--- /dev/null
+From cd32e596f02fc981674573402c1138f616df1728 Mon Sep 17 00:00:00 2001
+From: Zhen Ni <zhen.ni@easystack.cn>
+Date: Thu, 14 Aug 2025 20:33:24 +0800
+Subject: clocksource/drivers/clps711x: Fix resource leaks in error paths
+
+From: Zhen Ni <zhen.ni@easystack.cn>
+
+commit cd32e596f02fc981674573402c1138f616df1728 upstream.
+
+The current implementation of clps711x_timer_init() has multiple error
+paths that directly return without releasing the base I/O memory mapped
+via of_iomap(). Fix of_iomap leaks in error paths.
+
+Fixes: 04410efbb6bc ("clocksource/drivers/clps711x: Convert init function to return error")
+Fixes: 2a6a8e2d9004 ("clocksource/drivers/clps711x: Remove board support")
+Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20250814123324.1516495-1-zhen.ni@easystack.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/clocksource/clps711x-timer.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+--- a/drivers/clocksource/clps711x-timer.c
++++ b/drivers/clocksource/clps711x-timer.c
+@@ -78,24 +78,33 @@ static int __init clps711x_timer_init(st
+ unsigned int irq = irq_of_parse_and_map(np, 0);
+ struct clk *clock = of_clk_get(np, 0);
+ void __iomem *base = of_iomap(np, 0);
++ int ret = 0;
+
+ if (!base)
+ return -ENOMEM;
+- if (!irq)
+- return -EINVAL;
+- if (IS_ERR(clock))
+- return PTR_ERR(clock);
++ if (!irq) {
++ ret = -EINVAL;
++ goto unmap_io;
++ }
++ if (IS_ERR(clock)) {
++ ret = PTR_ERR(clock);
++ goto unmap_io;
++ }
+
+ switch (of_alias_get_id(np, "timer")) {
+ case CLPS711X_CLKSRC_CLOCKSOURCE:
+ clps711x_clksrc_init(clock, base);
+ break;
+ case CLPS711X_CLKSRC_CLOCKEVENT:
+- return _clps711x_clkevt_init(clock, base, irq);
++ ret = _clps711x_clkevt_init(clock, base, irq);
++ break;
+ default:
+- return -EINVAL;
++ ret = -EINVAL;
++ break;
+ }
+
+- return 0;
++unmap_io:
++ iounmap(base);
++ return ret;
+ }
+ TIMER_OF_DECLARE(clps711x, "cirrus,ep7209-timer", clps711x_timer_init);
--- /dev/null
+From 1d8fdabe19267338f29b58f968499e5b55e6a3b6 Mon Sep 17 00:00:00 2001
+From: Michael Hennerich <michael.hennerich@analog.com>
+Date: Fri, 29 Aug 2025 12:25:43 +0100
+Subject: iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Hennerich <michael.hennerich@analog.com>
+
+commit 1d8fdabe19267338f29b58f968499e5b55e6a3b6 upstream.
+
+The clk div bits (2 bits wide) do not start in bit 16 but in bit 15. Fix it
+accordingly.
+
+Fixes: e31166f0fd48 ("iio: frequency: New driver for Analog Devices ADF4350/ADF4351 Wideband Synthesizers")
+Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
+Signed-off-by: Nuno Sá <nuno.sa@analog.com>
+Link: https://patch.msgid.link/20250829-adf4350-fix-v2-2-0bf543ba797d@analog.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/iio/frequency/adf4350.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/iio/frequency/adf4350.h
++++ b/include/linux/iio/frequency/adf4350.h
+@@ -51,7 +51,7 @@
+
+ /* REG3 Bit Definitions */
+ #define ADF4350_REG3_12BIT_CLKDIV(x) ((x) << 3)
+-#define ADF4350_REG3_12BIT_CLKDIV_MODE(x) ((x) << 16)
++#define ADF4350_REG3_12BIT_CLKDIV_MODE(x) ((x) << 15)
+ #define ADF4350_REG3_12BIT_CSR_EN (1 << 18)
+ #define ADF4351_REG3_CHARGE_CANCELLATION_EN (1 << 21)
+ #define ADF4351_REG3_ANTI_BACKLASH_3ns_EN (1 << 22)
--- /dev/null
+From f37df9a0eb5e43fcfe02cbaef076123dc0d79c7e Mon Sep 17 00:00:00 2001
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Date: Fri, 8 Aug 2025 11:59:15 +0300
+Subject: media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()
+
+From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+
+commit f37df9a0eb5e43fcfe02cbaef076123dc0d79c7e upstream.
+
+v4l2_subdev_call_state_try() macro allocates a subdev state with
+__v4l2_subdev_state_alloc(), but does not check the returned value. If
+__v4l2_subdev_state_alloc fails, it returns an ERR_PTR, and that would
+cause v4l2_subdev_call_state_try() to crash.
+
+Add proper error handling to v4l2_subdev_call_state_try().
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Fixes: 982c0487185b ("media: subdev: Add v4l2_subdev_call_state_try() macro")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Closes: https://lore.kernel.org/all/aJTNtpDUbTz7eyJc%40stanley.mountain/
+Cc: stable@vger.kernel.org
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/media/v4l2-subdev.h | 30 +++++++++++++++++-------------
+ 1 file changed, 17 insertions(+), 13 deletions(-)
+
+--- a/include/media/v4l2-subdev.h
++++ b/include/media/v4l2-subdev.h
+@@ -1462,19 +1462,23 @@ extern const struct v4l2_subdev_ops v4l2
+ *
+ * Note: only legacy non-MC drivers may need this macro.
+ */
+-#define v4l2_subdev_call_state_try(sd, o, f, args...) \
+- ({ \
+- int __result; \
+- static struct lock_class_key __key; \
+- const char *name = KBUILD_BASENAME \
+- ":" __stringify(__LINE__) ":state->lock"; \
+- struct v4l2_subdev_state *state = \
+- __v4l2_subdev_state_alloc(sd, name, &__key); \
+- v4l2_subdev_lock_state(state); \
+- __result = v4l2_subdev_call(sd, o, f, state, ##args); \
+- v4l2_subdev_unlock_state(state); \
+- __v4l2_subdev_state_free(state); \
+- __result; \
++#define v4l2_subdev_call_state_try(sd, o, f, args...) \
++ ({ \
++ int __result; \
++ static struct lock_class_key __key; \
++ const char *name = KBUILD_BASENAME \
++ ":" __stringify(__LINE__) ":state->lock"; \
++ struct v4l2_subdev_state *state = \
++ __v4l2_subdev_state_alloc(sd, name, &__key); \
++ if (IS_ERR(state)) { \
++ __result = PTR_ERR(state); \
++ } else { \
++ v4l2_subdev_lock_state(state); \
++ __result = v4l2_subdev_call(sd, o, f, state, ##args); \
++ v4l2_subdev_unlock_state(state); \
++ __v4l2_subdev_state_free(state); \
++ } \
++ __result; \
+ })
+
+ /**
fs-always-return-zero-on-success-from-replace_fd.patch
fscontext-do-not-consume-log-entries-when-returning-emsgsize.patch
+clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch
+iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch
+media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
