--- /dev/null
+From 416dacb819f59180e4d86a5550052033ebb6d72c Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 21 Aug 2019 13:27:12 -0400
+Subject: HID: hidraw: Fix invalid read in hidraw_ioctl
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 416dacb819f59180e4d86a5550052033ebb6d72c upstream.
+
+The syzbot fuzzer has reported a pair of problems in the
+hidraw_ioctl() function: slab-out-of-bounds read and use-after-free
+read. An example of the first:
+
+BUG: KASAN: slab-out-of-bounds in strlen+0x79/0x90 lib/string.c:525
+Read of size 1 at addr ffff8881c8035f38 by task syz-executor.4/2833
+
+CPU: 1 PID: 2833 Comm: syz-executor.4 Not tainted 5.3.0-rc2+ #1
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
+Google 01/01/2011
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0xca/0x13e lib/dump_stack.c:113
+ print_address_description+0x6a/0x32c mm/kasan/report.c:351
+ __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
+ kasan_report+0xe/0x12 mm/kasan/common.c:612
+ strlen+0x79/0x90 lib/string.c:525
+ strlen include/linux/string.h:281 [inline]
+ hidraw_ioctl+0x245/0xae0 drivers/hid/hidraw.c:446
+ vfs_ioctl fs/ioctl.c:46 [inline]
+ file_ioctl fs/ioctl.c:509 [inline]
+ do_vfs_ioctl+0xd2d/0x1330 fs/ioctl.c:696
+ ksys_ioctl+0x9b/0xc0 fs/ioctl.c:713
+ __do_sys_ioctl fs/ioctl.c:720 [inline]
+ __se_sys_ioctl fs/ioctl.c:718 [inline]
+ __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718
+ do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:296
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+RIP: 0033:0x459829
+Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7
+48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
+ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
+RSP: 002b:00007f7a68f6dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
+RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459829
+RDX: 0000000000000000 RSI: 0000000080404805 RDI: 0000000000000004
+RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7a68f6e6d4
+R13: 00000000004c21de R14: 00000000004d5620 R15: 00000000ffffffff
+
+The two problems have the same cause: hidraw_ioctl() fails to test
+whether the device has been removed. This patch adds the missing test.
+
+Reported-and-tested-by: syzbot+5a6c4ec678a0c6ee84ba@syzkaller.appspotmail.com
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+CC: <stable@vger.kernel.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hidraw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hid/hidraw.c
++++ b/drivers/hid/hidraw.c
+@@ -378,7 +378,7 @@ static long hidraw_ioctl(struct file *fi
+
+ mutex_lock(&minors_lock);
+ dev = hidraw_table[minor];
+- if (!dev) {
++ if (!dev || !dev->exist) {
+ ret = -ENODEV;
+ goto out;
+ }
--- /dev/null
+From 5f9242775bb61f390f0885f23fc16397262c7538 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 20 Aug 2019 16:00:21 -0400
+Subject: HID: logitech: Fix general protection fault caused by Logitech driver
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 5f9242775bb61f390f0885f23fc16397262c7538 upstream.
+
+The syzbot fuzzer found a general protection fault in the HID subsystem:
+
+kasan: CONFIG_KASAN_INLINE enabled
+kasan: GPF could be caused by NULL-ptr deref or user memory access
+general protection fault: 0000 [#1] SMP KASAN
+CPU: 0 PID: 3715 Comm: syz-executor.3 Not tainted 5.2.0-rc6+ #15
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
+Google 01/01/2011
+RIP: 0010:__pm_runtime_resume+0x49/0x180 drivers/base/power/runtime.c:1069
+Code: ed 74 d5 fe 45 85 ed 0f 85 9a 00 00 00 e8 6f 73 d5 fe 48 8d bd c1 02
+00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48
+89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 fe 00 00 00
+RSP: 0018:ffff8881d99d78e0 EFLAGS: 00010202
+RAX: dffffc0000000000 RBX: 0000000000000020 RCX: ffffc90003f3f000
+RDX: 0000000416d8686d RSI: ffffffff82676841 RDI: 00000020b6c3436a
+RBP: 00000020b6c340a9 R08: ffff8881c6d64800 R09: fffffbfff0e84c25
+R10: ffff8881d99d7940 R11: ffffffff87426127 R12: 0000000000000004
+R13: 0000000000000000 R14: ffff8881d9b94000 R15: ffffffff897f9048
+FS: 00007f047f542700(0000) GS:ffff8881db200000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000001b30f21000 CR3: 00000001ca032000 CR4: 00000000001406f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ pm_runtime_get_sync include/linux/pm_runtime.h:226 [inline]
+ usb_autopm_get_interface+0x1b/0x50 drivers/usb/core/driver.c:1707
+ usbhid_power+0x7c/0xe0 drivers/hid/usbhid/hid-core.c:1234
+ hid_hw_power include/linux/hid.h:1038 [inline]
+ hidraw_open+0x20d/0x740 drivers/hid/hidraw.c:282
+ chrdev_open+0x219/0x5c0 fs/char_dev.c:413
+ do_dentry_open+0x497/0x1040 fs/open.c:778
+ do_last fs/namei.c:3416 [inline]
+ path_openat+0x1430/0x3ff0 fs/namei.c:3533
+ do_filp_open+0x1a1/0x280 fs/namei.c:3563
+ do_sys_open+0x3c0/0x580 fs/open.c:1070
+ do_syscall_64+0xb7/0x560 arch/x86/entry/common.c:301
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+It turns out the fault was caused by a bug in the HID Logitech driver,
+which violates the requirement that every pathway calling
+hid_hw_start() must also call hid_hw_stop(). This patch fixes the bug
+by making sure the requirement is met.
+
+Reported-and-tested-by: syzbot+3cbe5cd105d2ad56a1df@syzkaller.appspotmail.com
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+CC: <stable@vger.kernel.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-lg.c | 10 ++++++----
+ drivers/hid/hid-lg4ff.c | 1 -
+ 2 files changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/hid/hid-lg.c
++++ b/drivers/hid/hid-lg.c
+@@ -761,7 +761,7 @@ static int lg_probe(struct hid_device *h
+
+ if (!buf) {
+ ret = -ENOMEM;
+- goto err_free;
++ goto err_stop;
+ }
+
+ ret = hid_hw_raw_request(hdev, buf[0], buf, sizeof(cbuf),
+@@ -793,9 +793,12 @@ static int lg_probe(struct hid_device *h
+ ret = lg4ff_init(hdev);
+
+ if (ret)
+- goto err_free;
++ goto err_stop;
+
+ return 0;
++
++err_stop:
++ hid_hw_stop(hdev);
+ err_free:
+ kfree(drv_data);
+ return ret;
+@@ -806,8 +809,7 @@ static void lg_remove(struct hid_device
+ struct lg_drv_data *drv_data = hid_get_drvdata(hdev);
+ if (drv_data->quirks & LG_FF4)
+ lg4ff_deinit(hdev);
+- else
+- hid_hw_stop(hdev);
++ hid_hw_stop(hdev);
+ kfree(drv_data);
+ }
+
+--- a/drivers/hid/hid-lg4ff.c
++++ b/drivers/hid/hid-lg4ff.c
+@@ -1485,7 +1485,6 @@ int lg4ff_deinit(struct hid_device *hid)
+ }
+ }
+ #endif
+- hid_hw_stop(hid);
+ drv_data->device_props = NULL;
+
+ kfree(entry);
--- /dev/null
+From 98375b86c79137416e9fd354177b85e768c16e56 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 4 Sep 2019 11:54:20 -0400
+Subject: HID: prodikeys: Fix general protection fault during probe
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 98375b86c79137416e9fd354177b85e768c16e56 upstream.
+
+The syzbot fuzzer provoked a general protection fault in the
+hid-prodikeys driver:
+
+kasan: CONFIG_KASAN_INLINE enabled
+kasan: GPF could be caused by NULL-ptr deref or user memory access
+general protection fault: 0000 [#1] SMP KASAN
+CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.3.0-rc5+ #28
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
+Google 01/01/2011
+Workqueue: usb_hub_wq hub_event
+RIP: 0010:pcmidi_submit_output_report drivers/hid/hid-prodikeys.c:300 [inline]
+RIP: 0010:pcmidi_set_operational drivers/hid/hid-prodikeys.c:558 [inline]
+RIP: 0010:pcmidi_snd_initialise drivers/hid/hid-prodikeys.c:686 [inline]
+RIP: 0010:pk_probe+0xb51/0xfd0 drivers/hid/hid-prodikeys.c:836
+Code: 0f 85 50 04 00 00 48 8b 04 24 4c 89 7d 10 48 8b 58 08 e8 b2 53 e4 fc
+48 8b 54 24 20 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f
+85 13 04 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b
+
+The problem is caused by the fact that pcmidi_get_output_report() will
+return an error if the HID device doesn't provide the right sort of
+output report, but pcmidi_set_operational() doesn't bother to check
+the return code and assumes the function call always succeeds.
+
+This patch adds the missing check and aborts the probe operation if
+necessary.
+
+Reported-and-tested-by: syzbot+1088533649dafa1c9004@syzkaller.appspotmail.com
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+CC: <stable@vger.kernel.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-prodikeys.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/hid/hid-prodikeys.c
++++ b/drivers/hid/hid-prodikeys.c
+@@ -556,10 +556,14 @@ static void pcmidi_setup_extra_keys(
+
+ static int pcmidi_set_operational(struct pcmidi_snd *pm)
+ {
++ int rc;
++
+ if (pm->ifnum != 1)
+ return 0; /* only set up ONCE for interace 1 */
+
+- pcmidi_get_output_report(pm);
++ rc = pcmidi_get_output_report(pm);
++ if (rc < 0)
++ return rc;
+ pcmidi_submit_output_report(pm, 0xc1);
+ return 0;
+ }
+@@ -688,7 +692,11 @@ static int pcmidi_snd_initialise(struct
+ spin_lock_init(&pm->rawmidi_in_lock);
+
+ init_sustain_timers(pm);
+- pcmidi_set_operational(pm);
++ err = pcmidi_set_operational(pm);
++ if (err < 0) {
++ pk_error("failed to find output report\n");
++ goto fail_register;
++ }
+
+ /* register it */
+ err = snd_card_register(card);
--- /dev/null
+From f794809a7259dfaa3d47d90ef5a86007cf48b1ce Mon Sep 17 00:00:00 2001
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Date: Mon, 27 Aug 2018 08:35:55 +0300
+Subject: IB/core: Add an unbound WQ type to the new CQ API
+
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+
+commit f794809a7259dfaa3d47d90ef5a86007cf48b1ce upstream.
+
+The upstream kernel commit cited below modified the workqueue in the
+new CQ API to be bound to a specific CPU (instead of being unbound).
+This caused ALL users of the new CQ API to use the same bound WQ.
+
+Specifically, MAD handling was severely delayed when the CPU bound
+to the WQ was busy handling (higher priority) interrupts.
+
+This caused a delay in the MAD "heartbeat" response handling,
+which resulted in ports being incorrectly classified as "down".
+
+To fix this, add a new "unbound" WQ type to the new CQ API, so that users
+have the option to choose either a bound WQ or an unbound WQ.
+
+For MADs, choose the new "unbound" WQ.
+
+Fixes: b7363e67b23e ("IB/device: Convert ib-comp-wq to be CPU-bound")
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.m>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/cq.c | 8 ++++++--
+ drivers/infiniband/core/device.c | 15 ++++++++++++++-
+ drivers/infiniband/core/mad.c | 2 +-
+ include/rdma/ib_verbs.h | 9 ++++++---
+ 4 files changed, 27 insertions(+), 7 deletions(-)
+
+--- a/drivers/infiniband/core/cq.c
++++ b/drivers/infiniband/core/cq.c
+@@ -102,12 +102,12 @@ static void ib_cq_poll_work(struct work_
+ completed = __ib_process_cq(cq, IB_POLL_BUDGET_WORKQUEUE);
+ if (completed >= IB_POLL_BUDGET_WORKQUEUE ||
+ ib_req_notify_cq(cq, IB_POLL_FLAGS) > 0)
+- queue_work(ib_comp_wq, &cq->work);
++ queue_work(cq->comp_wq, &cq->work);
+ }
+
+ static void ib_cq_completion_workqueue(struct ib_cq *cq, void *private)
+ {
+- queue_work(ib_comp_wq, &cq->work);
++ queue_work(cq->comp_wq, &cq->work);
+ }
+
+ /**
+@@ -159,9 +159,12 @@ struct ib_cq *ib_alloc_cq(struct ib_devi
+ ib_req_notify_cq(cq, IB_CQ_NEXT_COMP);
+ break;
+ case IB_POLL_WORKQUEUE:
++ case IB_POLL_UNBOUND_WORKQUEUE:
+ cq->comp_handler = ib_cq_completion_workqueue;
+ INIT_WORK(&cq->work, ib_cq_poll_work);
+ ib_req_notify_cq(cq, IB_CQ_NEXT_COMP);
++ cq->comp_wq = (cq->poll_ctx == IB_POLL_WORKQUEUE) ?
++ ib_comp_wq : ib_comp_unbound_wq;
+ break;
+ default:
+ ret = -EINVAL;
+@@ -196,6 +199,7 @@ void ib_free_cq(struct ib_cq *cq)
+ irq_poll_disable(&cq->iop);
+ break;
+ case IB_POLL_WORKQUEUE:
++ case IB_POLL_UNBOUND_WORKQUEUE:
+ cancel_work_sync(&cq->work);
+ break;
+ default:
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -59,6 +59,7 @@ struct ib_client_data {
+ };
+
+ struct workqueue_struct *ib_comp_wq;
++struct workqueue_struct *ib_comp_unbound_wq;
+ struct workqueue_struct *ib_wq;
+ EXPORT_SYMBOL_GPL(ib_wq);
+
+@@ -1005,10 +1006,19 @@ static int __init ib_core_init(void)
+ goto err;
+ }
+
++ ib_comp_unbound_wq =
++ alloc_workqueue("ib-comp-unb-wq",
++ WQ_UNBOUND | WQ_HIGHPRI | WQ_MEM_RECLAIM |
++ WQ_SYSFS, WQ_UNBOUND_MAX_ACTIVE);
++ if (!ib_comp_unbound_wq) {
++ ret = -ENOMEM;
++ goto err_comp;
++ }
++
+ ret = class_register(&ib_class);
+ if (ret) {
+ pr_warn("Couldn't create InfiniBand device class\n");
+- goto err_comp;
++ goto err_comp_unbound;
+ }
+
+ ret = ibnl_init();
+@@ -1055,6 +1065,8 @@ err_ibnl:
+ ibnl_cleanup();
+ err_sysfs:
+ class_unregister(&ib_class);
++err_comp_unbound:
++ destroy_workqueue(ib_comp_unbound_wq);
+ err_comp:
+ destroy_workqueue(ib_comp_wq);
+ err:
+@@ -1071,6 +1083,7 @@ static void __exit ib_core_cleanup(void)
+ addr_cleanup();
+ ibnl_cleanup();
+ class_unregister(&ib_class);
++ destroy_workqueue(ib_comp_unbound_wq);
+ destroy_workqueue(ib_comp_wq);
+ /* Make sure that any pending umem accounting work is done. */
+ destroy_workqueue(ib_wq);
+--- a/drivers/infiniband/core/mad.c
++++ b/drivers/infiniband/core/mad.c
+@@ -3163,7 +3163,7 @@ static int ib_mad_port_open(struct ib_de
+ }
+
+ port_priv->cq = ib_alloc_cq(port_priv->device, port_priv, cq_size, 0,
+- IB_POLL_WORKQUEUE);
++ IB_POLL_UNBOUND_WORKQUEUE);
+ if (IS_ERR(port_priv->cq)) {
+ dev_err(&device->dev, "Couldn't create ib_mad CQ\n");
+ ret = PTR_ERR(port_priv->cq);
+--- a/include/rdma/ib_verbs.h
++++ b/include/rdma/ib_verbs.h
+@@ -63,6 +63,7 @@
+
+ extern struct workqueue_struct *ib_wq;
+ extern struct workqueue_struct *ib_comp_wq;
++extern struct workqueue_struct *ib_comp_unbound_wq;
+
+ union ib_gid {
+ u8 raw[16];
+@@ -1415,9 +1416,10 @@ struct ib_ah {
+ typedef void (*ib_comp_handler)(struct ib_cq *cq, void *cq_context);
+
+ enum ib_poll_context {
+- IB_POLL_DIRECT, /* caller context, no hw completions */
+- IB_POLL_SOFTIRQ, /* poll from softirq context */
+- IB_POLL_WORKQUEUE, /* poll from workqueue */
++ IB_POLL_DIRECT, /* caller context, no hw completions */
++ IB_POLL_SOFTIRQ, /* poll from softirq context */
++ IB_POLL_WORKQUEUE, /* poll from workqueue */
++ IB_POLL_UNBOUND_WORKQUEUE, /* poll from unbound workqueue */
+ };
+
+ struct ib_cq {
+@@ -1434,6 +1436,7 @@ struct ib_cq {
+ struct irq_poll iop;
+ struct work_struct work;
+ };
++ struct workqueue_struct *comp_wq;
+ };
+
+ struct ib_srq {
--- /dev/null
+From 37c673ade35c707d50583b5b25091ff8ebdeafd7 Mon Sep 17 00:00:00 2001
+From: Tokunori Ikegami <ikegami.t@gmail.com>
+Date: Tue, 6 Aug 2019 04:03:18 +0900
+Subject: mtd: cfi_cmdset_0002: Use chip_good() to retry in do_write_oneword()
+
+From: Tokunori Ikegami <ikegami.t@gmail.com>
+
+commit 37c673ade35c707d50583b5b25091ff8ebdeafd7 upstream.
+
+As reported by the OpenWRT team, write requests sometimes fail on some
+platforms.
+Currently to check the state chip_ready() is used correctly as described by
+the flash memory S29GL256P11TFI01 datasheet.
+Also chip_good() is used to check if the write is succeeded and it was
+implemented by the commit fb4a90bfcd6d8 ("[MTD] CFI-0002 - Improve error
+checking").
+But actually the write failure is caused on some platforms and also it can
+be fixed by using chip_good() to check the state and retry instead.
+Also it seems that it is caused after repeated about 1,000 times to retry
+the write one word with the reset command.
+By using chip_good() to check the state to be done it can be reduced the
+retry with reset.
+It is depended on the actual flash chip behavior so the root cause is
+unknown.
+
+Cc: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Cc: Joakim Tjernlund <Joakim.Tjernlund@infinera.com>
+Cc: linux-mtd@lists.infradead.org
+Cc: stable@vger.kernel.org
+Reported-by: Fabio Bettoni <fbettoni@gmail.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: Tokunori Ikegami <ikegami.t@gmail.com>
+[vigneshr@ti.com: Fix a checkpatch warning]
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/mtd/chips/cfi_cmdset_0002.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/mtd/chips/cfi_cmdset_0002.c
++++ b/drivers/mtd/chips/cfi_cmdset_0002.c
+@@ -1624,29 +1624,35 @@ static int __xipram do_write_oneword(str
+ continue;
+ }
+
+- if (time_after(jiffies, timeo) && !chip_ready(map, adr)){
++ /*
++ * We check "time_after" and "!chip_good" before checking
++ * "chip_good" to avoid the failure due to scheduling.
++ */
++ if (time_after(jiffies, timeo) && !chip_good(map, adr, datum)) {
+ xip_enable(map, chip, adr);
+ printk(KERN_WARNING "MTD %s(): software timeout\n", __func__);
+ xip_disable(map, chip, adr);
++ ret = -EIO;
+ break;
+ }
+
+- if (chip_ready(map, adr))
++ if (chip_good(map, adr, datum))
+ break;
+
+ /* Latency issues. Drop the lock, wait a while and retry */
+ UDELAY(map, chip, adr, 1);
+ }
++
+ /* Did we succeed? */
+- if (!chip_good(map, adr, datum)) {
++ if (ret) {
+ /* reset on all failures. */
+ map_write( map, CMD(0xF0), chip->start );
+ /* FIXME - should have reset delay before continuing */
+
+- if (++retry_cnt <= MAX_RETRIES)
++ if (++retry_cnt <= MAX_RETRIES) {
++ ret = 0;
+ goto retry;
+-
+- ret = -EIO;
++ }
+ }
+ xip_enable(map, chip, adr);
+ op_done:
revert-bluetooth-validate-ble-connection-interval-up.patch
+ib-core-add-an-unbound-wq-type-to-the-new-cq-api.patch
+hid-prodikeys-fix-general-protection-fault-during-probe.patch
+hid-logitech-fix-general-protection-fault-caused-by-logitech-driver.patch
+hid-hidraw-fix-invalid-read-in-hidraw_ioctl.patch
+mtd-cfi_cmdset_0002-use-chip_good-to-retry-in-do_write_oneword.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
