From: Greg Kroah-Hartman Date: Thu, 3 Apr 2025 15:00:11 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v6.1.133~6 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5d4a8ed87ea6820d2ae63aa38eed3fbecb10c2fc;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: i2c-dev-check-return-value-when-calling-dev_set_name.patch media-i2c-et8ek8-don-t-strip-remove-function-when-driver-is-builtin.patch --- diff --git a/queue-5.10/i2c-dev-check-return-value-when-calling-dev_set_name.patch b/queue-5.10/i2c-dev-check-return-value-when-calling-dev_set_name.patch new file mode 100644 index 0000000000..1ddcb48720 --- /dev/null +++ b/queue-5.10/i2c-dev-check-return-value-when-calling-dev_set_name.patch @@ -0,0 +1,52 @@ +From 993eb48fa199b5f476df8204e652eff63dd19361 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Mon, 11 Apr 2022 21:07:51 +0300 +Subject: i2c: dev: check return value when calling dev_set_name() + +From: Andy Shevchenko + +commit 993eb48fa199b5f476df8204e652eff63dd19361 upstream. + +If dev_set_name() fails, the dev_name() is null, check the return +value of dev_set_name() to avoid the null-ptr-deref. + +Fixes: 1413ef638aba ("i2c: dev: Fix the race between the release of i2c_dev and cdev") +Signed-off-by: Andy Shevchenko +Signed-off-by: Wolfram Sang +Signed-off-by: Feng Liu +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/i2c-dev.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/drivers/i2c/i2c-dev.c ++++ b/drivers/i2c/i2c-dev.c +@@ -669,17 +669,22 @@ static int i2cdev_attach_adapter(struct + i2c_dev->dev.class = i2c_dev_class; + i2c_dev->dev.parent = &adap->dev; + i2c_dev->dev.release = i2cdev_dev_release; +- dev_set_name(&i2c_dev->dev, "i2c-%d", adap->nr); ++ ++ res = dev_set_name(&i2c_dev->dev, "i2c-%d", adap->nr); ++ if (res) ++ goto err_put_i2c_dev; + + res = cdev_device_add(&i2c_dev->cdev, &i2c_dev->dev); +- if (res) { +- put_i2c_dev(i2c_dev, false); +- return res; +- } ++ if (res) ++ goto err_put_i2c_dev; + + pr_debug("i2c-dev: adapter [%s] registered as minor %d\n", + adap->name, adap->nr); + return 0; ++ ++err_put_i2c_dev: ++ put_i2c_dev(i2c_dev, false); ++ return res; + } + + static int i2cdev_detach_adapter(struct device *dev, void *dummy) diff --git a/queue-5.10/media-i2c-et8ek8-don-t-strip-remove-function-when-driver-is-builtin.patch b/queue-5.10/media-i2c-et8ek8-don-t-strip-remove-function-when-driver-is-builtin.patch new file mode 100644 index 0000000000..b200c4585a --- /dev/null +++ b/queue-5.10/media-i2c-et8ek8-don-t-strip-remove-function-when-driver-is-builtin.patch @@ -0,0 +1,53 @@ +From 545b215736c5c4b354e182d99c578a472ac9bfce Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Sun, 24 Mar 2024 17:00:44 +0100 +Subject: media: i2c: et8ek8: Don't strip remove function when driver is builtin +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +commit 545b215736c5c4b354e182d99c578a472ac9bfce upstream. + +Using __exit for the remove function results in the remove callback +being discarded with CONFIG_VIDEO_ET8EK8=y. When such a device gets +unbound (e.g. using sysfs or hotplug), the driver is just removed +without the cleanup being performed. This results in resource leaks. Fix +it by compiling in the remove callback unconditionally. + +This also fixes a W=1 modpost warning: + + WARNING: modpost: drivers/media/i2c/et8ek8/et8ek8: section mismatch in reference: et8ek8_i2c_driver+0x10 (section: .data) -> et8ek8_remove (section: .exit.text) + +Fixes: c5254e72b8ed ("[media] media: Driver for Toshiba et8ek8 5MP sensor") +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Bin Lan +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/et8ek8/et8ek8_driver.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/i2c/et8ek8/et8ek8_driver.c ++++ b/drivers/media/i2c/et8ek8/et8ek8_driver.c +@@ -1460,7 +1460,7 @@ err_mutex: + return ret; + } + +-static int __exit et8ek8_remove(struct i2c_client *client) ++static int et8ek8_remove(struct i2c_client *client) + { + struct v4l2_subdev *subdev = i2c_get_clientdata(client); + struct et8ek8_sensor *sensor = to_et8ek8_sensor(subdev); +@@ -1504,7 +1504,7 @@ static struct i2c_driver et8ek8_i2c_driv + .of_match_table = et8ek8_of_table, + }, + .probe_new = et8ek8_probe, +- .remove = __exit_p(et8ek8_remove), ++ .remove = et8ek8_remove, + .id_table = et8ek8_id_table, + }; + diff --git a/queue-5.10/series b/queue-5.10/series index 9b7f844243..4a1e58a859 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -106,3 +106,5 @@ net-usb-qmi_wwan-add-telit-cinterion-fe990b-composition.patch net-usb-usbnet-restore-usb-d-name-exception-for-local-mac-addresses.patch memstick-rtsx_usb_ms-fix-slab-use-after-free-in-rtsx_usb_ms_drv_remove.patch serial-8250_dma-terminate-correct-dma-in-tx_dma_flush.patch +media-i2c-et8ek8-don-t-strip-remove-function-when-driver-is-builtin.patch +i2c-dev-check-return-value-when-calling-dev_set_name.patch