From: Greg Kroah-Hartman Date: Thu, 1 May 2014 00:21:18 +0000 (-0700) Subject: 3.14-stable patches X-Git-Tag: v3.4.89~44 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=127521be63d818a87c90120acb09682aa062a947;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: mfd-88pm800-fix-i2c-device-resource-leak-if-probe-fails.patch mfd-88pm860x-fix-i2c-device-resource-leak-on-regmap-init-fail.patch mfd-88pm860x-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch mfd-kempld-core-fix-potential-hang-up-during-boot.patch mfd-max77686-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch mfd-max77693-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch mfd-max8925-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch mfd-max8997-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch mfd-max8998-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch mfd-sec-core-fix-possible-null-pointer-dereference-when-i2c_new_dummy-error.patch mfd-tps65910-fix-possible-invalid-pointer-dereference-on-regmap_add_irq_chip-fail.patch mfd-twl-core-fix-accessibility-of-some-twl4030-audio-registers.patch staging-serqt_usb2-fix-sparse-warning-restricted-__le16-degrades-to-integer.patch w1-fix-w1_send_slave-dropping-a-slave-id.patch --- diff --git a/queue-3.14/mfd-88pm800-fix-i2c-device-resource-leak-if-probe-fails.patch b/queue-3.14/mfd-88pm800-fix-i2c-device-resource-leak-if-probe-fails.patch new file mode 100644 index 00000000000..ac869eee92b --- /dev/null +++ b/queue-3.14/mfd-88pm800-fix-i2c-device-resource-leak-if-probe-fails.patch @@ -0,0 +1,44 @@ +From 141050cf3d84fc303df58796d68dc1376b0e8f67 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 12 Feb 2014 11:10:56 +0100 +Subject: mfd: 88pm800: Fix I2C device resource leak if probe fails + +From: Krzysztof Kozlowski + +commit 141050cf3d84fc303df58796d68dc1376b0e8f67 upstream. + +During probe the driver allocates two dummy I2C devices for subchips in +function pm800_pages_init(). Additionally this function allocates +regmaps for these subchips. If any of these steps fail then these dummy +I2C devices are not freed and resources leak. + +On pm800_pages_init() fail the driver must call pm800_pages_exit() to +unregister dummy I2C devices. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/88pm800.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/mfd/88pm800.c ++++ b/drivers/mfd/88pm800.c +@@ -571,7 +571,7 @@ static int pm800_probe(struct i2c_client + ret = pm800_pages_init(chip); + if (ret) { + dev_err(&client->dev, "pm800_pages_init failed!\n"); +- goto err_page_init; ++ goto err_device_init; + } + + ret = device_800_init(chip, pdata); +@@ -587,7 +587,6 @@ static int pm800_probe(struct i2c_client + + err_device_init: + pm800_pages_exit(chip); +-err_page_init: + err_subchip_alloc: + pm80x_deinit(); + out_init: diff --git a/queue-3.14/mfd-88pm860x-fix-i2c-device-resource-leak-on-regmap-init-fail.patch b/queue-3.14/mfd-88pm860x-fix-i2c-device-resource-leak-on-regmap-init-fail.patch new file mode 100644 index 00000000000..f3e5081ce89 --- /dev/null +++ b/queue-3.14/mfd-88pm860x-fix-i2c-device-resource-leak-on-regmap-init-fail.patch @@ -0,0 +1,32 @@ +From a7ab1c8b261305af583ce26bb4a14f555fdaa73e Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 11 Feb 2014 11:03:30 +0100 +Subject: mfd: 88pm860x: Fix I2C device resource leak on regmap init fail + +From: Krzysztof Kozlowski + +commit a7ab1c8b261305af583ce26bb4a14f555fdaa73e upstream. + +During probe the driver allocates dummy I2C device for companion chip +and then allocates a regmap for it. If regmap_init_i2c() fails then the +I2C driver (allocated with i2c_new_dummy()) is not freed and this +resource leaks. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/88pm860x-core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/mfd/88pm860x-core.c ++++ b/drivers/mfd/88pm860x-core.c +@@ -1190,6 +1190,7 @@ static int pm860x_probe(struct i2c_clien + ret = PTR_ERR(chip->regmap_companion); + dev_err(&chip->companion->dev, + "Failed to allocate register map: %d\n", ret); ++ i2c_unregister_device(chip->companion); + return ret; + } + i2c_set_clientdata(chip->companion, chip); diff --git a/queue-3.14/mfd-88pm860x-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch b/queue-3.14/mfd-88pm860x-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch new file mode 100644 index 00000000000..ff9e6ee57f7 --- /dev/null +++ b/queue-3.14/mfd-88pm860x-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch @@ -0,0 +1,41 @@ +From 159ce52a6b777fc82fa0b51c7440e25f9e4c6feb Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 11 Feb 2014 11:03:29 +0100 +Subject: mfd: 88pm860x: Fix possible NULL pointer dereference on i2c_new_dummy error + +From: Krzysztof Kozlowski + +commit 159ce52a6b777fc82fa0b51c7440e25f9e4c6feb upstream. + +During probe the driver allocates dummy I2C device for companion chip +with i2c_new_dummy() but it does not check the return value of this call. + +In case of error (i2c_new_device(): memory allocation failure or I2C +address cannot be used) this function returns NULL which is later used +by regmap_init_i2c(). + +If i2c_new_dummy() fails for companion device, fail also the probe for +main MFD driver. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/88pm860x-core.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/mfd/88pm860x-core.c ++++ b/drivers/mfd/88pm860x-core.c +@@ -1179,6 +1179,11 @@ static int pm860x_probe(struct i2c_clien + chip->companion_addr = pdata->companion_addr; + chip->companion = i2c_new_dummy(chip->client->adapter, + chip->companion_addr); ++ if (!chip->companion) { ++ dev_err(&client->dev, ++ "Failed to allocate I2C companion device\n"); ++ return -ENODEV; ++ } + chip->regmap_companion = regmap_init_i2c(chip->companion, + &pm860x_regmap_config); + if (IS_ERR(chip->regmap_companion)) { diff --git a/queue-3.14/mfd-kempld-core-fix-potential-hang-up-during-boot.patch b/queue-3.14/mfd-kempld-core-fix-potential-hang-up-during-boot.patch new file mode 100644 index 00000000000..c24429a6266 --- /dev/null +++ b/queue-3.14/mfd-kempld-core-fix-potential-hang-up-during-boot.patch @@ -0,0 +1,45 @@ +From 204747c970c0d568721c76ab8a57dde0e5dcf0d5 Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Thu, 20 Mar 2014 08:12:28 -0700 +Subject: mfd: kempld-core: Fix potential hang-up during boot + +From: Guenter Roeck + +commit 204747c970c0d568721c76ab8a57dde0e5dcf0d5 upstream. + +On PXT and COMe-cPC2 boards it is observed that the hardware +mutex is acquired but not being released during initialization. +This can result in a hang-up during boot if the driver is built +into the kernel. + +Releasing the mutex twice if it was acquired fixes the problem. +Subsequent request/release cycles work as expected, so the fix is +only needed during initialization. + +Reviewed-by: Michael Brunner +Tested-by: Michael Brunner +Signed-off-by: Guenter Roeck +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/kempld-core.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/mfd/kempld-core.c ++++ b/drivers/mfd/kempld-core.c +@@ -322,9 +322,12 @@ static int kempld_detect_device(struct k + return -ENODEV; + } + +- /* Release hardware mutex if aquired */ +- if (!(index_reg & KEMPLD_MUTEX_KEY)) ++ /* Release hardware mutex if acquired */ ++ if (!(index_reg & KEMPLD_MUTEX_KEY)) { + iowrite8(KEMPLD_MUTEX_KEY, pld->io_index); ++ /* PXT and COMe-cPC2 boards may require a second release */ ++ iowrite8(KEMPLD_MUTEX_KEY, pld->io_index); ++ } + + mutex_unlock(&pld->lock); + diff --git a/queue-3.14/mfd-max77686-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch b/queue-3.14/mfd-max77686-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch new file mode 100644 index 00000000000..b400d71bfd6 --- /dev/null +++ b/queue-3.14/mfd-max77686-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch @@ -0,0 +1,40 @@ +From b9e183a1d495cd65412abe0f9df19b151716bfe7 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 11 Feb 2014 11:03:31 +0100 +Subject: mfd: max77686: Fix possible NULL pointer dereference on i2c_new_dummy error + +From: Krzysztof Kozlowski + +commit b9e183a1d495cd65412abe0f9df19b151716bfe7 upstream. + +During probe the driver allocates dummy I2C device for RTC with +i2c_new_dummy() but it does not check the return value of this call. + +In case of error (i2c_new_device(): memory allocation failure or I2C +address cannot be used) this function returns NULL which is later used +by i2c_unregister_device(). + +If i2c_new_dummy() fails for RTC device, fail also the probe for main +MFD driver. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/max77686.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/mfd/max77686.c ++++ b/drivers/mfd/max77686.c +@@ -121,6 +121,10 @@ static int max77686_i2c_probe(struct i2c + dev_info(max77686->dev, "device found\n"); + + max77686->rtc = i2c_new_dummy(i2c->adapter, I2C_ADDR_RTC); ++ if (!max77686->rtc) { ++ dev_err(max77686->dev, "Failed to allocate I2C device for RTC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(max77686->rtc, max77686); + + max77686_irq_init(max77686); diff --git a/queue-3.14/mfd-max77693-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch b/queue-3.14/mfd-max77693-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch new file mode 100644 index 00000000000..f0daa72e828 --- /dev/null +++ b/queue-3.14/mfd-max77693-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch @@ -0,0 +1,60 @@ +From ad09dd6a1f5d6244bd89314015af506ba7f9810a Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 11 Feb 2014 11:03:32 +0100 +Subject: mfd: max77693: Fix possible NULL pointer dereference on i2c_new_dummy error + +From: Krzysztof Kozlowski + +commit ad09dd6a1f5d6244bd89314015af506ba7f9810a upstream. + +During probe the driver allocates dummy I2C devices for MUIC and haptic +with i2c_new_dummy() but it does not check the return value of this +calls. + +In case of error (i2c_new_device(): memory allocation failure or I2C +address cannot be used) this function returns NULL which is later used +by devm_regmap_init_i2c() and i2c_unregister_device(). + +If i2c_new_dummy() fails for MUIC or haptic devices, fail also the probe +for main MFD driver. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/max77693.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/mfd/max77693.c ++++ b/drivers/mfd/max77693.c +@@ -148,9 +148,18 @@ static int max77693_i2c_probe(struct i2c + dev_info(max77693->dev, "device ID: 0x%x\n", reg_data); + + max77693->muic = i2c_new_dummy(i2c->adapter, I2C_ADDR_MUIC); ++ if (!max77693->muic) { ++ dev_err(max77693->dev, "Failed to allocate I2C device for MUIC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(max77693->muic, max77693); + + max77693->haptic = i2c_new_dummy(i2c->adapter, I2C_ADDR_HAPTIC); ++ if (!max77693->haptic) { ++ dev_err(max77693->dev, "Failed to allocate I2C device for Haptic\n"); ++ ret = -ENODEV; ++ goto err_i2c_haptic; ++ } + i2c_set_clientdata(max77693->haptic, max77693); + + /* +@@ -184,8 +193,9 @@ err_mfd: + max77693_irq_exit(max77693); + err_irq: + err_regmap_muic: +- i2c_unregister_device(max77693->muic); + i2c_unregister_device(max77693->haptic); ++err_i2c_haptic: ++ i2c_unregister_device(max77693->muic); + return ret; + } + diff --git a/queue-3.14/mfd-max8925-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch b/queue-3.14/mfd-max8925-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch new file mode 100644 index 00000000000..a3a4bc93d6e --- /dev/null +++ b/queue-3.14/mfd-max8925-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch @@ -0,0 +1,49 @@ +From 96cf3dedc491d2f1f66cc26217f2b06b0c7b6797 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 11 Feb 2014 11:03:33 +0100 +Subject: mfd: max8925: Fix possible NULL pointer dereference on i2c_new_dummy error + +From: Krzysztof Kozlowski + +commit 96cf3dedc491d2f1f66cc26217f2b06b0c7b6797 upstream. + +During probe the driver allocates dummy I2C devices for RTC and ADC +with i2c_new_dummy() but it does not check the return value of this +calls. + +In case of error (i2c_new_device(): memory allocation failure or I2C +address cannot be used) this function returns NULL which is later used +by i2c_unregister_device(). + +If i2c_new_dummy() fails for RTC or ADC devices, fail also the probe +for main MFD driver. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/max8925-i2c.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/mfd/max8925-i2c.c ++++ b/drivers/mfd/max8925-i2c.c +@@ -181,9 +181,18 @@ static int max8925_probe(struct i2c_clie + mutex_init(&chip->io_lock); + + chip->rtc = i2c_new_dummy(chip->i2c->adapter, RTC_I2C_ADDR); ++ if (!chip->rtc) { ++ dev_err(chip->dev, "Failed to allocate I2C device for RTC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(chip->rtc, chip); + + chip->adc = i2c_new_dummy(chip->i2c->adapter, ADC_I2C_ADDR); ++ if (!chip->adc) { ++ dev_err(chip->dev, "Failed to allocate I2C device for ADC\n"); ++ i2c_unregister_device(chip->rtc); ++ return -ENODEV; ++ } + i2c_set_clientdata(chip->adc, chip); + + device_init_wakeup(&client->dev, 1); diff --git a/queue-3.14/mfd-max8997-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch b/queue-3.14/mfd-max8997-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch new file mode 100644 index 00000000000..720321b60fb --- /dev/null +++ b/queue-3.14/mfd-max8997-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch @@ -0,0 +1,67 @@ +From 97dc4ed3fa377ec91bb60ba98b70d645c2099384 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 11 Feb 2014 11:03:34 +0100 +Subject: mfd: max8997: Fix possible NULL pointer dereference on i2c_new_dummy error + +From: Krzysztof Kozlowski + +commit 97dc4ed3fa377ec91bb60ba98b70d645c2099384 upstream. + +During probe the driver allocates dummy I2C devices for RTC, haptic and +MUIC with i2c_new_dummy() but it does not check the return value of this +calls. + +In case of error (i2c_new_device(): memory allocation failure or I2C +address cannot be used) this function returns NULL which is later used +by i2c_unregister_device(). + +If i2c_new_dummy() fails for RTC, haptic or MUIC devices, fail also the +probe for main MFD driver. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/max8997.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +--- a/drivers/mfd/max8997.c ++++ b/drivers/mfd/max8997.c +@@ -208,10 +208,26 @@ static int max8997_i2c_probe(struct i2c_ + mutex_init(&max8997->iolock); + + max8997->rtc = i2c_new_dummy(i2c->adapter, I2C_ADDR_RTC); ++ if (!max8997->rtc) { ++ dev_err(max8997->dev, "Failed to allocate I2C device for RTC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(max8997->rtc, max8997); ++ + max8997->haptic = i2c_new_dummy(i2c->adapter, I2C_ADDR_HAPTIC); ++ if (!max8997->haptic) { ++ dev_err(max8997->dev, "Failed to allocate I2C device for Haptic\n"); ++ ret = -ENODEV; ++ goto err_i2c_haptic; ++ } + i2c_set_clientdata(max8997->haptic, max8997); ++ + max8997->muic = i2c_new_dummy(i2c->adapter, I2C_ADDR_MUIC); ++ if (!max8997->muic) { ++ dev_err(max8997->dev, "Failed to allocate I2C device for MUIC\n"); ++ ret = -ENODEV; ++ goto err_i2c_muic; ++ } + i2c_set_clientdata(max8997->muic, max8997); + + pm_runtime_set_active(max8997->dev); +@@ -239,7 +255,9 @@ static int max8997_i2c_probe(struct i2c_ + err_mfd: + mfd_remove_devices(max8997->dev); + i2c_unregister_device(max8997->muic); ++err_i2c_muic: + i2c_unregister_device(max8997->haptic); ++err_i2c_haptic: + i2c_unregister_device(max8997->rtc); + return ret; + } diff --git a/queue-3.14/mfd-max8998-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch b/queue-3.14/mfd-max8998-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch new file mode 100644 index 00000000000..b7b6dd69be3 --- /dev/null +++ b/queue-3.14/mfd-max8998-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch @@ -0,0 +1,39 @@ +From ed26f87b9f71693a1d1ee85f5e6209601505080f Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 11 Feb 2014 11:03:35 +0100 +Subject: mfd: max8998: Fix possible NULL pointer dereference on i2c_new_dummy error + +From: Krzysztof Kozlowski + +commit ed26f87b9f71693a1d1ee85f5e6209601505080f upstream. + +During probe the driver allocates dummy I2C device for RTC with i2c_new_dummy() but it does not check the return value of this call. + +In case of error (i2c_new_device(): memory allocation failure or I2C +address cannot be used) this function returns NULL which is later used +by i2c_unregister_device(). + +If i2c_new_dummy() fails for RTC device, fail also the probe for +main MFD driver. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/max8998.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/mfd/max8998.c ++++ b/drivers/mfd/max8998.c +@@ -215,6 +215,10 @@ static int max8998_i2c_probe(struct i2c_ + mutex_init(&max8998->iolock); + + max8998->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR); ++ if (!max8998->rtc) { ++ dev_err(&i2c->dev, "Failed to allocate I2C device for RTC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(max8998->rtc, max8998); + + max8998_irq_init(max8998); diff --git a/queue-3.14/mfd-sec-core-fix-possible-null-pointer-dereference-when-i2c_new_dummy-error.patch b/queue-3.14/mfd-sec-core-fix-possible-null-pointer-dereference-when-i2c_new_dummy-error.patch new file mode 100644 index 00000000000..873269b0e88 --- /dev/null +++ b/queue-3.14/mfd-sec-core-fix-possible-null-pointer-dereference-when-i2c_new_dummy-error.patch @@ -0,0 +1,39 @@ +From 65aba1e04916d72b30c028730a1e31860c225412 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Tue, 11 Feb 2014 10:12:25 +0100 +Subject: mfd: sec-core: Fix possible NULL pointer dereference when i2c_new_dummy error + +From: Krzysztof Kozlowski + +commit 65aba1e04916d72b30c028730a1e31860c225412 upstream. + +During probe the sec-core driver allocates dummy I2C device for RTC with +i2c_new_dummy() but return value is not checked. In case of error +(i2c_new_device(): memory allocation failure or I2C address cannot be +used) this function returns NULL which is later used by +devm_regmap_init_i2c() or i2c_unregister_device(). + +If i2c_new_dummy() fails for RTC device, fail also the probe for main +MFD driver. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/sec-core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/mfd/sec-core.c ++++ b/drivers/mfd/sec-core.c +@@ -252,6 +252,10 @@ static int sec_pmic_probe(struct i2c_cli + } + + sec_pmic->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR); ++ if (!sec_pmic->rtc) { ++ dev_err(&i2c->dev, "Failed to allocate I2C for RTC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(sec_pmic->rtc, sec_pmic); + + sec_pmic->regmap_rtc = devm_regmap_init_i2c(sec_pmic->rtc, diff --git a/queue-3.14/mfd-tps65910-fix-possible-invalid-pointer-dereference-on-regmap_add_irq_chip-fail.patch b/queue-3.14/mfd-tps65910-fix-possible-invalid-pointer-dereference-on-regmap_add_irq_chip-fail.patch new file mode 100644 index 00000000000..c03e7580ff1 --- /dev/null +++ b/queue-3.14/mfd-tps65910-fix-possible-invalid-pointer-dereference-on-regmap_add_irq_chip-fail.patch @@ -0,0 +1,44 @@ +From 483e2dfdbc94751430e41db9973985f5b054d322 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 12 Mar 2014 16:50:44 +0100 +Subject: mfd: tps65910: Fix possible invalid pointer dereference on regmap_add_irq_chip fail + +From: Krzysztof Kozlowski + +commit 483e2dfdbc94751430e41db9973985f5b054d322 upstream. + +Fixes: 4aab3fadad32 ("mfd: tps65910: Move interrupt implementation code to mfd file") + +tps65910_irq_init() sets 'tps65910->chip_irq' before calling +regmap_add_irq_chip(). If the regmap_add_irq_chip() call fails in +memory allocation of regmap_irq_chip_data members then: + +1. The 'tps65910->chip_irq' will still hold some value +2. 'tps65910->irq_data' will be pointing to already freed memory + (because regmap_add_irq_chip() will free it on error) + +This results in invalid memory access during driver remove because the +tps65910_irq_exit() tests whether 'tps65910->chip_irq' is not zero. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/tps65910.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/mfd/tps65910.c ++++ b/drivers/mfd/tps65910.c +@@ -255,8 +255,10 @@ static int tps65910_irq_init(struct tps6 + ret = regmap_add_irq_chip(tps65910->regmap, tps65910->chip_irq, + IRQF_ONESHOT, pdata->irq_base, + tps6591x_irqs_chip, &tps65910->irq_data); +- if (ret < 0) ++ if (ret < 0) { + dev_warn(tps65910->dev, "Failed to add irq_chip %d\n", ret); ++ tps65910->chip_irq = 0; ++ } + return ret; + } + diff --git a/queue-3.14/mfd-twl-core-fix-accessibility-of-some-twl4030-audio-registers.patch b/queue-3.14/mfd-twl-core-fix-accessibility-of-some-twl4030-audio-registers.patch new file mode 100644 index 00000000000..74bb6bdac8c --- /dev/null +++ b/queue-3.14/mfd-twl-core-fix-accessibility-of-some-twl4030-audio-registers.patch @@ -0,0 +1,45 @@ +From 56816b700c8c773270f3aaf4c92be53e359a03fd Mon Sep 17 00:00:00 2001 +From: Tomas Novotny +Date: Mon, 10 Mar 2014 19:12:50 +0100 +Subject: mfd: twl-core: Fix accessibility of some twl4030 audio registers + +From: Tomas Novotny + +commit 56816b700c8c773270f3aaf4c92be53e359a03fd upstream. + +There are some unused registers in twl4030 at I2C address 0x49 and function +twl4030_49_nop_reg() is used to check accessibility of that registers. These +registers are written in decimal format but the values are correct in +hexadecimal format. (It can be checked few lines above the patched code - +these registers are marked as unused there.) + +As a consequence three registers of audio submodule are treated as +inaccessible (preamplifier carkit right and both handsfree registers). + +Signed-off-by: Tomas Novotny +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/twl-core.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/mfd/twl-core.c ++++ b/drivers/mfd/twl-core.c +@@ -282,11 +282,11 @@ static struct reg_default twl4030_49_def + static bool twl4030_49_nop_reg(struct device *dev, unsigned int reg) + { + switch (reg) { +- case 0: +- case 3: +- case 40: +- case 41: +- case 42: ++ case 0x00: ++ case 0x03: ++ case 0x40: ++ case 0x41: ++ case 0x42: + return false; + default: + return true; diff --git a/queue-3.14/series b/queue-3.14/series index e08c58d9bb5..cd4a688325a 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -36,3 +36,17 @@ s390-fix-control-register-update.patch mei-fix-memory-leak-of-pending-write-cb-objects.patch mei-me-do-not-load-the-driver-if-the-fw-doesn-t-support-mei-interface.patch mei-ignore-client-writing-state-during-cb-completion.patch +mfd-sec-core-fix-possible-null-pointer-dereference-when-i2c_new_dummy-error.patch +mfd-88pm860x-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch +mfd-88pm860x-fix-i2c-device-resource-leak-on-regmap-init-fail.patch +mfd-88pm800-fix-i2c-device-resource-leak-if-probe-fails.patch +mfd-max77686-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch +mfd-max77693-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch +mfd-max8925-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch +mfd-max8998-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch +mfd-max8997-fix-possible-null-pointer-dereference-on-i2c_new_dummy-error.patch +mfd-tps65910-fix-possible-invalid-pointer-dereference-on-regmap_add_irq_chip-fail.patch +mfd-kempld-core-fix-potential-hang-up-during-boot.patch +mfd-twl-core-fix-accessibility-of-some-twl4030-audio-registers.patch +w1-fix-w1_send_slave-dropping-a-slave-id.patch +staging-serqt_usb2-fix-sparse-warning-restricted-__le16-degrades-to-integer.patch diff --git a/queue-3.14/staging-serqt_usb2-fix-sparse-warning-restricted-__le16-degrades-to-integer.patch b/queue-3.14/staging-serqt_usb2-fix-sparse-warning-restricted-__le16-degrades-to-integer.patch new file mode 100644 index 00000000000..f2e03e0cb02 --- /dev/null +++ b/queue-3.14/staging-serqt_usb2-fix-sparse-warning-restricted-__le16-degrades-to-integer.patch @@ -0,0 +1,30 @@ +From abe5d64d1a74195a44cd14624f8178b9f48b7cc7 Mon Sep 17 00:00:00 2001 +From: Himangi Saraogi +Date: Wed, 5 Mar 2014 04:59:57 +0530 +Subject: staging:serqt_usb2: Fix sparse warning restricted __le16 degrades to integer + +From: Himangi Saraogi + +commit abe5d64d1a74195a44cd14624f8178b9f48b7cc7 upstream. + +This patch fixes the following sparse warning : +drivers/staging/serqt_usb2/serqt_usb2.c:727:40: warning: restricted __le16 degrades to integer + +Signed-off-by: Himangi Saraogi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/serqt_usb2/serqt_usb2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/serqt_usb2/serqt_usb2.c ++++ b/drivers/staging/serqt_usb2/serqt_usb2.c +@@ -724,7 +724,7 @@ static int qt_startup(struct usb_serial + goto startup_error; + } + +- switch (serial->dev->descriptor.idProduct) { ++ switch (le16_to_cpu(serial->dev->descriptor.idProduct)) { + case QUATECH_DSU100: + case QUATECH_QSU100: + case QUATECH_ESU100A: diff --git a/queue-3.14/w1-fix-w1_send_slave-dropping-a-slave-id.patch b/queue-3.14/w1-fix-w1_send_slave-dropping-a-slave-id.patch new file mode 100644 index 00000000000..8bfb5351839 --- /dev/null +++ b/queue-3.14/w1-fix-w1_send_slave-dropping-a-slave-id.patch @@ -0,0 +1,77 @@ +From 6b355b33a64fd6d8ead2b838ec16fb9b551f71e8 Mon Sep 17 00:00:00 2001 +From: David Fries +Date: Wed, 15 Jan 2014 22:29:12 -0600 +Subject: w1: fix w1_send_slave dropping a slave id + +From: David Fries + +commit 6b355b33a64fd6d8ead2b838ec16fb9b551f71e8 upstream. + +Previous logic, +if (avail > 8) { + store slave; + return; +} +send data; clear; + +The logic error is, if there isn't space send the buffer and clear, +but the slave wasn't added to the now empty buffer loosing that slave +id. It also should have been "if (avail >= 8)" because when it is 8, +there is space. + +Instead, if there isn't space send and clear the buffer, then there is +always space for the slave id. + +Signed-off-by: David Fries +Acked-by: Evgeniy Polyakov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/w1/w1_netlink.c | 27 ++++++++++++++------------- + 1 file changed, 14 insertions(+), 13 deletions(-) + +--- a/drivers/w1/w1_netlink.c ++++ b/drivers/w1/w1_netlink.c +@@ -54,28 +54,29 @@ static void w1_send_slave(struct w1_mast + struct w1_netlink_msg *hdr = (struct w1_netlink_msg *)(msg + 1); + struct w1_netlink_cmd *cmd = (struct w1_netlink_cmd *)(hdr + 1); + int avail; ++ u64 *data; + + /* update kernel slave list */ + w1_slave_found(dev, rn); + + avail = dev->priv_size - cmd->len; + +- if (avail > 8) { +- u64 *data = (void *)(cmd + 1) + cmd->len; +- +- *data = rn; +- cmd->len += 8; +- hdr->len += 8; +- msg->len += 8; +- return; ++ if (avail < 8) { ++ msg->ack++; ++ cn_netlink_send(msg, 0, GFP_KERNEL); ++ ++ msg->len = sizeof(struct w1_netlink_msg) + ++ sizeof(struct w1_netlink_cmd); ++ hdr->len = sizeof(struct w1_netlink_cmd); ++ cmd->len = 0; + } + +- msg->ack++; +- cn_netlink_send(msg, 0, GFP_KERNEL); ++ data = (void *)(cmd + 1) + cmd->len; + +- msg->len = sizeof(struct w1_netlink_msg) + sizeof(struct w1_netlink_cmd); +- hdr->len = sizeof(struct w1_netlink_cmd); +- cmd->len = 0; ++ *data = rn; ++ cmd->len += 8; ++ hdr->len += 8; ++ msg->len += 8; + } + + static int w1_process_search_command(struct w1_master *dev, struct cn_msg *msg,