From: Greg Kroah-Hartman Date: Mon, 25 May 2020 14:21:02 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v4.4.225~23 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4fc72e58294443cdde5cc0a100ffcc74fea90992;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: iio-dac-vf610-fix-an-error-handling-path-in-vf610_dac_probe.patch mei-release-me_cl-object-reference.patch rapidio-fix-an-error-in-get_user_pages_fast-error-handling.patch staging-greybus-fix-uninitialized-scalar-variable.patch staging-iio-ad2s1210-fix-spi-reading.patch --- diff --git a/queue-4.9/iio-dac-vf610-fix-an-error-handling-path-in-vf610_dac_probe.patch b/queue-4.9/iio-dac-vf610-fix-an-error-handling-path-in-vf610_dac_probe.patch new file mode 100644 index 00000000000..ad9de8c8df0 --- /dev/null +++ b/queue-4.9/iio-dac-vf610-fix-an-error-handling-path-in-vf610_dac_probe.patch @@ -0,0 +1,31 @@ +From aad4742fbf0a560c25827adb58695a4497ffc204 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sun, 26 Apr 2020 21:44:03 +0200 +Subject: iio: dac: vf610: Fix an error handling path in 'vf610_dac_probe()' + +From: Christophe JAILLET + +commit aad4742fbf0a560c25827adb58695a4497ffc204 upstream. + +A call to 'vf610_dac_exit()' is missing in an error handling path. + +Fixes: 1b983bf42fad ("iio: dac: vf610_dac: Add IIO DAC driver for Vybrid SoC") +Signed-off-by: Christophe JAILLET +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/dac/vf610_dac.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/dac/vf610_dac.c ++++ b/drivers/iio/dac/vf610_dac.c +@@ -235,6 +235,7 @@ static int vf610_dac_probe(struct platfo + return 0; + + error_iio_device_register: ++ vf610_dac_exit(info); + clk_disable_unprepare(info->clk); + + return ret; diff --git a/queue-4.9/mei-release-me_cl-object-reference.patch b/queue-4.9/mei-release-me_cl-object-reference.patch new file mode 100644 index 00000000000..a9803a27616 --- /dev/null +++ b/queue-4.9/mei-release-me_cl-object-reference.patch @@ -0,0 +1,45 @@ +From fc9c03ce30f79b71807961bfcb42be191af79873 Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Wed, 13 May 2020 01:31:40 +0300 +Subject: mei: release me_cl object reference +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander Usyskin + +commit fc9c03ce30f79b71807961bfcb42be191af79873 upstream. + +Allow me_cl object to be freed by releasing the reference +that was acquired by one of the search functions: +__mei_me_cl_by_uuid_id() or __mei_me_cl_by_uuid() + +Cc: +Reported-by: 亿一 +Signed-off-by: Alexander Usyskin +Signed-off-by: Tomas Winkler +Link: https://lore.kernel.org/r/20200512223140.32186-1-tomas.winkler@intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/mei/client.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/misc/mei/client.c ++++ b/drivers/misc/mei/client.c +@@ -276,6 +276,7 @@ void mei_me_cl_rm_by_uuid(struct mei_dev + down_write(&dev->me_clients_rwsem); + me_cl = __mei_me_cl_by_uuid(dev, uuid); + __mei_me_cl_del(dev, me_cl); ++ mei_me_cl_put(me_cl); + up_write(&dev->me_clients_rwsem); + } + +@@ -297,6 +298,7 @@ void mei_me_cl_rm_by_uuid_id(struct mei_ + down_write(&dev->me_clients_rwsem); + me_cl = __mei_me_cl_by_uuid_id(dev, uuid, id); + __mei_me_cl_del(dev, me_cl); ++ mei_me_cl_put(me_cl); + up_write(&dev->me_clients_rwsem); + } + diff --git a/queue-4.9/rapidio-fix-an-error-in-get_user_pages_fast-error-handling.patch b/queue-4.9/rapidio-fix-an-error-in-get_user_pages_fast-error-handling.patch new file mode 100644 index 00000000000..0dfb44d6a40 --- /dev/null +++ b/queue-4.9/rapidio-fix-an-error-in-get_user_pages_fast-error-handling.patch @@ -0,0 +1,48 @@ +From ffca476a0a8d26de767cc41d62b8ca7f540ecfdd Mon Sep 17 00:00:00 2001 +From: John Hubbard +Date: Fri, 22 May 2020 22:22:48 -0700 +Subject: rapidio: fix an error in get_user_pages_fast() error handling + +From: John Hubbard + +commit ffca476a0a8d26de767cc41d62b8ca7f540ecfdd upstream. + +In the case of get_user_pages_fast() returning fewer pages than +requested, rio_dma_transfer() does not quite do the right thing. It +attempts to release all the pages that were requested, rather than just +the pages that were pinned. + +Fix the error handling so that only the pages that were successfully +pinned are released. + +Fixes: e8de370188d0 ("rapidio: add mport char device driver") +Signed-off-by: John Hubbard +Signed-off-by: Andrew Morton +Reviewed-by: Andrew Morton +Cc: Matt Porter +Cc: Alexandre Bounine +Cc: Sumit Semwal +Cc: Dan Carpenter +Cc: +Link: http://lkml.kernel.org/r/20200517235620.205225-2-jhubbard@nvidia.com +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rapidio/devices/rio_mport_cdev.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/rapidio/devices/rio_mport_cdev.c ++++ b/drivers/rapidio/devices/rio_mport_cdev.c +@@ -905,6 +905,11 @@ rio_dma_transfer(struct file *filp, u32 + rmcd_error("pinned %ld out of %ld pages", + pinned, nr_pages); + ret = -EFAULT; ++ /* ++ * Set nr_pages up to mean "how many pages to unpin, in ++ * the error handler: ++ */ ++ nr_pages = pinned; + goto err_pg; + } + diff --git a/queue-4.9/series b/queue-4.9/series index 6bb3942a579..23f39d873c7 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -57,3 +57,8 @@ edac-ghes-use-cper-module-handles-to-locate-dimms.patch cxgb4-free-mac_hlist-properly.patch cxgb4-cxgb4vf-fix-mac_hlist-initialization-and-free.patch revert-gfs2-don-t-demote-a-glock-until-its-revokes-a.patch +staging-iio-ad2s1210-fix-spi-reading.patch +staging-greybus-fix-uninitialized-scalar-variable.patch +iio-dac-vf610-fix-an-error-handling-path-in-vf610_dac_probe.patch +mei-release-me_cl-object-reference.patch +rapidio-fix-an-error-in-get_user_pages_fast-error-handling.patch diff --git a/queue-4.9/staging-greybus-fix-uninitialized-scalar-variable.patch b/queue-4.9/staging-greybus-fix-uninitialized-scalar-variable.patch new file mode 100644 index 00000000000..aed4dcb8601 --- /dev/null +++ b/queue-4.9/staging-greybus-fix-uninitialized-scalar-variable.patch @@ -0,0 +1,42 @@ +From 34625c1931f8204c234c532b446b9f53c69f4b68 Mon Sep 17 00:00:00 2001 +From: Oscar Carter +Date: Sun, 10 May 2020 12:14:26 +0200 +Subject: staging: greybus: Fix uninitialized scalar variable + +From: Oscar Carter + +commit 34625c1931f8204c234c532b446b9f53c69f4b68 upstream. + +In the "gb_tty_set_termios" function the "newline" variable is declared +but not initialized. So the "flow_control" member is not initialized and +the OR / AND operations with itself results in an undefined value in +this member. + +The purpose of the code is to set the flow control type, so remove the +OR / AND self operator and set the value directly. + +Addresses-Coverity-ID: 1374016 ("Uninitialized scalar variable") +Fixes: e55c25206d5c9 ("greybus: uart: Handle CRTSCTS flag in termios") +Signed-off-by: Oscar Carter +Cc: stable +Link: https://lore.kernel.org/r/20200510101426.23631-1-oscar.carter@gmx.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/greybus/uart.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/staging/greybus/uart.c ++++ b/drivers/staging/greybus/uart.c +@@ -539,9 +539,9 @@ static void gb_tty_set_termios(struct tt + } + + if (C_CRTSCTS(tty) && C_BAUD(tty) != B0) +- newline.flow_control |= GB_SERIAL_AUTO_RTSCTS_EN; ++ newline.flow_control = GB_SERIAL_AUTO_RTSCTS_EN; + else +- newline.flow_control &= ~GB_SERIAL_AUTO_RTSCTS_EN; ++ newline.flow_control = 0; + + if (memcmp(&gb_tty->line_coding, &newline, sizeof(newline))) { + memcpy(&gb_tty->line_coding, &newline, sizeof(newline)); diff --git a/queue-4.9/staging-iio-ad2s1210-fix-spi-reading.patch b/queue-4.9/staging-iio-ad2s1210-fix-spi-reading.patch new file mode 100644 index 00000000000..478ae9b33ec --- /dev/null +++ b/queue-4.9/staging-iio-ad2s1210-fix-spi-reading.patch @@ -0,0 +1,63 @@ +From 5e4f99a6b788047b0b8a7496c2e0c8f372f6edf2 Mon Sep 17 00:00:00 2001 +From: Dragos Bogdan +Date: Wed, 29 Apr 2020 10:21:29 +0300 +Subject: staging: iio: ad2s1210: Fix SPI reading + +From: Dragos Bogdan + +commit 5e4f99a6b788047b0b8a7496c2e0c8f372f6edf2 upstream. + +If the serial interface is used, the 8-bit address should be latched using +the rising edge of the WR/FSYNC signal. + +This basically means that a CS change is required between the first byte +sent, and the second one. +This change splits the single-transfer transfer of 2 bytes into 2 transfers +with a single byte, and CS change in-between. + +Note fixes tag is not accurate, but reflects a point beyond which there +are too many refactors to make backporting straight forward. + +Fixes: b19e9ad5e2cb ("staging:iio:resolver:ad2s1210 general driver cleanup.") +Signed-off-by: Dragos Bogdan +Signed-off-by: Alexandru Ardelean +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/iio/resolver/ad2s1210.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/drivers/staging/iio/resolver/ad2s1210.c ++++ b/drivers/staging/iio/resolver/ad2s1210.c +@@ -126,17 +126,24 @@ static int ad2s1210_config_write(struct + static int ad2s1210_config_read(struct ad2s1210_state *st, + unsigned char address) + { +- struct spi_transfer xfer = { +- .len = 2, +- .rx_buf = st->rx, +- .tx_buf = st->tx, ++ struct spi_transfer xfers[] = { ++ { ++ .len = 1, ++ .rx_buf = &st->rx[0], ++ .tx_buf = &st->tx[0], ++ .cs_change = 1, ++ }, { ++ .len = 1, ++ .rx_buf = &st->rx[1], ++ .tx_buf = &st->tx[1], ++ }, + }; + int ret = 0; + + ad2s1210_set_mode(MOD_CONFIG, st); + st->tx[0] = address | AD2S1210_MSB_IS_HIGH; + st->tx[1] = AD2S1210_REG_FAULT; +- ret = spi_sync_transfer(st->sdev, &xfer, 1); ++ ret = spi_sync_transfer(st->sdev, xfers, 2); + if (ret < 0) + return ret; + st->old_data = true;