--- /dev/null
+From 1e4e25c4959c10728fbfcc6a286f9503d32dfe02 Mon Sep 17 00:00:00 2001
+From: Eugen Hristev <eugen.hristev@microchip.com>
+Date: Fri, 12 Apr 2019 06:19:49 -0400
+Subject: media: atmel: atmel-isc: fix asd memory allocation
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+commit 1e4e25c4959c10728fbfcc6a286f9503d32dfe02 upstream.
+
+The subsystem will free the asd memory on notifier cleanup, if the asd is
+added to the notifier.
+However the memory is freed using kfree.
+Thus, we cannot allocate the asd using devm_*
+This can lead to crashes and problems.
+To test this issue, just return an error at probe, but cleanup the
+notifier beforehand.
+
+Fixes: 106267444f ("[media] atmel-isc: add the Image Sensor Controller code")
+
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/atmel/atmel-isc.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/atmel/atmel-isc.c
++++ b/drivers/media/platform/atmel/atmel-isc.c
+@@ -1722,8 +1722,11 @@ static int isc_parse_dt(struct device *d
+ break;
+ }
+
+- subdev_entity->asd = devm_kzalloc(dev,
+- sizeof(*subdev_entity->asd), GFP_KERNEL);
++ /* asd will be freed by the subsystem once it's added to the
++ * notifier list
++ */
++ subdev_entity->asd = kzalloc(sizeof(*subdev_entity->asd),
++ GFP_KERNEL);
+ if (subdev_entity->asd == NULL) {
+ of_node_put(rem);
+ ret = -ENOMEM;
+@@ -1859,6 +1862,7 @@ static int atmel_isc_probe(struct platfo
+ &subdev_entity->notifier);
+ if (ret) {
+ dev_err(dev, "fail to register async notifier\n");
++ kfree(subdev_entity->asd);
+ goto cleanup_subdev;
+ }
+
--- /dev/null
+From 79199002db5c571e335131856b3ff057ffd9f3c0 Mon Sep 17 00:00:00 2001
+From: Eugen Hristev <eugen.hristev@microchip.com>
+Date: Fri, 12 Apr 2019 06:19:46 -0400
+Subject: media: atmel: atmel-isc: fix INIT_WORK misplacement
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+commit 79199002db5c571e335131856b3ff057ffd9f3c0 upstream.
+
+In case the completion function failes, unbind will be called
+which will call cancel_work for awb_work.
+This will trigger a WARN message from the workqueue.
+To avoid this, move the INIT_WORK call at the start of the completion
+function. This way the work is always initialized, which corresponds
+to the 'always canceled' unbind code.
+
+Fixes: 93d4a26c3d ("[media] atmel-isc: add the isc pipeline function")
+
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/atmel/atmel-isc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/atmel/atmel-isc.c
++++ b/drivers/media/platform/atmel/atmel-isc.c
+@@ -1555,6 +1555,8 @@ static int isc_async_complete(struct v4l
+ struct vb2_queue *q = &isc->vb2_vidq;
+ int ret;
+
++ INIT_WORK(&isc->awb_work, isc_awb_work);
++
+ ret = v4l2_device_register_subdev_nodes(&isc->v4l2_dev);
+ if (ret < 0) {
+ v4l2_err(&isc->v4l2_dev, "Failed to register subdev nodes\n");
+@@ -1614,8 +1616,6 @@ static int isc_async_complete(struct v4l
+ return ret;
+ }
+
+- INIT_WORK(&isc->awb_work, isc_awb_work);
+-
+ /* Register video device */
+ strlcpy(vdev->name, ATMEL_ISC_NAME, sizeof(vdev->name));
+ vdev->release = video_device_release_empty;
--- /dev/null
+From a0816e5088baab82aa738d61a55513114a673c8e Mon Sep 17 00:00:00 2001
+From: Eugen Hristev <eugen.hristev@microchip.com>
+Date: Mon, 15 Apr 2019 10:13:51 -0400
+Subject: media: v4l2-ctrl: fix flags for DO_WHITE_BALANCE
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+commit a0816e5088baab82aa738d61a55513114a673c8e upstream.
+
+Control DO_WHITE_BALANCE is a button, with read only and execute-on-write flags.
+Adding this control in the proper list in the fill function.
+
+After adding it here, we can see output of v4l2-ctl -L
+do_white_balance 0x0098090d (button) : flags=write-only, execute-on-write
+
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/v4l2-core/v4l2-ctrls.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/v4l2-core/v4l2-ctrls.c
++++ b/drivers/media/v4l2-core/v4l2-ctrls.c
+@@ -1014,6 +1014,7 @@ void v4l2_ctrl_fill(u32 id, const char *
+ case V4L2_CID_FLASH_STROBE_STOP:
+ case V4L2_CID_AUTO_FOCUS_START:
+ case V4L2_CID_AUTO_FOCUS_STOP:
++ case V4L2_CID_DO_WHITE_BALANCE:
+ *type = V4L2_CTRL_TYPE_BUTTON;
+ *flags |= V4L2_CTRL_FLAG_WRITE_ONLY |
+ V4L2_CTRL_FLAG_EXECUTE_ON_WRITE;
--- /dev/null
+From f413cbb332a0b5251a790f396d0eb4ebcade5dec Mon Sep 17 00:00:00 2001
+From: Luca Ceresoli <luca@lucaceresoli.net>
+Date: Tue, 14 May 2019 15:23:07 +0200
+Subject: net: macb: fix error format in dev_err()
+
+From: Luca Ceresoli <luca@lucaceresoli.net>
+
+commit f413cbb332a0b5251a790f396d0eb4ebcade5dec upstream.
+
+Errors are negative numbers. Using %u shows them as very large positive
+numbers such as 4294967277 that don't make sense. Use the %d format
+instead, and get a much nicer -19.
+
+Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net>
+Fixes: b48e0bab142f ("net: macb: Migrate to devm clock interface")
+Fixes: 93b31f48b3ba ("net/macb: unify clock management")
+Fixes: 421d9df0628b ("net/macb: merge at91_ether driver into macb driver")
+Fixes: aead88bd0e99 ("net: ethernet: macb: Add support for rx_clk")
+Fixes: f5473d1d44e4 ("net: macb: Support clock management for tsu_clk")
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/cadence/macb_main.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -2822,7 +2822,7 @@ static int macb_clk_init(struct platform
+ if (!err)
+ err = -ENODEV;
+
+- dev_err(&pdev->dev, "failed to get macb_clk (%u)\n", err);
++ dev_err(&pdev->dev, "failed to get macb_clk (%d)\n", err);
+ return err;
+ }
+
+@@ -2831,7 +2831,7 @@ static int macb_clk_init(struct platform
+ if (!err)
+ err = -ENODEV;
+
+- dev_err(&pdev->dev, "failed to get hclk (%u)\n", err);
++ dev_err(&pdev->dev, "failed to get hclk (%d)\n", err);
+ return err;
+ }
+
+@@ -2845,25 +2845,25 @@ static int macb_clk_init(struct platform
+
+ err = clk_prepare_enable(*pclk);
+ if (err) {
+- dev_err(&pdev->dev, "failed to enable pclk (%u)\n", err);
++ dev_err(&pdev->dev, "failed to enable pclk (%d)\n", err);
+ return err;
+ }
+
+ err = clk_prepare_enable(*hclk);
+ if (err) {
+- dev_err(&pdev->dev, "failed to enable hclk (%u)\n", err);
++ dev_err(&pdev->dev, "failed to enable hclk (%d)\n", err);
+ goto err_disable_pclk;
+ }
+
+ err = clk_prepare_enable(*tx_clk);
+ if (err) {
+- dev_err(&pdev->dev, "failed to enable tx_clk (%u)\n", err);
++ dev_err(&pdev->dev, "failed to enable tx_clk (%d)\n", err);
+ goto err_disable_hclk;
+ }
+
+ err = clk_prepare_enable(*rx_clk);
+ if (err) {
+- dev_err(&pdev->dev, "failed to enable rx_clk (%u)\n", err);
++ dev_err(&pdev->dev, "failed to enable rx_clk (%d)\n", err);
+ goto err_disable_txclk;
+ }
+
+@@ -3298,7 +3298,7 @@ static int at91ether_clk_init(struct pla
+
+ err = clk_prepare_enable(*pclk);
+ if (err) {
+- dev_err(&pdev->dev, "failed to enable pclk (%u)\n", err);
++ dev_err(&pdev->dev, "failed to enable pclk (%d)\n", err);
+ return err;
+ }
+
--- /dev/null
+From e926b12c611c2095c7976e2ed31753ad6eb5ff1a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= <u.kleine-koenig@pengutronix.de>
+Date: Mon, 25 Mar 2019 10:49:33 +0100
+Subject: pwm: Clear chip_data in pwm_put()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+commit e926b12c611c2095c7976e2ed31753ad6eb5ff1a upstream.
+
+After a PWM is disposed by its user the per chip data becomes invalid.
+Clear the data in common code instead of the device drivers to get
+consistent behaviour. Before this patch only three of nine drivers
+cleaned up here.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pwm/core.c | 1 +
+ drivers/pwm/pwm-berlin.c | 1 -
+ drivers/pwm/pwm-pca9685.c | 1 -
+ drivers/pwm/pwm-samsung.c | 1 -
+ 4 files changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/pwm/core.c
++++ b/drivers/pwm/core.c
+@@ -874,6 +874,7 @@ void pwm_put(struct pwm_device *pwm)
+ if (pwm->chip->ops->free)
+ pwm->chip->ops->free(pwm->chip, pwm);
+
++ pwm_set_chip_data(pwm, NULL);
+ pwm->label = NULL;
+
+ module_put(pwm->chip->ops->owner);
+--- a/drivers/pwm/pwm-berlin.c
++++ b/drivers/pwm/pwm-berlin.c
+@@ -78,7 +78,6 @@ static void berlin_pwm_free(struct pwm_c
+ {
+ struct berlin_pwm_channel *channel = pwm_get_chip_data(pwm);
+
+- pwm_set_chip_data(pwm, NULL);
+ kfree(channel);
+ }
+
+--- a/drivers/pwm/pwm-pca9685.c
++++ b/drivers/pwm/pwm-pca9685.c
+@@ -176,7 +176,6 @@ static void pca9685_pwm_gpio_free(struct
+ pm_runtime_put(pca->chip.dev);
+ mutex_lock(&pca->lock);
+ pwm = &pca->chip.pwms[offset];
+- pwm_set_chip_data(pwm, NULL);
+ mutex_unlock(&pca->lock);
+ }
+
+--- a/drivers/pwm/pwm-samsung.c
++++ b/drivers/pwm/pwm-samsung.c
+@@ -238,7 +238,6 @@ static int pwm_samsung_request(struct pw
+ static void pwm_samsung_free(struct pwm_chip *chip, struct pwm_device *pwm)
+ {
+ devm_kfree(chip->dev, pwm_get_chip_data(pwm));
+- pwm_set_chip_data(pwm, NULL);
+ }
+
+ static int pwm_samsung_enable(struct pwm_chip *chip, struct pwm_device *pwm)
staging-rtl8723bs-add-024c-0525-to-the-list-of-sdio-device-ids.patch
usb-serial-ftdi_sio-add-device-ids-for-u-blox-c099-f9p.patch
mei-bus-prefix-device-names-on-bus-with-the-bus-name.patch
+xfrm-fix-memleak-on-xfrm-state-destroy.patch
+media-v4l2-ctrl-fix-flags-for-do_white_balance.patch
+net-macb-fix-error-format-in-dev_err.patch
+pwm-clear-chip_data-in-pwm_put.patch
+media-atmel-atmel-isc-fix-asd-memory-allocation.patch
+media-atmel-atmel-isc-fix-init_work-misplacement.patch
--- /dev/null
+From 86c6739eda7d2a03f2db30cbee67a5fb81afa8ba Mon Sep 17 00:00:00 2001
+From: Steffen Klassert <steffen.klassert@secunet.com>
+Date: Wed, 6 Nov 2019 08:13:49 +0100
+Subject: xfrm: Fix memleak on xfrm state destroy
+
+From: Steffen Klassert <steffen.klassert@secunet.com>
+
+commit 86c6739eda7d2a03f2db30cbee67a5fb81afa8ba upstream.
+
+We leak the page that we use to create skb page fragments
+when destroying the xfrm_state. Fix this by dropping a
+page reference if a page was assigned to the xfrm_state.
+
+Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
+Reported-by: JD <jdtxs00@gmail.com>
+Reported-by: Paul Wouters <paul@nohats.ca>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/xfrm/xfrm_state.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -449,6 +449,8 @@ static void xfrm_state_gc_destroy(struct
+ x->type->destructor(x);
+ xfrm_put_type(x->type);
+ }
++ if (x->xfrag.page)
++ put_page(x->xfrag.page);
+ xfrm_dev_state_free(x);
+ security_xfrm_state_free(x);
+ kfree(x);
projects / thirdparty / kernel / stable-queue.git / commitdiff
