From: Greg Kroah-Hartman Date: Wed, 15 Oct 2025 11:04:46 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v5.15.195~114 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=540e3f0678b3ee7e1614fc95afe4545a6bc9a3ca;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch --- diff --git a/queue-6.1/clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch b/queue-6.1/clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch new file mode 100644 index 0000000000..15590d7f71 --- /dev/null +++ b/queue-6.1/clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch @@ -0,0 +1,67 @@ +From cd32e596f02fc981674573402c1138f616df1728 Mon Sep 17 00:00:00 2001 +From: Zhen Ni +Date: Thu, 14 Aug 2025 20:33:24 +0800 +Subject: clocksource/drivers/clps711x: Fix resource leaks in error paths + +From: Zhen Ni + +commit cd32e596f02fc981674573402c1138f616df1728 upstream. + +The current implementation of clps711x_timer_init() has multiple error +paths that directly return without releasing the base I/O memory mapped +via of_iomap(). Fix of_iomap leaks in error paths. + +Fixes: 04410efbb6bc ("clocksource/drivers/clps711x: Convert init function to return error") +Fixes: 2a6a8e2d9004 ("clocksource/drivers/clps711x: Remove board support") +Signed-off-by: Zhen Ni +Signed-off-by: Daniel Lezcano +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250814123324.1516495-1-zhen.ni@easystack.cn +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clocksource/clps711x-timer.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +--- a/drivers/clocksource/clps711x-timer.c ++++ b/drivers/clocksource/clps711x-timer.c +@@ -78,24 +78,33 @@ static int __init clps711x_timer_init(st + unsigned int irq = irq_of_parse_and_map(np, 0); + struct clk *clock = of_clk_get(np, 0); + void __iomem *base = of_iomap(np, 0); ++ int ret = 0; + + if (!base) + return -ENOMEM; +- if (!irq) +- return -EINVAL; +- if (IS_ERR(clock)) +- return PTR_ERR(clock); ++ if (!irq) { ++ ret = -EINVAL; ++ goto unmap_io; ++ } ++ if (IS_ERR(clock)) { ++ ret = PTR_ERR(clock); ++ goto unmap_io; ++ } + + switch (of_alias_get_id(np, "timer")) { + case CLPS711X_CLKSRC_CLOCKSOURCE: + clps711x_clksrc_init(clock, base); + break; + case CLPS711X_CLKSRC_CLOCKEVENT: +- return _clps711x_clkevt_init(clock, base, irq); ++ ret = _clps711x_clkevt_init(clock, base, irq); ++ break; + default: +- return -EINVAL; ++ ret = -EINVAL; ++ break; + } + +- return 0; ++unmap_io: ++ iounmap(base); ++ return ret; + } + TIMER_OF_DECLARE(clps711x, "cirrus,ep7209-timer", clps711x_timer_init); diff --git a/queue-6.1/iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch b/queue-6.1/iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch new file mode 100644 index 0000000000..f9badfca3a --- /dev/null +++ b/queue-6.1/iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch @@ -0,0 +1,37 @@ +From 1d8fdabe19267338f29b58f968499e5b55e6a3b6 Mon Sep 17 00:00:00 2001 +From: Michael Hennerich +Date: Fri, 29 Aug 2025 12:25:43 +0100 +Subject: iio: frequency: adf4350: Fix ADF4350_REG3_12BIT_CLKDIV_MODE +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Hennerich + +commit 1d8fdabe19267338f29b58f968499e5b55e6a3b6 upstream. + +The clk div bits (2 bits wide) do not start in bit 16 but in bit 15. Fix it +accordingly. + +Fixes: e31166f0fd48 ("iio: frequency: New driver for Analog Devices ADF4350/ADF4351 Wideband Synthesizers") +Signed-off-by: Michael Hennerich +Signed-off-by: Nuno Sá +Link: https://patch.msgid.link/20250829-adf4350-fix-v2-2-0bf543ba797d@analog.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/iio/frequency/adf4350.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/iio/frequency/adf4350.h ++++ b/include/linux/iio/frequency/adf4350.h +@@ -51,7 +51,7 @@ + + /* REG3 Bit Definitions */ + #define ADF4350_REG3_12BIT_CLKDIV(x) ((x) << 3) +-#define ADF4350_REG3_12BIT_CLKDIV_MODE(x) ((x) << 16) ++#define ADF4350_REG3_12BIT_CLKDIV_MODE(x) ((x) << 15) + #define ADF4350_REG3_12BIT_CSR_EN (1 << 18) + #define ADF4351_REG3_CHARGE_CANCELLATION_EN (1 << 21) + #define ADF4351_REG3_ANTI_BACKLASH_3ns_EN (1 << 22) diff --git a/queue-6.1/media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch b/queue-6.1/media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch new file mode 100644 index 0000000000..9f28a2cd72 --- /dev/null +++ b/queue-6.1/media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch @@ -0,0 +1,68 @@ +From f37df9a0eb5e43fcfe02cbaef076123dc0d79c7e Mon Sep 17 00:00:00 2001 +From: Tomi Valkeinen +Date: Fri, 8 Aug 2025 11:59:15 +0300 +Subject: media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() + +From: Tomi Valkeinen + +commit f37df9a0eb5e43fcfe02cbaef076123dc0d79c7e upstream. + +v4l2_subdev_call_state_try() macro allocates a subdev state with +__v4l2_subdev_state_alloc(), but does not check the returned value. If +__v4l2_subdev_state_alloc fails, it returns an ERR_PTR, and that would +cause v4l2_subdev_call_state_try() to crash. + +Add proper error handling to v4l2_subdev_call_state_try(). + +Signed-off-by: Tomi Valkeinen +Fixes: 982c0487185b ("media: subdev: Add v4l2_subdev_call_state_try() macro") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/all/aJTNtpDUbTz7eyJc%40stanley.mountain/ +Cc: stable@vger.kernel.org +Reviewed-by: Dan Carpenter +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + include/media/v4l2-subdev.h | 30 +++++++++++++++++------------- + 1 file changed, 17 insertions(+), 13 deletions(-) + +--- a/include/media/v4l2-subdev.h ++++ b/include/media/v4l2-subdev.h +@@ -1462,19 +1462,23 @@ extern const struct v4l2_subdev_ops v4l2 + * + * Note: only legacy non-MC drivers may need this macro. + */ +-#define v4l2_subdev_call_state_try(sd, o, f, args...) \ +- ({ \ +- int __result; \ +- static struct lock_class_key __key; \ +- const char *name = KBUILD_BASENAME \ +- ":" __stringify(__LINE__) ":state->lock"; \ +- struct v4l2_subdev_state *state = \ +- __v4l2_subdev_state_alloc(sd, name, &__key); \ +- v4l2_subdev_lock_state(state); \ +- __result = v4l2_subdev_call(sd, o, f, state, ##args); \ +- v4l2_subdev_unlock_state(state); \ +- __v4l2_subdev_state_free(state); \ +- __result; \ ++#define v4l2_subdev_call_state_try(sd, o, f, args...) \ ++ ({ \ ++ int __result; \ ++ static struct lock_class_key __key; \ ++ const char *name = KBUILD_BASENAME \ ++ ":" __stringify(__LINE__) ":state->lock"; \ ++ struct v4l2_subdev_state *state = \ ++ __v4l2_subdev_state_alloc(sd, name, &__key); \ ++ if (IS_ERR(state)) { \ ++ __result = PTR_ERR(state); \ ++ } else { \ ++ v4l2_subdev_lock_state(state); \ ++ __result = v4l2_subdev_call(sd, o, f, state, ##args); \ ++ v4l2_subdev_unlock_state(state); \ ++ __v4l2_subdev_state_free(state); \ ++ } \ ++ __result; \ + }) + + /** diff --git a/queue-6.1/series b/queue-6.1/series index 04bfff757d..2fca31c252 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -1,2 +1,5 @@ fs-always-return-zero-on-success-from-replace_fd.patch fscontext-do-not-consume-log-entries-when-returning-emsgsize.patch +clocksource-drivers-clps711x-fix-resource-leaks-in-error-paths.patch +iio-frequency-adf4350-fix-adf4350_reg3_12bit_clkdiv_mode.patch +media-v4l2-subdev-fix-alloc-failure-check-in-v4l2_subdev_call_state_try.patch