--- /dev/null
+From 558df982d4ead9cac628153d0d7b60feae05ddc8 Mon Sep 17 00:00:00 2001
+From: Pekka Korpinen <pekka.korpinen@iki.fi>
+Date: Wed, 29 Sep 2021 21:57:55 +0300
+Subject: iio: dac: ad5446: Fix ad5622_write() return value
+
+From: Pekka Korpinen <pekka.korpinen@iki.fi>
+
+commit 558df982d4ead9cac628153d0d7b60feae05ddc8 upstream.
+
+On success i2c_master_send() returns the number of bytes written. The
+call from iio_write_channel_info(), however, expects the return value to
+be zero on success.
+
+This bug causes incorrect consumption of the sysfs buffer in
+iio_write_channel_info(). When writing more than two characters to
+out_voltage0_raw, the ad5446 write handler is called multiple times
+causing unexpected behavior.
+
+Fixes: 3ec36a2cf0d5 ("iio:ad5446: Add support for I2C based DACs")
+Signed-off-by: Pekka Korpinen <pekka.korpinen@iki.fi>
+Link: https://lore.kernel.org/r/20210929185755.2384-1-pekka.korpinen@iki.fi
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/dac/ad5446.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/dac/ad5446.c
++++ b/drivers/iio/dac/ad5446.c
+@@ -528,8 +528,15 @@ static int ad5622_write(struct ad5446_st
+ {
+ struct i2c_client *client = to_i2c_client(st->dev);
+ __be16 data = cpu_to_be16(val);
++ int ret;
+
+- return i2c_master_send(client, (char *)&data, sizeof(data));
++ ret = i2c_master_send(client, (char *)&data, sizeof(data));
++ if (ret < 0)
++ return ret;
++ if (ret != sizeof(data))
++ return -EIO;
++
++ return 0;
+ }
+
+ /**
--- /dev/null
+From c7892ae13e461ed20154321eb792e07ebe38f5b3 Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Fri, 22 Oct 2021 09:43:23 +0800
+Subject: pinctrl: core: fix possible memory leak in pinctrl_enable()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+commit c7892ae13e461ed20154321eb792e07ebe38f5b3 upstream.
+
+I got memory leak as follows when doing fault injection test:
+
+unreferenced object 0xffff888020a7a680 (size 64):
+ comm "i2c-mcp23018-41", pid 23090, jiffies 4295160544 (age 8.680s)
+ hex dump (first 32 bytes):
+ 00 48 d3 1e 80 88 ff ff 00 1a 56 c1 ff ff ff ff .H........V.....
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<0000000083c79b35>] kmem_cache_alloc_trace+0x16d/0x360
+ [<0000000051803c95>] pinctrl_init_controller+0x6ed/0xb70
+ [<0000000064346707>] pinctrl_register+0x27/0x80
+ [<0000000029b0e186>] devm_pinctrl_register+0x5b/0xe0
+ [<00000000391f5a3e>] mcp23s08_probe_one+0x968/0x118a [pinctrl_mcp23s08]
+ [<000000006112c039>] mcp230xx_probe+0x266/0x560 [pinctrl_mcp23s08_i2c]
+
+If pinctrl_claim_hogs() fails, the 'pindesc' allocated in pinctrl_register_one_pin()
+need be freed.
+
+Cc: stable@vger.kernel.org
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 950b0d91dc10 ("pinctrl: core: Fix regression caused by delayed work for hogs")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20211022014323.1156924-1-yangyingliang@huawei.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/pinctrl/core.c
++++ b/drivers/pinctrl/core.c
+@@ -2038,6 +2038,8 @@ int pinctrl_enable(struct pinctrl_dev *p
+ if (error) {
+ dev_err(pctldev->dev, "could not claim hogs: %i\n",
+ error);
++ pinctrl_free_pindescs(pctldev, pctldev->desc->pins,
++ pctldev->desc->npins);
+ mutex_destroy(&pctldev->mutex);
+ kfree(pctldev);
+
pci-aardvark-read-all-16-bits-from-pcie_msi_payload_reg.patch
quota-check-block-number-when-reading-the-block-in-quota-file.patch
quota-correct-error-number-in-free_dqentry.patch
+pinctrl-core-fix-possible-memory-leak-in-pinctrl_enable.patch
+iio-dac-ad5446-fix-ad5622_write-return-value.patch
+usb-serial-keyspan-fix-memleak-on-probe-errors.patch
+usb-iowarrior-fix-control-message-timeouts.patch
--- /dev/null
+From 79a4479a17b83310deb0b1a2a274fe5be12d2318 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 25 Oct 2021 13:51:59 +0200
+Subject: USB: iowarrior: fix control-message timeouts
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 79a4479a17b83310deb0b1a2a274fe5be12d2318 upstream.
+
+USB control-message timeouts are specified in milliseconds and should
+specifically not vary with CONFIG_HZ.
+
+Use the common control-message timeout define for the five-second
+timeout and drop the driver-specific one.
+
+Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.")
+Cc: stable@vger.kernel.org # 2.6.21
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20211025115159.4954-3-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/misc/iowarrior.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/misc/iowarrior.c
++++ b/drivers/usb/misc/iowarrior.c
+@@ -103,10 +103,6 @@ struct iowarrior {
+ /* globals */
+ /*--------------*/
+
+-/*
+- * USB spec identifies 5 second timeouts.
+- */
+-#define GET_TIMEOUT 5
+ #define USB_REQ_GET_REPORT 0x01
+ //#if 0
+ static int usb_get_report(struct usb_device *dev,
+@@ -118,7 +114,7 @@ static int usb_get_report(struct usb_dev
+ USB_DIR_IN | USB_TYPE_CLASS |
+ USB_RECIP_INTERFACE, (type << 8) + id,
+ inter->desc.bInterfaceNumber, buf, size,
+- GET_TIMEOUT*HZ);
++ USB_CTRL_GET_TIMEOUT);
+ }
+ //#endif
+
+@@ -133,7 +129,7 @@ static int usb_set_report(struct usb_int
+ USB_TYPE_CLASS | USB_RECIP_INTERFACE,
+ (type << 8) + id,
+ intf->cur_altsetting->desc.bInterfaceNumber, buf,
+- size, HZ);
++ size, 1000);
+ }
+
+ /*---------------------*/
--- /dev/null
+From 910c996335c37552ee30fcb837375b808bb4f33b Mon Sep 17 00:00:00 2001
+From: Wang Hai <wanghai38@huawei.com>
+Date: Fri, 15 Oct 2021 16:55:43 +0800
+Subject: USB: serial: keyspan: fix memleak on probe errors
+
+From: Wang Hai <wanghai38@huawei.com>
+
+commit 910c996335c37552ee30fcb837375b808bb4f33b upstream.
+
+I got memory leak as follows when doing fault injection test:
+
+unreferenced object 0xffff888258228440 (size 64):
+ comm "kworker/7:2", pid 2005, jiffies 4294989509 (age 824.540s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<ffffffff8167939c>] slab_post_alloc_hook+0x9c/0x490
+ [<ffffffff8167f627>] kmem_cache_alloc_trace+0x1f7/0x470
+ [<ffffffffa02ac0e4>] keyspan_port_probe+0xa4/0x5d0 [keyspan]
+ [<ffffffffa0294c07>] usb_serial_device_probe+0x97/0x1d0 [usbserial]
+ [<ffffffff82b50ca7>] really_probe+0x167/0x460
+ [<ffffffff82b51099>] __driver_probe_device+0xf9/0x180
+ [<ffffffff82b51173>] driver_probe_device+0x53/0x130
+ [<ffffffff82b516f5>] __device_attach_driver+0x105/0x130
+ [<ffffffff82b4cfe9>] bus_for_each_drv+0x129/0x190
+ [<ffffffff82b50a69>] __device_attach+0x1c9/0x270
+ [<ffffffff82b518d0>] device_initial_probe+0x20/0x30
+ [<ffffffff82b4f062>] bus_probe_device+0x142/0x160
+ [<ffffffff82b4a4e9>] device_add+0x829/0x1300
+ [<ffffffffa0295fda>] usb_serial_probe.cold+0xc9b/0x14ac [usbserial]
+ [<ffffffffa02266aa>] usb_probe_interface+0x1aa/0x3c0 [usbcore]
+ [<ffffffff82b50ca7>] really_probe+0x167/0x460
+
+If keyspan_port_probe() fails to allocate memory for an out_buffer[i] or
+in_buffer[i], the previously allocated memory for out_buffer or
+in_buffer needs to be freed on the error handling path, otherwise a
+memory leak will result.
+
+Fixes: bad41a5bf177 ("USB: keyspan: fix port DMA-buffer allocations")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Link: https://lore.kernel.org/r/20211015085543.1203011-1-wanghai38@huawei.com
+Cc: stable@vger.kernel.org # 3.12
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/keyspan.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/drivers/usb/serial/keyspan.c
++++ b/drivers/usb/serial/keyspan.c
+@@ -2910,22 +2910,22 @@ static int keyspan_port_probe(struct usb
+ for (i = 0; i < ARRAY_SIZE(p_priv->in_buffer); ++i) {
+ p_priv->in_buffer[i] = kzalloc(IN_BUFLEN, GFP_KERNEL);
+ if (!p_priv->in_buffer[i])
+- goto err_in_buffer;
++ goto err_free_in_buffer;
+ }
+
+ for (i = 0; i < ARRAY_SIZE(p_priv->out_buffer); ++i) {
+ p_priv->out_buffer[i] = kzalloc(OUT_BUFLEN, GFP_KERNEL);
+ if (!p_priv->out_buffer[i])
+- goto err_out_buffer;
++ goto err_free_out_buffer;
+ }
+
+ p_priv->inack_buffer = kzalloc(INACK_BUFLEN, GFP_KERNEL);
+ if (!p_priv->inack_buffer)
+- goto err_inack_buffer;
++ goto err_free_out_buffer;
+
+ p_priv->outcont_buffer = kzalloc(OUTCONT_BUFLEN, GFP_KERNEL);
+ if (!p_priv->outcont_buffer)
+- goto err_outcont_buffer;
++ goto err_free_inack_buffer;
+
+ p_priv->device_details = d_details;
+
+@@ -2971,15 +2971,14 @@ static int keyspan_port_probe(struct usb
+
+ return 0;
+
+-err_outcont_buffer:
++err_free_inack_buffer:
+ kfree(p_priv->inack_buffer);
+-err_inack_buffer:
++err_free_out_buffer:
+ for (i = 0; i < ARRAY_SIZE(p_priv->out_buffer); ++i)
+ kfree(p_priv->out_buffer[i]);
+-err_out_buffer:
++err_free_in_buffer:
+ for (i = 0; i < ARRAY_SIZE(p_priv->in_buffer); ++i)
+ kfree(p_priv->in_buffer[i]);
+-err_in_buffer:
+ kfree(p_priv);
+
+ return -ENOMEM;
projects / thirdparty / kernel / stable-queue.git / commitdiff
