--- /dev/null
+From aad4742fbf0a560c25827adb58695a4497ffc204 Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sun, 26 Apr 2020 21:44:03 +0200
+Subject: iio: dac: vf610: Fix an error handling path in 'vf610_dac_probe()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit aad4742fbf0a560c25827adb58695a4497ffc204 upstream.
+
+A call to 'vf610_dac_exit()' is missing in an error handling path.
+
+Fixes: 1b983bf42fad ("iio: dac: vf610_dac: Add IIO DAC driver for Vybrid SoC")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/dac/vf610_dac.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iio/dac/vf610_dac.c
++++ b/drivers/iio/dac/vf610_dac.c
+@@ -235,6 +235,7 @@ static int vf610_dac_probe(struct platfo
+ return 0;
+
+ error_iio_device_register:
++ vf610_dac_exit(info);
+ clk_disable_unprepare(info->clk);
+
+ return ret;
--- /dev/null
+From fc9c03ce30f79b71807961bfcb42be191af79873 Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Wed, 13 May 2020 01:31:40 +0300
+Subject: mei: release me_cl object reference
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit fc9c03ce30f79b71807961bfcb42be191af79873 upstream.
+
+Allow me_cl object to be freed by releasing the reference
+that was acquired by one of the search functions:
+__mei_me_cl_by_uuid_id() or __mei_me_cl_by_uuid()
+
+Cc: <stable@vger.kernel.org>
+Reported-by: 亿一 <teroincn@gmail.com>
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Link: https://lore.kernel.org/r/20200512223140.32186-1-tomas.winkler@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/client.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/misc/mei/client.c
++++ b/drivers/misc/mei/client.c
+@@ -276,6 +276,7 @@ void mei_me_cl_rm_by_uuid(struct mei_dev
+ down_write(&dev->me_clients_rwsem);
+ me_cl = __mei_me_cl_by_uuid(dev, uuid);
+ __mei_me_cl_del(dev, me_cl);
++ mei_me_cl_put(me_cl);
+ up_write(&dev->me_clients_rwsem);
+ }
+
+@@ -297,6 +298,7 @@ void mei_me_cl_rm_by_uuid_id(struct mei_
+ down_write(&dev->me_clients_rwsem);
+ me_cl = __mei_me_cl_by_uuid_id(dev, uuid, id);
+ __mei_me_cl_del(dev, me_cl);
++ mei_me_cl_put(me_cl);
+ up_write(&dev->me_clients_rwsem);
+ }
+
--- /dev/null
+From ffca476a0a8d26de767cc41d62b8ca7f540ecfdd Mon Sep 17 00:00:00 2001
+From: John Hubbard <jhubbard@nvidia.com>
+Date: Fri, 22 May 2020 22:22:48 -0700
+Subject: rapidio: fix an error in get_user_pages_fast() error handling
+
+From: John Hubbard <jhubbard@nvidia.com>
+
+commit ffca476a0a8d26de767cc41d62b8ca7f540ecfdd upstream.
+
+In the case of get_user_pages_fast() returning fewer pages than
+requested, rio_dma_transfer() does not quite do the right thing. It
+attempts to release all the pages that were requested, rather than just
+the pages that were pinned.
+
+Fix the error handling so that only the pages that were successfully
+pinned are released.
+
+Fixes: e8de370188d0 ("rapidio: add mport char device driver")
+Signed-off-by: John Hubbard <jhubbard@nvidia.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Matt Porter <mporter@kernel.crashing.org>
+Cc: Alexandre Bounine <alex.bou9@gmail.com>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Cc: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: <stable@vger.kernel.org>
+Link: http://lkml.kernel.org/r/20200517235620.205225-2-jhubbard@nvidia.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/rapidio/devices/rio_mport_cdev.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/rapidio/devices/rio_mport_cdev.c
++++ b/drivers/rapidio/devices/rio_mport_cdev.c
+@@ -905,6 +905,11 @@ rio_dma_transfer(struct file *filp, u32
+ rmcd_error("pinned %ld out of %ld pages",
+ pinned, nr_pages);
+ ret = -EFAULT;
++ /*
++ * Set nr_pages up to mean "how many pages to unpin, in
++ * the error handler:
++ */
++ nr_pages = pinned;
+ goto err_pg;
+ }
+
cxgb4-free-mac_hlist-properly.patch
cxgb4-cxgb4vf-fix-mac_hlist-initialization-and-free.patch
revert-gfs2-don-t-demote-a-glock-until-its-revokes-a.patch
+staging-iio-ad2s1210-fix-spi-reading.patch
+staging-greybus-fix-uninitialized-scalar-variable.patch
+iio-dac-vf610-fix-an-error-handling-path-in-vf610_dac_probe.patch
+mei-release-me_cl-object-reference.patch
+rapidio-fix-an-error-in-get_user_pages_fast-error-handling.patch
--- /dev/null
+From 34625c1931f8204c234c532b446b9f53c69f4b68 Mon Sep 17 00:00:00 2001
+From: Oscar Carter <oscar.carter@gmx.com>
+Date: Sun, 10 May 2020 12:14:26 +0200
+Subject: staging: greybus: Fix uninitialized scalar variable
+
+From: Oscar Carter <oscar.carter@gmx.com>
+
+commit 34625c1931f8204c234c532b446b9f53c69f4b68 upstream.
+
+In the "gb_tty_set_termios" function the "newline" variable is declared
+but not initialized. So the "flow_control" member is not initialized and
+the OR / AND operations with itself results in an undefined value in
+this member.
+
+The purpose of the code is to set the flow control type, so remove the
+OR / AND self operator and set the value directly.
+
+Addresses-Coverity-ID: 1374016 ("Uninitialized scalar variable")
+Fixes: e55c25206d5c9 ("greybus: uart: Handle CRTSCTS flag in termios")
+Signed-off-by: Oscar Carter <oscar.carter@gmx.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200510101426.23631-1-oscar.carter@gmx.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/greybus/uart.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/greybus/uart.c
++++ b/drivers/staging/greybus/uart.c
+@@ -539,9 +539,9 @@ static void gb_tty_set_termios(struct tt
+ }
+
+ if (C_CRTSCTS(tty) && C_BAUD(tty) != B0)
+- newline.flow_control |= GB_SERIAL_AUTO_RTSCTS_EN;
++ newline.flow_control = GB_SERIAL_AUTO_RTSCTS_EN;
+ else
+- newline.flow_control &= ~GB_SERIAL_AUTO_RTSCTS_EN;
++ newline.flow_control = 0;
+
+ if (memcmp(&gb_tty->line_coding, &newline, sizeof(newline))) {
+ memcpy(&gb_tty->line_coding, &newline, sizeof(newline));
--- /dev/null
+From 5e4f99a6b788047b0b8a7496c2e0c8f372f6edf2 Mon Sep 17 00:00:00 2001
+From: Dragos Bogdan <dragos.bogdan@analog.com>
+Date: Wed, 29 Apr 2020 10:21:29 +0300
+Subject: staging: iio: ad2s1210: Fix SPI reading
+
+From: Dragos Bogdan <dragos.bogdan@analog.com>
+
+commit 5e4f99a6b788047b0b8a7496c2e0c8f372f6edf2 upstream.
+
+If the serial interface is used, the 8-bit address should be latched using
+the rising edge of the WR/FSYNC signal.
+
+This basically means that a CS change is required between the first byte
+sent, and the second one.
+This change splits the single-transfer transfer of 2 bytes into 2 transfers
+with a single byte, and CS change in-between.
+
+Note fixes tag is not accurate, but reflects a point beyond which there
+are too many refactors to make backporting straight forward.
+
+Fixes: b19e9ad5e2cb ("staging:iio:resolver:ad2s1210 general driver cleanup.")
+Signed-off-by: Dragos Bogdan <dragos.bogdan@analog.com>
+Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/iio/resolver/ad2s1210.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/drivers/staging/iio/resolver/ad2s1210.c
++++ b/drivers/staging/iio/resolver/ad2s1210.c
+@@ -126,17 +126,24 @@ static int ad2s1210_config_write(struct
+ static int ad2s1210_config_read(struct ad2s1210_state *st,
+ unsigned char address)
+ {
+- struct spi_transfer xfer = {
+- .len = 2,
+- .rx_buf = st->rx,
+- .tx_buf = st->tx,
++ struct spi_transfer xfers[] = {
++ {
++ .len = 1,
++ .rx_buf = &st->rx[0],
++ .tx_buf = &st->tx[0],
++ .cs_change = 1,
++ }, {
++ .len = 1,
++ .rx_buf = &st->rx[1],
++ .tx_buf = &st->tx[1],
++ },
+ };
+ int ret = 0;
+
+ ad2s1210_set_mode(MOD_CONFIG, st);
+ st->tx[0] = address | AD2S1210_MSB_IS_HIGH;
+ st->tx[1] = AD2S1210_REG_FAULT;
+- ret = spi_sync_transfer(st->sdev, &xfer, 1);
++ ret = spi_sync_transfer(st->sdev, xfers, 2);
+ if (ret < 0)
+ return ret;
+ st->old_data = true;
projects / thirdparty / kernel / stable-queue.git / commitdiff
