--- /dev/null
+From 4ed243b1da169bcbc1ec5507867e56250c5f1ff9 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Fri, 14 May 2021 16:02:54 +0800
+Subject: iio: adc: ad7793: Add missing error code in ad7793_setup()
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+commit 4ed243b1da169bcbc1ec5507867e56250c5f1ff9 upstream.
+
+Set error code while device ID query failed.
+
+Fixes: 88bc30548aae ("IIO: ADC: New driver for AD7792/AD7793 3 Channel SPI ADC")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/adc/ad7793.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iio/adc/ad7793.c
++++ b/drivers/iio/adc/ad7793.c
+@@ -279,6 +279,7 @@ static int ad7793_setup(struct iio_dev *
+ id &= AD7793_ID_MASK;
+
+ if (id != st->chip_info->id) {
++ ret = -ENODEV;
+ dev_err(&st->sd.spi->dev, "device ID query failed\n");
+ goto out;
+ }
--- /dev/null
+From bbf0a94744edfeee298e4a9ab6fd694d639a5cdf Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Wed, 26 May 2021 22:33:34 +0300
+Subject: mei: request autosuspend after sending rx flow control
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit bbf0a94744edfeee298e4a9ab6fd694d639a5cdf upstream.
+
+A rx flow control waiting in the control queue may block autosuspend.
+Re-request autosuspend after flow control been sent to unblock
+the transition to the low power state.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Link: https://lore.kernel.org/r/20210526193334.445759-1-tomas.winkler@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/mei/interrupt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/misc/mei/interrupt.c
++++ b/drivers/misc/mei/interrupt.c
+@@ -220,6 +220,9 @@ static int mei_cl_irq_read(struct mei_cl
+ return ret;
+ }
+
++ pm_runtime_mark_last_busy(dev->dev);
++ pm_request_autosuspend(dev->dev);
++
+ list_move_tail(&cb->list, &cl->rd_pending);
+
+ return 0;
--- /dev/null
+From dcb4b8ad6a448532d8b681b5d1a7036210b622de Mon Sep 17 00:00:00 2001
+From: Dongliang Mu <mudongliangabcd@gmail.com>
+Date: Fri, 14 May 2021 20:43:48 +0800
+Subject: misc/uss720: fix memory leak in uss720_probe
+
+From: Dongliang Mu <mudongliangabcd@gmail.com>
+
+commit dcb4b8ad6a448532d8b681b5d1a7036210b622de upstream.
+
+uss720_probe forgets to decrease the refcount of usbdev in uss720_probe.
+Fix this by decreasing the refcount of usbdev by usb_put_dev.
+
+BUG: memory leak
+unreferenced object 0xffff888101113800 (size 2048):
+ comm "kworker/0:1", pid 7, jiffies 4294956777 (age 28.870s)
+ hex dump (first 32 bytes):
+ ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00 ....1...........
+ 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ................
+ backtrace:
+ [<ffffffff82b8e822>] kmalloc include/linux/slab.h:554 [inline]
+ [<ffffffff82b8e822>] kzalloc include/linux/slab.h:684 [inline]
+ [<ffffffff82b8e822>] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582
+ [<ffffffff82b98441>] hub_port_connect drivers/usb/core/hub.c:5129 [inline]
+ [<ffffffff82b98441>] hub_port_connect_change drivers/usb/core/hub.c:5363 [inline]
+ [<ffffffff82b98441>] port_event drivers/usb/core/hub.c:5509 [inline]
+ [<ffffffff82b98441>] hub_event+0x1171/0x20c0 drivers/usb/core/hub.c:5591
+ [<ffffffff81259229>] process_one_work+0x2c9/0x600 kernel/workqueue.c:2275
+ [<ffffffff81259b19>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2421
+ [<ffffffff81261228>] kthread+0x178/0x1b0 kernel/kthread.c:292
+ [<ffffffff8100227f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
+
+Fixes: 0f36163d3abe ("[PATCH] usb: fix uss720 schedule with interrupts off")
+Cc: stable <stable@vger.kernel.org>
+Reported-by: syzbot+636c58f40a86b4a879e7@syzkaller.appspotmail.com
+Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
+Link: https://lore.kernel.org/r/20210514124348.6587-1-mudongliangabcd@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/misc/uss720.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/misc/uss720.c
++++ b/drivers/usb/misc/uss720.c
+@@ -749,6 +749,7 @@ static int uss720_probe(struct usb_inter
+ parport_announce_port(pp);
+
+ usb_set_intfdata(intf, pp);
++ usb_put_dev(usbdev);
+ return 0;
+
+ probe_abort:
ath10k-validate-first-subframe-of-a-msdu-before-processing-the-list.patch
dm-snapshot-properly-fix-a-crash-when-an-origin-has-no-snapshots.patch
kgdb-fix-gcc-11-warnings-harder.patch
+misc-uss720-fix-memory-leak-in-uss720_probe.patch
+thunderbolt-dma_port-fix-nvm-read-buffer-bounds-and-offset-issue.patch
+mei-request-autosuspend-after-sending-rx-flow-control.patch
+staging-iio-cdc-ad7746-avoid-overwrite-of-num_channels.patch
+iio-adc-ad7793-add-missing-error-code-in-ad7793_setup.patch
+usb-trancevibrator-fix-control-request-direction.patch
--- /dev/null
+From 04f5b9f539ce314f758d919a14dc7a669f3b7838 Mon Sep 17 00:00:00 2001
+From: Lucas Stankus <lucas.p.stankus@gmail.com>
+Date: Tue, 11 May 2021 17:54:18 -0300
+Subject: staging: iio: cdc: ad7746: avoid overwrite of num_channels
+
+From: Lucas Stankus <lucas.p.stankus@gmail.com>
+
+commit 04f5b9f539ce314f758d919a14dc7a669f3b7838 upstream.
+
+AD7745 devices don't have the CIN2 pins and therefore can't handle related
+channels. Forcing the number of AD7746 channels may lead to enabling more
+channels than what the hardware actually supports.
+Avoid num_channels being overwritten after first assignment.
+
+Signed-off-by: Lucas Stankus <lucas.p.stankus@gmail.com>
+Fixes: 83e416f458d53 ("staging: iio: adc: Replace, rewrite ad7745 from scratch.")
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/iio/cdc/ad7746.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/staging/iio/cdc/ad7746.c
++++ b/drivers/staging/iio/cdc/ad7746.c
+@@ -703,7 +703,6 @@ static int ad7746_probe(struct i2c_clien
+ indio_dev->num_channels = ARRAY_SIZE(ad7746_channels);
+ else
+ indio_dev->num_channels = ARRAY_SIZE(ad7746_channels) - 2;
+- indio_dev->num_channels = ARRAY_SIZE(ad7746_channels);
+ indio_dev->modes = INDIO_DIRECT_MODE;
+
+ if (pdata) {
--- /dev/null
+From b106776080a1cf953a1b2fd50cb2a995db4732be Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Tue, 27 Apr 2021 15:48:29 +0300
+Subject: thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit b106776080a1cf953a1b2fd50cb2a995db4732be upstream.
+
+Up to 64 bytes of data can be read from NVM in one go. Read address
+must be dword aligned. Data is read into a local buffer.
+
+If caller asks to read data starting at an unaligned address then full
+dword is anyway read from NVM into a local buffer. Data is then copied
+from the local buffer starting at the unaligned offset to the caller
+buffer.
+
+In cases where asked data length + unaligned offset is over 64 bytes
+we need to make sure we don't read past the 64 bytes in the local
+buffer when copying to caller buffer, and make sure that we don't
+skip copying unaligned offset bytes from local buffer anymore after
+the first round of 64 byte NVM data read.
+
+Fixes: 3e13676862f9 ("thunderbolt: Add support for DMA configuration based mailbox")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thunderbolt/dma_port.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/thunderbolt/dma_port.c
++++ b/drivers/thunderbolt/dma_port.c
+@@ -369,15 +369,15 @@ int dma_port_flash_read(struct tb_dma_po
+ void *buf, size_t size)
+ {
+ unsigned int retries = DMA_PORT_RETRIES;
+- unsigned int offset;
+-
+- offset = address & 3;
+- address = address & ~3;
+
+ do {
+- u32 nbytes = min_t(u32, size, MAIL_DATA_DWORDS * 4);
++ unsigned int offset;
++ size_t nbytes;
+ int ret;
+
++ offset = address & 3;
++ nbytes = min_t(size_t, size + offset, MAIL_DATA_DWORDS * 4);
++
+ ret = dma_port_flash_read_block(dma, address, dma->buf,
+ ALIGN(nbytes, 4));
+ if (ret) {
+@@ -389,6 +389,7 @@ int dma_port_flash_read(struct tb_dma_po
+ return ret;
+ }
+
++ nbytes -= offset;
+ memcpy(buf, dma->buf + offset, nbytes);
+
+ size -= nbytes;
--- /dev/null
+From 746e4acf87bcacf1406e05ef24a0b7139147c63e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 21 May 2021 15:31:09 +0200
+Subject: USB: trancevibrator: fix control-request direction
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 746e4acf87bcacf1406e05ef24a0b7139147c63e upstream.
+
+The direction of the pipe argument must match the request-type direction
+bit or control requests may fail depending on the host-controller-driver
+implementation.
+
+Fix the set-speed request which erroneously used USB_DIR_IN and update
+the default timeout argument to match (same value).
+
+Fixes: 5638e4d92e77 ("USB: add PlayStation 2 Trance Vibrator driver")
+Cc: stable@vger.kernel.org # 2.6.19
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20210521133109.17396-1-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/misc/trancevibrator.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/misc/trancevibrator.c
++++ b/drivers/usb/misc/trancevibrator.c
+@@ -72,9 +72,9 @@ static ssize_t set_speed(struct device *
+ /* Set speed */
+ retval = usb_control_msg(tv->udev, usb_sndctrlpipe(tv->udev, 0),
+ 0x01, /* vendor request: set speed */
+- USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_OTHER,
++ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER,
+ tv->speed, /* speed value */
+- 0, NULL, 0, USB_CTRL_GET_TIMEOUT);
++ 0, NULL, 0, USB_CTRL_SET_TIMEOUT);
+ if (retval) {
+ tv->speed = old;
+ dev_dbg(&tv->udev->dev, "retval = %d\n", retval);
projects / thirdparty / kernel / stable-queue.git / commitdiff
