From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 7 Feb 2023 09:35:33 +0000 (+0100)
Subject: 5.10-stable patches
X-Git-Tag: v5.15.93~28
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b4cdf85ca106431213b5d598166725704a053e49;p=thirdparty%2Fkernel%2Fstable-queue.git

5.10-stable patches

added patches:
	nvmem-core-fix-cell-removal-on-error.patch
	nvmem-core-initialise-nvmem-id-early.patch
---

diff --git a/queue-5.10/nvmem-core-fix-cell-removal-on-error.patch b/queue-5.10/nvmem-core-fix-cell-removal-on-error.patch
new file mode 100644
index 00000000000..425c45ceee5
--- /dev/null
+++ b/queue-5.10/nvmem-core-fix-cell-removal-on-error.patch
@@ -0,0 +1,42 @@
+From db3546d58b5a0fa581d9c9f2bdc2856fa6c5e43e Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Fri, 27 Jan 2023 10:40:13 +0000
+Subject: nvmem: core: fix cell removal on error
+
+From: Michael Walle <michael@walle.cc>
+
+commit db3546d58b5a0fa581d9c9f2bdc2856fa6c5e43e upstream.
+
+nvmem_add_cells() could return an error after some cells are already
+added to the provider. In this case, the added cells are not removed.
+Remove any registered cells if nvmem_add_cells() fails.
+
+Fixes: fa72d847d68d7 ("nvmem: check the return value of nvmem_add_cells()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Michael Walle <michael@walle.cc>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230127104015.23839-9-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -695,7 +695,7 @@ struct nvmem_device *nvmem_register(cons
+ 	if (config->cells) {
+ 		rval = nvmem_add_cells(nvmem, config->cells, config->ncells);
+ 		if (rval)
+-			goto err_teardown_compat;
++			goto err_remove_cells;
+ 	}
+ 
+ 	rval = nvmem_add_cells_from_table(nvmem);
+@@ -712,7 +712,6 @@ struct nvmem_device *nvmem_register(cons
+ 
+ err_remove_cells:
+ 	nvmem_device_remove_all_cells(nvmem);
+-err_teardown_compat:
+ 	if (config->compat)
+ 		nvmem_sysfs_remove_compat(nvmem, config);
+ err_device_del:
diff --git a/queue-5.10/nvmem-core-initialise-nvmem-id-early.patch b/queue-5.10/nvmem-core-initialise-nvmem-id-early.patch
new file mode 100644
index 00000000000..99aeb69a7b5
--- /dev/null
+++ b/queue-5.10/nvmem-core-initialise-nvmem-id-early.patch
@@ -0,0 +1,43 @@
+From 3bd747c7ea13cb145f0d84444e00df928b0842d9 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Fri, 27 Jan 2023 10:40:08 +0000
+Subject: nvmem: core: initialise nvmem->id early
+
+From: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+
+commit 3bd747c7ea13cb145f0d84444e00df928b0842d9 upstream.
+
+The error path for wp_gpio attempts to free the IDA nvmem->id, but
+this has yet to be assigned, so will always be zero - leaking the
+ID allocated by ida_alloc(). Fix this by moving the initialisation
+of nvmem->id earlier.
+
+Fixes: f7d8d7dcd978 ("nvmem: fix memory leak in error path")
+Cc: stable@vger.kernel.org
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230127104015.23839-4-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvmem/core.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -625,6 +625,8 @@ struct nvmem_device *nvmem_register(cons
+ 		return ERR_PTR(rval);
+ 	}
+ 
++	nvmem->id = rval;
++
+ 	if (config->wp_gpio)
+ 		nvmem->wp_gpio = config->wp_gpio;
+ 	else
+@@ -640,7 +642,6 @@ struct nvmem_device *nvmem_register(cons
+ 	kref_init(&nvmem->refcnt);
+ 	INIT_LIST_HEAD(&nvmem->cells);
+ 
+-	nvmem->id = rval;
+ 	nvmem->owner = config->owner;
+ 	if (!nvmem->owner && config->dev->driver)
+ 		nvmem->owner = config->dev->driver->owner;
diff --git a/queue-5.10/series b/queue-5.10/series
index 69e5acf19dd..2efd2821dc7 100644
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -77,3 +77,5 @@ fpga-stratix10-soc-fix-return-value-check-in-s10_ops_write_init.patch
 mm-swapfile-add-cond_resched-in-get_swap_pages.patch
 squashfs-fix-handling-and-sanity-checking-of-xattr_ids-count.patch
 drm-i915-fix-potential-bit_17-double-free.patch
+nvmem-core-initialise-nvmem-id-early.patch
+nvmem-core-fix-cell-removal-on-error.patch