IIO: 3rd set of fixes for the 6.12 cycle

Usual mixed bag of new issues from this cycle and ancient bugs
 recently noticed.
 
 core
 - Fix wrong fwnode handle if __fwnode_iio_channel_get_by_name()
   looks at parents of the provider node.
 core,backend
 - Fix a wrong pointer error check.
 gts library
 - Fix plausible corner case where the value returned was not set.
 - Avoid near infinite loop if the size of the table is 0.
   (neither are an issue for current drivers).
 adi,ad4000
 - Fix reading of unsigned channels that were returning garbage.
 adi,ad7780
 - Prevent a division by zero.
 adi,ad7923
 - Fix buffer overflows in arrays that were not resized when devices
   with more channels were added to the driver.
 adi,adxl380
 - Check only for negative error codes rather than including the
   positive channel read values in an error check.
 invense,common
 - Fix an issue where changing the sampling rate to another value and
   back again whilst the FIFO was off would not update things correctly.
 kionix,kx022a
 - Fix failure to sign extend value read from device.
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCAAvFiEEbilms4eEBlKRJoGxVIU0mcT0FogFAmctBygRHGppYzIzQGtl
 cm5lbC5vcmcACgkQVIU0mcT0Fog9gQ/8CdpYJWoK2qnXiWkNQdLR4vqd3RKnQ8ch
 046D26kNoQNDEdT/lSKKvZdGaZmcMg2SqK3VpCJCPc08uuqIZoRbMcv6WkhdP5iK
 besdoaqkyEQaCnR+o0annbDq+hADN0uwe398WbIKMmKxU6nUPTwLkJTTroCnP8pn
 juAi4Elvhz93LhgVPuDtzuMxFAI4gRz8LPfv1WdIIyMitwO8j7ILjjab3Jy+1Rfr
 8n8HwZolS74iSY9qLc7kaipCRb4He+Q6/+c011ym9g8E8ge8KO1huxOn0FnIsWXv
 g/qLsmnEMy56ypguf0uStNHN9f7AXHlqC1xiScnkZXsbP4CFakaL3M8hBbOiw13S
 u/ylhYkxSqCsjZ/oNlTaDtnZrL/ZaHlSTBcsqEu3JRHkG9bJCgLQl2IfTS5Px65Y
 JEj5OGu9nEDi5lPGOUqgJgmLuxSNEMtHqqvqTAp0kk4McM/BocW0ldEaZy7cokCb
 Tb/auEK4sGssdhJM8Nq+wH6mHfjn0IL38sBHNyP640kFNRMG1WnVDICzFGsC3ldL
 TLsczCulnVdr8xhK5vl2irqjnVKzjSFgXZg5jB/29N0V4re/b6pOh8LWm3Ze5hQZ
 sR0rkXI7FkDaNk7Ifb/Pe2XCbU2IjgAvf3dyZxO/E1UuLAz+spa0WjImghHCT5P8
 e9WcX1hoKbg=
 =4pCM
 -----END PGP SIGNATURE-----

Merge tag 'iio-fixes-for-6.12c' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next

Jonathan writes:

IIO: 3rd set of fixes for the 6.12 cycle

Usual mixed bag of new issues from this cycle and ancient bugs
recently noticed.

core
- Fix wrong fwnode handle if __fwnode_iio_channel_get_by_name()
  looks at parents of the provider node.
core,backend
- Fix a wrong pointer error check.
gts library
- Fix plausible corner case where the value returned was not set.
- Avoid near infinite loop if the size of the table is 0.
  (neither are an issue for current drivers).
adi,ad4000
- Fix reading of unsigned channels that were returning garbage.
adi,ad7780
- Prevent a division by zero.
adi,ad7923
- Fix buffer overflows in arrays that were not resized when devices
  with more channels were added to the driver.
adi,adxl380
- Check only for negative error codes rather than including the
  positive channel read values in an error check.
invense,common
- Fix an issue where changing the sampling rate to another value and
  back again whilst the FIFO was off would not update things correctly.
kionix,kx022a
- Fix failure to sign extend value read from device.

* tag 'iio-fixes-for-6.12c' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio:
  iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name()
  iio: accel: adxl380: fix raw sample read
  iio: accel: kx022a: Fix raw read format
  iio: gts: fix infinite loop for gain_to_scaletables()
  iio: gts: Fix uninitialized symbol 'ret'
  iio: adc: ad4000: fix reading unsigned data
  ad7780: fix division by zero in ad7780_write_raw()
  iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer
  iio: backend: fix wrong pointer passed to IS_ERR()
  iio: invensense: fix multiple odr switch when FIFO is off

drivers/iio/accel/adxl380.c

@@ -1181,7 +1181,7 @@ static int adxl380_read_raw(struct iio_dev *indio_dev,
 
 		ret = adxl380_read_chn(st, chan->address);
 		iio_device_release_direct_mode(indio_dev);
-		if (ret)
+		if (ret < 0)
 			return ret;
 
 		*val = sign_extend32(ret >> chan->scan_type.shift,

drivers/iio/accel/kionix-kx022a.c

@@ -594,7 +594,7 @@ static int kx022a_get_axis(struct kx022a_data *data,
 	if (ret)
 		return ret;
 
-	*val = le16_to_cpu(data->buffer[0]);
+	*val = (s16)le16_to_cpu(data->buffer[0]);
 
 	return IIO_VAL_INT;
 }

drivers/iio/adc/ad4000.c

@@ -344,6 +344,8 @@ static int ad4000_single_conversion(struct iio_dev *indio_dev,
 
 	if (chan->scan_type.sign == 's')
 		*val = sign_extend32(sample, chan->scan_type.realbits - 1);
+	else
+		*val = sample;
 
 	return IIO_VAL_INT;
 }

drivers/iio/adc/ad7780.c

@@ -152,7 +152,7 @@ static int ad7780_write_raw(struct iio_dev *indio_dev,
 
 	switch (m) {
 	case IIO_CHAN_INFO_SCALE:
-		if (val != 0)
+		if (val != 0 || val2 == 0)
 			return -EINVAL;
 
 		vref = st->int_vref_mv * 1000000LL;

drivers/iio/adc/ad7923.c

@@ -48,7 +48,7 @@
 
 struct ad7923_state {
 	struct spi_device		*spi;
-	struct spi_transfer		ring_xfer[5];
+	struct spi_transfer		ring_xfer[9];
 	struct spi_transfer		scan_single_xfer[2];
 	struct spi_message		ring_msg;
 	struct spi_message		scan_single_msg;
@@ -64,7 +64,7 @@ struct ad7923_state {
 	 * Length = 8 channels + 4 extra for 8 byte timestamp
 	 */
 	__be16				rx_buf[12] __aligned(IIO_DMA_MINALIGN);
-	__be16				tx_buf[4];
+	__be16				tx_buf[8];
 };
 
 struct ad7923_chip_info {

drivers/iio/common/inv_sensors/inv_sensors_timestamp.c

@@ -70,6 +70,10 @@ int inv_sensors_timestamp_update_odr(struct inv_sensors_timestamp *ts,
 	if (mult != ts->mult)
 		ts->new_mult = mult;
 
+	/* When FIFO is off, directly apply the new ODR */
+	if (!fifo)
+		inv_sensors_timestamp_apply_odr(ts, 0, 0, 0);
+
 	return 0;
 }
 EXPORT_SYMBOL_NS_GPL(inv_sensors_timestamp_update_odr, IIO_INV_SENSORS_TIMESTAMP);

drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c

@@ -200,7 +200,6 @@ static int inv_icm42600_accel_update_scan_mode(struct iio_dev *indio_dev,
 {
 	struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev);
 	struct inv_icm42600_sensor_state *accel_st = iio_priv(indio_dev);
-	struct inv_sensors_timestamp *ts = &accel_st->ts;
 	struct inv_icm42600_sensor_conf conf = INV_ICM42600_SENSOR_CONF_INIT;
 	unsigned int fifo_en = 0;
 	unsigned int sleep_temp = 0;
@@ -229,7 +228,6 @@ static int inv_icm42600_accel_update_scan_mode(struct iio_dev *indio_dev,
 	}
 
 	/* update data FIFO write */
-	inv_sensors_timestamp_apply_odr(ts, 0, 0, 0);
 	ret = inv_icm42600_buffer_set_fifo_en(st, fifo_en | st->fifo.en);
 
 out_unlock:

drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c

@@ -99,8 +99,6 @@ static int inv_icm42600_gyro_update_scan_mode(struct iio_dev *indio_dev,
 					      const unsigned long *scan_mask)
 {
 	struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev);
-	struct inv_icm42600_sensor_state *gyro_st = iio_priv(indio_dev);
-	struct inv_sensors_timestamp *ts = &gyro_st->ts;
 	struct inv_icm42600_sensor_conf conf = INV_ICM42600_SENSOR_CONF_INIT;
 	unsigned int fifo_en = 0;
 	unsigned int sleep_gyro = 0;
@@ -128,7 +126,6 @@ static int inv_icm42600_gyro_update_scan_mode(struct iio_dev *indio_dev,
 	}
 
 	/* update data FIFO write */
-	inv_sensors_timestamp_apply_odr(ts, 0, 0, 0);
 	ret = inv_icm42600_buffer_set_fifo_en(st, fifo_en | st->fifo.en);
 
 out_unlock:

drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c

@@ -112,7 +112,6 @@ int inv_mpu6050_prepare_fifo(struct inv_mpu6050_state *st, bool enable)
 	if (enable) {
 		/* reset timestamping */
 		inv_sensors_timestamp_reset(&st->timestamp);
-		inv_sensors_timestamp_apply_odr(&st->timestamp, 0, 0, 0);
 		/* reset FIFO */
 		d = st->chip_config.user_ctrl | INV_MPU6050_BIT_FIFO_RST;
 		ret = regmap_write(st->map, st->reg->user_ctrl, d);

drivers/iio/industrialio-backend.c

@@ -737,8 +737,8 @@ static struct iio_backend *__devm_iio_backend_fwnode_get(struct device *dev, con
 	}
 
 	fwnode_back = fwnode_find_reference(fwnode, "io-backends", index);
-	if (IS_ERR(fwnode))
-		return dev_err_cast_probe(dev, fwnode,
+	if (IS_ERR(fwnode_back))
+		return dev_err_cast_probe(dev, fwnode_back,
 					  "Cannot get Firmware reference\n");
 
 	guard(mutex)(&iio_back_lock);

drivers/iio/industrialio-gts-helper.c

@@ -167,7 +167,7 @@ static int iio_gts_gain_cmp(const void *a, const void *b)
 
 static int gain_to_scaletables(struct iio_gts *gts, int **gains, int **scales)
 {
-	int ret, i, j, new_idx, time_idx;
+	int i, j, new_idx, time_idx, ret = 0;
 	int *all_gains;
 	size_t gain_bytes;
 
@@ -205,7 +205,7 @@ static int gain_to_scaletables(struct iio_gts *gts, int **gains, int **scales)
 	memcpy(all_gains, gains[time_idx], gain_bytes);
 	new_idx = gts->num_hwgain;
 
-	while (time_idx--) {
+	while (time_idx-- > 0) {
 		for (j = 0; j < gts->num_hwgain; j++) {
 			int candidate = gains[time_idx][j];
 			int chk;

drivers/iio/inkern.c

@@ -270,7 +270,7 @@ struct iio_channel *fwnode_iio_channel_get_by_name(struct fwnode_handle *fwnode,
 			return ERR_PTR(-ENODEV);
 		}
 
-		chan = __fwnode_iio_channel_get_by_name(fwnode, name);
+		chan = __fwnode_iio_channel_get_by_name(parent, name);
 		if (!IS_ERR(chan) || PTR_ERR(chan) != -ENODEV) {
 			fwnode_handle_put(parent);
  			return chan;