From: Sasha Levin Date: Mon, 4 Jan 2021 15:53:14 +0000 (-0500) Subject: Fixes for 4.19 X-Git-Tag: v4.19.165~6 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a6696e9e276054e9f4949bb8ca7a410927cf8aa3;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/alsa-pcm-clear-the-full-allocated-memory-at-hw_param.patch b/queue-4.19/alsa-pcm-clear-the-full-allocated-memory-at-hw_param.patch new file mode 100644 index 00000000000..0afb2e74b83 --- /dev/null +++ b/queue-4.19/alsa-pcm-clear-the-full-allocated-memory-at-hw_param.patch @@ -0,0 +1,52 @@ +From 19691959c7f71e2025ee950dfc24634d0746ccec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Dec 2020 15:56:25 +0100 +Subject: ALSA: pcm: Clear the full allocated memory at hw_params + +From: Takashi Iwai + +[ Upstream commit 618de0f4ef11acd8cf26902e65493d46cc20cc89 ] + +The PCM hw_params core function tries to clear up the PCM buffer +before actually using for avoiding the information leak from the +previous usages or the usage before a new allocation. It performs the +memset() with runtime->dma_bytes, but this might still leave some +remaining bytes untouched; namely, the PCM buffer size is aligned in +page size for mmap, hence runtime->dma_bytes doesn't necessarily cover +all PCM buffer pages, and the remaining bytes are exposed via mmap. + +This patch changes the memory clearance to cover the all buffer pages +if the stream is supposed to be mmap-ready (that guarantees that the +buffer size is aligned in page size). + +Reviewed-by: Lars-Peter Clausen +Link: https://lore.kernel.org/r/20201218145625.2045-3-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/pcm_native.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index 7c12b0deb4eb5..db62dbe7eaa8a 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -753,8 +753,13 @@ static int snd_pcm_hw_params(struct snd_pcm_substream *substream, + runtime->boundary *= 2; + + /* clear the buffer for avoiding possible kernel info leaks */ +- if (runtime->dma_area && !substream->ops->copy_user) +- memset(runtime->dma_area, 0, runtime->dma_bytes); ++ if (runtime->dma_area && !substream->ops->copy_user) { ++ size_t size = runtime->dma_bytes; ++ ++ if (runtime->info & SNDRV_PCM_INFO_MMAP) ++ size = PAGE_ALIGN(size); ++ memset(runtime->dma_area, 0, size); ++ } + + snd_pcm_timer_resolution_change(substream); + snd_pcm_set_state(substream, SNDRV_PCM_STATE_SETUP); +-- +2.27.0 + diff --git a/queue-4.19/dm-verity-skip-verity-work-if-i-o-error-when-system-.patch b/queue-4.19/dm-verity-skip-verity-work-if-i-o-error-when-system-.patch new file mode 100644 index 00000000000..68e85cb7097 --- /dev/null +++ b/queue-4.19/dm-verity-skip-verity-work-if-i-o-error-when-system-.patch @@ -0,0 +1,59 @@ +From ee731d9fd38fd7f6d07085efc19942596960b26b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Dec 2020 09:46:59 +0900 +Subject: dm verity: skip verity work if I/O error when system is shutting down + +From: Hyeongseok Kim + +[ Upstream commit 252bd1256396cebc6fc3526127fdb0b317601318 ] + +If emergency system shutdown is called, like by thermal shutdown, +a dm device could be alive when the block device couldn't process +I/O requests anymore. In this state, the handling of I/O errors +by new dm I/O requests or by those already in-flight can lead to +a verity corruption state, which is a misjudgment. + +So, skip verity work in response to I/O error when system is shutting +down. + +Signed-off-by: Hyeongseok Kim +Reviewed-by: Sami Tolvanen +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-verity-target.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c +index e3599b43f9eb9..599be2d2b0ae9 100644 +--- a/drivers/md/dm-verity-target.c ++++ b/drivers/md/dm-verity-target.c +@@ -533,6 +533,15 @@ static int verity_verify_io(struct dm_verity_io *io) + return 0; + } + ++/* ++ * Skip verity work in response to I/O error when system is shutting down. ++ */ ++static inline bool verity_is_system_shutting_down(void) ++{ ++ return system_state == SYSTEM_HALT || system_state == SYSTEM_POWER_OFF ++ || system_state == SYSTEM_RESTART; ++} ++ + /* + * End one "io" structure with a given error. + */ +@@ -560,7 +569,8 @@ static void verity_end_io(struct bio *bio) + { + struct dm_verity_io *io = bio->bi_private; + +- if (bio->bi_status && !verity_fec_is_enabled(io->v)) { ++ if (bio->bi_status && ++ (!verity_fec_is_enabled(io->v) || verity_is_system_shutting_down())) { + verity_finish_io(io, bio->bi_status); + return; + } +-- +2.27.0 + diff --git a/queue-4.19/module-delay-kobject-uevent-until-after-module-init-.patch b/queue-4.19/module-delay-kobject-uevent-until-after-module-init-.patch new file mode 100644 index 00000000000..ab10a7d59fb --- /dev/null +++ b/queue-4.19/module-delay-kobject-uevent-until-after-module-init-.patch @@ -0,0 +1,72 @@ +From 622d90da86f971d7e2b7eceaed02db9248f52da3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Nov 2020 10:09:39 +0100 +Subject: module: delay kobject uevent until after module init call + +From: Jessica Yu + +[ Upstream commit 38dc717e97153e46375ee21797aa54777e5498f3 ] + +Apparently there has been a longstanding race between udev/systemd and +the module loader. Currently, the module loader sends a uevent right +after sysfs initialization, but before the module calls its init +function. However, some udev rules expect that the module has +initialized already upon receiving the uevent. + +This race has been triggered recently (see link in references) in some +systemd mount unit files. For instance, the configfs module creates the +/sys/kernel/config mount point in its init function, however the module +loader issues the uevent before this happens. sys-kernel-config.mount +expects to be able to mount /sys/kernel/config upon receipt of the +module loading uevent, but if the configfs module has not called its +init function yet, then this directory will not exist and the mount unit +fails. A similar situation exists for sys-fs-fuse-connections.mount, as +the fuse sysfs mount point is created during the fuse module's init +function. If udev is faster than module initialization then the mount +unit would fail in a similar fashion. + +To fix this race, delay the module KOBJ_ADD uevent until after the +module has finished calling its init routine. + +References: https://github.com/systemd/systemd/issues/17586 +Reviewed-by: Greg Kroah-Hartman +Tested-By: Nicolas Morey-Chaisemartin +Signed-off-by: Jessica Yu +Signed-off-by: Sasha Levin +--- + kernel/module.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/kernel/module.c b/kernel/module.c +index 8dbe0ff22134e..429769605871d 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -1806,7 +1806,6 @@ static int mod_sysfs_init(struct module *mod) + if (err) + mod_kobject_put(mod); + +- /* delay uevent until full sysfs population */ + out: + return err; + } +@@ -1843,7 +1842,6 @@ static int mod_sysfs_setup(struct module *mod, + add_sect_attrs(mod, info); + add_notes_attrs(mod, info); + +- kobject_uevent(&mod->mkobj.kobj, KOBJ_ADD); + return 0; + + out_unreg_modinfo_attrs: +@@ -3499,6 +3497,9 @@ static noinline int do_init_module(struct module *mod) + blocking_notifier_call_chain(&module_notify_list, + MODULE_STATE_LIVE, mod); + ++ /* Delay uevent until module has finished its init routine */ ++ kobject_uevent(&mod->mkobj.kobj, KOBJ_ADD); ++ + /* + * We need to finish all async code before the module init sequence + * is done. This has potential to deadlock. For example, a newly +-- +2.27.0 + diff --git a/queue-4.19/module-set-module_state_going-state-when-a-module-fa.patch b/queue-4.19/module-set-module_state_going-state-when-a-module-fa.patch new file mode 100644 index 00000000000..cf3e012ae40 --- /dev/null +++ b/queue-4.19/module-set-module_state_going-state-when-a-module-fa.patch @@ -0,0 +1,36 @@ +From 0ae2ed4e95318c9b4a8b3886e2e38a1edcf8eb42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Oct 2020 15:03:36 +0100 +Subject: module: set MODULE_STATE_GOING state when a module fails to load + +From: Miroslav Benes + +[ Upstream commit 5e8ed280dab9eeabc1ba0b2db5dbe9fe6debb6b5 ] + +If a module fails to load due to an error in prepare_coming_module(), +the following error handling in load_module() runs with +MODULE_STATE_COMING in module's state. Fix it by correctly setting +MODULE_STATE_GOING under "bug_cleanup" label. + +Signed-off-by: Miroslav Benes +Signed-off-by: Jessica Yu +Signed-off-by: Sasha Levin +--- + kernel/module.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/kernel/module.c b/kernel/module.c +index d05e1bfdd3559..8dbe0ff22134e 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -3841,6 +3841,7 @@ static int load_module(struct load_info *info, const char __user *uargs, + MODULE_STATE_GOING, mod); + klp_module_going(mod); + bug_cleanup: ++ mod->state = MODULE_STATE_GOING; + /* module_bug_cleanup needs module_mutex protection */ + mutex_lock(&module_mutex); + module_bug_cleanup(mod); +-- +2.27.0 + diff --git a/queue-4.19/nfsv4-fix-a-pnfs-layout-related-use-after-free-race-.patch b/queue-4.19/nfsv4-fix-a-pnfs-layout-related-use-after-free-race-.patch new file mode 100644 index 00000000000..389f80551fa --- /dev/null +++ b/queue-4.19/nfsv4-fix-a-pnfs-layout-related-use-after-free-race-.patch @@ -0,0 +1,131 @@ +From c47c2ec8fdf04e303d7d84cddf11bec974f81233 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 12:06:14 -0500 +Subject: NFSv4: Fix a pNFS layout related use-after-free race when freeing the + inode + +From: Trond Myklebust + +[ Upstream commit b6d49ecd1081740b6e632366428b960461f8158b ] + +When returning the layout in nfs4_evict_inode(), we need to ensure that +the layout is actually done being freed before we can proceed to free the +inode itself. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4super.c | 2 +- + fs/nfs/pnfs.c | 33 +++++++++++++++++++++++++++++++-- + fs/nfs/pnfs.h | 5 +++++ + 3 files changed, 37 insertions(+), 3 deletions(-) + +diff --git a/fs/nfs/nfs4super.c b/fs/nfs/nfs4super.c +index 6fb7cb6b3f4b0..e7a10f5f54057 100644 +--- a/fs/nfs/nfs4super.c ++++ b/fs/nfs/nfs4super.c +@@ -95,7 +95,7 @@ static void nfs4_evict_inode(struct inode *inode) + nfs_inode_return_delegation_noreclaim(inode); + /* Note that above delegreturn would trigger pnfs return-on-close */ + pnfs_return_layout(inode); +- pnfs_destroy_layout(NFS_I(inode)); ++ pnfs_destroy_layout_final(NFS_I(inode)); + /* First call standard NFS clear_inode() code */ + nfs_clear_inode(inode); + } +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index 2b9e139a29975..a253384a4710b 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -294,6 +294,7 @@ void + pnfs_put_layout_hdr(struct pnfs_layout_hdr *lo) + { + struct inode *inode; ++ unsigned long i_state; + + if (!lo) + return; +@@ -304,8 +305,12 @@ pnfs_put_layout_hdr(struct pnfs_layout_hdr *lo) + if (!list_empty(&lo->plh_segs)) + WARN_ONCE(1, "NFS: BUG unfreed layout segments.\n"); + pnfs_detach_layout_hdr(lo); ++ i_state = inode->i_state; + spin_unlock(&inode->i_lock); + pnfs_free_layout_hdr(lo); ++ /* Notify pnfs_destroy_layout_final() that we're done */ ++ if (i_state & (I_FREEING | I_CLEAR)) ++ wake_up_var(lo); + } + } + +@@ -713,8 +718,7 @@ pnfs_free_lseg_list(struct list_head *free_me) + } + } + +-void +-pnfs_destroy_layout(struct nfs_inode *nfsi) ++static struct pnfs_layout_hdr *__pnfs_destroy_layout(struct nfs_inode *nfsi) + { + struct pnfs_layout_hdr *lo; + LIST_HEAD(tmp_list); +@@ -732,9 +736,34 @@ pnfs_destroy_layout(struct nfs_inode *nfsi) + pnfs_put_layout_hdr(lo); + } else + spin_unlock(&nfsi->vfs_inode.i_lock); ++ return lo; ++} ++ ++void pnfs_destroy_layout(struct nfs_inode *nfsi) ++{ ++ __pnfs_destroy_layout(nfsi); + } + EXPORT_SYMBOL_GPL(pnfs_destroy_layout); + ++static bool pnfs_layout_removed(struct nfs_inode *nfsi, ++ struct pnfs_layout_hdr *lo) ++{ ++ bool ret; ++ ++ spin_lock(&nfsi->vfs_inode.i_lock); ++ ret = nfsi->layout != lo; ++ spin_unlock(&nfsi->vfs_inode.i_lock); ++ return ret; ++} ++ ++void pnfs_destroy_layout_final(struct nfs_inode *nfsi) ++{ ++ struct pnfs_layout_hdr *lo = __pnfs_destroy_layout(nfsi); ++ ++ if (lo) ++ wait_var_event(lo, pnfs_layout_removed(nfsi, lo)); ++} ++ + static bool + pnfs_layout_add_bulk_destroy_list(struct inode *inode, + struct list_head *layout_list) +diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h +index 3ba44819a88ae..80fafa29e567a 100644 +--- a/fs/nfs/pnfs.h ++++ b/fs/nfs/pnfs.h +@@ -254,6 +254,7 @@ struct pnfs_layout_segment *pnfs_layout_process(struct nfs4_layoutget *lgp); + void pnfs_layoutget_free(struct nfs4_layoutget *lgp); + void pnfs_free_lseg_list(struct list_head *tmp_list); + void pnfs_destroy_layout(struct nfs_inode *); ++void pnfs_destroy_layout_final(struct nfs_inode *); + void pnfs_destroy_all_layouts(struct nfs_client *); + int pnfs_destroy_layouts_byfsid(struct nfs_client *clp, + struct nfs_fsid *fsid, +@@ -645,6 +646,10 @@ static inline void pnfs_destroy_layout(struct nfs_inode *nfsi) + { + } + ++static inline void pnfs_destroy_layout_final(struct nfs_inode *nfsi) ++{ ++} ++ + static inline struct pnfs_layout_segment * + pnfs_get_lseg(struct pnfs_layout_segment *lseg) + { +-- +2.27.0 + diff --git a/queue-4.19/powerpc-sysdev-add-missing-iounmap-on-error-in-mpic_.patch b/queue-4.19/powerpc-sysdev-add-missing-iounmap-on-error-in-mpic_.patch new file mode 100644 index 00000000000..898327d02e2 --- /dev/null +++ b/queue-4.19/powerpc-sysdev-add-missing-iounmap-on-error-in-mpic_.patch @@ -0,0 +1,39 @@ +From 1fe16d16556e5b909c9cdc153caca511e89df1c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 17:15:51 +0800 +Subject: powerpc: sysdev: add missing iounmap() on error in mpic_msgr_probe() + +From: Qinglang Miao + +[ Upstream commit ffa1797040c5da391859a9556be7b735acbe1242 ] + +I noticed that iounmap() of msgr_block_addr before return from +mpic_msgr_probe() in the error handling case is missing. So use +devm_ioremap() instead of just ioremap() when remapping the message +register block, so the mapping will be automatically released on +probe failure. + +Signed-off-by: Qinglang Miao +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20201028091551.136400-1-miaoqinglang@huawei.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/sysdev/mpic_msgr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/sysdev/mpic_msgr.c b/arch/powerpc/sysdev/mpic_msgr.c +index 280e964e1aa88..497e86cfb12e0 100644 +--- a/arch/powerpc/sysdev/mpic_msgr.c ++++ b/arch/powerpc/sysdev/mpic_msgr.c +@@ -196,7 +196,7 @@ static int mpic_msgr_probe(struct platform_device *dev) + + /* IO map the message register block. */ + of_address_to_resource(np, 0, &rsrc); +- msgr_block_addr = ioremap(rsrc.start, resource_size(&rsrc)); ++ msgr_block_addr = devm_ioremap(&dev->dev, rsrc.start, resource_size(&rsrc)); + if (!msgr_block_addr) { + dev_err(&dev->dev, "Failed to iomap MPIC message registers"); + return -EFAULT; +-- +2.27.0 + diff --git a/queue-4.19/quota-don-t-overflow-quota-file-offsets.patch b/queue-4.19/quota-don-t-overflow-quota-file-offsets.patch new file mode 100644 index 00000000000..472d1caabe6 --- /dev/null +++ b/queue-4.19/quota-don-t-overflow-quota-file-offsets.patch @@ -0,0 +1,66 @@ +From 0cc3ad0a62b1c4457189240ccab8ceae916ca81c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Nov 2020 16:32:10 +0100 +Subject: quota: Don't overflow quota file offsets + +From: Jan Kara + +[ Upstream commit 10f04d40a9fa29785206c619f80d8beedb778837 ] + +The on-disk quota format supports quota files with upto 2^32 blocks. Be +careful when computing quota file offsets in the quota files from block +numbers as they can overflow 32-bit types. Since quota files larger than +4GB would require ~26 millions of quota users, this is mostly a +theoretical concern now but better be careful, fuzzers would find the +problem sooner or later anyway... + +Reviewed-by: Andreas Dilger +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/quota/quota_tree.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/fs/quota/quota_tree.c b/fs/quota/quota_tree.c +index bb3f59bcfcf5b..656f9ff63edda 100644 +--- a/fs/quota/quota_tree.c ++++ b/fs/quota/quota_tree.c +@@ -61,7 +61,7 @@ static ssize_t read_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf) + + memset(buf, 0, info->dqi_usable_bs); + return sb->s_op->quota_read(sb, info->dqi_type, buf, +- info->dqi_usable_bs, blk << info->dqi_blocksize_bits); ++ info->dqi_usable_bs, (loff_t)blk << info->dqi_blocksize_bits); + } + + static ssize_t write_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf) +@@ -70,7 +70,7 @@ static ssize_t write_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf) + ssize_t ret; + + ret = sb->s_op->quota_write(sb, info->dqi_type, buf, +- info->dqi_usable_bs, blk << info->dqi_blocksize_bits); ++ info->dqi_usable_bs, (loff_t)blk << info->dqi_blocksize_bits); + if (ret != info->dqi_usable_bs) { + quota_error(sb, "dquota write failed"); + if (ret >= 0) +@@ -283,7 +283,7 @@ static uint find_free_dqentry(struct qtree_mem_dqinfo *info, + blk); + goto out_buf; + } +- dquot->dq_off = (blk << info->dqi_blocksize_bits) + ++ dquot->dq_off = ((loff_t)blk << info->dqi_blocksize_bits) + + sizeof(struct qt_disk_dqdbheader) + + i * info->dqi_entry_size; + kfree(buf); +@@ -558,7 +558,7 @@ static loff_t find_block_dqentry(struct qtree_mem_dqinfo *info, + ret = -EIO; + goto out_buf; + } else { +- ret = (blk << info->dqi_blocksize_bits) + sizeof(struct ++ ret = ((loff_t)blk << info->dqi_blocksize_bits) + sizeof(struct + qt_disk_dqdbheader) + i * info->dqi_entry_size; + } + out_buf: +-- +2.27.0 + diff --git a/queue-4.19/rtc-sun6i-fix-memleak-in-sun6i_rtc_clk_init.patch b/queue-4.19/rtc-sun6i-fix-memleak-in-sun6i_rtc_clk_init.patch new file mode 100644 index 00000000000..03e9b26eb52 --- /dev/null +++ b/queue-4.19/rtc-sun6i-fix-memleak-in-sun6i_rtc_clk_init.patch @@ -0,0 +1,65 @@ +From 7dc1c28bf36e34f8ff98d63b0d4107f5a6bb9cc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Oct 2020 14:12:26 +0800 +Subject: rtc: sun6i: Fix memleak in sun6i_rtc_clk_init + +From: Dinghao Liu + +[ Upstream commit 28d211919e422f58c1e6c900e5810eee4f1ce4c8 ] + +When clk_hw_register_fixed_rate_with_accuracy() fails, +clk_data should be freed. It's the same for the subsequent +two error paths, but we should also unregister the already +registered clocks in them. + +Signed-off-by: Dinghao Liu +Signed-off-by: Alexandre Belloni +Link: https://lore.kernel.org/r/20201020061226.6572-1-dinghao.liu@zju.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-sun6i.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/rtc/rtc-sun6i.c b/drivers/rtc/rtc-sun6i.c +index 2cd5a7b1a2e30..e85abe8056064 100644 +--- a/drivers/rtc/rtc-sun6i.c ++++ b/drivers/rtc/rtc-sun6i.c +@@ -232,7 +232,7 @@ static void __init sun6i_rtc_clk_init(struct device_node *node) + 300000000); + if (IS_ERR(rtc->int_osc)) { + pr_crit("Couldn't register the internal oscillator\n"); +- return; ++ goto err; + } + + parents[0] = clk_hw_get_name(rtc->int_osc); +@@ -248,7 +248,7 @@ static void __init sun6i_rtc_clk_init(struct device_node *node) + rtc->losc = clk_register(NULL, &rtc->hw); + if (IS_ERR(rtc->losc)) { + pr_crit("Couldn't register the LOSC clock\n"); +- return; ++ goto err_register; + } + + of_property_read_string_index(node, "clock-output-names", 1, +@@ -259,7 +259,7 @@ static void __init sun6i_rtc_clk_init(struct device_node *node) + &rtc->lock); + if (IS_ERR(rtc->ext_losc)) { + pr_crit("Couldn't register the LOSC external gate\n"); +- return; ++ goto err_register; + } + + clk_data->num = 2; +@@ -268,6 +268,8 @@ static void __init sun6i_rtc_clk_init(struct device_node *node) + of_clk_add_hw_provider(node, of_clk_hw_onecell_get, clk_data); + return; + ++err_register: ++ clk_hw_unregister_fixed_rate(rtc->int_osc); + err: + kfree(clk_data); + } +-- +2.27.0 + diff --git a/queue-4.19/series b/queue-4.19/series index 5dbfe731e42..30ab2df7bdb 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -25,3 +25,11 @@ media-gp8psk-initialize-stats-at-power-control-logic.patch alsa-seq-use-bool-for-snd_seq_queue-internal-flags.patch alsa-rawmidi-access-runtime-avail-always-in-spinlock.patch fcntl-fix-potential-deadlock-in-send_sig-io-urg.patch +rtc-sun6i-fix-memleak-in-sun6i_rtc_clk_init.patch +module-set-module_state_going-state-when-a-module-fa.patch +quota-don-t-overflow-quota-file-offsets.patch +powerpc-sysdev-add-missing-iounmap-on-error-in-mpic_.patch +nfsv4-fix-a-pnfs-layout-related-use-after-free-race-.patch +module-delay-kobject-uevent-until-after-module-init-.patch +alsa-pcm-clear-the-full-allocated-memory-at-hw_param.patch +dm-verity-skip-verity-work-if-i-o-error-when-system-.patch