5.15-stable patches

added patches:
	comedi-dmm32at-serialize-use-of-paged-registers.patch
	w1-fix-redundant-counter-decrement-in-w1_attach_slave_device.patch

diff --git a/queue-5.15/comedi-dmm32at-serialize-use-of-paged-registers.patch b/queue-5.15/comedi-dmm32at-serialize-use-of-paged-registers.patch
new file mode 100644 (file)
index 0000000..e5c1bc1
--- /dev/null
+++ b/queue-5.15/comedi-dmm32at-serialize-use-of-paged-registers.patch
@@ -0,0 +1,127 @@
+From e03b29b55f2b7c345a919a6ee36633b06bf3fb56 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Mon, 12 Jan 2026 16:28:35 +0000
+Subject: comedi: dmm32at: serialize use of paged registers
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit e03b29b55f2b7c345a919a6ee36633b06bf3fb56 upstream.
+
+Some of the hardware registers of the DMM-32-AT board are multiplexed,
+using the least significant two bits of the Miscellaneous Control
+register to select the function of registers at offsets 12 to 15:
+
+ 00 => 8254 timer/counter registers are accessible
+ 01 => 8255 digital I/O registers are accessible
+ 10 => Reserved
+ 11 => Calibration registers are accessible
+
+The interrupt service routine (`dmm32at_isr()`) clobbers the bottom two
+bits of the register with value 00, which would interfere with access to
+the 8255 registers by the `dm32at_8255_io()` function (used for Comedi
+instruction handling on the digital I/O subdevice).
+
+Make use of the generic Comedi device spin-lock `dev->spinlock` (which
+is otherwise unused by this driver) to serialize access to the
+miscellaneous control register and paged registers.
+
+Fixes: 3c501880ac44 ("Staging: comedi: add dmm32at driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Link: https://patch.msgid.link/20260112162835.91688-1-abbotti@mev.co.uk
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/comedi/drivers/dmm32at.c |   32 ++++++++++++++++++++++++++++++--
+ 1 file changed, 30 insertions(+), 2 deletions(-)
+
+--- a/drivers/comedi/drivers/dmm32at.c
++++ b/drivers/comedi/drivers/dmm32at.c
+@@ -331,6 +331,7 @@ static int dmm32at_ai_cmdtest(struct com
+ 
+ static void dmm32at_setaitimer(struct comedi_device *dev, unsigned int nansec)
+ {
++      unsigned long irq_flags;
+       unsigned char lo1, lo2, hi2;
+       unsigned short both2;
+ 
+@@ -343,6 +344,9 @@ static void dmm32at_setaitimer(struct co
+       /* set counter clocks to 10MHz, disable all aux dio */
+       outb(0, dev->iobase + DMM32AT_CTRDIO_CFG_REG);
+ 
++      /* serialize access to control register and paged registers */
++      spin_lock_irqsave(&dev->spinlock, irq_flags);
++
+       /* get access to the clock regs */
+       outb(DMM32AT_CTRL_PAGE_8254, dev->iobase + DMM32AT_CTRL_REG);
+ 
+@@ -355,6 +359,8 @@ static void dmm32at_setaitimer(struct co
+       outb(lo2, dev->iobase + DMM32AT_CLK2);
+       outb(hi2, dev->iobase + DMM32AT_CLK2);
+ 
++      spin_unlock_irqrestore(&dev->spinlock, irq_flags);
++
+       /* enable the ai conversion interrupt and the clock to start scans */
+       outb(DMM32AT_INTCLK_ADINT |
+            DMM32AT_INTCLK_CLKEN | DMM32AT_INTCLK_CLKSEL,
+@@ -364,13 +370,19 @@ static void dmm32at_setaitimer(struct co
+ static int dmm32at_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
+ {
+       struct comedi_cmd *cmd = &s->async->cmd;
++      unsigned long irq_flags;
+       int ret;
+ 
+       dmm32at_ai_set_chanspec(dev, s, cmd->chanlist[0], cmd->chanlist_len);
+ 
++      /* serialize access to control register and paged registers */
++      spin_lock_irqsave(&dev->spinlock, irq_flags);
++
+       /* reset the interrupt just in case */
+       outb(DMM32AT_CTRL_INTRST, dev->iobase + DMM32AT_CTRL_REG);
+ 
++      spin_unlock_irqrestore(&dev->spinlock, irq_flags);
++
+       /*
+        * wait for circuit to settle
+        * we don't have the 'insn' here but it's not needed
+@@ -430,8 +442,13 @@ static irqreturn_t dmm32at_isr(int irq,
+               comedi_handle_events(dev, s);
+       }
+ 
++      /* serialize access to control register and paged registers */
++      spin_lock(&dev->spinlock);
++
+       /* reset the interrupt */
+       outb(DMM32AT_CTRL_INTRST, dev->iobase + DMM32AT_CTRL_REG);
++
++      spin_unlock(&dev->spinlock);
+       return IRQ_HANDLED;
+ }
+ 
+@@ -482,14 +499,25 @@ static int dmm32at_ao_insn_write(struct
+ static int dmm32at_8255_io(struct comedi_device *dev,
+                          int dir, int port, int data, unsigned long regbase)
+ {
++      unsigned long irq_flags;
++      int ret;
++
++      /* serialize access to control register and paged registers */
++      spin_lock_irqsave(&dev->spinlock, irq_flags);
++
+       /* get access to the DIO regs */
+       outb(DMM32AT_CTRL_PAGE_8255, dev->iobase + DMM32AT_CTRL_REG);
+ 
+       if (dir) {
+               outb(data, dev->iobase + regbase + port);
+-              return 0;
++              ret = 0;
++      } else {
++              ret = inb(dev->iobase + regbase + port);
+       }
+-      return inb(dev->iobase + regbase + port);
++
++      spin_unlock_irqrestore(&dev->spinlock, irq_flags);
++
++      return ret;
+ }
+ 
+ /* Make sure the board is there and put it to a known state */

diff --git a/queue-5.15/series b/queue-5.15/series
index 22719ddd6cfaf8ccd08cb49fd735a6630b3ac329..413612c63229985b3b2f1770be9f0b23cd3b585a 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -79,3 +79,5 @@ ipvlan-make-the-addrs_lock-be-per-port.patch
 net-sched-enforce-that-teql-can-only-be-used-as-root.patch
 net-sched-qfq-use-cl_is_active-to-determine-whether-.patch
 crypto-authencesn-reject-too-short-aad-assoclen-8-to.patch
+comedi-dmm32at-serialize-use-of-paged-registers.patch
+w1-fix-redundant-counter-decrement-in-w1_attach_slave_device.patch

diff --git a/queue-5.15/w1-fix-redundant-counter-decrement-in-w1_attach_slave_device.patch b/queue-5.15/w1-fix-redundant-counter-decrement-in-w1_attach_slave_device.patch
new file mode 100644 (file)
index 0000000..484efc2
--- /dev/null
+++ b/queue-5.15/w1-fix-redundant-counter-decrement-in-w1_attach_slave_device.patch
@@ -0,0 +1,36 @@
+From cc8f92e41eb76f450f05234fef2054afc3633100 Mon Sep 17 00:00:00 2001
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Date: Thu, 18 Dec 2025 19:14:14 +0800
+Subject: w1: fix redundant counter decrement in w1_attach_slave_device()
+
+From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+
+commit cc8f92e41eb76f450f05234fef2054afc3633100 upstream.
+
+In w1_attach_slave_device(), if __w1_attach_slave_device() fails,
+put_device() -> w1_slave_release() is called to do the cleanup job.
+In w1_slave_release(), sl->family->refcnt and sl->master->slave_count
+have already been decremented. There is no need to decrement twice
+in w1_attach_slave_device().
+
+Fixes: 2c927c0c73fd ("w1: Fix slave count on 1-Wire bus (resend)")
+Cc: stable@vger.kernel.org
+Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
+Link: https://patch.msgid.link/20251218111414.564403-1-lihaoxiang@isrc.iscas.ac.cn
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/w1/w1.c |    2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/w1/w1.c
++++ b/drivers/w1/w1.c
+@@ -767,8 +767,6 @@ int w1_attach_slave_device(struct w1_mas
+       if (err < 0) {
+               dev_err(&dev->dev, "%s: Attaching %s failed.\n", __func__,
+                        sl->name);
+-              dev->slave_count--;
+-              w1_family_put(sl->family);
+               atomic_dec(&sl->master->refcnt);
+               kfree(sl);
+               return err;