]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.10-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 24 May 2021 11:39:39 +0000 (13:39 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 24 May 2021 11:39:39 +0000 (13:39 +0200)
added patches:
cdrom-gdrom-deallocate-struct-gdrom_unit-fields-in-remove_gdrom.patch
cdrom-gdrom-initialize-global-variable-at-init-time.patch
ethernet-sun-niu-fix-missing-checks-of-niu_pci_eeprom_read.patch
net-rtlwifi-properly-check-for-alloc_workqueue-failure.patch
net-stmicro-handle-clk_prepare-failure-during-init.patch
revert-ecryptfs-replace-bug_on-with-error-handling-code.patch
revert-gdrom-fix-a-memory-leak-bug.patch
revert-hwmon-lm80-fix-a-missing-check-of-bus-read-in-lm80-probe.patch
revert-leds-lp5523-fix-a-missing-check-of-return-value-of-lp55xx_read.patch
revert-media-rcar_drif-fix-a-memory-disclosure.patch
revert-net-stmicro-fix-a-missing-check-of-clk_prepare.patch
revert-niu-fix-missing-checks-of-niu_pci_eeprom_read.patch
revert-qlcnic-avoid-potential-null-pointer-dereference.patch
revert-rtlwifi-fix-a-potential-null-pointer-dereference.patch
revert-scsi-ufs-fix-a-missing-check-of-devm_reset_control_get.patch
revert-video-hgafb-fix-potential-null-pointer-dereference.patch
revert-video-imsttfb-fix-potential-null-pointer-dereferences.patch
scsi-ufs-handle-cleanup-correctly-on-devm_reset_control_get-error.patch

19 files changed:
queue-5.10/cdrom-gdrom-deallocate-struct-gdrom_unit-fields-in-remove_gdrom.patch [new file with mode: 0644]
queue-5.10/cdrom-gdrom-initialize-global-variable-at-init-time.patch [new file with mode: 0644]
queue-5.10/ethernet-sun-niu-fix-missing-checks-of-niu_pci_eeprom_read.patch [new file with mode: 0644]
queue-5.10/net-rtlwifi-properly-check-for-alloc_workqueue-failure.patch [new file with mode: 0644]
queue-5.10/net-stmicro-handle-clk_prepare-failure-during-init.patch [new file with mode: 0644]
queue-5.10/revert-ecryptfs-replace-bug_on-with-error-handling-code.patch [new file with mode: 0644]
queue-5.10/revert-gdrom-fix-a-memory-leak-bug.patch [new file with mode: 0644]
queue-5.10/revert-hwmon-lm80-fix-a-missing-check-of-bus-read-in-lm80-probe.patch [new file with mode: 0644]
queue-5.10/revert-leds-lp5523-fix-a-missing-check-of-return-value-of-lp55xx_read.patch [new file with mode: 0644]
queue-5.10/revert-media-rcar_drif-fix-a-memory-disclosure.patch [new file with mode: 0644]
queue-5.10/revert-net-stmicro-fix-a-missing-check-of-clk_prepare.patch [new file with mode: 0644]
queue-5.10/revert-niu-fix-missing-checks-of-niu_pci_eeprom_read.patch [new file with mode: 0644]
queue-5.10/revert-qlcnic-avoid-potential-null-pointer-dereference.patch [new file with mode: 0644]
queue-5.10/revert-rtlwifi-fix-a-potential-null-pointer-dereference.patch [new file with mode: 0644]
queue-5.10/revert-scsi-ufs-fix-a-missing-check-of-devm_reset_control_get.patch [new file with mode: 0644]
queue-5.10/revert-video-hgafb-fix-potential-null-pointer-dereference.patch [new file with mode: 0644]
queue-5.10/revert-video-imsttfb-fix-potential-null-pointer-dereferences.patch [new file with mode: 0644]
queue-5.10/scsi-ufs-handle-cleanup-correctly-on-devm_reset_control_get-error.patch [new file with mode: 0644]
queue-5.10/series

diff --git a/queue-5.10/cdrom-gdrom-deallocate-struct-gdrom_unit-fields-in-remove_gdrom.patch b/queue-5.10/cdrom-gdrom-deallocate-struct-gdrom_unit-fields-in-remove_gdrom.patch
new file mode 100644 (file)
index 0000000..38a68c5
--- /dev/null
@@ -0,0 +1,52 @@
+From d03d1021da6fe7f46efe9f2a7335564e7c9db5ab Mon Sep 17 00:00:00 2001
+From: Atul Gopinathan <atulgopinathan@gmail.com>
+Date: Mon, 3 May 2021 13:56:54 +0200
+Subject: cdrom: gdrom: deallocate struct gdrom_unit fields in remove_gdrom
+
+From: Atul Gopinathan <atulgopinathan@gmail.com>
+
+commit d03d1021da6fe7f46efe9f2a7335564e7c9db5ab upstream.
+
+The fields, "toc" and "cd_info", of "struct gdrom_unit gd" are allocated
+in "probe_gdrom()". Prevent a memory leak by making sure "gd.cd_info" is
+deallocated in the "remove_gdrom()" function.
+
+Also prevent double free of the field "gd.toc" by moving it from the
+module's exit function to "remove_gdrom()". This is because, in
+"probe_gdrom()", the function makes sure to deallocate "gd.toc" in case
+of any errors, so the exit function invoked later would again free
+"gd.toc".
+
+The patch also maintains consistency by deallocating the above mentioned
+fields in "remove_gdrom()" along with another memory allocated field
+"gd.disk".
+
+Suggested-by: Jens Axboe <axboe@kernel.dk>
+Cc: Peter Rosin <peda@axentia.se>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Atul Gopinathan <atulgopinathan@gmail.com>
+Link: https://lore.kernel.org/r/20210503115736.2104747-28-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cdrom/gdrom.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/cdrom/gdrom.c
++++ b/drivers/cdrom/gdrom.c
+@@ -831,6 +831,8 @@ static int remove_gdrom(struct platform_
+       if (gdrom_major)
+               unregister_blkdev(gdrom_major, GDROM_DEV_NAME);
+       unregister_cdrom(gd.cd_info);
++      kfree(gd.cd_info);
++      kfree(gd.toc);
+       return 0;
+ }
+@@ -862,7 +864,6 @@ static void __exit exit_gdrom(void)
+ {
+       platform_device_unregister(pd);
+       platform_driver_unregister(&gdrom_driver);
+-      kfree(gd.toc);
+ }
+ module_init(init_gdrom);
diff --git a/queue-5.10/cdrom-gdrom-initialize-global-variable-at-init-time.patch b/queue-5.10/cdrom-gdrom-initialize-global-variable-at-init-time.patch
new file mode 100644 (file)
index 0000000..d4c1010
--- /dev/null
@@ -0,0 +1,52 @@
+From 9183f01b5e6e32eb3f17b5f3f8d5ad5ac9786c49 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Thu, 6 May 2021 16:00:47 +0200
+Subject: cdrom: gdrom: initialize global variable at init time
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 9183f01b5e6e32eb3f17b5f3f8d5ad5ac9786c49 upstream.
+
+As Peter points out, if we were to disconnect and then reconnect this
+driver from a device, the "global" state of the device would contain odd
+values and could cause problems.  Fix this up by just initializing the
+whole thing to 0 at probe() time.
+
+Ideally this would be a per-device variable, but given the age and the
+total lack of users of it, that would require a lot of s/./->/g changes
+for really no good reason.
+
+Reported-by: Peter Rosin <peda@axentia.se>
+Cc: Jens Axboe <axboe@kernel.dk>
+Reviewed-by: Peter Rosin <peda@axentia.se>
+Link: https://lore.kernel.org/r/YJP2j6AU82MqEY2M@kroah.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cdrom/gdrom.c |    9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/cdrom/gdrom.c
++++ b/drivers/cdrom/gdrom.c
+@@ -743,6 +743,13 @@ static const struct blk_mq_ops gdrom_mq_
+ static int probe_gdrom(struct platform_device *devptr)
+ {
+       int err;
++
++      /*
++       * Ensure our "one" device is initialized properly in case of previous
++       * usages of it
++       */
++      memset(&gd, 0, sizeof(gd));
++
+       /* Start the device */
+       if (gdrom_execute_diagnostic() != 1) {
+               pr_warn("ATA Probe for GDROM failed\n");
+@@ -848,7 +855,7 @@ static struct platform_driver gdrom_driv
+ static int __init init_gdrom(void)
+ {
+       int rc;
+-      gd.toc = NULL;
++
+       rc = platform_driver_register(&gdrom_driver);
+       if (rc)
+               return rc;
diff --git a/queue-5.10/ethernet-sun-niu-fix-missing-checks-of-niu_pci_eeprom_read.patch b/queue-5.10/ethernet-sun-niu-fix-missing-checks-of-niu_pci_eeprom_read.patch
new file mode 100644 (file)
index 0000000..a64b11f
--- /dev/null
@@ -0,0 +1,121 @@
+From e6e337708c22f80824b82d4af645f20715730ad0 Mon Sep 17 00:00:00 2001
+From: Du Cheng <ducheng2@gmail.com>
+Date: Mon, 3 May 2021 13:56:50 +0200
+Subject: ethernet: sun: niu: fix missing checks of niu_pci_eeprom_read()
+
+From: Du Cheng <ducheng2@gmail.com>
+
+commit e6e337708c22f80824b82d4af645f20715730ad0 upstream.
+
+niu_pci_eeprom_read() may fail, so add checks to its return value and
+propagate the error up the callstack.
+
+An examination of the callstack up to niu_pci_eeprom_read shows that:
+
+niu_pci_eeprom_read() // returns int
+    niu_pci_vpd_scan_props() // returns int
+        niu_pci_vpd_fetch() // returns *void*
+            niu_get_invariants() // returns int
+
+since niu_pci_vpd_fetch() returns void which breaks the bubbling up,
+change its return type to int so that error is propagated upwards.
+
+Signed-off-by: Du Cheng <ducheng2@gmail.com>
+Cc: Shannon Nelson <shannon.lee.nelson@gmail.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210503115736.2104747-24-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/sun/niu.c |   34 ++++++++++++++++++++++++----------
+ 1 file changed, 24 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/sun/niu.c
++++ b/drivers/net/ethernet/sun/niu.c
+@@ -8097,6 +8097,8 @@ static int niu_pci_vpd_scan_props(struct
+               start += 3;
+               prop_len = niu_pci_eeprom_read(np, start + 4);
++              if (prop_len < 0)
++                      return prop_len;
+               err = niu_pci_vpd_get_propname(np, start + 5, namebuf, 64);
+               if (err < 0)
+                       return err;
+@@ -8141,8 +8143,12 @@ static int niu_pci_vpd_scan_props(struct
+                       netif_printk(np, probe, KERN_DEBUG, np->dev,
+                                    "VPD_SCAN: Reading in property [%s] len[%d]\n",
+                                    namebuf, prop_len);
+-                      for (i = 0; i < prop_len; i++)
+-                              *prop_buf++ = niu_pci_eeprom_read(np, off + i);
++                      for (i = 0; i < prop_len; i++) {
++                              err =  niu_pci_eeprom_read(np, off + i);
++                              if (err < 0)
++                                      return err;
++                              *prop_buf++ = err;
++                      }
+               }
+               start += len;
+@@ -8152,14 +8158,14 @@ static int niu_pci_vpd_scan_props(struct
+ }
+ /* ESPC_PIO_EN_ENABLE must be set */
+-static void niu_pci_vpd_fetch(struct niu *np, u32 start)
++static int niu_pci_vpd_fetch(struct niu *np, u32 start)
+ {
+       u32 offset;
+       int err;
+       err = niu_pci_eeprom_read16_swp(np, start + 1);
+       if (err < 0)
+-              return;
++              return err;
+       offset = err + 3;
+@@ -8168,12 +8174,14 @@ static void niu_pci_vpd_fetch(struct niu
+               u32 end;
+               err = niu_pci_eeprom_read(np, here);
++              if (err < 0)
++                      return err;
+               if (err != 0x90)
+-                      return;
++                      return -EINVAL;
+               err = niu_pci_eeprom_read16_swp(np, here + 1);
+               if (err < 0)
+-                      return;
++                      return err;
+               here = start + offset + 3;
+               end = start + offset + err;
+@@ -8181,9 +8189,12 @@ static void niu_pci_vpd_fetch(struct niu
+               offset += err;
+               err = niu_pci_vpd_scan_props(np, here, end);
+-              if (err < 0 || err == 1)
+-                      return;
++              if (err < 0)
++                      return err;
++              if (err == 1)
++                      return -EINVAL;
+       }
++      return 0;
+ }
+ /* ESPC_PIO_EN_ENABLE must be set */
+@@ -9274,8 +9285,11 @@ static int niu_get_invariants(struct niu
+               offset = niu_pci_vpd_offset(np);
+               netif_printk(np, probe, KERN_DEBUG, np->dev,
+                            "%s() VPD offset [%08x]\n", __func__, offset);
+-              if (offset)
+-                      niu_pci_vpd_fetch(np, offset);
++              if (offset) {
++                      err = niu_pci_vpd_fetch(np, offset);
++                      if (err < 0)
++                              return err;
++              }
+               nw64(ESPC_PIO_EN, 0);
+               if (np->flags & NIU_FLAGS_VPD_VALID) {
diff --git a/queue-5.10/net-rtlwifi-properly-check-for-alloc_workqueue-failure.patch b/queue-5.10/net-rtlwifi-properly-check-for-alloc_workqueue-failure.patch
new file mode 100644 (file)
index 0000000..2dd4162
--- /dev/null
@@ -0,0 +1,69 @@
+From 30b0e0ee9d02b97b68705c46b41444786effc40c Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 3 May 2021 13:56:40 +0200
+Subject: net: rtlwifi: properly check for alloc_workqueue() failure
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 30b0e0ee9d02b97b68705c46b41444786effc40c upstream.
+
+If alloc_workqueue() fails, properly catch this and propagate the error
+to the calling functions, so that the devuce initialization will
+properly error out.
+
+Cc: Kalle Valo <kvalo@codeaurora.org>
+Cc: Bryan Brattlof <hello@bryanbrattlof.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210503115736.2104747-14-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/base.c |   15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtlwifi/base.c
++++ b/drivers/net/wireless/realtek/rtlwifi/base.c
+@@ -440,9 +440,14 @@ static void rtl_watchdog_wq_callback(str
+ static void rtl_fwevt_wq_callback(struct work_struct *work);
+ static void rtl_c2hcmd_wq_callback(struct work_struct *work);
+-static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
++static int _rtl_init_deferred_work(struct ieee80211_hw *hw)
+ {
+       struct rtl_priv *rtlpriv = rtl_priv(hw);
++      struct workqueue_struct *wq;
++
++      wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name);
++      if (!wq)
++              return -ENOMEM;
+       /* <1> timer */
+       timer_setup(&rtlpriv->works.watchdog_timer,
+@@ -451,7 +456,8 @@ static void _rtl_init_deferred_work(stru
+                   rtl_easy_concurrent_retrytimer_callback, 0);
+       /* <2> work queue */
+       rtlpriv->works.hw = hw;
+-      rtlpriv->works.rtl_wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name);
++      rtlpriv->works.rtl_wq = wq;
++
+       INIT_DELAYED_WORK(&rtlpriv->works.watchdog_wq,
+                         rtl_watchdog_wq_callback);
+       INIT_DELAYED_WORK(&rtlpriv->works.ips_nic_off_wq,
+@@ -461,6 +467,7 @@ static void _rtl_init_deferred_work(stru
+                         rtl_swlps_rfon_wq_callback);
+       INIT_DELAYED_WORK(&rtlpriv->works.fwevt_wq, rtl_fwevt_wq_callback);
+       INIT_DELAYED_WORK(&rtlpriv->works.c2hcmd_wq, rtl_c2hcmd_wq_callback);
++      return 0;
+ }
+ void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq)
+@@ -560,9 +567,7 @@ int rtl_init_core(struct ieee80211_hw *h
+       rtlmac->link_state = MAC80211_NOLINK;
+       /* <6> init deferred work */
+-      _rtl_init_deferred_work(hw);
+-
+-      return 0;
++      return _rtl_init_deferred_work(hw);
+ }
+ EXPORT_SYMBOL_GPL(rtl_init_core);
diff --git a/queue-5.10/net-stmicro-handle-clk_prepare-failure-during-init.patch b/queue-5.10/net-stmicro-handle-clk_prepare-failure-during-init.patch
new file mode 100644 (file)
index 0000000..8595b7f
--- /dev/null
@@ -0,0 +1,48 @@
+From 0c32a96d000f260b5ebfabb4145a86ae1cd71847 Mon Sep 17 00:00:00 2001
+From: Anirudh Rayabharam <mail@anirudhrb.com>
+Date: Mon, 3 May 2021 13:56:48 +0200
+Subject: net: stmicro: handle clk_prepare() failure during init
+
+From: Anirudh Rayabharam <mail@anirudhrb.com>
+
+commit 0c32a96d000f260b5ebfabb4145a86ae1cd71847 upstream.
+
+In case clk_prepare() fails, capture and propagate the error code up the
+stack. If regulator_enable() was called earlier, properly unwind it by
+calling regulator_disable().
+
+Signed-off-by: Anirudh Rayabharam <mail@anirudhrb.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210503115736.2104747-22-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c |    8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+@@ -30,7 +30,7 @@ struct sunxi_priv_data {
+ static int sun7i_gmac_init(struct platform_device *pdev, void *priv)
+ {
+       struct sunxi_priv_data *gmac = priv;
+-      int ret;
++      int ret = 0;
+       if (gmac->regulator) {
+               ret = regulator_enable(gmac->regulator);
+@@ -50,10 +50,12 @@ static int sun7i_gmac_init(struct platfo
+               gmac->clk_enabled = 1;
+       } else {
+               clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE);
+-              clk_prepare(gmac->tx_clk);
++              ret = clk_prepare(gmac->tx_clk);
++              if (ret && gmac->regulator)
++                      regulator_disable(gmac->regulator);
+       }
+-      return 0;
++      return ret;
+ }
+ static void sun7i_gmac_exit(struct platform_device *pdev, void *priv)
diff --git a/queue-5.10/revert-ecryptfs-replace-bug_on-with-error-handling-code.patch b/queue-5.10/revert-ecryptfs-replace-bug_on-with-error-handling-code.patch
new file mode 100644 (file)
index 0000000..8c97b14
--- /dev/null
@@ -0,0 +1,51 @@
+From e1436df2f2550bc89d832ffd456373fdf5d5b5d7 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 3 May 2021 13:57:15 +0200
+Subject: Revert "ecryptfs: replace BUG_ON with error handling code"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit e1436df2f2550bc89d832ffd456373fdf5d5b5d7 upstream.
+
+This reverts commit 2c2a7552dd6465e8fde6bc9cccf8d66ed1c1eb72.
+
+Because of recent interactions with developers from @umn.edu, all
+commits from them have been recently re-reviewed to ensure if they were
+correct or not.
+
+Upon review, this commit was found to be incorrect for the reasons
+below, so it must be reverted.  It will be fixed up "correctly" in a
+later kernel change.
+
+The original commit log for this change was incorrect, no "error
+handling code" was added, things will blow up just as badly as before if
+any of these cases ever were true.  As this BUG_ON() never fired, and
+most of these checks are "obviously" never going to be true, let's just
+revert to the original code for now until this gets unwound to be done
+correctly in the future.
+
+Cc: Aditya Pakki <pakki001@umn.edu>
+Fixes: 2c2a7552dd64 ("ecryptfs: replace BUG_ON with error handling code")
+Cc: stable <stable@vger.kernel.org>
+Acked-by: Tyler Hicks <code@tyhicks.com>
+Link: https://lore.kernel.org/r/20210503115736.2104747-49-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ecryptfs/crypto.c |    6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/fs/ecryptfs/crypto.c
++++ b/fs/ecryptfs/crypto.c
+@@ -296,10 +296,8 @@ static int crypt_scatterlist(struct ecry
+       struct extent_crypt_result ecr;
+       int rc = 0;
+-      if (!crypt_stat || !crypt_stat->tfm
+-             || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED))
+-              return -EINVAL;
+-
++      BUG_ON(!crypt_stat || !crypt_stat->tfm
++             || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED));
+       if (unlikely(ecryptfs_verbosity > 0)) {
+               ecryptfs_printk(KERN_DEBUG, "Key size [%zd]; key:\n",
+                               crypt_stat->key_size);
diff --git a/queue-5.10/revert-gdrom-fix-a-memory-leak-bug.patch b/queue-5.10/revert-gdrom-fix-a-memory-leak-bug.patch
new file mode 100644 (file)
index 0000000..2d91d9a
--- /dev/null
@@ -0,0 +1,46 @@
+From 257343d3ed557f11d580d0b7c515dc154f64a42b Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 3 May 2021 13:56:53 +0200
+Subject: Revert "gdrom: fix a memory leak bug"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 257343d3ed557f11d580d0b7c515dc154f64a42b upstream.
+
+This reverts commit 093c48213ee37c3c3ff1cf5ac1aa2a9d8bc66017.
+
+Because of recent interactions with developers from @umn.edu, all
+commits from them have been recently re-reviewed to ensure if they were
+correct or not.
+
+Upon review, this commit was found to be incorrect for the reasons
+below, so it must be reverted.  It will be fixed up "correctly" in a
+later kernel change.
+
+Because of this, all submissions from this group must be reverted from
+the kernel tree and will need to be re-reviewed again to determine if
+they actually are a valid fix.  Until that work is complete, remove this
+change to ensure that no problems are being introduced into the
+codebase.
+
+Cc: Wenwen Wang <wang6495@umn.edu>
+Cc: Peter Rosin <peda@axentia.se>
+Cc: Jens Axboe <axboe@kernel.dk>
+Fixes: 093c48213ee3 ("gdrom: fix a memory leak bug")
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210503115736.2104747-27-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/cdrom/gdrom.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/cdrom/gdrom.c
++++ b/drivers/cdrom/gdrom.c
+@@ -863,7 +863,6 @@ static void __exit exit_gdrom(void)
+       platform_device_unregister(pd);
+       platform_driver_unregister(&gdrom_driver);
+       kfree(gd.toc);
+-      kfree(gd.cd_info);
+ }
+ module_init(init_gdrom);
diff --git a/queue-5.10/revert-hwmon-lm80-fix-a-missing-check-of-bus-read-in-lm80-probe.patch b/queue-5.10/revert-hwmon-lm80-fix-a-missing-check-of-bus-read-in-lm80-probe.patch
new file mode 100644 (file)
index 0000000..0e32f9e
--- /dev/null
@@ -0,0 +1,58 @@
+From 99ae3417672a6d4a3bf68d4fc43d7c6ca074d477 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 3 May 2021 13:56:31 +0200
+Subject: Revert "hwmon: (lm80) fix a missing check of bus read in lm80 probe"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 99ae3417672a6d4a3bf68d4fc43d7c6ca074d477 upstream.
+
+This reverts commit 9aa3aa15f4c2f74f47afd6c5db4b420fadf3f315.
+
+Because of recent interactions with developers from @umn.edu, all
+commits from them have been recently re-reviewed to ensure if they were
+correct or not.
+
+Upon review, it was determined that this commit is not needed at all so
+just revert it.  Also, the call to lm80_init_client() was not properly
+handled, so if error handling is needed in the lm80_probe() function,
+then it should be done properly, not half-baked like the commit being
+reverted here did.
+
+Cc: Kangjie Lu <kjlu@umn.edu>
+Fixes: 9aa3aa15f4c2 ("hwmon: (lm80) fix a missing check of bus read in lm80 probe")
+Cc: stable <stable@vger.kernel.org>
+Acked-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20210503115736.2104747-5-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/lm80.c |   11 ++---------
+ 1 file changed, 2 insertions(+), 9 deletions(-)
+
+--- a/drivers/hwmon/lm80.c
++++ b/drivers/hwmon/lm80.c
+@@ -596,7 +596,6 @@ static int lm80_probe(struct i2c_client
+       struct device *dev = &client->dev;
+       struct device *hwmon_dev;
+       struct lm80_data *data;
+-      int rv;
+       data = devm_kzalloc(dev, sizeof(struct lm80_data), GFP_KERNEL);
+       if (!data)
+@@ -609,14 +608,8 @@ static int lm80_probe(struct i2c_client
+       lm80_init_client(client);
+       /* A few vars need to be filled upon startup */
+-      rv = lm80_read_value(client, LM80_REG_FAN_MIN(1));
+-      if (rv < 0)
+-              return rv;
+-      data->fan[f_min][0] = rv;
+-      rv = lm80_read_value(client, LM80_REG_FAN_MIN(2));
+-      if (rv < 0)
+-              return rv;
+-      data->fan[f_min][1] = rv;
++      data->fan[f_min][0] = lm80_read_value(client, LM80_REG_FAN_MIN(1));
++      data->fan[f_min][1] = lm80_read_value(client, LM80_REG_FAN_MIN(2));
+       hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name,
+                                                          data, lm80_groups);
diff --git a/queue-5.10/revert-leds-lp5523-fix-a-missing-check-of-return-value-of-lp55xx_read.patch b/queue-5.10/revert-leds-lp5523-fix-a-missing-check-of-return-value-of-lp55xx_read.patch
new file mode 100644 (file)
index 0000000..4a96e23
--- /dev/null
@@ -0,0 +1,45 @@
+From 8d1beda5f11953ffe135a5213287f0b25b4da41b Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 3 May 2021 13:56:35 +0200
+Subject: Revert "leds: lp5523: fix a missing check of return value of lp55xx_read"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 8d1beda5f11953ffe135a5213287f0b25b4da41b upstream.
+
+This reverts commit 248b57015f35c94d4eae2fdd8c6febf5cd703900.
+
+Because of recent interactions with developers from @umn.edu, all
+commits from them have been recently re-reviewed to ensure if they were
+correct or not.
+
+Upon review, this commit was found to be incorrect for the reasons
+below, so it must be reverted.  It will be fixed up "correctly" in a
+later kernel change.
+
+The original commit does not properly unwind if there is an error
+condition so it needs to be reverted at this point in time.
+
+Cc: Kangjie Lu <kjlu@umn.edu>
+Cc: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Fixes: 248b57015f35 ("leds: lp5523: fix a missing check of return value of lp55xx_read")
+Link: https://lore.kernel.org/r/20210503115736.2104747-9-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/leds/leds-lp5523.c |    4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/leds/leds-lp5523.c
++++ b/drivers/leds/leds-lp5523.c
+@@ -305,9 +305,7 @@ static int lp5523_init_program_engine(st
+       /* Let the programs run for couple of ms and check the engine status */
+       usleep_range(3000, 6000);
+-      ret = lp55xx_read(chip, LP5523_REG_STATUS, &status);
+-      if (ret)
+-              return ret;
++      lp55xx_read(chip, LP5523_REG_STATUS, &status);
+       status &= LP5523_ENG_STATUS_MASK;
+       if (status != LP5523_ENG_STATUS_MASK) {
diff --git a/queue-5.10/revert-media-rcar_drif-fix-a-memory-disclosure.patch b/queue-5.10/revert-media-rcar_drif-fix-a-memory-disclosure.patch
new file mode 100644 (file)
index 0000000..77367dd
--- /dev/null
@@ -0,0 +1,43 @@
+From 3e465fc3846734e9489273d889f19cc17b4cf4bd Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 3 May 2021 13:56:30 +0200
+Subject: Revert "media: rcar_drif: fix a memory disclosure"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 3e465fc3846734e9489273d889f19cc17b4cf4bd upstream.
+
+This reverts commit d39083234c60519724c6ed59509a2129fd2aed41.
+
+Because of recent interactions with developers from @umn.edu, all
+commits from them have been recently re-reviewed to ensure if they were
+correct or not.
+
+Upon review, it was determined that this commit is not needed at all as
+the media core already prevents memory disclosure on this codepath, so
+just drop the extra memset happening here.
+
+Cc: Kangjie Lu <kjlu@umn.edu>
+Cc: Geert Uytterhoeven <geert+renesas@glider.be>
+Cc: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Fixes: d39083234c60 ("media: rcar_drif: fix a memory disclosure")
+Cc: stable <stable@vger.kernel.org>
+Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Reviewed-by: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
+Link: https://lore.kernel.org/r/20210503115736.2104747-4-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/rcar_drif.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/media/platform/rcar_drif.c
++++ b/drivers/media/platform/rcar_drif.c
+@@ -915,7 +915,6 @@ static int rcar_drif_g_fmt_sdr_cap(struc
+ {
+       struct rcar_drif_sdr *sdr = video_drvdata(file);
+-      memset(f->fmt.sdr.reserved, 0, sizeof(f->fmt.sdr.reserved));
+       f->fmt.sdr.pixelformat = sdr->fmt->pixelformat;
+       f->fmt.sdr.buffersize = sdr->fmt->buffersize;
diff --git a/queue-5.10/revert-net-stmicro-fix-a-missing-check-of-clk_prepare.patch b/queue-5.10/revert-net-stmicro-fix-a-missing-check-of-clk_prepare.patch
new file mode 100644 (file)
index 0000000..d8fcabd
--- /dev/null
@@ -0,0 +1,46 @@
+From bee1b0511844c8c79fccf1f2b13472393b6b91f7 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 3 May 2021 13:56:47 +0200
+Subject: Revert "net: stmicro: fix a missing check of clk_prepare"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit bee1b0511844c8c79fccf1f2b13472393b6b91f7 upstream.
+
+This reverts commit f86a3b83833e7cfe558ca4d70b64ebc48903efec.
+
+Because of recent interactions with developers from @umn.edu, all
+commits from them have been recently re-reviewed to ensure if they were
+correct or not.
+
+Upon review, this commit was found to be incorrect for the reasons
+below, so it must be reverted.  It will be fixed up "correctly" in a
+later kernel change.
+
+The original commit causes a memory leak when it is trying to claim it
+is properly handling errors.  Revert this change and fix it up properly
+in a follow-on commit.
+
+Cc: Kangjie Lu <kjlu@umn.edu>
+Cc: David S. Miller <davem@davemloft.net>
+Fixes: f86a3b83833e ("net: stmicro: fix a missing check of clk_prepare")
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210503115736.2104747-21-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c |    4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+@@ -50,9 +50,7 @@ static int sun7i_gmac_init(struct platfo
+               gmac->clk_enabled = 1;
+       } else {
+               clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE);
+-              ret = clk_prepare(gmac->tx_clk);
+-              if (ret)
+-                      return ret;
++              clk_prepare(gmac->tx_clk);
+       }
+       return 0;
diff --git a/queue-5.10/revert-niu-fix-missing-checks-of-niu_pci_eeprom_read.patch b/queue-5.10/revert-niu-fix-missing-checks-of-niu_pci_eeprom_read.patch
new file mode 100644 (file)
index 0000000..dd8ea4b
--- /dev/null
@@ -0,0 +1,63 @@
+From 7930742d6a0ff091c85b92ef4e076432d8d8cb79 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 3 May 2021 13:56:49 +0200
+Subject: Revert "niu: fix missing checks of niu_pci_eeprom_read"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 7930742d6a0ff091c85b92ef4e076432d8d8cb79 upstream.
+
+This reverts commit 26fd962bde0b15e54234fe762d86bc0349df1de4.
+
+Because of recent interactions with developers from @umn.edu, all
+commits from them have been recently re-reviewed to ensure if they were
+correct or not.
+
+Upon review, this commit was found to be incorrect for the reasons
+below, so it must be reverted.  It will be fixed up "correctly" in a
+later kernel change.
+
+The change here was incorrect.  While it is nice to check if
+niu_pci_eeprom_read() succeeded or not when using the data, any error
+that might have happened was not propagated upwards properly, causing
+the kernel to assume that these reads were successful, which results in
+invalid data in the buffer that was to contain the successfully read
+data.
+
+Cc: Kangjie Lu <kjlu@umn.edu>
+Cc: Shannon Nelson <shannon.lee.nelson@gmail.com>
+Cc: David S. Miller <davem@davemloft.net>
+Fixes: 26fd962bde0b ("niu: fix missing checks of niu_pci_eeprom_read")
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210503115736.2104747-23-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/sun/niu.c |   10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/sun/niu.c
++++ b/drivers/net/ethernet/sun/niu.c
+@@ -8097,8 +8097,6 @@ static int niu_pci_vpd_scan_props(struct
+               start += 3;
+               prop_len = niu_pci_eeprom_read(np, start + 4);
+-              if (prop_len < 0)
+-                      return prop_len;
+               err = niu_pci_vpd_get_propname(np, start + 5, namebuf, 64);
+               if (err < 0)
+                       return err;
+@@ -8143,12 +8141,8 @@ static int niu_pci_vpd_scan_props(struct
+                       netif_printk(np, probe, KERN_DEBUG, np->dev,
+                                    "VPD_SCAN: Reading in property [%s] len[%d]\n",
+                                    namebuf, prop_len);
+-                      for (i = 0; i < prop_len; i++) {
+-                              err = niu_pci_eeprom_read(np, off + i);
+-                              if (err >= 0)
+-                                      *prop_buf = err;
+-                              ++prop_buf;
+-                      }
++                      for (i = 0; i < prop_len; i++)
++                              *prop_buf++ = niu_pci_eeprom_read(np, off + i);
+               }
+               start += len;
diff --git a/queue-5.10/revert-qlcnic-avoid-potential-null-pointer-dereference.patch b/queue-5.10/revert-qlcnic-avoid-potential-null-pointer-dereference.patch
new file mode 100644 (file)
index 0000000..2ba9de0
--- /dev/null
@@ -0,0 +1,44 @@
+From b95b57dfe7a142bf2446548eb7f49340fd73e78b Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 3 May 2021 13:56:51 +0200
+Subject: Revert "qlcnic: Avoid potential NULL pointer dereference"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit b95b57dfe7a142bf2446548eb7f49340fd73e78b upstream.
+
+This reverts commit 5bf7295fe34a5251b1d241b9736af4697b590670.
+
+Because of recent interactions with developers from @umn.edu, all
+commits from them have been recently re-reviewed to ensure if they were
+correct or not.
+
+Upon review, this commit was found to be incorrect for the reasons
+below, so it must be reverted.  It will be fixed up "correctly" in a
+later kernel change.
+
+This commit does not properly detect if an error happens because the
+logic after this loop will not detect that there was a failed
+allocation.
+
+Cc: Aditya Pakki <pakki001@umn.edu>
+Cc: David S. Miller <davem@davemloft.net>
+Fixes: 5bf7295fe34a ("qlcnic: Avoid potential NULL pointer dereference")
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210503115736.2104747-25-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c |    2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+@@ -1047,8 +1047,6 @@ int qlcnic_do_lb_test(struct qlcnic_adap
+       for (i = 0; i < QLCNIC_NUM_ILB_PKT; i++) {
+               skb = netdev_alloc_skb(adapter->netdev, QLCNIC_ILB_PKT_SIZE);
+-              if (!skb)
+-                      break;
+               qlcnic_create_loopback_buff(skb->data, adapter->mac_addr);
+               skb_put(skb, QLCNIC_ILB_PKT_SIZE);
+               adapter->ahw->diag_cnt = 0;
diff --git a/queue-5.10/revert-rtlwifi-fix-a-potential-null-pointer-dereference.patch b/queue-5.10/revert-rtlwifi-fix-a-potential-null-pointer-dereference.patch
new file mode 100644 (file)
index 0000000..bb4bf03
--- /dev/null
@@ -0,0 +1,51 @@
+From 68c5634c4a7278672a3bed00eb5646884257c413 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 3 May 2021 13:56:39 +0200
+Subject: Revert "rtlwifi: fix a potential NULL pointer dereference"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 68c5634c4a7278672a3bed00eb5646884257c413 upstream.
+
+This reverts commit 765976285a8c8db3f0eb7f033829a899d0c2786e.
+
+Because of recent interactions with developers from @umn.edu, all
+commits from them have been recently re-reviewed to ensure if they were
+correct or not.
+
+Upon review, this commit was found to be incorrect for the reasons
+below, so it must be reverted.  It will be fixed up "correctly" in a
+later kernel change.
+
+This commit is not correct, it should not have used unlikely() and is
+not propagating the error properly to the calling function, so it should
+be reverted at this point in time.  Also, if the check failed, the
+work queue was still assumed to be allocated, so further accesses would
+have continued to fail, meaning this patch does nothing to solve the
+root issues at all.
+
+Cc: Kangjie Lu <kjlu@umn.edu>
+Cc: Kalle Valo <kvalo@codeaurora.org>
+Cc: Bryan Brattlof <hello@bryanbrattlof.com>
+Fixes: 765976285a8c ("rtlwifi: fix a potential NULL pointer dereference")
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210503115736.2104747-13-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/base.c |    5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtlwifi/base.c
++++ b/drivers/net/wireless/realtek/rtlwifi/base.c
+@@ -452,11 +452,6 @@ static void _rtl_init_deferred_work(stru
+       /* <2> work queue */
+       rtlpriv->works.hw = hw;
+       rtlpriv->works.rtl_wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name);
+-      if (unlikely(!rtlpriv->works.rtl_wq)) {
+-              pr_err("Failed to allocate work queue\n");
+-              return;
+-      }
+-
+       INIT_DELAYED_WORK(&rtlpriv->works.watchdog_wq,
+                         rtl_watchdog_wq_callback);
+       INIT_DELAYED_WORK(&rtlpriv->works.ips_nic_off_wq,
diff --git a/queue-5.10/revert-scsi-ufs-fix-a-missing-check-of-devm_reset_control_get.patch b/queue-5.10/revert-scsi-ufs-fix-a-missing-check-of-devm_reset_control_get.patch
new file mode 100644 (file)
index 0000000..a986c95
--- /dev/null
@@ -0,0 +1,47 @@
+From 4d427b408c4c2ff1676966c72119a3a559f8e39b Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 3 May 2021 13:56:57 +0200
+Subject: Revert "scsi: ufs: fix a missing check of devm_reset_control_get"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 4d427b408c4c2ff1676966c72119a3a559f8e39b upstream.
+
+This reverts commit 63a06181d7ce169d09843645c50fea1901bc9f0a.
+
+Because of recent interactions with developers from @umn.edu, all
+commits from them have been recently re-reviewed to ensure if they were
+correct or not.
+
+Upon review, this commit was found to be incorrect for the reasons
+below, so it must be reverted.  It will be fixed up "correctly" in a
+later kernel change.
+
+The original commit is incorrect, it does not properly clean up on the
+error path, so I'll keep the revert and fix it up properly with a
+follow-on patch.
+
+Cc: Kangjie Lu <kjlu@umn.edu>
+Cc: Avri Altman <avri.altman@wdc.com>
+Cc: Martin K. Petersen <martin.petersen@oracle.com>
+Fixes: 63a06181d7ce ("scsi: ufs: fix a missing check of devm_reset_control_get")
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210503115736.2104747-31-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/ufs/ufs-hisi.c |    4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/scsi/ufs/ufs-hisi.c
++++ b/drivers/scsi/ufs/ufs-hisi.c
+@@ -479,10 +479,6 @@ static int ufs_hisi_init_common(struct u
+       ufshcd_set_variant(hba, host);
+       host->rst  = devm_reset_control_get(dev, "rst");
+-      if (IS_ERR(host->rst)) {
+-              dev_err(dev, "%s: failed to get reset control\n", __func__);
+-              return PTR_ERR(host->rst);
+-      }
+       ufs_hisi_set_pm_lvl(hba);
diff --git a/queue-5.10/revert-video-hgafb-fix-potential-null-pointer-dereference.patch b/queue-5.10/revert-video-hgafb-fix-potential-null-pointer-dereference.patch
new file mode 100644 (file)
index 0000000..990e55f
--- /dev/null
@@ -0,0 +1,49 @@
+From 58c0cc2d90f1e37c4eb63ae7f164c83830833f78 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 3 May 2021 13:57:05 +0200
+Subject: Revert "video: hgafb: fix potential NULL pointer dereference"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 58c0cc2d90f1e37c4eb63ae7f164c83830833f78 upstream.
+
+This reverts commit ec7f6aad57ad29e4e66cc2e18e1e1599ddb02542.
+
+Because of recent interactions with developers from @umn.edu, all
+commits from them have been recently re-reviewed to ensure if they were
+correct or not.
+
+Upon review, this commit was found to be incorrect for the reasons
+below, so it must be reverted.  It will be fixed up "correctly" in a
+later kernel change.
+
+This patch "looks" correct, but the driver keeps on running and will
+fail horribly right afterward if this error condition ever trips.
+
+So points for trying to resolve an issue, but a huge NEGATIVE value for
+providing a "fake" fix for the problem as nothing actually got resolved
+at all.  I'll go fix this up properly...
+
+Cc: Kangjie Lu <kjlu@umn.edu>
+Cc: Aditya Pakki <pakki001@umn.edu>
+Cc: Ferenc Bakonyi <fero@drama.obuda.kando.hu>
+Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Fixes: ec7f6aad57ad ("video: hgafb: fix potential NULL pointer dereference")
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210503115736.2104747-39-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/hgafb.c |    2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/video/fbdev/hgafb.c
++++ b/drivers/video/fbdev/hgafb.c
+@@ -285,8 +285,6 @@ static int hga_card_detect(void)
+       hga_vram_len  = 0x08000;
+       hga_vram = ioremap(0xb0000, hga_vram_len);
+-      if (!hga_vram)
+-              goto error;
+       if (request_region(0x3b0, 12, "hgafb"))
+               release_io_ports = 1;
diff --git a/queue-5.10/revert-video-imsttfb-fix-potential-null-pointer-dereferences.patch b/queue-5.10/revert-video-imsttfb-fix-potential-null-pointer-dereferences.patch
new file mode 100644 (file)
index 0000000..d23832a
--- /dev/null
@@ -0,0 +1,54 @@
+From ed04fe8a0e87d7b5ea17d47f4ac9ec962b24814a Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 3 May 2021 13:57:33 +0200
+Subject: Revert "video: imsttfb: fix potential NULL pointer dereferences"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit ed04fe8a0e87d7b5ea17d47f4ac9ec962b24814a upstream.
+
+This reverts commit 1d84353d205a953e2381044953b7fa31c8c9702d.
+
+Because of recent interactions with developers from @umn.edu, all
+commits from them have been recently re-reviewed to ensure if they were
+correct or not.
+
+Upon review, this commit was found to be incorrect for the reasons
+below, so it must be reverted.  It will be fixed up "correctly" in a
+later kernel change.
+
+The original commit here, while technically correct, did not fully
+handle all of the reported issues that the commit stated it was fixing,
+so revert it until it can be "fixed" fully.
+
+Note, ioremap() probably will never fail for old hardware like this, and
+if anyone actually used this hardware (a PowerMac era PCI display card),
+they would not be using fbdev anymore.
+
+Cc: Kangjie Lu <kjlu@umn.edu>
+Cc: Aditya Pakki <pakki001@umn.edu>
+Cc: Finn Thain <fthain@telegraphics.com.au>
+Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Fixes: 1d84353d205a ("video: imsttfb: fix potential NULL pointer dereferences")
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210503115736.2104747-67-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/imsttfb.c |    5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/video/fbdev/imsttfb.c
++++ b/drivers/video/fbdev/imsttfb.c
+@@ -1512,11 +1512,6 @@ static int imsttfb_probe(struct pci_dev
+       info->fix.smem_start = addr;
+       info->screen_base = (__u8 *)ioremap(addr, par->ramdac == IBM ?
+                                           0x400000 : 0x800000);
+-      if (!info->screen_base) {
+-              release_mem_region(addr, size);
+-              framebuffer_release(info);
+-              return -ENOMEM;
+-      }
+       info->fix.mmio_start = addr + 0x800000;
+       par->dc_regs = ioremap(addr + 0x800000, 0x1000);
+       par->cmap_regs_phys = addr + 0x840000;
diff --git a/queue-5.10/scsi-ufs-handle-cleanup-correctly-on-devm_reset_control_get-error.patch b/queue-5.10/scsi-ufs-handle-cleanup-correctly-on-devm_reset_control_get-error.patch
new file mode 100644 (file)
index 0000000..b68930d
--- /dev/null
@@ -0,0 +1,58 @@
+From 2f4a784f40f8d337d6590e2e93f46429052e15ac Mon Sep 17 00:00:00 2001
+From: Phillip Potter <phil@philpotter.co.uk>
+Date: Mon, 3 May 2021 13:56:58 +0200
+Subject: scsi: ufs: handle cleanup correctly on devm_reset_control_get error
+
+From: Phillip Potter <phil@philpotter.co.uk>
+
+commit 2f4a784f40f8d337d6590e2e93f46429052e15ac upstream.
+
+Move ufshcd_set_variant call in ufs_hisi_init_common to common error
+section at end of the function, and then jump to this from the error
+checking statements for both devm_reset_control_get and
+ufs_hisi_get_resource. This fixes the original commit (63a06181d7ce)
+which was reverted due to the University of Minnesota problems.
+
+Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Avri Altman <avri.altman@wdc.com>
+Cc: Martin K. Petersen <martin.petersen@oracle.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
+Link: https://lore.kernel.org/r/20210503115736.2104747-32-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/ufs/ufs-hisi.c |   17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/drivers/scsi/ufs/ufs-hisi.c
++++ b/drivers/scsi/ufs/ufs-hisi.c
+@@ -478,17 +478,24 @@ static int ufs_hisi_init_common(struct u
+       host->hba = hba;
+       ufshcd_set_variant(hba, host);
+-      host->rst  = devm_reset_control_get(dev, "rst");
++      host->rst = devm_reset_control_get(dev, "rst");
++      if (IS_ERR(host->rst)) {
++              dev_err(dev, "%s: failed to get reset control\n", __func__);
++              err = PTR_ERR(host->rst);
++              goto error;
++      }
+       ufs_hisi_set_pm_lvl(hba);
+       err = ufs_hisi_get_resource(host);
+-      if (err) {
+-              ufshcd_set_variant(hba, NULL);
+-              return err;
+-      }
++      if (err)
++              goto error;
+       return 0;
++
++error:
++      ufshcd_set_variant(hba, NULL);
++      return err;
+ }
+ static int ufs_hi3660_init(struct ufs_hba *hba)
index d3d3d2ffb16ffa21aae6cb439c314067a9f29ae4..f7f171e2cb9c1681b9022459088205a0688b875b 100644 (file)
@@ -70,3 +70,21 @@ ipc-mqueue-msg-sem-avoid-relying-on-a-stack-reference-past-its-expiry.patch
 dm-snapshot-fix-a-crash-when-an-origin-has-no-snapshots.patch
 dm-snapshot-fix-crash-with-transient-storage-and-zero-chunk-size.patch
 kcsan-fix-debugfs-initcall-return-type.patch
+revert-video-hgafb-fix-potential-null-pointer-dereference.patch
+revert-net-stmicro-fix-a-missing-check-of-clk_prepare.patch
+revert-leds-lp5523-fix-a-missing-check-of-return-value-of-lp55xx_read.patch
+revert-hwmon-lm80-fix-a-missing-check-of-bus-read-in-lm80-probe.patch
+revert-video-imsttfb-fix-potential-null-pointer-dereferences.patch
+revert-ecryptfs-replace-bug_on-with-error-handling-code.patch
+revert-scsi-ufs-fix-a-missing-check-of-devm_reset_control_get.patch
+revert-gdrom-fix-a-memory-leak-bug.patch
+cdrom-gdrom-deallocate-struct-gdrom_unit-fields-in-remove_gdrom.patch
+cdrom-gdrom-initialize-global-variable-at-init-time.patch
+revert-media-rcar_drif-fix-a-memory-disclosure.patch
+revert-rtlwifi-fix-a-potential-null-pointer-dereference.patch
+revert-qlcnic-avoid-potential-null-pointer-dereference.patch
+revert-niu-fix-missing-checks-of-niu_pci_eeprom_read.patch
+ethernet-sun-niu-fix-missing-checks-of-niu_pci_eeprom_read.patch
+net-stmicro-handle-clk_prepare-failure-during-init.patch
+scsi-ufs-handle-cleanup-correctly-on-devm_reset_control_get-error.patch
+net-rtlwifi-properly-check-for-alloc_workqueue-failure.patch