From: Greg Kroah-Hartman Date: Mon, 26 Jan 2026 12:57:32 +0000 (+0100) Subject: 5.15-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7d720a9cd9834dfd5811ef08abebe80007cf8330;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: comedi-dmm32at-serialize-use-of-paged-registers.patch w1-fix-redundant-counter-decrement-in-w1_attach_slave_device.patch --- diff --git a/queue-5.15/comedi-dmm32at-serialize-use-of-paged-registers.patch b/queue-5.15/comedi-dmm32at-serialize-use-of-paged-registers.patch new file mode 100644 index 0000000000..e5c1bc174e --- /dev/null +++ b/queue-5.15/comedi-dmm32at-serialize-use-of-paged-registers.patch @@ -0,0 +1,127 @@ +From e03b29b55f2b7c345a919a6ee36633b06bf3fb56 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Mon, 12 Jan 2026 16:28:35 +0000 +Subject: comedi: dmm32at: serialize use of paged registers + +From: Ian Abbott + +commit e03b29b55f2b7c345a919a6ee36633b06bf3fb56 upstream. + +Some of the hardware registers of the DMM-32-AT board are multiplexed, +using the least significant two bits of the Miscellaneous Control +register to select the function of registers at offsets 12 to 15: + + 00 => 8254 timer/counter registers are accessible + 01 => 8255 digital I/O registers are accessible + 10 => Reserved + 11 => Calibration registers are accessible + +The interrupt service routine (`dmm32at_isr()`) clobbers the bottom two +bits of the register with value 00, which would interfere with access to +the 8255 registers by the `dm32at_8255_io()` function (used for Comedi +instruction handling on the digital I/O subdevice). + +Make use of the generic Comedi device spin-lock `dev->spinlock` (which +is otherwise unused by this driver) to serialize access to the +miscellaneous control register and paged registers. + +Fixes: 3c501880ac44 ("Staging: comedi: add dmm32at driver") +Cc: stable@vger.kernel.org +Signed-off-by: Ian Abbott +Link: https://patch.msgid.link/20260112162835.91688-1-abbotti@mev.co.uk +Signed-off-by: Greg Kroah-Hartman +--- + drivers/comedi/drivers/dmm32at.c | 32 ++++++++++++++++++++++++++++++-- + 1 file changed, 30 insertions(+), 2 deletions(-) + +--- a/drivers/comedi/drivers/dmm32at.c ++++ b/drivers/comedi/drivers/dmm32at.c +@@ -331,6 +331,7 @@ static int dmm32at_ai_cmdtest(struct com + + static void dmm32at_setaitimer(struct comedi_device *dev, unsigned int nansec) + { ++ unsigned long irq_flags; + unsigned char lo1, lo2, hi2; + unsigned short both2; + +@@ -343,6 +344,9 @@ static void dmm32at_setaitimer(struct co + /* set counter clocks to 10MHz, disable all aux dio */ + outb(0, dev->iobase + DMM32AT_CTRDIO_CFG_REG); + ++ /* serialize access to control register and paged registers */ ++ spin_lock_irqsave(&dev->spinlock, irq_flags); ++ + /* get access to the clock regs */ + outb(DMM32AT_CTRL_PAGE_8254, dev->iobase + DMM32AT_CTRL_REG); + +@@ -355,6 +359,8 @@ static void dmm32at_setaitimer(struct co + outb(lo2, dev->iobase + DMM32AT_CLK2); + outb(hi2, dev->iobase + DMM32AT_CLK2); + ++ spin_unlock_irqrestore(&dev->spinlock, irq_flags); ++ + /* enable the ai conversion interrupt and the clock to start scans */ + outb(DMM32AT_INTCLK_ADINT | + DMM32AT_INTCLK_CLKEN | DMM32AT_INTCLK_CLKSEL, +@@ -364,13 +370,19 @@ static void dmm32at_setaitimer(struct co + static int dmm32at_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s) + { + struct comedi_cmd *cmd = &s->async->cmd; ++ unsigned long irq_flags; + int ret; + + dmm32at_ai_set_chanspec(dev, s, cmd->chanlist[0], cmd->chanlist_len); + ++ /* serialize access to control register and paged registers */ ++ spin_lock_irqsave(&dev->spinlock, irq_flags); ++ + /* reset the interrupt just in case */ + outb(DMM32AT_CTRL_INTRST, dev->iobase + DMM32AT_CTRL_REG); + ++ spin_unlock_irqrestore(&dev->spinlock, irq_flags); ++ + /* + * wait for circuit to settle + * we don't have the 'insn' here but it's not needed +@@ -430,8 +442,13 @@ static irqreturn_t dmm32at_isr(int irq, + comedi_handle_events(dev, s); + } + ++ /* serialize access to control register and paged registers */ ++ spin_lock(&dev->spinlock); ++ + /* reset the interrupt */ + outb(DMM32AT_CTRL_INTRST, dev->iobase + DMM32AT_CTRL_REG); ++ ++ spin_unlock(&dev->spinlock); + return IRQ_HANDLED; + } + +@@ -482,14 +499,25 @@ static int dmm32at_ao_insn_write(struct + static int dmm32at_8255_io(struct comedi_device *dev, + int dir, int port, int data, unsigned long regbase) + { ++ unsigned long irq_flags; ++ int ret; ++ ++ /* serialize access to control register and paged registers */ ++ spin_lock_irqsave(&dev->spinlock, irq_flags); ++ + /* get access to the DIO regs */ + outb(DMM32AT_CTRL_PAGE_8255, dev->iobase + DMM32AT_CTRL_REG); + + if (dir) { + outb(data, dev->iobase + regbase + port); +- return 0; ++ ret = 0; ++ } else { ++ ret = inb(dev->iobase + regbase + port); + } +- return inb(dev->iobase + regbase + port); ++ ++ spin_unlock_irqrestore(&dev->spinlock, irq_flags); ++ ++ return ret; + } + + /* Make sure the board is there and put it to a known state */ diff --git a/queue-5.15/series b/queue-5.15/series index 22719ddd6c..413612c632 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -79,3 +79,5 @@ ipvlan-make-the-addrs_lock-be-per-port.patch net-sched-enforce-that-teql-can-only-be-used-as-root.patch net-sched-qfq-use-cl_is_active-to-determine-whether-.patch crypto-authencesn-reject-too-short-aad-assoclen-8-to.patch +comedi-dmm32at-serialize-use-of-paged-registers.patch +w1-fix-redundant-counter-decrement-in-w1_attach_slave_device.patch diff --git a/queue-5.15/w1-fix-redundant-counter-decrement-in-w1_attach_slave_device.patch b/queue-5.15/w1-fix-redundant-counter-decrement-in-w1_attach_slave_device.patch new file mode 100644 index 0000000000..484efc2aa7 --- /dev/null +++ b/queue-5.15/w1-fix-redundant-counter-decrement-in-w1_attach_slave_device.patch @@ -0,0 +1,36 @@ +From cc8f92e41eb76f450f05234fef2054afc3633100 Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Thu, 18 Dec 2025 19:14:14 +0800 +Subject: w1: fix redundant counter decrement in w1_attach_slave_device() + +From: Haoxiang Li + +commit cc8f92e41eb76f450f05234fef2054afc3633100 upstream. + +In w1_attach_slave_device(), if __w1_attach_slave_device() fails, +put_device() -> w1_slave_release() is called to do the cleanup job. +In w1_slave_release(), sl->family->refcnt and sl->master->slave_count +have already been decremented. There is no need to decrement twice +in w1_attach_slave_device(). + +Fixes: 2c927c0c73fd ("w1: Fix slave count on 1-Wire bus (resend)") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Link: https://patch.msgid.link/20251218111414.564403-1-lihaoxiang@isrc.iscas.ac.cn +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/w1/w1.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/w1/w1.c ++++ b/drivers/w1/w1.c +@@ -767,8 +767,6 @@ int w1_attach_slave_device(struct w1_mas + if (err < 0) { + dev_err(&dev->dev, "%s: Attaching %s failed.\n", __func__, + sl->name); +- dev->slave_count--; +- w1_family_put(sl->family); + atomic_dec(&sl->master->refcnt); + kfree(sl); + return err;