From 0b8a651b76c7b0c6c816ea93f48e672f6335b5a5 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 14 Nov 2021 15:35:40 +0100 Subject: [PATCH] 4.9-stable patches added patches: iio-dac-ad5446-fix-ad5622_write-return-value.patch usb-iowarrior-fix-control-message-timeouts.patch usb-serial-keyspan-fix-memleak-on-probe-errors.patch --- ...ad5446-fix-ad5622_write-return-value.patch | 47 +++++++++ queue-4.9/series | 3 + ...warrior-fix-control-message-timeouts.patch | 55 +++++++++++ ...-keyspan-fix-memleak-on-probe-errors.patch | 98 +++++++++++++++++++ 4 files changed, 203 insertions(+) create mode 100644 queue-4.9/iio-dac-ad5446-fix-ad5622_write-return-value.patch create mode 100644 queue-4.9/usb-iowarrior-fix-control-message-timeouts.patch create mode 100644 queue-4.9/usb-serial-keyspan-fix-memleak-on-probe-errors.patch diff --git a/queue-4.9/iio-dac-ad5446-fix-ad5622_write-return-value.patch b/queue-4.9/iio-dac-ad5446-fix-ad5622_write-return-value.patch new file mode 100644 index 00000000000..bb545322e47 --- /dev/null +++ b/queue-4.9/iio-dac-ad5446-fix-ad5622_write-return-value.patch @@ -0,0 +1,47 @@ +From 558df982d4ead9cac628153d0d7b60feae05ddc8 Mon Sep 17 00:00:00 2001 +From: Pekka Korpinen +Date: Wed, 29 Sep 2021 21:57:55 +0300 +Subject: iio: dac: ad5446: Fix ad5622_write() return value + +From: Pekka Korpinen + +commit 558df982d4ead9cac628153d0d7b60feae05ddc8 upstream. + +On success i2c_master_send() returns the number of bytes written. The +call from iio_write_channel_info(), however, expects the return value to +be zero on success. + +This bug causes incorrect consumption of the sysfs buffer in +iio_write_channel_info(). When writing more than two characters to +out_voltage0_raw, the ad5446 write handler is called multiple times +causing unexpected behavior. + +Fixes: 3ec36a2cf0d5 ("iio:ad5446: Add support for I2C based DACs") +Signed-off-by: Pekka Korpinen +Link: https://lore.kernel.org/r/20210929185755.2384-1-pekka.korpinen@iki.fi +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/dac/ad5446.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/iio/dac/ad5446.c ++++ b/drivers/iio/dac/ad5446.c +@@ -510,8 +510,15 @@ static int ad5622_write(struct ad5446_st + { + struct i2c_client *client = to_i2c_client(st->dev); + __be16 data = cpu_to_be16(val); ++ int ret; + +- return i2c_master_send(client, (char *)&data, sizeof(data)); ++ ret = i2c_master_send(client, (char *)&data, sizeof(data)); ++ if (ret < 0) ++ return ret; ++ if (ret != sizeof(data)) ++ return -EIO; ++ ++ return 0; + } + + /** diff --git a/queue-4.9/series b/queue-4.9/series index 1c3d6e869f8..c2fd9dd49c6 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -51,3 +51,6 @@ alsa-mixer-fix-deadlock-in-snd_mixer_oss_set_volume.patch pci-aardvark-read-all-16-bits-from-pcie_msi_payload_reg.patch quota-check-block-number-when-reading-the-block-in-quota-file.patch quota-correct-error-number-in-free_dqentry.patch +iio-dac-ad5446-fix-ad5622_write-return-value.patch +usb-serial-keyspan-fix-memleak-on-probe-errors.patch +usb-iowarrior-fix-control-message-timeouts.patch diff --git a/queue-4.9/usb-iowarrior-fix-control-message-timeouts.patch b/queue-4.9/usb-iowarrior-fix-control-message-timeouts.patch new file mode 100644 index 00000000000..053b13a540c --- /dev/null +++ b/queue-4.9/usb-iowarrior-fix-control-message-timeouts.patch @@ -0,0 +1,55 @@ +From 79a4479a17b83310deb0b1a2a274fe5be12d2318 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 25 Oct 2021 13:51:59 +0200 +Subject: USB: iowarrior: fix control-message timeouts + +From: Johan Hovold + +commit 79a4479a17b83310deb0b1a2a274fe5be12d2318 upstream. + +USB control-message timeouts are specified in milliseconds and should +specifically not vary with CONFIG_HZ. + +Use the common control-message timeout define for the five-second +timeout and drop the driver-specific one. + +Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.") +Cc: stable@vger.kernel.org # 2.6.21 +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20211025115159.4954-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/misc/iowarrior.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/drivers/usb/misc/iowarrior.c ++++ b/drivers/usb/misc/iowarrior.c +@@ -96,10 +96,6 @@ struct iowarrior { + /* globals */ + /*--------------*/ + +-/* +- * USB spec identifies 5 second timeouts. +- */ +-#define GET_TIMEOUT 5 + #define USB_REQ_GET_REPORT 0x01 + //#if 0 + static int usb_get_report(struct usb_device *dev, +@@ -111,7 +107,7 @@ static int usb_get_report(struct usb_dev + USB_DIR_IN | USB_TYPE_CLASS | + USB_RECIP_INTERFACE, (type << 8) + id, + inter->desc.bInterfaceNumber, buf, size, +- GET_TIMEOUT*HZ); ++ USB_CTRL_GET_TIMEOUT); + } + //#endif + +@@ -126,7 +122,7 @@ static int usb_set_report(struct usb_int + USB_TYPE_CLASS | USB_RECIP_INTERFACE, + (type << 8) + id, + intf->cur_altsetting->desc.bInterfaceNumber, buf, +- size, HZ); ++ size, 1000); + } + + /*---------------------*/ diff --git a/queue-4.9/usb-serial-keyspan-fix-memleak-on-probe-errors.patch b/queue-4.9/usb-serial-keyspan-fix-memleak-on-probe-errors.patch new file mode 100644 index 00000000000..38053e6c9de --- /dev/null +++ b/queue-4.9/usb-serial-keyspan-fix-memleak-on-probe-errors.patch @@ -0,0 +1,98 @@ +From 910c996335c37552ee30fcb837375b808bb4f33b Mon Sep 17 00:00:00 2001 +From: Wang Hai +Date: Fri, 15 Oct 2021 16:55:43 +0800 +Subject: USB: serial: keyspan: fix memleak on probe errors + +From: Wang Hai + +commit 910c996335c37552ee30fcb837375b808bb4f33b upstream. + +I got memory leak as follows when doing fault injection test: + +unreferenced object 0xffff888258228440 (size 64): + comm "kworker/7:2", pid 2005, jiffies 4294989509 (age 824.540s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [] slab_post_alloc_hook+0x9c/0x490 + [] kmem_cache_alloc_trace+0x1f7/0x470 + [] keyspan_port_probe+0xa4/0x5d0 [keyspan] + [] usb_serial_device_probe+0x97/0x1d0 [usbserial] + [] really_probe+0x167/0x460 + [] __driver_probe_device+0xf9/0x180 + [] driver_probe_device+0x53/0x130 + [] __device_attach_driver+0x105/0x130 + [] bus_for_each_drv+0x129/0x190 + [] __device_attach+0x1c9/0x270 + [] device_initial_probe+0x20/0x30 + [] bus_probe_device+0x142/0x160 + [] device_add+0x829/0x1300 + [] usb_serial_probe.cold+0xc9b/0x14ac [usbserial] + [] usb_probe_interface+0x1aa/0x3c0 [usbcore] + [] really_probe+0x167/0x460 + +If keyspan_port_probe() fails to allocate memory for an out_buffer[i] or +in_buffer[i], the previously allocated memory for out_buffer or +in_buffer needs to be freed on the error handling path, otherwise a +memory leak will result. + +Fixes: bad41a5bf177 ("USB: keyspan: fix port DMA-buffer allocations") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Link: https://lore.kernel.org/r/20211015085543.1203011-1-wanghai38@huawei.com +Cc: stable@vger.kernel.org # 3.12 +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/keyspan.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +--- a/drivers/usb/serial/keyspan.c ++++ b/drivers/usb/serial/keyspan.c +@@ -2419,22 +2419,22 @@ static int keyspan_port_probe(struct usb + for (i = 0; i < ARRAY_SIZE(p_priv->in_buffer); ++i) { + p_priv->in_buffer[i] = kzalloc(IN_BUFLEN, GFP_KERNEL); + if (!p_priv->in_buffer[i]) +- goto err_in_buffer; ++ goto err_free_in_buffer; + } + + for (i = 0; i < ARRAY_SIZE(p_priv->out_buffer); ++i) { + p_priv->out_buffer[i] = kzalloc(OUT_BUFLEN, GFP_KERNEL); + if (!p_priv->out_buffer[i]) +- goto err_out_buffer; ++ goto err_free_out_buffer; + } + + p_priv->inack_buffer = kzalloc(INACK_BUFLEN, GFP_KERNEL); + if (!p_priv->inack_buffer) +- goto err_inack_buffer; ++ goto err_free_out_buffer; + + p_priv->outcont_buffer = kzalloc(OUTCONT_BUFLEN, GFP_KERNEL); + if (!p_priv->outcont_buffer) +- goto err_outcont_buffer; ++ goto err_free_inack_buffer; + + p_priv->device_details = d_details; + +@@ -2480,15 +2480,14 @@ static int keyspan_port_probe(struct usb + + return 0; + +-err_outcont_buffer: ++err_free_inack_buffer: + kfree(p_priv->inack_buffer); +-err_inack_buffer: ++err_free_out_buffer: + for (i = 0; i < ARRAY_SIZE(p_priv->out_buffer); ++i) + kfree(p_priv->out_buffer[i]); +-err_out_buffer: ++err_free_in_buffer: + for (i = 0; i < ARRAY_SIZE(p_priv->in_buffer); ++i) + kfree(p_priv->in_buffer[i]); +-err_in_buffer: + kfree(p_priv); + + return -ENOMEM; -- 2.47.2