From: Greg Kroah-Hartman Date: Mon, 25 May 2020 14:27:19 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.4.225~21 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d525c4ac144177927944e77e9e14ef2ccbecb13f;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: iio-dac-vf610-fix-an-error-handling-path-in-vf610_dac_probe.patch iio-sca3000-remove-an-erroneous-get_device.patch ipack-tpci200-fix-error-return-code-in-tpci200_register.patch mei-release-me_cl-object-reference.patch misc-rtsx-add-short-delay-after-exit-from-aspm.patch rapidio-fix-an-error-in-get_user_pages_fast-error-handling.patch staging-greybus-fix-uninitialized-scalar-variable.patch staging-iio-ad2s1210-fix-spi-reading.patch --- diff --git a/queue-4.19/iio-dac-vf610-fix-an-error-handling-path-in-vf610_dac_probe.patch b/queue-4.19/iio-dac-vf610-fix-an-error-handling-path-in-vf610_dac_probe.patch new file mode 100644 index 00000000000..a6dbb911361 --- /dev/null +++ b/queue-4.19/iio-dac-vf610-fix-an-error-handling-path-in-vf610_dac_probe.patch @@ -0,0 +1,31 @@ +From aad4742fbf0a560c25827adb58695a4497ffc204 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sun, 26 Apr 2020 21:44:03 +0200 +Subject: iio: dac: vf610: Fix an error handling path in 'vf610_dac_probe()' + +From: Christophe JAILLET + +commit aad4742fbf0a560c25827adb58695a4497ffc204 upstream. + +A call to 'vf610_dac_exit()' is missing in an error handling path. + +Fixes: 1b983bf42fad ("iio: dac: vf610_dac: Add IIO DAC driver for Vybrid SoC") +Signed-off-by: Christophe JAILLET +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/dac/vf610_dac.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/dac/vf610_dac.c ++++ b/drivers/iio/dac/vf610_dac.c +@@ -234,6 +234,7 @@ static int vf610_dac_probe(struct platfo + return 0; + + error_iio_device_register: ++ vf610_dac_exit(info); + clk_disable_unprepare(info->clk); + + return ret; diff --git a/queue-4.19/iio-sca3000-remove-an-erroneous-get_device.patch b/queue-4.19/iio-sca3000-remove-an-erroneous-get_device.patch new file mode 100644 index 00000000000..4f2c3643930 --- /dev/null +++ b/queue-4.19/iio-sca3000-remove-an-erroneous-get_device.patch @@ -0,0 +1,36 @@ +From 928edefbc18cd8433f7df235c6e09a9306e7d580 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Wed, 6 May 2020 05:52:06 +0200 +Subject: iio: sca3000: Remove an erroneous 'get_device()' + +From: Christophe JAILLET + +commit 928edefbc18cd8433f7df235c6e09a9306e7d580 upstream. + +This looks really unusual to have a 'get_device()' hidden in a 'dev_err()' +call. +Remove it. + +While at it add a missing \n at the end of the message. + +Fixes: 574fb258d636 ("Staging: IIO: VTI sca3000 series accelerometer driver (spi)") +Signed-off-by: Christophe JAILLET +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/accel/sca3000.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/accel/sca3000.c ++++ b/drivers/iio/accel/sca3000.c +@@ -982,7 +982,7 @@ static int sca3000_read_data(struct sca3 + st->tx[0] = SCA3000_READ_REG(reg_address_high); + ret = spi_sync_transfer(st->us, xfer, ARRAY_SIZE(xfer)); + if (ret) { +- dev_err(get_device(&st->us->dev), "problem reading register"); ++ dev_err(&st->us->dev, "problem reading register\n"); + return ret; + } + diff --git a/queue-4.19/ipack-tpci200-fix-error-return-code-in-tpci200_register.patch b/queue-4.19/ipack-tpci200-fix-error-return-code-in-tpci200_register.patch new file mode 100644 index 00000000000..209cb28e565 --- /dev/null +++ b/queue-4.19/ipack-tpci200-fix-error-return-code-in-tpci200_register.patch @@ -0,0 +1,34 @@ +From 133317479f0324f6faaf797c4f5f3e9b1b36ce35 Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Thu, 7 May 2020 09:42:37 +0000 +Subject: ipack: tpci200: fix error return code in tpci200_register() + +From: Wei Yongjun + +commit 133317479f0324f6faaf797c4f5f3e9b1b36ce35 upstream. + +Fix to return negative error code -ENOMEM from the ioremap() error handling +case instead of 0, as done elsewhere in this function. + +Fixes: 43986798fd50 ("ipack: add error handling for ioremap_nocache") +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Cc: stable +Acked-by: Samuel Iglesias Gonsalvez +Link: https://lore.kernel.org/r/20200507094237.13599-1-weiyongjun1@huawei.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ipack/carriers/tpci200.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/ipack/carriers/tpci200.c ++++ b/drivers/ipack/carriers/tpci200.c +@@ -309,6 +309,7 @@ static int tpci200_register(struct tpci2 + "(bn 0x%X, sn 0x%X) failed to map driver user space!", + tpci200->info->pdev->bus->number, + tpci200->info->pdev->devfn); ++ res = -ENOMEM; + goto out_release_mem8_space; + } + diff --git a/queue-4.19/mei-release-me_cl-object-reference.patch b/queue-4.19/mei-release-me_cl-object-reference.patch new file mode 100644 index 00000000000..a9803a27616 --- /dev/null +++ b/queue-4.19/mei-release-me_cl-object-reference.patch @@ -0,0 +1,45 @@ +From fc9c03ce30f79b71807961bfcb42be191af79873 Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Wed, 13 May 2020 01:31:40 +0300 +Subject: mei: release me_cl object reference +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexander Usyskin + +commit fc9c03ce30f79b71807961bfcb42be191af79873 upstream. + +Allow me_cl object to be freed by releasing the reference +that was acquired by one of the search functions: +__mei_me_cl_by_uuid_id() or __mei_me_cl_by_uuid() + +Cc: +Reported-by: 亿一 +Signed-off-by: Alexander Usyskin +Signed-off-by: Tomas Winkler +Link: https://lore.kernel.org/r/20200512223140.32186-1-tomas.winkler@intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/mei/client.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/misc/mei/client.c ++++ b/drivers/misc/mei/client.c +@@ -276,6 +276,7 @@ void mei_me_cl_rm_by_uuid(struct mei_dev + down_write(&dev->me_clients_rwsem); + me_cl = __mei_me_cl_by_uuid(dev, uuid); + __mei_me_cl_del(dev, me_cl); ++ mei_me_cl_put(me_cl); + up_write(&dev->me_clients_rwsem); + } + +@@ -297,6 +298,7 @@ void mei_me_cl_rm_by_uuid_id(struct mei_ + down_write(&dev->me_clients_rwsem); + me_cl = __mei_me_cl_by_uuid_id(dev, uuid, id); + __mei_me_cl_del(dev, me_cl); ++ mei_me_cl_put(me_cl); + up_write(&dev->me_clients_rwsem); + } + diff --git a/queue-4.19/misc-rtsx-add-short-delay-after-exit-from-aspm.patch b/queue-4.19/misc-rtsx-add-short-delay-after-exit-from-aspm.patch new file mode 100644 index 00000000000..373a2731ce3 --- /dev/null +++ b/queue-4.19/misc-rtsx-add-short-delay-after-exit-from-aspm.patch @@ -0,0 +1,42 @@ +From 7a839dbab1be59f5ed3b3b046de29e166784c9b4 Mon Sep 17 00:00:00 2001 +From: Klaus Doth +Date: Fri, 22 May 2020 12:56:04 +0200 +Subject: misc: rtsx: Add short delay after exit from ASPM + +From: Klaus Doth + +commit 7a839dbab1be59f5ed3b3b046de29e166784c9b4 upstream. + +DMA transfers to and from the SD card stall for 10 seconds and run into +timeout on RTS5260 card readers after ASPM was enabled. + +Adding a short msleep after disabling ASPM fixes the issue on several +Dell Precision 7530/7540 systems I tested. + +This function is only called when waking up after the chip went into +power-save after not transferring data for a few seconds. The added +msleep does therefore not change anything in data transfer speed or +induce any excessive waiting while data transfers are running, or the +chip is sleeping. Only the transition from sleep to active is affected. + +Signed-off-by: Klaus Doth +Cc: stable +Link: https://lore.kernel.org/r/4434eaa7-2ee3-a560-faee-6cee63ebd6d4@doth.eu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/cardreader/rtsx_pcr.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/misc/cardreader/rtsx_pcr.c ++++ b/drivers/misc/cardreader/rtsx_pcr.c +@@ -155,6 +155,9 @@ static void rtsx_comm_pm_full_on(struct + + rtsx_disable_aspm(pcr); + ++ /* Fixes DMA transfer timout issue after disabling ASPM on RTS5260 */ ++ msleep(1); ++ + if (option->ltr_enabled) + rtsx_set_ltr_latency(pcr, option->ltr_active_latency); + diff --git a/queue-4.19/rapidio-fix-an-error-in-get_user_pages_fast-error-handling.patch b/queue-4.19/rapidio-fix-an-error-in-get_user_pages_fast-error-handling.patch new file mode 100644 index 00000000000..aad5ef0d6a0 --- /dev/null +++ b/queue-4.19/rapidio-fix-an-error-in-get_user_pages_fast-error-handling.patch @@ -0,0 +1,48 @@ +From ffca476a0a8d26de767cc41d62b8ca7f540ecfdd Mon Sep 17 00:00:00 2001 +From: John Hubbard +Date: Fri, 22 May 2020 22:22:48 -0700 +Subject: rapidio: fix an error in get_user_pages_fast() error handling + +From: John Hubbard + +commit ffca476a0a8d26de767cc41d62b8ca7f540ecfdd upstream. + +In the case of get_user_pages_fast() returning fewer pages than +requested, rio_dma_transfer() does not quite do the right thing. It +attempts to release all the pages that were requested, rather than just +the pages that were pinned. + +Fix the error handling so that only the pages that were successfully +pinned are released. + +Fixes: e8de370188d0 ("rapidio: add mport char device driver") +Signed-off-by: John Hubbard +Signed-off-by: Andrew Morton +Reviewed-by: Andrew Morton +Cc: Matt Porter +Cc: Alexandre Bounine +Cc: Sumit Semwal +Cc: Dan Carpenter +Cc: +Link: http://lkml.kernel.org/r/20200517235620.205225-2-jhubbard@nvidia.com +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rapidio/devices/rio_mport_cdev.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/rapidio/devices/rio_mport_cdev.c ++++ b/drivers/rapidio/devices/rio_mport_cdev.c +@@ -879,6 +879,11 @@ rio_dma_transfer(struct file *filp, u32 + rmcd_error("pinned %ld out of %ld pages", + pinned, nr_pages); + ret = -EFAULT; ++ /* ++ * Set nr_pages up to mean "how many pages to unpin, in ++ * the error handler: ++ */ ++ nr_pages = pinned; + goto err_pg; + } + diff --git a/queue-4.19/series b/queue-4.19/series index 1c1c130eb04..ff986a0cbc5 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -64,3 +64,11 @@ cxgb4-cxgb4vf-fix-mac_hlist-initialization-and-free.patch tty-serial-qcom_geni_serial-fix-wrap-around-of-tx-bu.patch brcmfmac-abort-and-release-host-after-error.patch revert-gfs2-don-t-demote-a-glock-until-its-revokes-a.patch +staging-iio-ad2s1210-fix-spi-reading.patch +staging-greybus-fix-uninitialized-scalar-variable.patch +iio-sca3000-remove-an-erroneous-get_device.patch +iio-dac-vf610-fix-an-error-handling-path-in-vf610_dac_probe.patch +misc-rtsx-add-short-delay-after-exit-from-aspm.patch +mei-release-me_cl-object-reference.patch +ipack-tpci200-fix-error-return-code-in-tpci200_register.patch +rapidio-fix-an-error-in-get_user_pages_fast-error-handling.patch diff --git a/queue-4.19/staging-greybus-fix-uninitialized-scalar-variable.patch b/queue-4.19/staging-greybus-fix-uninitialized-scalar-variable.patch new file mode 100644 index 00000000000..9ffe1c52b2d --- /dev/null +++ b/queue-4.19/staging-greybus-fix-uninitialized-scalar-variable.patch @@ -0,0 +1,42 @@ +From 34625c1931f8204c234c532b446b9f53c69f4b68 Mon Sep 17 00:00:00 2001 +From: Oscar Carter +Date: Sun, 10 May 2020 12:14:26 +0200 +Subject: staging: greybus: Fix uninitialized scalar variable + +From: Oscar Carter + +commit 34625c1931f8204c234c532b446b9f53c69f4b68 upstream. + +In the "gb_tty_set_termios" function the "newline" variable is declared +but not initialized. So the "flow_control" member is not initialized and +the OR / AND operations with itself results in an undefined value in +this member. + +The purpose of the code is to set the flow control type, so remove the +OR / AND self operator and set the value directly. + +Addresses-Coverity-ID: 1374016 ("Uninitialized scalar variable") +Fixes: e55c25206d5c9 ("greybus: uart: Handle CRTSCTS flag in termios") +Signed-off-by: Oscar Carter +Cc: stable +Link: https://lore.kernel.org/r/20200510101426.23631-1-oscar.carter@gmx.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/greybus/uart.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/staging/greybus/uart.c ++++ b/drivers/staging/greybus/uart.c +@@ -537,9 +537,9 @@ static void gb_tty_set_termios(struct tt + } + + if (C_CRTSCTS(tty) && C_BAUD(tty) != B0) +- newline.flow_control |= GB_SERIAL_AUTO_RTSCTS_EN; ++ newline.flow_control = GB_SERIAL_AUTO_RTSCTS_EN; + else +- newline.flow_control &= ~GB_SERIAL_AUTO_RTSCTS_EN; ++ newline.flow_control = 0; + + if (memcmp(&gb_tty->line_coding, &newline, sizeof(newline))) { + memcpy(&gb_tty->line_coding, &newline, sizeof(newline)); diff --git a/queue-4.19/staging-iio-ad2s1210-fix-spi-reading.patch b/queue-4.19/staging-iio-ad2s1210-fix-spi-reading.patch new file mode 100644 index 00000000000..9550e736b4e --- /dev/null +++ b/queue-4.19/staging-iio-ad2s1210-fix-spi-reading.patch @@ -0,0 +1,63 @@ +From 5e4f99a6b788047b0b8a7496c2e0c8f372f6edf2 Mon Sep 17 00:00:00 2001 +From: Dragos Bogdan +Date: Wed, 29 Apr 2020 10:21:29 +0300 +Subject: staging: iio: ad2s1210: Fix SPI reading + +From: Dragos Bogdan + +commit 5e4f99a6b788047b0b8a7496c2e0c8f372f6edf2 upstream. + +If the serial interface is used, the 8-bit address should be latched using +the rising edge of the WR/FSYNC signal. + +This basically means that a CS change is required between the first byte +sent, and the second one. +This change splits the single-transfer transfer of 2 bytes into 2 transfers +with a single byte, and CS change in-between. + +Note fixes tag is not accurate, but reflects a point beyond which there +are too many refactors to make backporting straight forward. + +Fixes: b19e9ad5e2cb ("staging:iio:resolver:ad2s1210 general driver cleanup.") +Signed-off-by: Dragos Bogdan +Signed-off-by: Alexandru Ardelean +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/iio/resolver/ad2s1210.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/drivers/staging/iio/resolver/ad2s1210.c ++++ b/drivers/staging/iio/resolver/ad2s1210.c +@@ -114,17 +114,24 @@ static int ad2s1210_config_write(struct + static int ad2s1210_config_read(struct ad2s1210_state *st, + unsigned char address) + { +- struct spi_transfer xfer = { +- .len = 2, +- .rx_buf = st->rx, +- .tx_buf = st->tx, ++ struct spi_transfer xfers[] = { ++ { ++ .len = 1, ++ .rx_buf = &st->rx[0], ++ .tx_buf = &st->tx[0], ++ .cs_change = 1, ++ }, { ++ .len = 1, ++ .rx_buf = &st->rx[1], ++ .tx_buf = &st->tx[1], ++ }, + }; + int ret = 0; + + ad2s1210_set_mode(MOD_CONFIG, st); + st->tx[0] = address | AD2S1210_MSB_IS_HIGH; + st->tx[1] = AD2S1210_REG_FAULT; +- ret = spi_sync_transfer(st->sdev, &xfer, 1); ++ ret = spi_sync_transfer(st->sdev, xfers, 2); + if (ret < 0) + return ret; +