Magellan Linux

Contents of /trunk/kernel-alx/patches-4.9/0309-4.9.210-all-fixes.patch

Parent Directory Parent Directory | Revision Log Revision Log


Revision 3584 - (show annotations) (download)
Thu Aug 13 10:21:27 2020 UTC (3 years, 8 months ago) by niro
File size: 33083 byte(s)
linux-210
1 diff --git a/Makefile b/Makefile
2 index ed9a08ab3772..aa871ec44dd9 100644
3 --- a/Makefile
4 +++ b/Makefile
5 @@ -1,6 +1,6 @@
6 VERSION = 4
7 PATCHLEVEL = 9
8 -SUBLEVEL = 209
9 +SUBLEVEL = 210
10 EXTRAVERSION =
11 NAME = Roaring Lionus
12
13 diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
14 index f68dcf5790ad..e05dda92398c 100644
15 --- a/drivers/gpu/drm/drm_dp_mst_topology.c
16 +++ b/drivers/gpu/drm/drm_dp_mst_topology.c
17 @@ -272,7 +272,7 @@ static void drm_dp_encode_sideband_req(struct drm_dp_sideband_msg_req_body *req,
18 memcpy(&buf[idx], req->u.i2c_read.transactions[i].bytes, req->u.i2c_read.transactions[i].num_bytes);
19 idx += req->u.i2c_read.transactions[i].num_bytes;
20
21 - buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 5;
22 + buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 4;
23 buf[idx] |= (req->u.i2c_read.transactions[i].i2c_transaction_delay & 0xf);
24 idx++;
25 }
26 diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
27 index 62bcc770a181..b935d62be918 100644
28 --- a/drivers/gpu/drm/i915/intel_lrc.c
29 +++ b/drivers/gpu/drm/i915/intel_lrc.c
30 @@ -1017,6 +1017,8 @@ static int gen9_init_indirectctx_bb(struct intel_engine_cs *engine,
31 int ret;
32 struct drm_i915_private *dev_priv = engine->i915;
33 uint32_t index = wa_ctx_start(wa_ctx, *offset, CACHELINE_DWORDS);
34 + u32 scratch_addr =
35 + i915_ggtt_offset(engine->scratch) + 2 * CACHELINE_BYTES;
36
37 /* WaDisableCtxRestoreArbitration:skl,bxt */
38 if (IS_SKL_REVID(dev_priv, 0, SKL_REVID_D0) ||
39 @@ -1036,22 +1038,17 @@ static int gen9_init_indirectctx_bb(struct intel_engine_cs *engine,
40 GEN9_DISABLE_GATHER_AT_SET_SHADER_COMMON_SLICE));
41 wa_ctx_emit(batch, index, MI_NOOP);
42
43 - /* WaClearSlmSpaceAtContextSwitch:kbl */
44 + /* WaClearSlmSpaceAtContextSwitch:skl,bxt,kbl,glk,cfl */
45 /* Actual scratch location is at 128 bytes offset */
46 - if (IS_KBL_REVID(dev_priv, 0, KBL_REVID_A0)) {
47 - u32 scratch_addr =
48 - i915_ggtt_offset(engine->scratch) + 2 * CACHELINE_BYTES;
49 -
50 - wa_ctx_emit(batch, index, GFX_OP_PIPE_CONTROL(6));
51 - wa_ctx_emit(batch, index, (PIPE_CONTROL_FLUSH_L3 |
52 - PIPE_CONTROL_GLOBAL_GTT_IVB |
53 - PIPE_CONTROL_CS_STALL |
54 - PIPE_CONTROL_QW_WRITE));
55 - wa_ctx_emit(batch, index, scratch_addr);
56 - wa_ctx_emit(batch, index, 0);
57 - wa_ctx_emit(batch, index, 0);
58 - wa_ctx_emit(batch, index, 0);
59 - }
60 + wa_ctx_emit(batch, index, GFX_OP_PIPE_CONTROL(6));
61 + wa_ctx_emit(batch, index, (PIPE_CONTROL_FLUSH_L3 |
62 + PIPE_CONTROL_GLOBAL_GTT_IVB |
63 + PIPE_CONTROL_CS_STALL |
64 + PIPE_CONTROL_QW_WRITE));
65 + wa_ctx_emit(batch, index, scratch_addr);
66 + wa_ctx_emit(batch, index, 0);
67 + wa_ctx_emit(batch, index, 0);
68 + wa_ctx_emit(batch, index, 0);
69
70 /* WaMediaPoolStateCmdInWABB:bxt */
71 if (HAS_POOLED_EU(engine->i915)) {
72 diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
73 index c89eb3c3965c..e382d6f23097 100644
74 --- a/drivers/hid/hid-core.c
75 +++ b/drivers/hid/hid-core.c
76 @@ -269,6 +269,12 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
77 offset = report->size;
78 report->size += parser->global.report_size * parser->global.report_count;
79
80 + /* Total size check: Allow for possible report index byte */
81 + if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) {
82 + hid_err(parser->device, "report is too long\n");
83 + return -1;
84 + }
85 +
86 if (!parser->local.usage_index) /* Ignore padding fields */
87 return 0;
88
89 diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
90 index 9f7b1cf726a8..26e967730997 100644
91 --- a/drivers/hid/hid-input.c
92 +++ b/drivers/hid/hid-input.c
93 @@ -1026,9 +1026,15 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
94 }
95
96 mapped:
97 - if (device->driver->input_mapped && device->driver->input_mapped(device,
98 - hidinput, field, usage, &bit, &max) < 0)
99 - goto ignore;
100 + if (device->driver->input_mapped &&
101 + device->driver->input_mapped(device, hidinput, field, usage,
102 + &bit, &max) < 0) {
103 + /*
104 + * The driver indicated that no further generic handling
105 + * of the usage is desired.
106 + */
107 + return;
108 + }
109
110 set_bit(usage->type, input->evbit);
111
112 @@ -1087,9 +1093,11 @@ mapped:
113 set_bit(MSC_SCAN, input->mscbit);
114 }
115
116 -ignore:
117 return;
118
119 +ignore:
120 + usage->type = 0;
121 + usage->code = 0;
122 }
123
124 void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct hid_usage *usage, __s32 value)
125 diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
126 index d02ee5304217..d9b46da0e0aa 100644
127 --- a/drivers/hid/uhid.c
128 +++ b/drivers/hid/uhid.c
129 @@ -26,6 +26,7 @@
130 #include <linux/uhid.h>
131 #include <linux/wait.h>
132 #include <linux/uaccess.h>
133 +#include <linux/eventpoll.h>
134
135 #define UHID_NAME "uhid"
136 #define UHID_BUFSIZE 32
137 @@ -774,7 +775,7 @@ static unsigned int uhid_char_poll(struct file *file, poll_table *wait)
138 if (uhid->head != uhid->tail)
139 return POLLIN | POLLRDNORM;
140
141 - return 0;
142 + return EPOLLOUT | EPOLLWRNORM;
143 }
144
145 static const struct file_operations uhid_fops = {
146 diff --git a/drivers/input/input.c b/drivers/input/input.c
147 index d95c34ee5dc1..5d94fc3fce0b 100644
148 --- a/drivers/input/input.c
149 +++ b/drivers/input/input.c
150 @@ -850,16 +850,18 @@ static int input_default_setkeycode(struct input_dev *dev,
151 }
152 }
153
154 - __clear_bit(*old_keycode, dev->keybit);
155 - __set_bit(ke->keycode, dev->keybit);
156 -
157 - for (i = 0; i < dev->keycodemax; i++) {
158 - if (input_fetch_keycode(dev, i) == *old_keycode) {
159 - __set_bit(*old_keycode, dev->keybit);
160 - break; /* Setting the bit twice is useless, so break */
161 + if (*old_keycode <= KEY_MAX) {
162 + __clear_bit(*old_keycode, dev->keybit);
163 + for (i = 0; i < dev->keycodemax; i++) {
164 + if (input_fetch_keycode(dev, i) == *old_keycode) {
165 + __set_bit(*old_keycode, dev->keybit);
166 + /* Setting the bit twice is useless, so break */
167 + break;
168 + }
169 }
170 }
171
172 + __set_bit(ke->keycode, dev->keybit);
173 return 0;
174 }
175
176 @@ -915,9 +917,13 @@ int input_set_keycode(struct input_dev *dev,
177 * Simulate keyup event if keycode is not present
178 * in the keymap anymore
179 */
180 - if (test_bit(EV_KEY, dev->evbit) &&
181 - !is_event_supported(old_keycode, dev->keybit, KEY_MAX) &&
182 - __test_and_clear_bit(old_keycode, dev->key)) {
183 + if (old_keycode > KEY_MAX) {
184 + dev_warn(dev->dev.parent ?: &dev->dev,
185 + "%s: got too big old keycode %#x\n",
186 + __func__, old_keycode);
187 + } else if (test_bit(EV_KEY, dev->evbit) &&
188 + !is_event_supported(old_keycode, dev->keybit, KEY_MAX) &&
189 + __test_and_clear_bit(old_keycode, dev->key)) {
190 struct input_value vals[] = {
191 { EV_KEY, old_keycode, 0 },
192 input_value_sync
193 diff --git a/drivers/net/can/mscan/mscan.c b/drivers/net/can/mscan/mscan.c
194 index acb708fc1463..0a7d818a06f3 100644
195 --- a/drivers/net/can/mscan/mscan.c
196 +++ b/drivers/net/can/mscan/mscan.c
197 @@ -392,13 +392,12 @@ static int mscan_rx_poll(struct napi_struct *napi, int quota)
198 struct net_device *dev = napi->dev;
199 struct mscan_regs __iomem *regs = priv->reg_base;
200 struct net_device_stats *stats = &dev->stats;
201 - int npackets = 0;
202 - int ret = 1;
203 + int work_done = 0;
204 struct sk_buff *skb;
205 struct can_frame *frame;
206 u8 canrflg;
207
208 - while (npackets < quota) {
209 + while (work_done < quota) {
210 canrflg = in_8(&regs->canrflg);
211 if (!(canrflg & (MSCAN_RXF | MSCAN_ERR_IF)))
212 break;
213 @@ -419,18 +418,18 @@ static int mscan_rx_poll(struct napi_struct *napi, int quota)
214
215 stats->rx_packets++;
216 stats->rx_bytes += frame->can_dlc;
217 - npackets++;
218 + work_done++;
219 netif_receive_skb(skb);
220 }
221
222 - if (!(in_8(&regs->canrflg) & (MSCAN_RXF | MSCAN_ERR_IF))) {
223 - napi_complete(&priv->napi);
224 - clear_bit(F_RX_PROGRESS, &priv->flags);
225 - if (priv->can.state < CAN_STATE_BUS_OFF)
226 - out_8(&regs->canrier, priv->shadow_canrier);
227 - ret = 0;
228 + if (work_done < quota) {
229 + if (likely(napi_complete_done(&priv->napi, work_done))) {
230 + clear_bit(F_RX_PROGRESS, &priv->flags);
231 + if (priv->can.state < CAN_STATE_BUS_OFF)
232 + out_8(&regs->canrier, priv->shadow_canrier);
233 + }
234 }
235 - return ret;
236 + return work_done;
237 }
238
239 static irqreturn_t mscan_isr(int irq, void *dev_id)
240 diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
241 index 014b9ae3dc17..a65203e6ea5f 100644
242 --- a/drivers/net/can/usb/gs_usb.c
243 +++ b/drivers/net/can/usb/gs_usb.c
244 @@ -927,7 +927,7 @@ static int gs_usb_probe(struct usb_interface *intf,
245 GS_USB_BREQ_HOST_FORMAT,
246 USB_DIR_OUT|USB_TYPE_VENDOR|USB_RECIP_INTERFACE,
247 1,
248 - intf->altsetting[0].desc.bInterfaceNumber,
249 + intf->cur_altsetting->desc.bInterfaceNumber,
250 hconf,
251 sizeof(*hconf),
252 1000);
253 @@ -950,7 +950,7 @@ static int gs_usb_probe(struct usb_interface *intf,
254 GS_USB_BREQ_DEVICE_CONFIG,
255 USB_DIR_IN|USB_TYPE_VENDOR|USB_RECIP_INTERFACE,
256 1,
257 - intf->altsetting[0].desc.bInterfaceNumber,
258 + intf->cur_altsetting->desc.bInterfaceNumber,
259 dconf,
260 sizeof(*dconf),
261 1000);
262 diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
263 index 38d45a77c06b..d0743bd25ba9 100644
264 --- a/drivers/net/wireless/marvell/mwifiex/pcie.c
265 +++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
266 @@ -976,8 +976,10 @@ static int mwifiex_pcie_alloc_cmdrsp_buf(struct mwifiex_adapter *adapter)
267 }
268 skb_put(skb, MWIFIEX_UPLD_SIZE);
269 if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE,
270 - PCI_DMA_FROMDEVICE))
271 + PCI_DMA_FROMDEVICE)) {
272 + kfree_skb(skb);
273 return -1;
274 + }
275
276 card->cmdrsp_buf = skb;
277
278 diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
279 index 478885afb6c6..be3be7a63cf0 100644
280 --- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
281 +++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
282 @@ -271,6 +271,14 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv,
283 "11D: skip setting domain info in FW\n");
284 return 0;
285 }
286 +
287 + if (country_ie_len >
288 + (IEEE80211_COUNTRY_STRING_LEN + MWIFIEX_MAX_TRIPLET_802_11D)) {
289 + mwifiex_dbg(priv->adapter, ERROR,
290 + "11D: country_ie_len overflow!, deauth AP\n");
291 + return -EINVAL;
292 + }
293 +
294 memcpy(priv->adapter->country_code, &country_ie[2], 2);
295
296 domain_info->country_code[0] = country_ie[2];
297 @@ -314,8 +322,9 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
298 priv->scan_block = false;
299
300 if (bss) {
301 - if (adapter->region_code == 0x00)
302 - mwifiex_process_country_ie(priv, bss);
303 + if (adapter->region_code == 0x00 &&
304 + mwifiex_process_country_ie(priv, bss))
305 + return -EINVAL;
306
307 /* Allocate and fill new bss descriptor */
308 bss_desc = kzalloc(sizeof(struct mwifiex_bssdescriptor),
309 diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
310 index 6d34d442294a..e588a0365257 100644
311 --- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
312 +++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
313 @@ -5422,6 +5422,7 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw)
314 ret = usb_submit_urb(urb, GFP_KERNEL);
315 if (ret) {
316 usb_unanchor_urb(urb);
317 + usb_free_urb(urb);
318 goto error;
319 }
320
321 diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c
322 index d0a504af5b4f..0a70d54a4df6 100644
323 --- a/drivers/scsi/bfa/bfad_attr.c
324 +++ b/drivers/scsi/bfa/bfad_attr.c
325 @@ -283,8 +283,10 @@ bfad_im_get_stats(struct Scsi_Host *shost)
326 rc = bfa_port_get_stats(BFA_FCPORT(&bfad->bfa),
327 fcstats, bfad_hcb_comp, &fcomp);
328 spin_unlock_irqrestore(&bfad->bfad_lock, flags);
329 - if (rc != BFA_STATUS_OK)
330 + if (rc != BFA_STATUS_OK) {
331 + kfree(fcstats);
332 return NULL;
333 + }
334
335 wait_for_completion(&fcomp.comp);
336
337 diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c b/drivers/staging/comedi/drivers/adv_pci1710.c
338 index 2c1b6de30da8..385e14269870 100644
339 --- a/drivers/staging/comedi/drivers/adv_pci1710.c
340 +++ b/drivers/staging/comedi/drivers/adv_pci1710.c
341 @@ -45,8 +45,8 @@
342 #define PCI171X_RANGE_UNI BIT(4)
343 #define PCI171X_RANGE_GAIN(x) (((x) & 0x7) << 0)
344 #define PCI171X_MUX_REG 0x04 /* W: A/D multiplexor control */
345 -#define PCI171X_MUX_CHANH(x) (((x) & 0xf) << 8)
346 -#define PCI171X_MUX_CHANL(x) (((x) & 0xf) << 0)
347 +#define PCI171X_MUX_CHANH(x) (((x) & 0xff) << 8)
348 +#define PCI171X_MUX_CHANL(x) (((x) & 0xff) << 0)
349 #define PCI171X_MUX_CHAN(x) (PCI171X_MUX_CHANH(x) | PCI171X_MUX_CHANL(x))
350 #define PCI171X_STATUS_REG 0x06 /* R: status register */
351 #define PCI171X_STATUS_IRQ BIT(11) /* 1=IRQ occurred */
352 diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
353 index bfcf9e55f3c6..537a99eba6af 100644
354 --- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
355 +++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
356 @@ -45,6 +45,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
357 {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
358 {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */
359 {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */
360 + {USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */
361 {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
362 {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
363 {} /* Terminating entry */
364 diff --git a/drivers/staging/vt6656/device.h b/drivers/staging/vt6656/device.h
365 index 4832666cc580..5422ec1222ce 100644
366 --- a/drivers/staging/vt6656/device.h
367 +++ b/drivers/staging/vt6656/device.h
368 @@ -269,6 +269,7 @@ struct vnt_private {
369 u8 mac_hw;
370 /* netdev */
371 struct usb_device *usb;
372 + struct usb_interface *intf;
373
374 u64 tsf_time;
375 u8 rx_rate;
376 diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
377 index b1955378852a..78b09640bcf0 100644
378 --- a/drivers/staging/vt6656/main_usb.c
379 +++ b/drivers/staging/vt6656/main_usb.c
380 @@ -972,6 +972,7 @@ vt6656_probe(struct usb_interface *intf, const struct usb_device_id *id)
381 priv = hw->priv;
382 priv->hw = hw;
383 priv->usb = udev;
384 + priv->intf = intf;
385
386 vnt_set_options(priv);
387
388 diff --git a/drivers/staging/vt6656/wcmd.c b/drivers/staging/vt6656/wcmd.c
389 index 95faaeb7432a..4dc3521932ba 100644
390 --- a/drivers/staging/vt6656/wcmd.c
391 +++ b/drivers/staging/vt6656/wcmd.c
392 @@ -110,6 +110,7 @@ void vnt_run_command(struct work_struct *work)
393 if (vnt_init(priv)) {
394 /* If fail all ends TODO retry */
395 dev_err(&priv->usb->dev, "failed to start\n");
396 + usb_set_intfdata(priv->intf, NULL);
397 ieee80211_free_hw(priv->hw);
398 return;
399 }
400 diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
401 index ae118e68b406..3701b240fcb3 100644
402 --- a/drivers/tty/serial/serial_core.c
403 +++ b/drivers/tty/serial/serial_core.c
404 @@ -2795,6 +2795,7 @@ int uart_add_one_port(struct uart_driver *drv, struct uart_port *uport)
405 if (uport->cons && uport->dev)
406 of_console_check(uport->dev->of_node, uport->cons->name, uport->line);
407
408 + tty_port_link_device(port, drv->tty_driver, uport->line);
409 uart_configure_port(drv, state, uport);
410
411 port->console = uart_console(uport);
412 diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
413 index 111b0e0b8698..2178fe7a417b 100644
414 --- a/drivers/usb/chipidea/host.c
415 +++ b/drivers/usb/chipidea/host.c
416 @@ -37,6 +37,7 @@ static int (*orig_bus_suspend)(struct usb_hcd *hcd);
417
418 struct ehci_ci_priv {
419 struct regulator *reg_vbus;
420 + bool enabled;
421 };
422
423 static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable)
424 @@ -48,7 +49,7 @@ static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable)
425 int ret = 0;
426 int port = HCS_N_PORTS(ehci->hcs_params);
427
428 - if (priv->reg_vbus) {
429 + if (priv->reg_vbus && enable != priv->enabled) {
430 if (port > 1) {
431 dev_warn(dev,
432 "Not support multi-port regulator control\n");
433 @@ -64,6 +65,7 @@ static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable)
434 enable ? "enable" : "disable", ret);
435 return ret;
436 }
437 + priv->enabled = enable;
438 }
439
440 if (enable && (ci->platdata->phy_mode == USBPHY_INTERFACE_MODE_HSIC)) {
441 diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
442 index 32f5ccd5f2c7..edf66b2f916b 100644
443 --- a/drivers/usb/core/config.c
444 +++ b/drivers/usb/core/config.c
445 @@ -387,12 +387,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
446 endpoint->desc.wMaxPacketSize = cpu_to_le16(8);
447 }
448
449 - /* Validate the wMaxPacketSize field */
450 + /*
451 + * Validate the wMaxPacketSize field.
452 + * Some devices have isochronous endpoints in altsetting 0;
453 + * the USB-2 spec requires such endpoints to have wMaxPacketSize = 0
454 + * (see the end of section 5.6.3), so don't warn about them.
455 + */
456 maxp = usb_endpoint_maxp(&endpoint->desc);
457 - if (maxp == 0) {
458 - dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has wMaxPacketSize 0, skipping\n",
459 + if (maxp == 0 && !(usb_endpoint_xfer_isoc(d) && asnum == 0)) {
460 + dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid wMaxPacketSize 0\n",
461 cfgno, inum, asnum, d->bEndpointAddress);
462 - goto skip_to_next_endpoint_or_interface_descriptor;
463 }
464
465 /* Find the highest legal maxpacket size for this endpoint */
466 diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
467 index 579aa9accafc..c232229162e0 100644
468 --- a/drivers/usb/musb/musb_core.c
469 +++ b/drivers/usb/musb/musb_core.c
470 @@ -1832,6 +1832,9 @@ static const struct attribute_group musb_attr_group = {
471 #define MUSB_QUIRK_B_INVALID_VBUS_91 (MUSB_DEVCTL_BDEVICE | \
472 (2 << MUSB_DEVCTL_VBUS_SHIFT) | \
473 MUSB_DEVCTL_SESSION)
474 +#define MUSB_QUIRK_B_DISCONNECT_99 (MUSB_DEVCTL_BDEVICE | \
475 + (3 << MUSB_DEVCTL_VBUS_SHIFT) | \
476 + MUSB_DEVCTL_SESSION)
477 #define MUSB_QUIRK_A_DISCONNECT_19 ((3 << MUSB_DEVCTL_VBUS_SHIFT) | \
478 MUSB_DEVCTL_SESSION)
479
480 @@ -1854,6 +1857,11 @@ static void musb_pm_runtime_check_session(struct musb *musb)
481 s = MUSB_DEVCTL_FSDEV | MUSB_DEVCTL_LSDEV |
482 MUSB_DEVCTL_HR;
483 switch (devctl & ~s) {
484 + case MUSB_QUIRK_B_DISCONNECT_99:
485 + musb_dbg(musb, "Poll devctl in case of suspend after disconnect\n");
486 + schedule_delayed_work(&musb->irq_work,
487 + msecs_to_jiffies(1000));
488 + break;
489 case MUSB_QUIRK_B_INVALID_VBUS_91:
490 if (musb->quirk_retries--) {
491 musb_dbg(musb,
492 @@ -2309,6 +2317,9 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
493 musb_platform_disable(musb);
494 musb_generic_disable(musb);
495
496 + /* MUSB_POWER_SOFTCONN might be already set, JZ4740 does this. */
497 + musb_writeb(musb->mregs, MUSB_POWER, 0);
498 +
499 /* Init IRQ workqueue before request_irq */
500 INIT_DELAYED_WORK(&musb->irq_work, musb_irq_work);
501 INIT_DELAYED_WORK(&musb->deassert_reset_work, musb_deassert_reset);
502 diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c
503 index 512108e22d2b..1dc35ab31275 100644
504 --- a/drivers/usb/musb/musbhsdma.c
505 +++ b/drivers/usb/musb/musbhsdma.c
506 @@ -399,7 +399,7 @@ struct dma_controller *musbhs_dma_controller_create(struct musb *musb,
507 controller->controller.channel_abort = dma_channel_abort;
508
509 if (request_irq(irq, dma_controller_irq, 0,
510 - dev_name(musb->controller), &controller->controller)) {
511 + dev_name(musb->controller), controller)) {
512 dev_err(dev, "request_irq %d failed!\n", irq);
513 musb_dma_controller_destroy(&controller->controller);
514
515 diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
516 index 2d302ff62cc1..5ea4cd10abc7 100644
517 --- a/drivers/usb/serial/option.c
518 +++ b/drivers/usb/serial/option.c
519 @@ -566,6 +566,9 @@ static void option_instat_callback(struct urb *urb);
520 /* Interface is reserved */
521 #define RSVD(ifnum) ((BIT(ifnum) & 0xff) << 0)
522
523 +/* Device needs ZLP */
524 +#define ZLP BIT(17)
525 +
526
527 static const struct usb_device_id option_ids[] = {
528 { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
529 @@ -1193,6 +1196,8 @@ static const struct usb_device_id option_ids[] = {
530 .driver_info = NCTRL(0) | RSVD(1) },
531 { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */
532 .driver_info = NCTRL(0) },
533 + { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */
534 + .driver_info = NCTRL(0) | ZLP },
535 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
536 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
537 .driver_info = RSVD(1) },
538 @@ -2097,6 +2102,9 @@ static int option_attach(struct usb_serial *serial)
539 if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber)))
540 data->use_send_setup = 1;
541
542 + if (device_flags & ZLP)
543 + data->use_zlp = 1;
544 +
545 spin_lock_init(&data->susp_lock);
546
547 usb_set_serial_data(serial, data);
548 diff --git a/drivers/usb/serial/usb-wwan.h b/drivers/usb/serial/usb-wwan.h
549 index 44b25c08c68a..1d0e28538346 100644
550 --- a/drivers/usb/serial/usb-wwan.h
551 +++ b/drivers/usb/serial/usb-wwan.h
552 @@ -35,6 +35,7 @@ struct usb_wwan_intf_private {
553 spinlock_t susp_lock;
554 unsigned int suspended:1;
555 unsigned int use_send_setup:1;
556 + unsigned int use_zlp:1;
557 int in_flight;
558 unsigned int open_ports;
559 void *private;
560 diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
561 index 3dfdfc81254b..93c696e2131f 100644
562 --- a/drivers/usb/serial/usb_wwan.c
563 +++ b/drivers/usb/serial/usb_wwan.c
564 @@ -495,6 +495,7 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port,
565 void (*callback) (struct urb *))
566 {
567 struct usb_serial *serial = port->serial;
568 + struct usb_wwan_intf_private *intfdata = usb_get_serial_data(serial);
569 struct urb *urb;
570
571 urb = usb_alloc_urb(0, GFP_KERNEL); /* No ISO */
572 @@ -505,6 +506,9 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port,
573 usb_sndbulkpipe(serial->dev, endpoint) | dir,
574 buf, len, callback, ctx);
575
576 + if (intfdata->use_zlp && dir == USB_DIR_OUT)
577 + urb->transfer_flags |= URB_ZERO_PACKET;
578 +
579 return urb;
580 }
581
582 diff --git a/fs/char_dev.c b/fs/char_dev.c
583 index a112a4745d8b..23e0477edf7d 100644
584 --- a/fs/char_dev.c
585 +++ b/fs/char_dev.c
586 @@ -336,7 +336,7 @@ static struct kobject *cdev_get(struct cdev *p)
587
588 if (owner && !try_module_get(owner))
589 return NULL;
590 - kobj = kobject_get(&p->kobj);
591 + kobj = kobject_get_unless_zero(&p->kobj);
592 if (!kobj)
593 module_put(owner);
594 return kobj;
595 diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
596 index f7178f44825b..d2a497950639 100644
597 --- a/include/linux/can/dev.h
598 +++ b/include/linux/can/dev.h
599 @@ -17,6 +17,7 @@
600 #include <linux/can/error.h>
601 #include <linux/can/led.h>
602 #include <linux/can/netlink.h>
603 +#include <linux/can/skb.h>
604 #include <linux/netdevice.h>
605
606 /*
607 @@ -81,6 +82,36 @@ struct can_priv {
608 #define get_can_dlc(i) (min_t(__u8, (i), CAN_MAX_DLC))
609 #define get_canfd_dlc(i) (min_t(__u8, (i), CANFD_MAX_DLC))
610
611 +/* Check for outgoing skbs that have not been created by the CAN subsystem */
612 +static inline bool can_skb_headroom_valid(struct net_device *dev,
613 + struct sk_buff *skb)
614 +{
615 + /* af_packet creates a headroom of HH_DATA_MOD bytes which is fine */
616 + if (WARN_ON_ONCE(skb_headroom(skb) < sizeof(struct can_skb_priv)))
617 + return false;
618 +
619 + /* af_packet does not apply CAN skb specific settings */
620 + if (skb->ip_summed == CHECKSUM_NONE) {
621 + /* init headroom */
622 + can_skb_prv(skb)->ifindex = dev->ifindex;
623 + can_skb_prv(skb)->skbcnt = 0;
624 +
625 + skb->ip_summed = CHECKSUM_UNNECESSARY;
626 +
627 + /* preform proper loopback on capable devices */
628 + if (dev->flags & IFF_ECHO)
629 + skb->pkt_type = PACKET_LOOPBACK;
630 + else
631 + skb->pkt_type = PACKET_HOST;
632 +
633 + skb_reset_mac_header(skb);
634 + skb_reset_network_header(skb);
635 + skb_reset_transport_header(skb);
636 + }
637 +
638 + return true;
639 +}
640 +
641 /* Drop a given socketbuffer if it does not contain a valid CAN frame. */
642 static inline bool can_dropped_invalid_skb(struct net_device *dev,
643 struct sk_buff *skb)
644 @@ -98,6 +129,9 @@ static inline bool can_dropped_invalid_skb(struct net_device *dev,
645 } else
646 goto inval_skb;
647
648 + if (!can_skb_headroom_valid(dev, skb))
649 + goto inval_skb;
650 +
651 return false;
652
653 inval_skb:
654 diff --git a/include/linux/kobject.h b/include/linux/kobject.h
655 index 5957c6a3fd7f..d9d4485ebad2 100644
656 --- a/include/linux/kobject.h
657 +++ b/include/linux/kobject.h
658 @@ -108,6 +108,8 @@ extern int __must_check kobject_rename(struct kobject *, const char *new_name);
659 extern int __must_check kobject_move(struct kobject *, struct kobject *);
660
661 extern struct kobject *kobject_get(struct kobject *kobj);
662 +extern struct kobject * __must_check kobject_get_unless_zero(
663 + struct kobject *kobj);
664 extern void kobject_put(struct kobject *kobj);
665
666 extern const void *kobject_namespace(struct kobject *kobj);
667 diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c
668 index 9d4399b553a3..6403f45da9d5 100644
669 --- a/kernel/trace/trace_sched_wakeup.c
670 +++ b/kernel/trace/trace_sched_wakeup.c
671 @@ -625,7 +625,7 @@ static void start_wakeup_tracer(struct trace_array *tr)
672 if (ret) {
673 pr_info("wakeup trace: Couldn't activate tracepoint"
674 " probe to kernel_sched_migrate_task\n");
675 - return;
676 + goto fail_deprobe_sched_switch;
677 }
678
679 wakeup_reset(tr);
680 @@ -643,6 +643,8 @@ static void start_wakeup_tracer(struct trace_array *tr)
681 printk(KERN_ERR "failed to start wakeup tracer\n");
682
683 return;
684 +fail_deprobe_sched_switch:
685 + unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL);
686 fail_deprobe_wake_new:
687 unregister_trace_sched_wakeup_new(probe_wakeup, NULL);
688 fail_deprobe:
689 diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
690 index 2a1abbaca10e..5d2c08efd12f 100644
691 --- a/kernel/trace/trace_stack.c
692 +++ b/kernel/trace/trace_stack.c
693 @@ -201,6 +201,11 @@ check_stack(unsigned long ip, unsigned long *stack)
694 local_irq_restore(flags);
695 }
696
697 +/* Some archs may not define MCOUNT_INSN_SIZE */
698 +#ifndef MCOUNT_INSN_SIZE
699 +# define MCOUNT_INSN_SIZE 0
700 +#endif
701 +
702 static void
703 stack_trace_call(unsigned long ip, unsigned long parent_ip,
704 struct ftrace_ops *op, struct pt_regs *pt_regs)
705 diff --git a/lib/kobject.c b/lib/kobject.c
706 index f58c7f2b229c..bbbb067de8ec 100644
707 --- a/lib/kobject.c
708 +++ b/lib/kobject.c
709 @@ -599,12 +599,15 @@ struct kobject *kobject_get(struct kobject *kobj)
710 }
711 EXPORT_SYMBOL(kobject_get);
712
713 -static struct kobject * __must_check kobject_get_unless_zero(struct kobject *kobj)
714 +struct kobject * __must_check kobject_get_unless_zero(struct kobject *kobj)
715 {
716 + if (!kobj)
717 + return NULL;
718 if (!kref_get_unless_zero(&kobj->kref))
719 kobj = NULL;
720 return kobj;
721 }
722 +EXPORT_SYMBOL(kobject_get_unless_zero);
723
724 /*
725 * kobject_cleanup - free kobject resources.
726 diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
727 index d35815e5967b..d819e91df90d 100644
728 --- a/net/ipv4/netfilter/arp_tables.c
729 +++ b/net/ipv4/netfilter/arp_tables.c
730 @@ -403,10 +403,11 @@ next: ;
731 return 1;
732 }
733
734 -static inline int check_target(struct arpt_entry *e, const char *name)
735 +static int check_target(struct arpt_entry *e, struct net *net, const char *name)
736 {
737 struct xt_entry_target *t = arpt_get_target(e);
738 struct xt_tgchk_param par = {
739 + .net = net,
740 .table = name,
741 .entryinfo = e,
742 .target = t->u.kernel.target,
743 @@ -418,8 +419,9 @@ static inline int check_target(struct arpt_entry *e, const char *name)
744 return xt_check_target(&par, t->u.target_size - sizeof(*t), 0, false);
745 }
746
747 -static inline int
748 -find_check_entry(struct arpt_entry *e, const char *name, unsigned int size,
749 +static int
750 +find_check_entry(struct arpt_entry *e, struct net *net, const char *name,
751 + unsigned int size,
752 struct xt_percpu_counter_alloc_state *alloc_state)
753 {
754 struct xt_entry_target *t;
755 @@ -438,7 +440,7 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size,
756 }
757 t->u.kernel.target = target;
758
759 - ret = check_target(e, name);
760 + ret = check_target(e, net, name);
761 if (ret)
762 goto err;
763 return 0;
764 @@ -531,7 +533,9 @@ static inline void cleanup_entry(struct arpt_entry *e)
765 /* Checks and translates the user-supplied table segment (held in
766 * newinfo).
767 */
768 -static int translate_table(struct xt_table_info *newinfo, void *entry0,
769 +static int translate_table(struct net *net,
770 + struct xt_table_info *newinfo,
771 + void *entry0,
772 const struct arpt_replace *repl)
773 {
774 struct xt_percpu_counter_alloc_state alloc_state = { 0 };
775 @@ -597,7 +601,7 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0,
776 /* Finally, each sanity check must pass */
777 i = 0;
778 xt_entry_foreach(iter, entry0, newinfo->size) {
779 - ret = find_check_entry(iter, repl->name, repl->size,
780 + ret = find_check_entry(iter, net, repl->name, repl->size,
781 &alloc_state);
782 if (ret != 0)
783 break;
784 @@ -987,7 +991,7 @@ static int do_replace(struct net *net, const void __user *user,
785 goto free_newinfo;
786 }
787
788 - ret = translate_table(newinfo, loc_cpu_entry, &tmp);
789 + ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
790 if (ret != 0)
791 goto free_newinfo;
792
793 @@ -1164,7 +1168,8 @@ compat_copy_entry_from_user(struct compat_arpt_entry *e, void **dstptr,
794 }
795 }
796
797 -static int translate_compat_table(struct xt_table_info **pinfo,
798 +static int translate_compat_table(struct net *net,
799 + struct xt_table_info **pinfo,
800 void **pentry0,
801 const struct compat_arpt_replace *compatr)
802 {
803 @@ -1230,7 +1235,7 @@ static int translate_compat_table(struct xt_table_info **pinfo,
804 repl.num_counters = 0;
805 repl.counters = NULL;
806 repl.size = newinfo->size;
807 - ret = translate_table(newinfo, entry1, &repl);
808 + ret = translate_table(net, newinfo, entry1, &repl);
809 if (ret)
810 goto free_newinfo;
811
812 @@ -1283,7 +1288,7 @@ static int compat_do_replace(struct net *net, void __user *user,
813 goto free_newinfo;
814 }
815
816 - ret = translate_compat_table(&newinfo, &loc_cpu_entry, &tmp);
817 + ret = translate_compat_table(net, &newinfo, &loc_cpu_entry, &tmp);
818 if (ret != 0)
819 goto free_newinfo;
820
821 @@ -1559,7 +1564,7 @@ int arpt_register_table(struct net *net,
822 loc_cpu_entry = newinfo->entries;
823 memcpy(loc_cpu_entry, repl->entries, repl->size);
824
825 - ret = translate_table(newinfo, loc_cpu_entry, repl);
826 + ret = translate_table(net, newinfo, loc_cpu_entry, repl);
827 if (ret != 0)
828 goto out_free;
829
830 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
831 index 4901d17a8e63..9644dcef5a2b 100644
832 --- a/net/ipv4/tcp_input.c
833 +++ b/net/ipv4/tcp_input.c
834 @@ -129,7 +129,8 @@ int sysctl_tcp_invalid_ratelimit __read_mostly = HZ/2;
835 #define REXMIT_LOST 1 /* retransmit packets marked lost */
836 #define REXMIT_NEW 2 /* FRTO-style transmit of unsent/new packets */
837
838 -static void tcp_gro_dev_warn(struct sock *sk, const struct sk_buff *skb)
839 +static void tcp_gro_dev_warn(struct sock *sk, const struct sk_buff *skb,
840 + unsigned int len)
841 {
842 static bool __once __read_mostly;
843
844 @@ -140,8 +141,9 @@ static void tcp_gro_dev_warn(struct sock *sk, const struct sk_buff *skb)
845
846 rcu_read_lock();
847 dev = dev_get_by_index_rcu(sock_net(sk), skb->skb_iif);
848 - pr_warn("%s: Driver has suspect GRO implementation, TCP performance may be compromised.\n",
849 - dev ? dev->name : "Unknown driver");
850 + if (!dev || len >= dev->mtu)
851 + pr_warn("%s: Driver has suspect GRO implementation, TCP performance may be compromised.\n",
852 + dev ? dev->name : "Unknown driver");
853 rcu_read_unlock();
854 }
855 }
856 @@ -164,8 +166,10 @@ static void tcp_measure_rcv_mss(struct sock *sk, const struct sk_buff *skb)
857 if (len >= icsk->icsk_ack.rcv_mss) {
858 icsk->icsk_ack.rcv_mss = min_t(unsigned int, len,
859 tcp_sk(sk)->advmss);
860 - if (unlikely(icsk->icsk_ack.rcv_mss != len))
861 - tcp_gro_dev_warn(sk, skb);
862 + /* Account for possibly-removed options */
863 + if (unlikely(len > icsk->icsk_ack.rcv_mss +
864 + MAX_TCP_OPTION_SPACE))
865 + tcp_gro_dev_warn(sk, skb, len);
866 } else {
867 /* Otherwise, we make more careful check taking into account,
868 * that SACKs block is variable.
869 diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
870 index fa5229fd3703..f64660e9ff87 100644
871 --- a/net/netfilter/ipset/ip_set_core.c
872 +++ b/net/netfilter/ipset/ip_set_core.c
873 @@ -1634,6 +1634,7 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb,
874 struct ip_set *set;
875 struct nlattr *tb[IPSET_ATTR_ADT_MAX + 1] = {};
876 int ret = 0;
877 + u32 lineno;
878
879 if (unlikely(protocol_failed(attr) ||
880 !attr[IPSET_ATTR_SETNAME] ||
881 @@ -1650,7 +1651,7 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb,
882 return -IPSET_ERR_PROTOCOL;
883
884 rcu_read_lock_bh();
885 - ret = set->variant->uadt(set, tb, IPSET_TEST, NULL, 0, 0);
886 + ret = set->variant->uadt(set, tb, IPSET_TEST, &lineno, 0, 0);
887 rcu_read_unlock_bh();
888 /* Userspace can't trigger element to be re-added */
889 if (ret == -EAGAIN)
890 diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
891 index da9fc08b20bb..a5299cbb09ba 100644
892 --- a/sound/usb/quirks.c
893 +++ b/sound/usb/quirks.c
894 @@ -1141,6 +1141,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
895 case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
896 case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
897 case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */
898 + case USB_ID(0x05a7, 0x1020): /* Bose Companion 5 */
899 case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
900 case USB_ID(0x1395, 0x740a): /* Sennheiser DECT */
901 case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */