From: Greg Kroah-Hartman Date: Thu, 1 May 2014 00:21:03 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.4.89~45 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=89a987fcdf158d950422e03891d7d747bcc1a20a;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: mfd-88pm860x-fix-i2c-device-resource-leak-on-regmap-init-fail.patch mfd-88pm860x-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch mfd-max77686-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch mfd-max77693-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch mfd-max8925-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch mfd-max8997-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch mfd-max8998-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch mfd-sec-core-fix-possible-null-pointer-dereference-when-i2c_new_dummy-error.patch mfd-tps65910-fix-possible-invalid-pointer-dereference-on-regmap_add_irq_chip-fail.patch staging-serqt_usb2-fix-sparse-warning-restricted-__le16-degrades-to-integer.patch w1-fix-w1_send_slave-dropping-a-slave-id.patch --- diff --git a/queue-3.10/mfd-88pm860x-fix-i2c-device-resource-leak-on-regmap-init-fail.patch b/queue-3.10/mfd-88pm860x-fix-i2c-device-resource-leak-on-regmap-init-fail.patch new file mode 100644 index 00000000000..f3e5081ce89 --- /dev/null +++ b/queue-3.10/mfd-88pm860x-fix-i2c-device-resource-leak-on-regmap-init-fail.patch @@ -0,0 +1,32 @@ +From a7ab1c8b261305af583ce26bb4a14f555fdaa73e Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 11 Feb 2014 11:03:30 +0100 +Subject: mfd: 88pm860x: Fix I2C device resource leak on regmap init fail + +From: Krzysztof Kozlowski + +commit a7ab1c8b261305af583ce26bb4a14f555fdaa73e upstream. + +During probe the driver allocates dummy I2C device for companion chip +and then allocates a regmap for it. If regmap_init_i2c() fails then the +I2C driver (allocated with i2c_new_dummy()) is not freed and this +resource leaks. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/88pm860x-core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/mfd/88pm860x-core.c ++++ b/drivers/mfd/88pm860x-core.c +@@ -1190,6 +1190,7 @@ static int pm860x_probe(struct i2c_clien + ret = PTR_ERR(chip->regmap_companion); + dev_err(&chip->companion->dev, + "Failed to allocate register map: %d\n", ret); ++ i2c_unregister_device(chip->companion); + return ret; + } + i2c_set_clientdata(chip->companion, chip); diff --git a/queue-3.10/mfd-88pm860x-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch b/queue-3.10/mfd-88pm860x-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch new file mode 100644 index 00000000000..ff9e6ee57f7 --- /dev/null +++ b/queue-3.10/mfd-88pm860x-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch @@ -0,0 +1,41 @@ +From 159ce52a6b777fc82fa0b51c7440e25f9e4c6feb Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 11 Feb 2014 11:03:29 +0100 +Subject: mfd: 88pm860x: Fix possible NULL pointer dereference on i2c_new_dummy error + +From: Krzysztof Kozlowski + +commit 159ce52a6b777fc82fa0b51c7440e25f9e4c6feb upstream. + +During probe the driver allocates dummy I2C device for companion chip +with i2c_new_dummy() but it does not check the return value of this call. + +In case of error (i2c_new_device(): memory allocation failure or I2C +address cannot be used) this function returns NULL which is later used +by regmap_init_i2c(). + +If i2c_new_dummy() fails for companion device, fail also the probe for +main MFD driver. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/88pm860x-core.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/mfd/88pm860x-core.c ++++ b/drivers/mfd/88pm860x-core.c +@@ -1179,6 +1179,11 @@ static int pm860x_probe(struct i2c_clien + chip->companion_addr = pdata->companion_addr; + chip->companion = i2c_new_dummy(chip->client->adapter, + chip->companion_addr); ++ if (!chip->companion) { ++ dev_err(&client->dev, ++ "Failed to allocate I2C companion device\n"); ++ return -ENODEV; ++ } + chip->regmap_companion = regmap_init_i2c(chip->companion, + &pm860x_regmap_config); + if (IS_ERR(chip->regmap_companion)) { diff --git a/queue-3.10/mfd-max77686-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch b/queue-3.10/mfd-max77686-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch new file mode 100644 index 00000000000..b400d71bfd6 --- /dev/null +++ b/queue-3.10/mfd-max77686-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch @@ -0,0 +1,40 @@ +From b9e183a1d495cd65412abe0f9df19b151716bfe7 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 11 Feb 2014 11:03:31 +0100 +Subject: mfd: max77686: Fix possible NULL pointer dereference on i2c_new_dummy error + +From: Krzysztof Kozlowski + +commit b9e183a1d495cd65412abe0f9df19b151716bfe7 upstream. + +During probe the driver allocates dummy I2C device for RTC with +i2c_new_dummy() but it does not check the return value of this call. + +In case of error (i2c_new_device(): memory allocation failure or I2C +address cannot be used) this function returns NULL which is later used +by i2c_unregister_device(). + +If i2c_new_dummy() fails for RTC device, fail also the probe for main +MFD driver. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/max77686.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/mfd/max77686.c ++++ b/drivers/mfd/max77686.c +@@ -121,6 +121,10 @@ static int max77686_i2c_probe(struct i2c + dev_info(max77686->dev, "device found\n"); + + max77686->rtc = i2c_new_dummy(i2c->adapter, I2C_ADDR_RTC); ++ if (!max77686->rtc) { ++ dev_err(max77686->dev, "Failed to allocate I2C device for RTC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(max77686->rtc, max77686); + + max77686_irq_init(max77686); diff --git a/queue-3.10/mfd-max77693-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch b/queue-3.10/mfd-max77693-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch new file mode 100644 index 00000000000..3d184227209 --- /dev/null +++ b/queue-3.10/mfd-max77693-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch @@ -0,0 +1,60 @@ +From ad09dd6a1f5d6244bd89314015af506ba7f9810a Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 11 Feb 2014 11:03:32 +0100 +Subject: mfd: max77693: Fix possible NULL pointer dereference on i2c_new_dummy error + +From: Krzysztof Kozlowski + +commit ad09dd6a1f5d6244bd89314015af506ba7f9810a upstream. + +During probe the driver allocates dummy I2C devices for MUIC and haptic +with i2c_new_dummy() but it does not check the return value of this +calls. + +In case of error (i2c_new_device(): memory allocation failure or I2C +address cannot be used) this function returns NULL which is later used +by devm_regmap_init_i2c() and i2c_unregister_device(). + +If i2c_new_dummy() fails for MUIC or haptic devices, fail also the probe +for main MFD driver. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/max77693.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/mfd/max77693.c ++++ b/drivers/mfd/max77693.c +@@ -149,9 +149,18 @@ static int max77693_i2c_probe(struct i2c + dev_info(max77693->dev, "device ID: 0x%x\n", reg_data); + + max77693->muic = i2c_new_dummy(i2c->adapter, I2C_ADDR_MUIC); ++ if (!max77693->muic) { ++ dev_err(max77693->dev, "Failed to allocate I2C device for MUIC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(max77693->muic, max77693); + + max77693->haptic = i2c_new_dummy(i2c->adapter, I2C_ADDR_HAPTIC); ++ if (!max77693->haptic) { ++ dev_err(max77693->dev, "Failed to allocate I2C device for Haptic\n"); ++ ret = -ENODEV; ++ goto err_i2c_haptic; ++ } + i2c_set_clientdata(max77693->haptic, max77693); + + /* +@@ -187,8 +196,9 @@ err_mfd: + max77693_irq_exit(max77693); + err_irq: + err_regmap_muic: +- i2c_unregister_device(max77693->muic); + i2c_unregister_device(max77693->haptic); ++err_i2c_haptic: ++ i2c_unregister_device(max77693->muic); + return ret; + } + diff --git a/queue-3.10/mfd-max8925-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch b/queue-3.10/mfd-max8925-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch new file mode 100644 index 00000000000..b32a5e8ce6b --- /dev/null +++ b/queue-3.10/mfd-max8925-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch @@ -0,0 +1,49 @@ +From 96cf3dedc491d2f1f66cc26217f2b06b0c7b6797 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 11 Feb 2014 11:03:33 +0100 +Subject: mfd: max8925: Fix possible NULL pointer dereference on i2c_new_dummy error + +From: Krzysztof Kozlowski + +commit 96cf3dedc491d2f1f66cc26217f2b06b0c7b6797 upstream. + +During probe the driver allocates dummy I2C devices for RTC and ADC +with i2c_new_dummy() but it does not check the return value of this +calls. + +In case of error (i2c_new_device(): memory allocation failure or I2C +address cannot be used) this function returns NULL which is later used +by i2c_unregister_device(). + +If i2c_new_dummy() fails for RTC or ADC devices, fail also the probe +for main MFD driver. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/max8925-i2c.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/mfd/max8925-i2c.c ++++ b/drivers/mfd/max8925-i2c.c +@@ -180,9 +180,18 @@ static int max8925_probe(struct i2c_clie + mutex_init(&chip->io_lock); + + chip->rtc = i2c_new_dummy(chip->i2c->adapter, RTC_I2C_ADDR); ++ if (!chip->rtc) { ++ dev_err(chip->dev, "Failed to allocate I2C device for RTC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(chip->rtc, chip); + + chip->adc = i2c_new_dummy(chip->i2c->adapter, ADC_I2C_ADDR); ++ if (!chip->adc) { ++ dev_err(chip->dev, "Failed to allocate I2C device for ADC\n"); ++ i2c_unregister_device(chip->rtc); ++ return -ENODEV; ++ } + i2c_set_clientdata(chip->adc, chip); + + device_init_wakeup(&client->dev, 1); diff --git a/queue-3.10/mfd-max8997-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch b/queue-3.10/mfd-max8997-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch new file mode 100644 index 00000000000..cdc7c172b10 --- /dev/null +++ b/queue-3.10/mfd-max8997-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch @@ -0,0 +1,67 @@ +From 97dc4ed3fa377ec91bb60ba98b70d645c2099384 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 11 Feb 2014 11:03:34 +0100 +Subject: mfd: max8997: Fix possible NULL pointer dereference on i2c_new_dummy error + +From: Krzysztof Kozlowski + +commit 97dc4ed3fa377ec91bb60ba98b70d645c2099384 upstream. + +During probe the driver allocates dummy I2C devices for RTC, haptic and +MUIC with i2c_new_dummy() but it does not check the return value of this +calls. + +In case of error (i2c_new_device(): memory allocation failure or I2C +address cannot be used) this function returns NULL which is later used +by i2c_unregister_device(). + +If i2c_new_dummy() fails for RTC, haptic or MUIC devices, fail also the +probe for main MFD driver. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/max8997.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +--- a/drivers/mfd/max8997.c ++++ b/drivers/mfd/max8997.c +@@ -218,10 +218,26 @@ static int max8997_i2c_probe(struct i2c_ + mutex_init(&max8997->iolock); + + max8997->rtc = i2c_new_dummy(i2c->adapter, I2C_ADDR_RTC); ++ if (!max8997->rtc) { ++ dev_err(max8997->dev, "Failed to allocate I2C device for RTC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(max8997->rtc, max8997); ++ + max8997->haptic = i2c_new_dummy(i2c->adapter, I2C_ADDR_HAPTIC); ++ if (!max8997->haptic) { ++ dev_err(max8997->dev, "Failed to allocate I2C device for Haptic\n"); ++ ret = -ENODEV; ++ goto err_i2c_haptic; ++ } + i2c_set_clientdata(max8997->haptic, max8997); ++ + max8997->muic = i2c_new_dummy(i2c->adapter, I2C_ADDR_MUIC); ++ if (!max8997->muic) { ++ dev_err(max8997->dev, "Failed to allocate I2C device for MUIC\n"); ++ ret = -ENODEV; ++ goto err_i2c_muic; ++ } + i2c_set_clientdata(max8997->muic, max8997); + + pm_runtime_set_active(max8997->dev); +@@ -248,7 +264,9 @@ static int max8997_i2c_probe(struct i2c_ + err_mfd: + mfd_remove_devices(max8997->dev); + i2c_unregister_device(max8997->muic); ++err_i2c_muic: + i2c_unregister_device(max8997->haptic); ++err_i2c_haptic: + i2c_unregister_device(max8997->rtc); + err: + kfree(max8997); diff --git a/queue-3.10/mfd-max8998-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch b/queue-3.10/mfd-max8998-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch new file mode 100644 index 00000000000..e03cca2c357 --- /dev/null +++ b/queue-3.10/mfd-max8998-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch @@ -0,0 +1,39 @@ +From ed26f87b9f71693a1d1ee85f5e6209601505080f Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 11 Feb 2014 11:03:35 +0100 +Subject: mfd: max8998: Fix possible NULL pointer dereference on i2c_new_dummy error + +From: Krzysztof Kozlowski + +commit ed26f87b9f71693a1d1ee85f5e6209601505080f upstream. + +During probe the driver allocates dummy I2C device for RTC with i2c_new_dummy() but it does not check the return value of this call. + +In case of error (i2c_new_device(): memory allocation failure or I2C +address cannot be used) this function returns NULL which is later used +by i2c_unregister_device(). + +If i2c_new_dummy() fails for RTC device, fail also the probe for +main MFD driver. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/max8998.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/mfd/max8998.c ++++ b/drivers/mfd/max8998.c +@@ -152,6 +152,10 @@ static int max8998_i2c_probe(struct i2c_ + mutex_init(&max8998->iolock); + + max8998->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR); ++ if (!max8998->rtc) { ++ dev_err(&i2c->dev, "Failed to allocate I2C device for RTC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(max8998->rtc, max8998); + + max8998_irq_init(max8998); diff --git a/queue-3.10/mfd-sec-core-fix-possible-null-pointer-dereference-when-i2c_new_dummy-error.patch b/queue-3.10/mfd-sec-core-fix-possible-null-pointer-dereference-when-i2c_new_dummy-error.patch new file mode 100644 index 00000000000..821d8e7b082 --- /dev/null +++ b/queue-3.10/mfd-sec-core-fix-possible-null-pointer-dereference-when-i2c_new_dummy-error.patch @@ -0,0 +1,39 @@ +From 65aba1e04916d72b30c028730a1e31860c225412 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 11 Feb 2014 10:12:25 +0100 +Subject: mfd: sec-core: Fix possible NULL pointer dereference when i2c_new_dummy error + +From: Krzysztof Kozlowski + +commit 65aba1e04916d72b30c028730a1e31860c225412 upstream. + +During probe the sec-core driver allocates dummy I2C device for RTC with +i2c_new_dummy() but return value is not checked. In case of error +(i2c_new_device(): memory allocation failure or I2C address cannot be +used) this function returns NULL which is later used by +devm_regmap_init_i2c() or i2c_unregister_device(). + +If i2c_new_dummy() fails for RTC device, fail also the probe for main +MFD driver. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/sec-core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/mfd/sec-core.c ++++ b/drivers/mfd/sec-core.c +@@ -199,6 +199,10 @@ static int sec_pmic_probe(struct i2c_cli + } + + sec_pmic->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR); ++ if (!sec_pmic->rtc) { ++ dev_err(&i2c->dev, "Failed to allocate I2C for RTC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(sec_pmic->rtc, sec_pmic); + + if (pdata && pdata->cfg_pmic_irq) diff --git a/queue-3.10/mfd-tps65910-fix-possible-invalid-pointer-dereference-on-regmap_add_irq_chip-fail.patch b/queue-3.10/mfd-tps65910-fix-possible-invalid-pointer-dereference-on-regmap_add_irq_chip-fail.patch new file mode 100644 index 00000000000..aa7dad7267a --- /dev/null +++ b/queue-3.10/mfd-tps65910-fix-possible-invalid-pointer-dereference-on-regmap_add_irq_chip-fail.patch @@ -0,0 +1,44 @@ +From 483e2dfdbc94751430e41db9973985f5b054d322 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 12 Mar 2014 16:50:44 +0100 +Subject: mfd: tps65910: Fix possible invalid pointer dereference on regmap_add_irq_chip fail + +From: Krzysztof Kozlowski + +commit 483e2dfdbc94751430e41db9973985f5b054d322 upstream. + +Fixes: 4aab3fadad32 ("mfd: tps65910: Move interrupt implementation code to mfd file") + +tps65910_irq_init() sets 'tps65910->chip_irq' before calling +regmap_add_irq_chip(). If the regmap_add_irq_chip() call fails in +memory allocation of regmap_irq_chip_data members then: + +1. The 'tps65910->chip_irq' will still hold some value +2. 'tps65910->irq_data' will be pointing to already freed memory + (because regmap_add_irq_chip() will free it on error) + +This results in invalid memory access during driver remove because the +tps65910_irq_exit() tests whether 'tps65910->chip_irq' is not zero. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/tps65910.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/mfd/tps65910.c ++++ b/drivers/mfd/tps65910.c +@@ -254,8 +254,10 @@ static int tps65910_irq_init(struct tps6 + ret = regmap_add_irq_chip(tps65910->regmap, tps65910->chip_irq, + IRQF_ONESHOT, pdata->irq_base, + tps6591x_irqs_chip, &tps65910->irq_data); +- if (ret < 0) ++ if (ret < 0) { + dev_warn(tps65910->dev, "Failed to add irq_chip %d\n", ret); ++ tps65910->chip_irq = 0; ++ } + return ret; + } + diff --git a/queue-3.10/series b/queue-3.10/series index c1e36ef0c36..ae2702216a8 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -20,3 +20,14 @@ alsa-hda-fix-silent-speaker-output-due-to-mute-led-fixup.patch alsa-hda-realtek-add-support-of-alc288-codec.patch s390-cio-fix-driver-callback-initialization-for-ccw-consoles.patch mei-me-do-not-load-the-driver-if-the-fw-doesn-t-support-mei-interface.patch +mfd-sec-core-fix-possible-null-pointer-dereference-when-i2c_new_dummy-error.patch +mfd-88pm860x-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch +mfd-88pm860x-fix-i2c-device-resource-leak-on-regmap-init-fail.patch +mfd-max77686-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch +mfd-max77693-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch +mfd-max8925-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch +mfd-max8998-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch +mfd-max8997-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch +mfd-tps65910-fix-possible-invalid-pointer-dereference-on-regmap_add_irq_chip-fail.patch +w1-fix-w1_send_slave-dropping-a-slave-id.patch +staging-serqt_usb2-fix-sparse-warning-restricted-__le16-degrades-to-integer.patch diff --git a/queue-3.10/staging-serqt_usb2-fix-sparse-warning-restricted-__le16-degrades-to-integer.patch b/queue-3.10/staging-serqt_usb2-fix-sparse-warning-restricted-__le16-degrades-to-integer.patch new file mode 100644 index 00000000000..dc208b535fb --- /dev/null +++ b/queue-3.10/staging-serqt_usb2-fix-sparse-warning-restricted-__le16-degrades-to-integer.patch @@ -0,0 +1,30 @@ +From abe5d64d1a74195a44cd14624f8178b9f48b7cc7 Mon Sep 17 00:00:00 2001 +From: Himangi Saraogi +Date: Wed, 5 Mar 2014 04:59:57 +0530 +Subject: staging:serqt_usb2: Fix sparse warning restricted __le16 degrades to integer + +From: Himangi Saraogi + +commit abe5d64d1a74195a44cd14624f8178b9f48b7cc7 upstream. + +This patch fixes the following sparse warning : +drivers/staging/serqt_usb2/serqt_usb2.c:727:40: warning: restricted __le16 degrades to integer + +Signed-off-by: Himangi Saraogi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/serqt_usb2/serqt_usb2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/serqt_usb2/serqt_usb2.c ++++ b/drivers/staging/serqt_usb2/serqt_usb2.c +@@ -725,7 +725,7 @@ static int qt_startup(struct usb_serial + goto startup_error; + } + +- switch (serial->dev->descriptor.idProduct) { ++ switch (le16_to_cpu(serial->dev->descriptor.idProduct)) { + case QUATECH_DSU100: + case QUATECH_QSU100: + case QUATECH_ESU100A: diff --git a/queue-3.10/w1-fix-w1_send_slave-dropping-a-slave-id.patch b/queue-3.10/w1-fix-w1_send_slave-dropping-a-slave-id.patch new file mode 100644 index 00000000000..8bfb5351839 --- /dev/null +++ b/queue-3.10/w1-fix-w1_send_slave-dropping-a-slave-id.patch @@ -0,0 +1,77 @@ +From 6b355b33a64fd6d8ead2b838ec16fb9b551f71e8 Mon Sep 17 00:00:00 2001 +From: David Fries +Date: Wed, 15 Jan 2014 22:29:12 -0600 +Subject: w1: fix w1_send_slave dropping a slave id + +From: David Fries + +commit 6b355b33a64fd6d8ead2b838ec16fb9b551f71e8 upstream. + +Previous logic, +if (avail > 8) { + store slave; + return; +} +send data; clear; + +The logic error is, if there isn't space send the buffer and clear, +but the slave wasn't added to the now empty buffer loosing that slave +id. It also should have been "if (avail >= 8)" because when it is 8, +there is space. + +Instead, if there isn't space send and clear the buffer, then there is +always space for the slave id. + +Signed-off-by: David Fries +Acked-by: Evgeniy Polyakov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/w1/w1_netlink.c | 27 ++++++++++++++------------- + 1 file changed, 14 insertions(+), 13 deletions(-) + +--- a/drivers/w1/w1_netlink.c ++++ b/drivers/w1/w1_netlink.c +@@ -54,28 +54,29 @@ static void w1_send_slave(struct w1_mast + struct w1_netlink_msg *hdr = (struct w1_netlink_msg *)(msg + 1); + struct w1_netlink_cmd *cmd = (struct w1_netlink_cmd *)(hdr + 1); + int avail; ++ u64 *data; + + /* update kernel slave list */ + w1_slave_found(dev, rn); + + avail = dev->priv_size - cmd->len; + +- if (avail > 8) { +- u64 *data = (void *)(cmd + 1) + cmd->len; +- +- *data = rn; +- cmd->len += 8; +- hdr->len += 8; +- msg->len += 8; +- return; ++ if (avail < 8) { ++ msg->ack++; ++ cn_netlink_send(msg, 0, GFP_KERNEL); ++ ++ msg->len = sizeof(struct w1_netlink_msg) + ++ sizeof(struct w1_netlink_cmd); ++ hdr->len = sizeof(struct w1_netlink_cmd); ++ cmd->len = 0; + } + +- msg->ack++; +- cn_netlink_send(msg, 0, GFP_KERNEL); ++ data = (void *)(cmd + 1) + cmd->len; + +- msg->len = sizeof(struct w1_netlink_msg) + sizeof(struct w1_netlink_cmd); +- hdr->len = sizeof(struct w1_netlink_cmd); +- cmd->len = 0; ++ *data = rn; ++ cmd->len += 8; ++ hdr->len += 8; ++ msg->len += 8; + } + + static int w1_process_search_command(struct w1_master *dev, struct cn_msg *msg,