From: Greg Kroah-Hartman Date: Fri, 15 May 2026 07:46:47 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v5.10.256~24 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7f31d11a86e6540933b8f8f3a5d39ff5ba0a0d59;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: media-dib8000-avoid-division-by-0-in-dib8000_set_dds.patch spi-mtk-nor-fix-controller-deregistration.patch --- diff --git a/queue-5.10/media-dib8000-avoid-division-by-0-in-dib8000_set_dds.patch b/queue-5.10/media-dib8000-avoid-division-by-0-in-dib8000_set_dds.patch new file mode 100644 index 0000000000..88b8f577db --- /dev/null +++ b/queue-5.10/media-dib8000-avoid-division-by-0-in-dib8000_set_dds.patch @@ -0,0 +1,47 @@ +From dde3c37af95cd6fa301c4906f33d627bc9dd874c Mon Sep 17 00:00:00 2001 +From: Sergey Shtylyov +Date: Fri, 6 Feb 2026 17:22:26 +0300 +Subject: media: dib8000: avoid division by 0 in dib8000_set_dds() + +From: Sergey Shtylyov + +commit dde3c37af95cd6fa301c4906f33d627bc9dd874c upstream. + +In dib8000_set_dds(), 1 << 26 (67108864) divided by e.g. 1 apparently can't +fit into 16-bit variable unit_khz_dds_val, being truncated to 0; this will +cause division by 0 while calling dprintk() with debugging enabled (via the +module parameter). Use s32 instead of s16 to declare the variable, getting +rid of the cast to u16 in the *else* branch as well... + +Found by Linux Verification Center (linuxtesting.org) with the Svace static +analysis tool. + +Fixes: 173a64cb3fcf ("[media] dib8000: enhancement") +Cc: stable@vger.kernel.org +Signed-off-by: Sergey Shtylyov +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/dvb-frontends/dib8000.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/dvb-frontends/dib8000.c ++++ b/drivers/media/dvb-frontends/dib8000.c +@@ -2694,7 +2694,7 @@ static void dib8000_viterbi_state(struct + + static void dib8000_set_dds(struct dib8000_state *state, s32 offset_khz) + { +- s16 unit_khz_dds_val; ++ s32 unit_khz_dds_val; + u32 abs_offset_khz = abs(offset_khz); + u32 dds = state->cfg.pll->ifreq & 0x1ffffff; + u8 invert = !!(state->cfg.pll->ifreq & (1 << 25)); +@@ -2715,7 +2715,7 @@ static void dib8000_set_dds(struct dib80 + dds = (1<<26) - dds; + } else { + ratio = 2; +- unit_khz_dds_val = (u16) (67108864 / state->cfg.pll->internal); ++ unit_khz_dds_val = 67108864 / state->cfg.pll->internal; + + if (offset_khz < 0) + unit_khz_dds_val *= -1; diff --git a/queue-5.10/series b/queue-5.10/series index 392a89a22e..a793e02b2f 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -277,3 +277,5 @@ regulator-max77650-fix-of-node-reference-imbalance.patch media-rc-xbox_remote-heed-dma-restrictions.patch media-rc-streamzap-error-handling-in-probe.patch regulator-act8945a-fix-of-node-reference-imbalance.patch +media-dib8000-avoid-division-by-0-in-dib8000_set_dds.patch +spi-mtk-nor-fix-controller-deregistration.patch diff --git a/queue-5.10/spi-mtk-nor-fix-controller-deregistration.patch b/queue-5.10/spi-mtk-nor-fix-controller-deregistration.patch new file mode 100644 index 0000000000..b5ac2abe7e --- /dev/null +++ b/queue-5.10/spi-mtk-nor-fix-controller-deregistration.patch @@ -0,0 +1,43 @@ +From 76336f24934621db286cabb20b483773ee01dcaa Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 10 Apr 2026 10:17:32 +0200 +Subject: spi: mtk-nor: fix controller deregistration + +From: Johan Hovold + +commit 76336f24934621db286cabb20b483773ee01dcaa upstream. + +Make sure to deregister the controller before disabling underlying +resources like clocks during driver unbind. + +Fixes: 881d1ee9fe81 ("spi: add support for mediatek spi-nor controller") +Cc: stable@vger.kernel.org # 5.7 +Cc: Chuanhong Guo +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260410081757.503099-3-johan@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-mtk-nor.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-mtk-nor.c ++++ b/drivers/spi/spi-mtk-nor.c +@@ -835,7 +835,7 @@ static int mtk_nor_probe(struct platform + pm_runtime_enable(&pdev->dev); + pm_runtime_get_noresume(&pdev->dev); + +- ret = devm_spi_register_controller(&pdev->dev, ctlr); ++ ret = spi_register_controller(ctlr); + if (ret < 0) + goto err_probe; + +@@ -861,6 +861,8 @@ static int mtk_nor_remove(struct platfor + struct spi_controller *ctlr = dev_get_drvdata(&pdev->dev); + struct mtk_nor *sp = spi_controller_get_devdata(ctlr); + ++ spi_unregister_controller(ctlr); ++ + pm_runtime_disable(&pdev->dev); + pm_runtime_set_suspended(&pdev->dev); + pm_runtime_dont_use_autosuspend(&pdev->dev);