it was silently discarded and success returned, programming the wrong time. Fixed by returning -EINVAL early when val is non-zero, matching the IIO idiom used in sibling drivers. Marked for stable backport.

opt4060_read_ev_period() passes val2, an int *, to div_u64_rem() which expects a u32 * for its remainder argument. int * and u32 * are incompatible C pointer types. There is no functional impact — sizes are identical on all Linux-supported architectures and the remainder fits the positive range of int — but the type is wrong. Fixed by introducing a local u32 rem, passing its address to div_u64_rem(), and assigning back.

The second block in opt4060_get_thresholds() reads the HIGH threshold register but its dev_err() failure message reads "Failed to read THRESHOLD_LOW." — copy-pasted from the LOW block immediately above. Purely diagnostic: the return value and side effects are unchanged. Fixed by correcting the string to THRESHOLD_HIGH so dmesg points at the right register on failure. Marked for stable backport.

attr_data_write_resident() returns the private positive code E_NTFS_NONRESIDENT (556) when a file's DATA attribute is found non-resident mid-writeback. Positive values are not valid Linux errnos and trigger WARN_ON_ONCE(err > 0) in both mapping_set_error() and the next writeback_iter() call — a syzbot-caught crash. Sent as RFC to ask the maintainer whether non-resident mid-writeback should be terminal or retried on the iomap path. The patch clamps the positive return to -EIO before both WARN sinks.