Merge tag 'char-misc-4.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc driver fixes from Greg KH:
 "Here are some small fixes for some misc drivers that resolve some
  reported issues.  All of these have been linux-next for a while"

* tag 'char-misc-4.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  mcb: Fix error handling in mcb_pci_probe()
  mei: hbm: fix error in state check logic
  nvmem: sunxi: Check for memory allocation failure
  nvmem: core: Fix memory leak in nvmem_cell_write
  nvmem: core: Handle shift bits in-place if cell->nbits is non-zero
  nvmem: core: fix the out-of-range leak in read/write()

4 files changed, 19 insertions, 8 deletions

diff --git a/drivers/mcb/mcb-pci.c b/drivers/mcb/mcb-pci.c
index de36237d7c6b..051645498b53 100644
--- a/drivers/mcb/mcb-pci.c
+++ b/drivers/mcb/mcb-pci.c
@@ -74,7 +74,7 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                 ret = -ENOTSUPP;
                 dev_err(&pdev->dev,
                         "IO mapped PCI devices are not supported\n");
-                goto out_release;
+                goto out_iounmap;
         }
 
         pci_set_drvdata(pdev, priv);
@@ -89,7 +89,7 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         ret = chameleon_parse_cells(priv->bus, priv->mapbase, priv->base);
         if (ret < 0)
-                goto out_iounmap;
+                goto out_mcb_bus;
         num_cells = ret;
 
         dev_dbg(&pdev->dev, "Found %d cells\n", num_cells);
@@ -98,6 +98,8 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 
         return 0;
 
+out_mcb_bus:
+        mcb_release_bus(priv->bus);
 out_iounmap:
         iounmap(priv->base);
 out_release:
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index 8eec887c8f70..6d7c188fb65c 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -1209,7 +1209,7 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
                  * after the host receives the enum_resp
                  * message clients may be added or removed
                  */
-                if (dev->hbm_state <= MEI_HBM_ENUM_CLIENTS &&
+                if (dev->hbm_state <= MEI_HBM_ENUM_CLIENTS ||
                     dev->hbm_state >= MEI_HBM_STOPPED) {
                         dev_err(dev->dev, "hbm: add client: state mismatch, [%d, %d]\n",
                                 dev->dev_state, dev->hbm_state);
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index d3c6676b3c0c..6fd4e5a5ef4a 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -67,7 +67,7 @@ static ssize_t bin_attr_nvmem_read(struct file *filp, struct kobject *kobj,
         int rc;
 
         /* Stop the user from reading */
-        if (pos > nvmem->size)
+        if (pos >= nvmem->size)
                 return 0;
 
         if (pos + count > nvmem->size)
@@ -92,7 +92,7 @@ static ssize_t bin_attr_nvmem_write(struct file *filp, struct kobject *kobj,
         int rc;
 
         /* Stop the user from writing */
-        if (pos > nvmem->size)
+        if (pos >= nvmem->size)
                 return 0;
 
         if (pos + count > nvmem->size)
@@ -825,7 +825,7 @@ static int __nvmem_cell_read(struct nvmem_device *nvmem,
                 return rc;
 
         /* shift bits in-place */
-        if (cell->bit_offset || cell->bit_offset)
+        if (cell->bit_offset || cell->nbits)
                 nvmem_shift_read_buffer_in_place(cell, buf);
 
         *len = cell->bytes;
@@ -938,7 +938,7 @@ int nvmem_cell_write(struct nvmem_cell *cell, void *buf, size_t len)
         rc = regmap_raw_write(nvmem->regmap, cell->offset, buf, cell->bytes);
 
         /* free the tmp buffer */
-        if (cell->bit_offset)
+        if (cell->bit_offset || cell->nbits)
                 kfree(buf);
 
         if (IS_ERR_VALUE(rc))
diff --git a/drivers/nvmem/sunxi_sid.c b/drivers/nvmem/sunxi_sid.c
index 14777dd5212d..cfa3b85064dd 100644
--- a/drivers/nvmem/sunxi_sid.c
+++ b/drivers/nvmem/sunxi_sid.c
@@ -103,7 +103,7 @@ static int sunxi_sid_probe(struct platform_device *pdev)
         struct nvmem_device *nvmem;
         struct regmap *regmap;
         struct sunxi_sid *sid;
-        int i, size;
+        int ret, i, size;
         char *randomness;
 
         sid = devm_kzalloc(dev, sizeof(*sid), GFP_KERNEL);
@@ -131,6 +131,11 @@ static int sunxi_sid_probe(struct platform_device *pdev)
                 return PTR_ERR(nvmem);
 
         randomness = kzalloc(sizeof(u8) * size, GFP_KERNEL);
+        if (!randomness) {
+                ret = -EINVAL;
+                goto err_unreg_nvmem;
+        }
+
         for (i = 0; i < size; i++)
                 randomness[i] = sunxi_sid_read_byte(sid, i);
 
@@ -140,6 +145,10 @@ static int sunxi_sid_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, nvmem);
 
         return 0;
+
+err_unreg_nvmem:
+        nvmem_unregister(nvmem);
+        return ret;
 }
 
 static int sunxi_sid_remove(struct platform_device *pdev)