Contents of /trunk/kernel-alx-legacy/patches-4.9/0369-4.9.270-all-fixes.patch
Parent Directory | Revision Log
Revision 3671 -
(show annotations)
(download)
Mon Oct 24 14:07:48 2022 UTC (23 months ago) by niro
File size: 31101 byte(s)
Mon Oct 24 14:07:48 2022 UTC (23 months ago) by niro
File size: 31101 byte(s)
-linux-4.9.270
1 | diff --git a/Makefile b/Makefile |
2 | index 94436a50dc9fb..e8313ffb8af98 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,6 +1,6 @@ |
6 | VERSION = 4 |
7 | PATCHLEVEL = 9 |
8 | -SUBLEVEL = 269 |
9 | +SUBLEVEL = 270 |
10 | EXTRAVERSION = |
11 | NAME = Roaring Lionus |
12 | |
13 | diff --git a/arch/openrisc/kernel/setup.c b/arch/openrisc/kernel/setup.c |
14 | index b4ed8b36e078d..e5f5b69a7b7bd 100644 |
15 | --- a/arch/openrisc/kernel/setup.c |
16 | +++ b/arch/openrisc/kernel/setup.c |
17 | @@ -278,6 +278,8 @@ void calibrate_delay(void) |
18 | pr_cont("%lu.%02lu BogoMIPS (lpj=%lu)\n", |
19 | loops_per_jiffy / (500000 / HZ), |
20 | (loops_per_jiffy / (5000 / HZ)) % 100, loops_per_jiffy); |
21 | + |
22 | + of_node_put(cpu); |
23 | } |
24 | |
25 | void __init setup_arch(char **cmdline_p) |
26 | diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c |
27 | index 1852d19d0d7b0..86110a2abf0f0 100644 |
28 | --- a/drivers/cdrom/gdrom.c |
29 | +++ b/drivers/cdrom/gdrom.c |
30 | @@ -773,6 +773,13 @@ static int probe_gdrom_setupqueue(void) |
31 | static int probe_gdrom(struct platform_device *devptr) |
32 | { |
33 | int err; |
34 | + |
35 | + /* |
36 | + * Ensure our "one" device is initialized properly in case of previous |
37 | + * usages of it |
38 | + */ |
39 | + memset(&gd, 0, sizeof(gd)); |
40 | + |
41 | /* Start the device */ |
42 | if (gdrom_execute_diagnostic() != 1) { |
43 | pr_warning("ATA Probe for GDROM failed\n"); |
44 | @@ -850,6 +857,8 @@ static int remove_gdrom(struct platform_device *devptr) |
45 | if (gdrom_major) |
46 | unregister_blkdev(gdrom_major, GDROM_DEV_NAME); |
47 | unregister_cdrom(gd.cd_info); |
48 | + kfree(gd.cd_info); |
49 | + kfree(gd.toc); |
50 | |
51 | return 0; |
52 | } |
53 | @@ -865,7 +874,7 @@ static struct platform_driver gdrom_driver = { |
54 | static int __init init_gdrom(void) |
55 | { |
56 | int rc; |
57 | - gd.toc = NULL; |
58 | + |
59 | rc = platform_driver_register(&gdrom_driver); |
60 | if (rc) |
61 | return rc; |
62 | @@ -881,8 +890,6 @@ static void __exit exit_gdrom(void) |
63 | { |
64 | platform_device_unregister(pd); |
65 | platform_driver_unregister(&gdrom_driver); |
66 | - kfree(gd.toc); |
67 | - kfree(gd.cd_info); |
68 | } |
69 | |
70 | module_init(init_gdrom); |
71 | diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c |
72 | index be60bd5bab783..ee6d499edc1ba 100644 |
73 | --- a/drivers/hwmon/lm80.c |
74 | +++ b/drivers/hwmon/lm80.c |
75 | @@ -630,7 +630,6 @@ static int lm80_probe(struct i2c_client *client, |
76 | struct device *dev = &client->dev; |
77 | struct device *hwmon_dev; |
78 | struct lm80_data *data; |
79 | - int rv; |
80 | |
81 | data = devm_kzalloc(dev, sizeof(struct lm80_data), GFP_KERNEL); |
82 | if (!data) |
83 | @@ -643,14 +642,8 @@ static int lm80_probe(struct i2c_client *client, |
84 | lm80_init_client(client); |
85 | |
86 | /* A few vars need to be filled upon startup */ |
87 | - rv = lm80_read_value(client, LM80_REG_FAN_MIN(1)); |
88 | - if (rv < 0) |
89 | - return rv; |
90 | - data->fan[f_min][0] = rv; |
91 | - rv = lm80_read_value(client, LM80_REG_FAN_MIN(2)); |
92 | - if (rv < 0) |
93 | - return rv; |
94 | - data->fan[f_min][1] = rv; |
95 | + data->fan[f_min][0] = lm80_read_value(client, LM80_REG_FAN_MIN(1)); |
96 | + data->fan[f_min][1] = lm80_read_value(client, LM80_REG_FAN_MIN(2)); |
97 | |
98 | hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name, |
99 | data, lm80_groups); |
100 | diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c |
101 | index 186da467060cc..5fa1442fd4f11 100644 |
102 | --- a/drivers/infiniband/sw/rxe/rxe_qp.c |
103 | +++ b/drivers/infiniband/sw/rxe/rxe_qp.c |
104 | @@ -258,6 +258,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp, |
105 | if (err) { |
106 | vfree(qp->sq.queue->buf); |
107 | kfree(qp->sq.queue); |
108 | + qp->sq.queue = NULL; |
109 | return err; |
110 | } |
111 | |
112 | @@ -315,6 +316,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp, |
113 | if (err) { |
114 | vfree(qp->rq.queue->buf); |
115 | kfree(qp->rq.queue); |
116 | + qp->rq.queue = NULL; |
117 | return err; |
118 | } |
119 | } |
120 | @@ -374,6 +376,11 @@ int rxe_qp_from_init(struct rxe_dev *rxe, struct rxe_qp *qp, struct rxe_pd *pd, |
121 | err2: |
122 | rxe_queue_cleanup(qp->sq.queue); |
123 | err1: |
124 | + qp->pd = NULL; |
125 | + qp->rcq = NULL; |
126 | + qp->scq = NULL; |
127 | + qp->srq = NULL; |
128 | + |
129 | if (srq) |
130 | rxe_drop_ref(srq); |
131 | rxe_drop_ref(scq); |
132 | diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c |
133 | index 44ceed7ac3c5b..7cebcd458943e 100644 |
134 | --- a/drivers/leds/leds-lp5523.c |
135 | +++ b/drivers/leds/leds-lp5523.c |
136 | @@ -320,7 +320,7 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip) |
137 | usleep_range(3000, 6000); |
138 | ret = lp55xx_read(chip, LP5523_REG_STATUS, &status); |
139 | if (ret) |
140 | - return ret; |
141 | + goto out; |
142 | status &= LP5523_ENG_STATUS_MASK; |
143 | |
144 | if (status != LP5523_ENG_STATUS_MASK) { |
145 | diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c |
146 | index c04d9f22d1607..6acdbec05f702 100644 |
147 | --- a/drivers/md/dm-snap.c |
148 | +++ b/drivers/md/dm-snap.c |
149 | @@ -1264,6 +1264,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv) |
150 | |
151 | if (!s->store->chunk_size) { |
152 | ti->error = "Chunk size not set"; |
153 | + r = -EINVAL; |
154 | goto bad_read_metadata; |
155 | } |
156 | |
157 | diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c |
158 | index 63ebc491057b6..99fc0121da93d 100644 |
159 | --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c |
160 | +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c |
161 | @@ -1039,7 +1039,7 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode) |
162 | for (i = 0; i < QLCNIC_NUM_ILB_PKT; i++) { |
163 | skb = netdev_alloc_skb(adapter->netdev, QLCNIC_ILB_PKT_SIZE); |
164 | if (!skb) |
165 | - break; |
166 | + goto error; |
167 | qlcnic_create_loopback_buff(skb->data, adapter->mac_addr); |
168 | skb_put(skb, QLCNIC_ILB_PKT_SIZE); |
169 | adapter->ahw->diag_cnt = 0; |
170 | @@ -1063,6 +1063,7 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode) |
171 | cnt++; |
172 | } |
173 | if (cnt != i) { |
174 | +error: |
175 | dev_err(&adapter->pdev->dev, |
176 | "LB Test: failed, TX[%d], RX[%d]\n", i, cnt); |
177 | if (mode != QLCNIC_ILB_MODE) |
178 | diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c |
179 | index fc1fa0f9f3387..fe4128405bbb7 100644 |
180 | --- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c |
181 | +++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c |
182 | @@ -39,7 +39,7 @@ struct sunxi_priv_data { |
183 | static int sun7i_gmac_init(struct platform_device *pdev, void *priv) |
184 | { |
185 | struct sunxi_priv_data *gmac = priv; |
186 | - int ret; |
187 | + int ret = 0; |
188 | |
189 | if (gmac->regulator) { |
190 | ret = regulator_enable(gmac->regulator); |
191 | @@ -60,11 +60,11 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv) |
192 | } else { |
193 | clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE); |
194 | ret = clk_prepare(gmac->tx_clk); |
195 | - if (ret) |
196 | - return ret; |
197 | + if (ret && gmac->regulator) |
198 | + regulator_disable(gmac->regulator); |
199 | } |
200 | |
201 | - return 0; |
202 | + return ret; |
203 | } |
204 | |
205 | static void sun7i_gmac_exit(struct platform_device *pdev, void *priv) |
206 | diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c |
207 | index 5bf47279f9c1b..306d5d08141ee 100644 |
208 | --- a/drivers/net/ethernet/sun/niu.c |
209 | +++ b/drivers/net/ethernet/sun/niu.c |
210 | @@ -8166,10 +8166,10 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end) |
211 | "VPD_SCAN: Reading in property [%s] len[%d]\n", |
212 | namebuf, prop_len); |
213 | for (i = 0; i < prop_len; i++) { |
214 | - err = niu_pci_eeprom_read(np, off + i); |
215 | - if (err >= 0) |
216 | - *prop_buf = err; |
217 | - ++prop_buf; |
218 | + err = niu_pci_eeprom_read(np, off + i); |
219 | + if (err < 0) |
220 | + return err; |
221 | + *prop_buf++ = err; |
222 | } |
223 | } |
224 | |
225 | @@ -8180,14 +8180,14 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end) |
226 | } |
227 | |
228 | /* ESPC_PIO_EN_ENABLE must be set */ |
229 | -static void niu_pci_vpd_fetch(struct niu *np, u32 start) |
230 | +static int niu_pci_vpd_fetch(struct niu *np, u32 start) |
231 | { |
232 | u32 offset; |
233 | int err; |
234 | |
235 | err = niu_pci_eeprom_read16_swp(np, start + 1); |
236 | if (err < 0) |
237 | - return; |
238 | + return err; |
239 | |
240 | offset = err + 3; |
241 | |
242 | @@ -8196,12 +8196,14 @@ static void niu_pci_vpd_fetch(struct niu *np, u32 start) |
243 | u32 end; |
244 | |
245 | err = niu_pci_eeprom_read(np, here); |
246 | + if (err < 0) |
247 | + return err; |
248 | if (err != 0x90) |
249 | - return; |
250 | + return -EINVAL; |
251 | |
252 | err = niu_pci_eeprom_read16_swp(np, here + 1); |
253 | if (err < 0) |
254 | - return; |
255 | + return err; |
256 | |
257 | here = start + offset + 3; |
258 | end = start + offset + err; |
259 | @@ -8209,9 +8211,12 @@ static void niu_pci_vpd_fetch(struct niu *np, u32 start) |
260 | offset += err; |
261 | |
262 | err = niu_pci_vpd_scan_props(np, here, end); |
263 | - if (err < 0 || err == 1) |
264 | - return; |
265 | + if (err < 0) |
266 | + return err; |
267 | + if (err == 1) |
268 | + return -EINVAL; |
269 | } |
270 | + return 0; |
271 | } |
272 | |
273 | /* ESPC_PIO_EN_ENABLE must be set */ |
274 | @@ -9304,8 +9309,11 @@ static int niu_get_invariants(struct niu *np) |
275 | offset = niu_pci_vpd_offset(np); |
276 | netif_printk(np, probe, KERN_DEBUG, np->dev, |
277 | "%s() VPD offset [%08x]\n", __func__, offset); |
278 | - if (offset) |
279 | - niu_pci_vpd_fetch(np, offset); |
280 | + if (offset) { |
281 | + err = niu_pci_vpd_fetch(np, offset); |
282 | + if (err < 0) |
283 | + return err; |
284 | + } |
285 | nw64(ESPC_PIO_EN, 0); |
286 | |
287 | if (np->flags & NIU_FLAGS_VPD_VALID) { |
288 | diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c |
289 | index 7de18ed10db8e..e1992de500b0d 100644 |
290 | --- a/drivers/net/wireless/realtek/rtlwifi/base.c |
291 | +++ b/drivers/net/wireless/realtek/rtlwifi/base.c |
292 | @@ -454,9 +454,14 @@ static void _rtl_init_mac80211(struct ieee80211_hw *hw) |
293 | } |
294 | } |
295 | |
296 | -static void _rtl_init_deferred_work(struct ieee80211_hw *hw) |
297 | +static int _rtl_init_deferred_work(struct ieee80211_hw *hw) |
298 | { |
299 | struct rtl_priv *rtlpriv = rtl_priv(hw); |
300 | + struct workqueue_struct *wq; |
301 | + |
302 | + wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name); |
303 | + if (!wq) |
304 | + return -ENOMEM; |
305 | |
306 | /* <1> timer */ |
307 | setup_timer(&rtlpriv->works.watchdog_timer, |
308 | @@ -465,11 +470,7 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw) |
309 | rtl_easy_concurrent_retrytimer_callback, (unsigned long)hw); |
310 | /* <2> work queue */ |
311 | rtlpriv->works.hw = hw; |
312 | - rtlpriv->works.rtl_wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name); |
313 | - if (unlikely(!rtlpriv->works.rtl_wq)) { |
314 | - pr_err("Failed to allocate work queue\n"); |
315 | - return; |
316 | - } |
317 | + rtlpriv->works.rtl_wq = wq; |
318 | |
319 | INIT_DELAYED_WORK(&rtlpriv->works.watchdog_wq, |
320 | (void *)rtl_watchdog_wq_callback); |
321 | @@ -481,7 +482,7 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw) |
322 | (void *)rtl_swlps_rfon_wq_callback); |
323 | INIT_DELAYED_WORK(&rtlpriv->works.fwevt_wq, |
324 | (void *)rtl_fwevt_wq_callback); |
325 | - |
326 | + return 0; |
327 | } |
328 | |
329 | void rtl_deinit_deferred_work(struct ieee80211_hw *hw) |
330 | @@ -573,9 +574,7 @@ int rtl_init_core(struct ieee80211_hw *hw) |
331 | rtlmac->link_state = MAC80211_NOLINK; |
332 | |
333 | /* <6> init deferred work */ |
334 | - _rtl_init_deferred_work(hw); |
335 | - |
336 | - return 0; |
337 | + return _rtl_init_deferred_work(hw); |
338 | } |
339 | EXPORT_SYMBOL_GPL(rtl_init_core); |
340 | |
341 | diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c |
342 | index b29fc258eeba4..ab57a1eb519fc 100644 |
343 | --- a/drivers/rapidio/rio_cm.c |
344 | +++ b/drivers/rapidio/rio_cm.c |
345 | @@ -2136,6 +2136,14 @@ static int riocm_add_mport(struct device *dev, |
346 | return -ENODEV; |
347 | } |
348 | |
349 | + cm->rx_wq = create_workqueue(DRV_NAME "/rxq"); |
350 | + if (!cm->rx_wq) { |
351 | + rio_release_inb_mbox(mport, cmbox); |
352 | + rio_release_outb_mbox(mport, cmbox); |
353 | + kfree(cm); |
354 | + return -ENOMEM; |
355 | + } |
356 | + |
357 | /* |
358 | * Allocate and register inbound messaging buffers to be ready |
359 | * to receive channel and system management requests |
360 | @@ -2146,15 +2154,6 @@ static int riocm_add_mport(struct device *dev, |
361 | cm->rx_slots = RIOCM_RX_RING_SIZE; |
362 | mutex_init(&cm->rx_lock); |
363 | riocm_rx_fill(cm, RIOCM_RX_RING_SIZE); |
364 | - cm->rx_wq = create_workqueue(DRV_NAME "/rxq"); |
365 | - if (!cm->rx_wq) { |
366 | - riocm_error("failed to allocate IBMBOX_%d on %s", |
367 | - cmbox, mport->name); |
368 | - rio_release_outb_mbox(mport, cmbox); |
369 | - kfree(cm); |
370 | - return -ENOMEM; |
371 | - } |
372 | - |
373 | INIT_WORK(&cm->rx_work, rio_ibmsg_handler); |
374 | |
375 | cm->tx_slot = 0; |
376 | diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c |
377 | index 104e13ae34288..9ec18463b4523 100644 |
378 | --- a/drivers/scsi/qla2xxx/qla_nx.c |
379 | +++ b/drivers/scsi/qla2xxx/qla_nx.c |
380 | @@ -1102,7 +1102,8 @@ qla82xx_write_flash_dword(struct qla_hw_data *ha, uint32_t flashaddr, |
381 | return ret; |
382 | } |
383 | |
384 | - if (qla82xx_flash_set_write_enable(ha)) |
385 | + ret = qla82xx_flash_set_write_enable(ha); |
386 | + if (ret < 0) |
387 | goto done_write; |
388 | |
389 | qla82xx_wr_32(ha, QLA82XX_ROMUSB_ROM_WDATA, data); |
390 | diff --git a/drivers/staging/iio/light/tsl2583.c b/drivers/staging/iio/light/tsl2583.c |
391 | index 08f1583ee34e9..fb3ec56d45b61 100644 |
392 | --- a/drivers/staging/iio/light/tsl2583.c |
393 | +++ b/drivers/staging/iio/light/tsl2583.c |
394 | @@ -382,6 +382,15 @@ static int taos_als_calibrate(struct iio_dev *indio_dev) |
395 | dev_err(&chip->client->dev, "taos_als_calibrate failed to get lux\n"); |
396 | return lux_val; |
397 | } |
398 | + |
399 | + /* Avoid division by zero of lux_value later on */ |
400 | + if (lux_val == 0) { |
401 | + dev_err(&chip->client->dev, |
402 | + "%s: lux_val of 0 will produce out of range trim_value\n", |
403 | + __func__); |
404 | + return -ENODATA; |
405 | + } |
406 | + |
407 | gain_trim_val = (unsigned int)(((chip->taos_settings.als_cal_target) |
408 | * chip->taos_settings.als_gain_trim) / lux_val); |
409 | |
410 | diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c |
411 | index 2fa7527b1230e..8c74d9ebfc502 100644 |
412 | --- a/drivers/tty/vt/vt.c |
413 | +++ b/drivers/tty/vt/vt.c |
414 | @@ -838,7 +838,7 @@ static inline int resize_screen(struct vc_data *vc, int width, int height, |
415 | /* Resizes the resolution of the display adapater */ |
416 | int err = 0; |
417 | |
418 | - if (vc->vc_mode != KD_GRAPHICS && vc->vc_sw->con_resize) |
419 | + if (vc->vc_sw->con_resize) |
420 | err = vc->vc_sw->con_resize(vc, width, height, user); |
421 | |
422 | return err; |
423 | diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c |
424 | index 275ec49b30b9f..9206fd2489353 100644 |
425 | --- a/drivers/tty/vt/vt_ioctl.c |
426 | +++ b/drivers/tty/vt/vt_ioctl.c |
427 | @@ -898,17 +898,17 @@ int vt_ioctl(struct tty_struct *tty, |
428 | if (vcp) { |
429 | int ret; |
430 | int save_scan_lines = vcp->vc_scan_lines; |
431 | - int save_font_height = vcp->vc_font.height; |
432 | + int save_cell_height = vcp->vc_cell_height; |
433 | |
434 | if (v.v_vlin) |
435 | vcp->vc_scan_lines = v.v_vlin; |
436 | if (v.v_clin) |
437 | - vcp->vc_font.height = v.v_clin; |
438 | + vcp->vc_cell_height = v.v_clin; |
439 | vcp->vc_resize_user = 1; |
440 | ret = vc_resize(vcp, v.v_cols, v.v_rows); |
441 | if (ret) { |
442 | vcp->vc_scan_lines = save_scan_lines; |
443 | - vcp->vc_font.height = save_font_height; |
444 | + vcp->vc_cell_height = save_cell_height; |
445 | console_unlock(); |
446 | return ret; |
447 | } |
448 | diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c |
449 | index 44df6f6fd0636..510bc3f51dccf 100644 |
450 | --- a/drivers/video/console/fbcon.c |
451 | +++ b/drivers/video/console/fbcon.c |
452 | @@ -1986,7 +1986,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width, |
453 | return -EINVAL; |
454 | |
455 | DPRINTK("resize now %ix%i\n", var.xres, var.yres); |
456 | - if (con_is_visible(vc)) { |
457 | + if (con_is_visible(vc) && vc->vc_mode == KD_TEXT) { |
458 | var.activate = FB_ACTIVATE_NOW | |
459 | FB_ACTIVATE_FORCE; |
460 | fb_set_var(info, &var); |
461 | diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c |
462 | index b38ee2354cbfa..cb9b879631293 100644 |
463 | --- a/drivers/video/console/vgacon.c |
464 | +++ b/drivers/video/console/vgacon.c |
465 | @@ -434,7 +434,7 @@ static void vgacon_init(struct vc_data *c, int init) |
466 | vc_resize(c, vga_video_num_columns, vga_video_num_lines); |
467 | |
468 | c->vc_scan_lines = vga_scan_lines; |
469 | - c->vc_font.height = vga_video_font_height; |
470 | + c->vc_font.height = c->vc_cell_height = vga_video_font_height; |
471 | c->vc_complement_mask = 0x7700; |
472 | if (vga_512_chars) |
473 | c->vc_hi_font_mask = 0x0800; |
474 | @@ -572,32 +572,32 @@ static void vgacon_cursor(struct vc_data *c, int mode) |
475 | switch (c->vc_cursor_type & 0x0f) { |
476 | case CUR_UNDERLINE: |
477 | vgacon_set_cursor_size(c->vc_x, |
478 | - c->vc_font.height - |
479 | - (c->vc_font.height < |
480 | + c->vc_cell_height - |
481 | + (c->vc_cell_height < |
482 | 10 ? 2 : 3), |
483 | - c->vc_font.height - |
484 | - (c->vc_font.height < |
485 | + c->vc_cell_height - |
486 | + (c->vc_cell_height < |
487 | 10 ? 1 : 2)); |
488 | break; |
489 | case CUR_TWO_THIRDS: |
490 | vgacon_set_cursor_size(c->vc_x, |
491 | - c->vc_font.height / 3, |
492 | - c->vc_font.height - |
493 | - (c->vc_font.height < |
494 | + c->vc_cell_height / 3, |
495 | + c->vc_cell_height - |
496 | + (c->vc_cell_height < |
497 | 10 ? 1 : 2)); |
498 | break; |
499 | case CUR_LOWER_THIRD: |
500 | vgacon_set_cursor_size(c->vc_x, |
501 | - (c->vc_font.height * 2) / 3, |
502 | - c->vc_font.height - |
503 | - (c->vc_font.height < |
504 | + (c->vc_cell_height * 2) / 3, |
505 | + c->vc_cell_height - |
506 | + (c->vc_cell_height < |
507 | 10 ? 1 : 2)); |
508 | break; |
509 | case CUR_LOWER_HALF: |
510 | vgacon_set_cursor_size(c->vc_x, |
511 | - c->vc_font.height / 2, |
512 | - c->vc_font.height - |
513 | - (c->vc_font.height < |
514 | + c->vc_cell_height / 2, |
515 | + c->vc_cell_height - |
516 | + (c->vc_cell_height < |
517 | 10 ? 1 : 2)); |
518 | break; |
519 | case CUR_NONE: |
520 | @@ -608,7 +608,7 @@ static void vgacon_cursor(struct vc_data *c, int mode) |
521 | break; |
522 | default: |
523 | vgacon_set_cursor_size(c->vc_x, 1, |
524 | - c->vc_font.height); |
525 | + c->vc_cell_height); |
526 | break; |
527 | } |
528 | break; |
529 | @@ -619,13 +619,13 @@ static int vgacon_doresize(struct vc_data *c, |
530 | unsigned int width, unsigned int height) |
531 | { |
532 | unsigned long flags; |
533 | - unsigned int scanlines = height * c->vc_font.height; |
534 | + unsigned int scanlines = height * c->vc_cell_height; |
535 | u8 scanlines_lo = 0, r7 = 0, vsync_end = 0, mode, max_scan; |
536 | |
537 | raw_spin_lock_irqsave(&vga_lock, flags); |
538 | |
539 | vgacon_xres = width * VGA_FONTWIDTH; |
540 | - vgacon_yres = height * c->vc_font.height; |
541 | + vgacon_yres = height * c->vc_cell_height; |
542 | if (vga_video_type >= VIDEO_TYPE_VGAC) { |
543 | outb_p(VGA_CRTC_MAX_SCAN, vga_video_port_reg); |
544 | max_scan = inb_p(vga_video_port_val); |
545 | @@ -680,9 +680,9 @@ static int vgacon_doresize(struct vc_data *c, |
546 | static int vgacon_switch(struct vc_data *c) |
547 | { |
548 | int x = c->vc_cols * VGA_FONTWIDTH; |
549 | - int y = c->vc_rows * c->vc_font.height; |
550 | + int y = c->vc_rows * c->vc_cell_height; |
551 | int rows = screen_info.orig_video_lines * vga_default_font_height/ |
552 | - c->vc_font.height; |
553 | + c->vc_cell_height; |
554 | /* |
555 | * We need to save screen size here as it's the only way |
556 | * we can spot the screen has been resized and we need to |
557 | @@ -1120,7 +1120,7 @@ static int vgacon_adjust_height(struct vc_data *vc, unsigned fontheight) |
558 | cursor_size_lastto = 0; |
559 | c->vc_sw->con_cursor(c, CM_DRAW); |
560 | } |
561 | - c->vc_font.height = fontheight; |
562 | + c->vc_font.height = c->vc_cell_height = fontheight; |
563 | vc_resize(c, 0, rows); /* Adjust console size */ |
564 | } |
565 | } |
566 | @@ -1174,12 +1174,20 @@ static int vgacon_resize(struct vc_data *c, unsigned int width, |
567 | if ((width << 1) * height > vga_vram_size) |
568 | return -EINVAL; |
569 | |
570 | + if (user) { |
571 | + /* |
572 | + * Ho ho! Someone (svgatextmode, eh?) may have reprogrammed |
573 | + * the video mode! Set the new defaults then and go away. |
574 | + */ |
575 | + screen_info.orig_video_cols = width; |
576 | + screen_info.orig_video_lines = height; |
577 | + vga_default_font_height = c->vc_cell_height; |
578 | + return 0; |
579 | + } |
580 | if (width % 2 || width > screen_info.orig_video_cols || |
581 | height > (screen_info.orig_video_lines * vga_default_font_height)/ |
582 | - c->vc_font.height) |
583 | - /* let svgatextmode tinker with video timings and |
584 | - return success */ |
585 | - return (user) ? 0 : -EINVAL; |
586 | + c->vc_cell_height) |
587 | + return -EINVAL; |
588 | |
589 | if (con_is_visible(c) && !vga_is_gfx) /* who knows */ |
590 | vgacon_doresize(c, width, height); |
591 | diff --git a/drivers/video/fbdev/hgafb.c b/drivers/video/fbdev/hgafb.c |
592 | index 59e1cae579481..03c0b1b8747b9 100644 |
593 | --- a/drivers/video/fbdev/hgafb.c |
594 | +++ b/drivers/video/fbdev/hgafb.c |
595 | @@ -286,7 +286,7 @@ static int hga_card_detect(void) |
596 | |
597 | hga_vram = ioremap(0xb0000, hga_vram_len); |
598 | if (!hga_vram) |
599 | - goto error; |
600 | + return -ENOMEM; |
601 | |
602 | if (request_region(0x3b0, 12, "hgafb")) |
603 | release_io_ports = 1; |
604 | @@ -346,13 +346,18 @@ static int hga_card_detect(void) |
605 | hga_type_name = "Hercules"; |
606 | break; |
607 | } |
608 | - return 1; |
609 | + return 0; |
610 | error: |
611 | if (release_io_ports) |
612 | release_region(0x3b0, 12); |
613 | if (release_io_port) |
614 | release_region(0x3bf, 1); |
615 | - return 0; |
616 | + |
617 | + iounmap(hga_vram); |
618 | + |
619 | + pr_err("hgafb: HGA card not detected.\n"); |
620 | + |
621 | + return -EINVAL; |
622 | } |
623 | |
624 | /** |
625 | @@ -550,13 +555,11 @@ static struct fb_ops hgafb_ops = { |
626 | static int hgafb_probe(struct platform_device *pdev) |
627 | { |
628 | struct fb_info *info; |
629 | + int ret; |
630 | |
631 | - if (! hga_card_detect()) { |
632 | - printk(KERN_INFO "hgafb: HGA card not detected.\n"); |
633 | - if (hga_vram) |
634 | - iounmap(hga_vram); |
635 | - return -EINVAL; |
636 | - } |
637 | + ret = hga_card_detect(); |
638 | + if (ret) |
639 | + return ret; |
640 | |
641 | printk(KERN_INFO "hgafb: %s with %ldK of memory detected.\n", |
642 | hga_type_name, hga_vram_len/1024); |
643 | diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c |
644 | index 4ef9dc94e8138..4363c64d74e8c 100644 |
645 | --- a/drivers/video/fbdev/imsttfb.c |
646 | +++ b/drivers/video/fbdev/imsttfb.c |
647 | @@ -1516,11 +1516,6 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent) |
648 | info->fix.smem_start = addr; |
649 | info->screen_base = (__u8 *)ioremap(addr, par->ramdac == IBM ? |
650 | 0x400000 : 0x800000); |
651 | - if (!info->screen_base) { |
652 | - release_mem_region(addr, size); |
653 | - framebuffer_release(info); |
654 | - return -ENOMEM; |
655 | - } |
656 | info->fix.mmio_start = addr + 0x800000; |
657 | par->dc_regs = ioremap(addr + 0x800000, 0x1000); |
658 | par->cmap_regs_phys = addr + 0x840000; |
659 | diff --git a/drivers/xen/xen-pciback/xenbus.c b/drivers/xen/xen-pciback/xenbus.c |
660 | index 36ec99cff507b..2912905331020 100644 |
661 | --- a/drivers/xen/xen-pciback/xenbus.c |
662 | +++ b/drivers/xen/xen-pciback/xenbus.c |
663 | @@ -357,7 +357,8 @@ out: |
664 | return err; |
665 | } |
666 | |
667 | -static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev) |
668 | +static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev, |
669 | + enum xenbus_state state) |
670 | { |
671 | int err = 0; |
672 | int num_devs; |
673 | @@ -371,9 +372,7 @@ static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev) |
674 | dev_dbg(&pdev->xdev->dev, "Reconfiguring device ...\n"); |
675 | |
676 | mutex_lock(&pdev->dev_lock); |
677 | - /* Make sure we only reconfigure once */ |
678 | - if (xenbus_read_driver_state(pdev->xdev->nodename) != |
679 | - XenbusStateReconfiguring) |
680 | + if (xenbus_read_driver_state(pdev->xdev->nodename) != state) |
681 | goto out; |
682 | |
683 | err = xenbus_scanf(XBT_NIL, pdev->xdev->nodename, "num_devs", "%d", |
684 | @@ -500,6 +499,10 @@ static int xen_pcibk_reconfigure(struct xen_pcibk_device *pdev) |
685 | } |
686 | } |
687 | |
688 | + if (state != XenbusStateReconfiguring) |
689 | + /* Make sure we only reconfigure once. */ |
690 | + goto out; |
691 | + |
692 | err = xenbus_switch_state(pdev->xdev, XenbusStateReconfigured); |
693 | if (err) { |
694 | xenbus_dev_fatal(pdev->xdev, err, |
695 | @@ -525,7 +528,7 @@ static void xen_pcibk_frontend_changed(struct xenbus_device *xdev, |
696 | break; |
697 | |
698 | case XenbusStateReconfiguring: |
699 | - xen_pcibk_reconfigure(pdev); |
700 | + xen_pcibk_reconfigure(pdev, XenbusStateReconfiguring); |
701 | break; |
702 | |
703 | case XenbusStateConnected: |
704 | @@ -664,6 +667,15 @@ static void xen_pcibk_be_watch(struct xenbus_watch *watch, |
705 | xen_pcibk_setup_backend(pdev); |
706 | break; |
707 | |
708 | + case XenbusStateInitialised: |
709 | + /* |
710 | + * We typically move to Initialised when the first device was |
711 | + * added. Hence subsequent devices getting added may need |
712 | + * reconfiguring. |
713 | + */ |
714 | + xen_pcibk_reconfigure(pdev, XenbusStateInitialised); |
715 | + break; |
716 | + |
717 | default: |
718 | break; |
719 | } |
720 | diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c |
721 | index 67edd6e03f803..fffba1b1da2e4 100644 |
722 | --- a/fs/cifs/smb2ops.c |
723 | +++ b/fs/cifs/smb2ops.c |
724 | @@ -629,6 +629,8 @@ smb2_clone_range(const unsigned int xid, |
725 | cpu_to_le32(min_t(u32, len, tcon->max_bytes_chunk)); |
726 | |
727 | /* Request server copy to target from src identified by key */ |
728 | + kfree(retbuf); |
729 | + retbuf = NULL; |
730 | rc = SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid, |
731 | trgtfile->fid.volatile_fid, FSCTL_SRV_COPYCHUNK_WRITE, |
732 | true /* is_fsctl */, (char *)pcchunk, |
733 | diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c |
734 | index ff6cf23be8a21..cb77e7ee2c9f0 100644 |
735 | --- a/fs/ecryptfs/crypto.c |
736 | +++ b/fs/ecryptfs/crypto.c |
737 | @@ -339,10 +339,8 @@ static int crypt_scatterlist(struct ecryptfs_crypt_stat *crypt_stat, |
738 | struct extent_crypt_result ecr; |
739 | int rc = 0; |
740 | |
741 | - if (!crypt_stat || !crypt_stat->tfm |
742 | - || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED)) |
743 | - return -EINVAL; |
744 | - |
745 | + BUG_ON(!crypt_stat || !crypt_stat->tfm |
746 | + || !(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED)); |
747 | if (unlikely(ecryptfs_verbosity > 0)) { |
748 | ecryptfs_printk(KERN_DEBUG, "Key size [%zd]; key:\n", |
749 | crypt_stat->key_size); |
750 | diff --git a/include/linux/console_struct.h b/include/linux/console_struct.h |
751 | index 6fd3c908a340d..a30112ba06e44 100644 |
752 | --- a/include/linux/console_struct.h |
753 | +++ b/include/linux/console_struct.h |
754 | @@ -61,6 +61,7 @@ struct vc_data { |
755 | unsigned int vc_rows; |
756 | unsigned int vc_size_row; /* Bytes per row */ |
757 | unsigned int vc_scan_lines; /* # of scan lines */ |
758 | + unsigned int vc_cell_height; /* CRTC character cell height */ |
759 | unsigned long vc_origin; /* [!] Start of real screen */ |
760 | unsigned long vc_scr_end; /* [!] End of real screen */ |
761 | unsigned long vc_visible_origin; /* [!] Top of visible window */ |
762 | diff --git a/kernel/ptrace.c b/kernel/ptrace.c |
763 | index ea3370e205fb9..4f10223bc7b0f 100644 |
764 | --- a/kernel/ptrace.c |
765 | +++ b/kernel/ptrace.c |
766 | @@ -159,6 +159,21 @@ void __ptrace_unlink(struct task_struct *child) |
767 | spin_unlock(&child->sighand->siglock); |
768 | } |
769 | |
770 | +static bool looks_like_a_spurious_pid(struct task_struct *task) |
771 | +{ |
772 | + if (task->exit_code != ((PTRACE_EVENT_EXEC << 8) | SIGTRAP)) |
773 | + return false; |
774 | + |
775 | + if (task_pid_vnr(task) == task->ptrace_message) |
776 | + return false; |
777 | + /* |
778 | + * The tracee changed its pid but the PTRACE_EVENT_EXEC event |
779 | + * was not wait()'ed, most probably debugger targets the old |
780 | + * leader which was destroyed in de_thread(). |
781 | + */ |
782 | + return true; |
783 | +} |
784 | + |
785 | /* Ensure that nothing can wake it up, even SIGKILL */ |
786 | static bool ptrace_freeze_traced(struct task_struct *task) |
787 | { |
788 | @@ -169,7 +184,8 @@ static bool ptrace_freeze_traced(struct task_struct *task) |
789 | return ret; |
790 | |
791 | spin_lock_irq(&task->sighand->siglock); |
792 | - if (task_is_traced(task) && !__fatal_signal_pending(task)) { |
793 | + if (task_is_traced(task) && !looks_like_a_spurious_pid(task) && |
794 | + !__fatal_signal_pending(task)) { |
795 | task->state = __TASK_TRACED; |
796 | ret = true; |
797 | } |
798 | diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c |
799 | index 6670b7ffc2005..cedfce6f397ed 100644 |
800 | --- a/net/bluetooth/smp.c |
801 | +++ b/net/bluetooth/smp.c |
802 | @@ -2636,6 +2636,15 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb) |
803 | if (skb->len < sizeof(*key)) |
804 | return SMP_INVALID_PARAMS; |
805 | |
806 | + /* Check if remote and local public keys are the same and debug key is |
807 | + * not in use. |
808 | + */ |
809 | + if (!test_bit(SMP_FLAG_DEBUG_KEY, &smp->flags) && |
810 | + !crypto_memneq(key, smp->local_pk, 64)) { |
811 | + bt_dev_err(hdev, "Remote and local public keys are identical"); |
812 | + return SMP_UNSPECIFIED; |
813 | + } |
814 | + |
815 | memcpy(smp->remote_pk, key, 64); |
816 | |
817 | if (test_bit(SMP_FLAG_REMOTE_OOB, &smp->flags)) { |
818 | diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig |
819 | index 8557e54d26598..f7b8dcb578157 100644 |
820 | --- a/sound/firewire/Kconfig |
821 | +++ b/sound/firewire/Kconfig |
822 | @@ -36,7 +36,7 @@ config SND_OXFW |
823 | * Mackie(Loud) Onyx-i series (former models) |
824 | * Mackie(Loud) Onyx Satellite |
825 | * Mackie(Loud) Tapco Link.Firewire |
826 | - * Mackie(Loud) d.2 pro/d.4 pro |
827 | + * Mackie(Loud) d.4 pro |
828 | * Mackie(Loud) U.420/U.420d |
829 | * TASCAM FireOne |
830 | * Stanton Controllers & Systems 1 Deck/Mixer |
831 | @@ -82,7 +82,7 @@ config SND_BEBOB |
832 | * PreSonus FIREBOX/FIREPOD/FP10/Inspire1394 |
833 | * BridgeCo RDAudio1/Audio5 |
834 | * Mackie Onyx 1220/1620/1640 (FireWire I/O Card) |
835 | - * Mackie d.2 (FireWire Option) |
836 | + * Mackie d.2 (FireWire Option) and d.2 Pro |
837 | * Stanton FinalScratch 2 (ScratchAmp) |
838 | * Tascam IF-FW/DM |
839 | * Behringer XENIX UFX 1204/1604 |
840 | diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c |
841 | index a205b93fd9ac8..9d620a7c283f4 100644 |
842 | --- a/sound/firewire/bebob/bebob.c |
843 | +++ b/sound/firewire/bebob/bebob.c |
844 | @@ -414,7 +414,7 @@ static const struct ieee1394_device_id bebob_id_table[] = { |
845 | SND_BEBOB_DEV_ENTRY(VEN_BRIDGECO, 0x00010049, &spec_normal), |
846 | /* Mackie, Onyx 1220/1620/1640 (Firewire I/O Card) */ |
847 | SND_BEBOB_DEV_ENTRY(VEN_MACKIE2, 0x00010065, &spec_normal), |
848 | - /* Mackie, d.2 (Firewire Option) */ |
849 | + // Mackie, d.2 (Firewire option card) and d.2 Pro (the card is built-in). |
850 | SND_BEBOB_DEV_ENTRY(VEN_MACKIE1, 0x00010067, &spec_normal), |
851 | /* Stanton, ScratchAmp */ |
852 | SND_BEBOB_DEV_ENTRY(VEN_STANTON, 0x00000001, &spec_normal), |
853 | diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c |
854 | index a7ab34d5e7b08..44ecf2f5f65fd 100644 |
855 | --- a/sound/firewire/oxfw/oxfw.c |
856 | +++ b/sound/firewire/oxfw/oxfw.c |
857 | @@ -405,7 +405,6 @@ static const struct ieee1394_device_id oxfw_id_table[] = { |
858 | * Onyx-i series (former models): 0x081216 |
859 | * Mackie Onyx Satellite: 0x00200f |
860 | * Tapco LINK.firewire 4x6: 0x000460 |
861 | - * d.2 pro: Unknown |
862 | * d.4 pro: Unknown |
863 | * U.420: Unknown |
864 | * U.420d: Unknown |
865 | diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c |
866 | index e75bfc511e3e8..ad42d2364199f 100644 |
867 | --- a/sound/isa/sb/sb8.c |
868 | +++ b/sound/isa/sb/sb8.c |
869 | @@ -111,10 +111,6 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev) |
870 | |
871 | /* block the 0x388 port to avoid PnP conflicts */ |
872 | acard->fm_res = request_region(0x388, 4, "SoundBlaster FM"); |
873 | - if (!acard->fm_res) { |
874 | - err = -EBUSY; |
875 | - goto _err; |
876 | - } |
877 | |
878 | if (port[dev] != SNDRV_AUTO_PORT) { |
879 | if ((err = snd_sbdsp_create(card, port[dev], irq[dev], |
880 | diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c |
881 | index ea3a9bd05e687..0107bbfeb17d1 100644 |
882 | --- a/sound/usb/line6/driver.c |
883 | +++ b/sound/usb/line6/driver.c |
884 | @@ -687,6 +687,10 @@ static int line6_init_cap_control(struct usb_line6 *line6) |
885 | line6->buffer_message = kmalloc(LINE6_MIDI_MESSAGE_MAXLEN, GFP_KERNEL); |
886 | if (!line6->buffer_message) |
887 | return -ENOMEM; |
888 | + |
889 | + ret = line6_init_midi(line6); |
890 | + if (ret < 0) |
891 | + return ret; |
892 | } else { |
893 | ret = line6_hwdep_init(line6); |
894 | if (ret < 0) |
895 | diff --git a/sound/usb/line6/pod.c b/sound/usb/line6/pod.c |
896 | index 17aa616e61f53..aaa192aee883e 100644 |
897 | --- a/sound/usb/line6/pod.c |
898 | +++ b/sound/usb/line6/pod.c |
899 | @@ -421,11 +421,6 @@ static int pod_init(struct usb_line6 *line6, |
900 | if (err < 0) |
901 | return err; |
902 | |
903 | - /* initialize MIDI subsystem: */ |
904 | - err = line6_init_midi(line6); |
905 | - if (err < 0) |
906 | - return err; |
907 | - |
908 | /* initialize PCM subsystem: */ |
909 | err = line6_init_pcm(line6, &pod_pcm_properties); |
910 | if (err < 0) |
911 | diff --git a/sound/usb/line6/variax.c b/sound/usb/line6/variax.c |
912 | index 0c4512d0382ea..a911cff0cec86 100644 |
913 | --- a/sound/usb/line6/variax.c |
914 | +++ b/sound/usb/line6/variax.c |
915 | @@ -217,7 +217,6 @@ static int variax_init(struct usb_line6 *line6, |
916 | const struct usb_device_id *id) |
917 | { |
918 | struct usb_line6_variax *variax = (struct usb_line6_variax *) line6; |
919 | - int err; |
920 | |
921 | line6->process_message = line6_variax_process_message; |
922 | line6->disconnect = line6_variax_disconnect; |
923 | @@ -233,11 +232,6 @@ static int variax_init(struct usb_line6 *line6, |
924 | if (variax->buffer_activate == NULL) |
925 | return -ENOMEM; |
926 | |
927 | - /* initialize MIDI subsystem: */ |
928 | - err = line6_init_midi(&variax->line6); |
929 | - if (err < 0) |
930 | - return err; |
931 | - |
932 | /* initiate startup procedure: */ |
933 | variax_startup1(variax); |
934 | return 0; |
935 | diff --git a/sound/usb/midi.c b/sound/usb/midi.c |
936 | index ea264727fdf7b..f0b41fee71304 100644 |
937 | --- a/sound/usb/midi.c |
938 | +++ b/sound/usb/midi.c |
939 | @@ -1867,8 +1867,12 @@ static int snd_usbmidi_get_ms_info(struct snd_usb_midi *umidi, |
940 | ms_ep = find_usb_ms_endpoint_descriptor(hostep); |
941 | if (!ms_ep) |
942 | continue; |
943 | + if (ms_ep->bLength <= sizeof(*ms_ep)) |
944 | + continue; |
945 | if (ms_ep->bNumEmbMIDIJack > 0x10) |
946 | continue; |
947 | + if (ms_ep->bLength < sizeof(*ms_ep) + ms_ep->bNumEmbMIDIJack) |
948 | + continue; |
949 | if (usb_endpoint_dir_out(ep)) { |
950 | if (endpoints[epidx].out_ep) { |
951 | if (++epidx >= MIDI_MAX_ENDPOINTS) { |