Magellan Linux

Annotation of /trunk/kernel-alx/patches-5.4/0258-5.4.159-all-fixes.patch

Parent Directory Parent Directory | Revision Log Revision Log


Revision 3635 - (hide annotations) (download)
Mon Oct 24 12:34:12 2022 UTC (19 months, 2 weeks ago) by niro
File size: 23948 byte(s)
-sync kernel patches
1 niro 3635 diff --git a/Makefile b/Makefile
2     index cef1d2704c410..602b5167dacd7 100644
3     --- a/Makefile
4     +++ b/Makefile
5     @@ -1,7 +1,7 @@
6     # SPDX-License-Identifier: GPL-2.0
7     VERSION = 5
8     PATCHLEVEL = 4
9     -SUBLEVEL = 158
10     +SUBLEVEL = 159
11     EXTRAVERSION =
12     NAME = Kleptomaniac Octopus
13    
14     diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
15     index 642031b896f64..24a6905d60ee2 100644
16     --- a/arch/x86/kvm/ioapic.c
17     +++ b/arch/x86/kvm/ioapic.c
18     @@ -91,7 +91,7 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
19     static void rtc_irq_eoi_tracking_reset(struct kvm_ioapic *ioapic)
20     {
21     ioapic->rtc_status.pending_eoi = 0;
22     - bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID + 1);
23     + bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID);
24     }
25    
26     static void kvm_rtc_eoi_tracking_restore_all(struct kvm_ioapic *ioapic);
27     diff --git a/arch/x86/kvm/ioapic.h b/arch/x86/kvm/ioapic.h
28     index 283f1f489bcac..ea1a4e0297dae 100644
29     --- a/arch/x86/kvm/ioapic.h
30     +++ b/arch/x86/kvm/ioapic.h
31     @@ -43,13 +43,13 @@ struct kvm_vcpu;
32    
33     struct dest_map {
34     /* vcpu bitmap where IRQ has been sent */
35     - DECLARE_BITMAP(map, KVM_MAX_VCPU_ID + 1);
36     + DECLARE_BITMAP(map, KVM_MAX_VCPU_ID);
37    
38     /*
39     * Vector sent to a given vcpu, only valid when
40     * the vcpu's bit in map is set
41     */
42     - u8 vectors[KVM_MAX_VCPU_ID + 1];
43     + u8 vectors[KVM_MAX_VCPU_ID];
44     };
45    
46    
47     diff --git a/drivers/android/binder.c b/drivers/android/binder.c
48     index 4eaef780844ea..2be6687c0148f 100644
49     --- a/drivers/android/binder.c
50     +++ b/drivers/android/binder.c
51     @@ -2257,7 +2257,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
52     binder_dec_node(buffer->target_node, 1, 0);
53    
54     off_start_offset = ALIGN(buffer->data_size, sizeof(void *));
55     - off_end_offset = is_failure ? failed_at :
56     + off_end_offset = is_failure && failed_at ? failed_at :
57     off_start_offset + buffer->offsets_size;
58     for (buffer_offset = off_start_offset; buffer_offset < off_end_offset;
59     buffer_offset += sizeof(binder_size_t)) {
60     @@ -2343,9 +2343,8 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
61     binder_size_t fd_buf_size;
62     binder_size_t num_valid;
63    
64     - if (proc->tsk != current->group_leader) {
65     + if (is_failure) {
66     /*
67     - * Nothing to do if running in sender context
68     * The fd fixups have not been applied so no
69     * fds need to be closed.
70     */
71     @@ -3548,6 +3547,7 @@ err_invalid_target_handle:
72     * binder_free_buf() - free the specified buffer
73     * @proc: binder proc that owns buffer
74     * @buffer: buffer to be freed
75     + * @is_failure: failed to send transaction
76     *
77     * If buffer for an async transaction, enqueue the next async
78     * transaction from the node.
79     @@ -3557,7 +3557,7 @@ err_invalid_target_handle:
80     static void
81     binder_free_buf(struct binder_proc *proc,
82     struct binder_thread *thread,
83     - struct binder_buffer *buffer)
84     + struct binder_buffer *buffer, bool is_failure)
85     {
86     binder_inner_proc_lock(proc);
87     if (buffer->transaction) {
88     @@ -3585,7 +3585,7 @@ binder_free_buf(struct binder_proc *proc,
89     binder_node_inner_unlock(buf_node);
90     }
91     trace_binder_transaction_buffer_release(buffer);
92     - binder_transaction_buffer_release(proc, thread, buffer, 0, false);
93     + binder_transaction_buffer_release(proc, thread, buffer, 0, is_failure);
94     binder_alloc_free_buf(&proc->alloc, buffer);
95     }
96    
97     @@ -3786,7 +3786,7 @@ static int binder_thread_write(struct binder_proc *proc,
98     proc->pid, thread->pid, (u64)data_ptr,
99     buffer->debug_id,
100     buffer->transaction ? "active" : "finished");
101     - binder_free_buf(proc, thread, buffer);
102     + binder_free_buf(proc, thread, buffer, false);
103     break;
104     }
105    
106     @@ -4474,7 +4474,7 @@ retry:
107     buffer->transaction = NULL;
108     binder_cleanup_transaction(t, "fd fixups failed",
109     BR_FAILED_REPLY);
110     - binder_free_buf(proc, thread, buffer);
111     + binder_free_buf(proc, thread, buffer, true);
112     binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
113     "%d:%d %stransaction %d fd fixups failed %d/%d, line %d\n",
114     proc->pid, thread->pid,
115     diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
116     index e8aa3d4bda885..1e5a2a0cc6700 100644
117     --- a/drivers/net/wireless/rsi/rsi_91x_usb.c
118     +++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
119     @@ -61,7 +61,7 @@ static int rsi_usb_card_write(struct rsi_hw *adapter,
120     (void *)seg,
121     (int)len,
122     &transfer,
123     - HZ * 5);
124     + USB_CTRL_SET_TIMEOUT);
125    
126     if (status < 0) {
127     rsi_dbg(ERR_ZONE,
128     diff --git a/drivers/staging/comedi/drivers/dt9812.c b/drivers/staging/comedi/drivers/dt9812.c
129     index 634f57730c1e0..704b04d2980d3 100644
130     --- a/drivers/staging/comedi/drivers/dt9812.c
131     +++ b/drivers/staging/comedi/drivers/dt9812.c
132     @@ -32,6 +32,7 @@
133     #include <linux/kernel.h>
134     #include <linux/module.h>
135     #include <linux/errno.h>
136     +#include <linux/slab.h>
137     #include <linux/uaccess.h>
138    
139     #include "../comedi_usb.h"
140     @@ -237,22 +238,42 @@ static int dt9812_read_info(struct comedi_device *dev,
141     {
142     struct usb_device *usb = comedi_to_usb_dev(dev);
143     struct dt9812_private *devpriv = dev->private;
144     - struct dt9812_usb_cmd cmd;
145     + struct dt9812_usb_cmd *cmd;
146     + size_t tbuf_size;
147     int count, ret;
148     + void *tbuf;
149    
150     - cmd.cmd = cpu_to_le32(DT9812_R_FLASH_DATA);
151     - cmd.u.flash_data_info.address =
152     + tbuf_size = max(sizeof(*cmd), buf_size);
153     +
154     + tbuf = kzalloc(tbuf_size, GFP_KERNEL);
155     + if (!tbuf)
156     + return -ENOMEM;
157     +
158     + cmd = tbuf;
159     +
160     + cmd->cmd = cpu_to_le32(DT9812_R_FLASH_DATA);
161     + cmd->u.flash_data_info.address =
162     cpu_to_le16(DT9812_DIAGS_BOARD_INFO_ADDR + offset);
163     - cmd.u.flash_data_info.numbytes = cpu_to_le16(buf_size);
164     + cmd->u.flash_data_info.numbytes = cpu_to_le16(buf_size);
165    
166     /* DT9812 only responds to 32 byte writes!! */
167     ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
168     - &cmd, 32, &count, DT9812_USB_TIMEOUT);
169     + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
170     if (ret)
171     - return ret;
172     + goto out;
173     +
174     + ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
175     + tbuf, buf_size, &count, DT9812_USB_TIMEOUT);
176     + if (!ret) {
177     + if (count == buf_size)
178     + memcpy(buf, tbuf, buf_size);
179     + else
180     + ret = -EREMOTEIO;
181     + }
182     +out:
183     + kfree(tbuf);
184    
185     - return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
186     - buf, buf_size, &count, DT9812_USB_TIMEOUT);
187     + return ret;
188     }
189    
190     static int dt9812_read_multiple_registers(struct comedi_device *dev,
191     @@ -261,22 +282,42 @@ static int dt9812_read_multiple_registers(struct comedi_device *dev,
192     {
193     struct usb_device *usb = comedi_to_usb_dev(dev);
194     struct dt9812_private *devpriv = dev->private;
195     - struct dt9812_usb_cmd cmd;
196     + struct dt9812_usb_cmd *cmd;
197     int i, count, ret;
198     + size_t buf_size;
199     + void *buf;
200    
201     - cmd.cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG);
202     - cmd.u.read_multi_info.count = reg_count;
203     + buf_size = max_t(size_t, sizeof(*cmd), reg_count);
204     +
205     + buf = kzalloc(buf_size, GFP_KERNEL);
206     + if (!buf)
207     + return -ENOMEM;
208     +
209     + cmd = buf;
210     +
211     + cmd->cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG);
212     + cmd->u.read_multi_info.count = reg_count;
213     for (i = 0; i < reg_count; i++)
214     - cmd.u.read_multi_info.address[i] = address[i];
215     + cmd->u.read_multi_info.address[i] = address[i];
216    
217     /* DT9812 only responds to 32 byte writes!! */
218     ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
219     - &cmd, 32, &count, DT9812_USB_TIMEOUT);
220     + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
221     if (ret)
222     - return ret;
223     + goto out;
224     +
225     + ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
226     + buf, reg_count, &count, DT9812_USB_TIMEOUT);
227     + if (!ret) {
228     + if (count == reg_count)
229     + memcpy(value, buf, reg_count);
230     + else
231     + ret = -EREMOTEIO;
232     + }
233     +out:
234     + kfree(buf);
235    
236     - return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
237     - value, reg_count, &count, DT9812_USB_TIMEOUT);
238     + return ret;
239     }
240    
241     static int dt9812_write_multiple_registers(struct comedi_device *dev,
242     @@ -285,19 +326,27 @@ static int dt9812_write_multiple_registers(struct comedi_device *dev,
243     {
244     struct usb_device *usb = comedi_to_usb_dev(dev);
245     struct dt9812_private *devpriv = dev->private;
246     - struct dt9812_usb_cmd cmd;
247     + struct dt9812_usb_cmd *cmd;
248     int i, count;
249     + int ret;
250     +
251     + cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
252     + if (!cmd)
253     + return -ENOMEM;
254    
255     - cmd.cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG);
256     - cmd.u.read_multi_info.count = reg_count;
257     + cmd->cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG);
258     + cmd->u.read_multi_info.count = reg_count;
259     for (i = 0; i < reg_count; i++) {
260     - cmd.u.write_multi_info.write[i].address = address[i];
261     - cmd.u.write_multi_info.write[i].value = value[i];
262     + cmd->u.write_multi_info.write[i].address = address[i];
263     + cmd->u.write_multi_info.write[i].value = value[i];
264     }
265    
266     /* DT9812 only responds to 32 byte writes!! */
267     - return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
268     - &cmd, 32, &count, DT9812_USB_TIMEOUT);
269     + ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
270     + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
271     + kfree(cmd);
272     +
273     + return ret;
274     }
275    
276     static int dt9812_rmw_multiple_registers(struct comedi_device *dev,
277     @@ -306,17 +355,25 @@ static int dt9812_rmw_multiple_registers(struct comedi_device *dev,
278     {
279     struct usb_device *usb = comedi_to_usb_dev(dev);
280     struct dt9812_private *devpriv = dev->private;
281     - struct dt9812_usb_cmd cmd;
282     + struct dt9812_usb_cmd *cmd;
283     int i, count;
284     + int ret;
285     +
286     + cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
287     + if (!cmd)
288     + return -ENOMEM;
289    
290     - cmd.cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG);
291     - cmd.u.rmw_multi_info.count = reg_count;
292     + cmd->cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG);
293     + cmd->u.rmw_multi_info.count = reg_count;
294     for (i = 0; i < reg_count; i++)
295     - cmd.u.rmw_multi_info.rmw[i] = rmw[i];
296     + cmd->u.rmw_multi_info.rmw[i] = rmw[i];
297    
298     /* DT9812 only responds to 32 byte writes!! */
299     - return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
300     - &cmd, 32, &count, DT9812_USB_TIMEOUT);
301     + ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
302     + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
303     + kfree(cmd);
304     +
305     + return ret;
306     }
307    
308     static int dt9812_digital_in(struct comedi_device *dev, u8 *bits)
309     diff --git a/drivers/staging/comedi/drivers/ni_usb6501.c b/drivers/staging/comedi/drivers/ni_usb6501.c
310     index 360e86a19fe32..311632004f08a 100644
311     --- a/drivers/staging/comedi/drivers/ni_usb6501.c
312     +++ b/drivers/staging/comedi/drivers/ni_usb6501.c
313     @@ -144,6 +144,10 @@ static const u8 READ_COUNTER_RESPONSE[] = {0x00, 0x01, 0x00, 0x10,
314     0x00, 0x00, 0x00, 0x02,
315     0x00, 0x00, 0x00, 0x00};
316    
317     +/* Largest supported packets */
318     +static const size_t TX_MAX_SIZE = sizeof(SET_PORT_DIR_REQUEST);
319     +static const size_t RX_MAX_SIZE = sizeof(READ_PORT_RESPONSE);
320     +
321     enum commands {
322     READ_PORT,
323     WRITE_PORT,
324     @@ -501,6 +505,12 @@ static int ni6501_find_endpoints(struct comedi_device *dev)
325     if (!devpriv->ep_rx || !devpriv->ep_tx)
326     return -ENODEV;
327    
328     + if (usb_endpoint_maxp(devpriv->ep_rx) < RX_MAX_SIZE)
329     + return -ENODEV;
330     +
331     + if (usb_endpoint_maxp(devpriv->ep_tx) < TX_MAX_SIZE)
332     + return -ENODEV;
333     +
334     return 0;
335     }
336    
337     diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
338     index 7956abcbae22b..7769eadfaf61d 100644
339     --- a/drivers/staging/comedi/drivers/vmk80xx.c
340     +++ b/drivers/staging/comedi/drivers/vmk80xx.c
341     @@ -90,6 +90,9 @@ enum {
342     #define IC3_VERSION BIT(0)
343     #define IC6_VERSION BIT(1)
344    
345     +#define MIN_BUF_SIZE 64
346     +#define PACKET_TIMEOUT 10000 /* ms */
347     +
348     enum vmk80xx_model {
349     VMK8055_MODEL,
350     VMK8061_MODEL
351     @@ -157,22 +160,21 @@ static void vmk80xx_do_bulk_msg(struct comedi_device *dev)
352     __u8 rx_addr;
353     unsigned int tx_pipe;
354     unsigned int rx_pipe;
355     - size_t size;
356     + size_t tx_size;
357     + size_t rx_size;
358    
359     tx_addr = devpriv->ep_tx->bEndpointAddress;
360     rx_addr = devpriv->ep_rx->bEndpointAddress;
361     tx_pipe = usb_sndbulkpipe(usb, tx_addr);
362     rx_pipe = usb_rcvbulkpipe(usb, rx_addr);
363     + tx_size = usb_endpoint_maxp(devpriv->ep_tx);
364     + rx_size = usb_endpoint_maxp(devpriv->ep_rx);
365    
366     - /*
367     - * The max packet size attributes of the K8061
368     - * input/output endpoints are identical
369     - */
370     - size = usb_endpoint_maxp(devpriv->ep_tx);
371     + usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, tx_size, NULL,
372     + PACKET_TIMEOUT);
373    
374     - usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf,
375     - size, NULL, devpriv->ep_tx->bInterval);
376     - usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, size, NULL, HZ * 10);
377     + usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, rx_size, NULL,
378     + PACKET_TIMEOUT);
379     }
380    
381     static int vmk80xx_read_packet(struct comedi_device *dev)
382     @@ -191,7 +193,7 @@ static int vmk80xx_read_packet(struct comedi_device *dev)
383     pipe = usb_rcvintpipe(usb, ep->bEndpointAddress);
384     return usb_interrupt_msg(usb, pipe, devpriv->usb_rx_buf,
385     usb_endpoint_maxp(ep), NULL,
386     - HZ * 10);
387     + PACKET_TIMEOUT);
388     }
389    
390     static int vmk80xx_write_packet(struct comedi_device *dev, int cmd)
391     @@ -212,7 +214,7 @@ static int vmk80xx_write_packet(struct comedi_device *dev, int cmd)
392     pipe = usb_sndintpipe(usb, ep->bEndpointAddress);
393     return usb_interrupt_msg(usb, pipe, devpriv->usb_tx_buf,
394     usb_endpoint_maxp(ep), NULL,
395     - HZ * 10);
396     + PACKET_TIMEOUT);
397     }
398    
399     static int vmk80xx_reset_device(struct comedi_device *dev)
400     @@ -678,12 +680,12 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev)
401     struct vmk80xx_private *devpriv = dev->private;
402     size_t size;
403    
404     - size = usb_endpoint_maxp(devpriv->ep_rx);
405     + size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE);
406     devpriv->usb_rx_buf = kzalloc(size, GFP_KERNEL);
407     if (!devpriv->usb_rx_buf)
408     return -ENOMEM;
409    
410     - size = usb_endpoint_maxp(devpriv->ep_tx);
411     + size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE);
412     devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
413     if (!devpriv->usb_tx_buf)
414     return -ENOMEM;
415     diff --git a/drivers/staging/media/ipu3/ipu3-css-fw.c b/drivers/staging/media/ipu3/ipu3-css-fw.c
416     index 45aff76198e2c..981693eed8155 100644
417     --- a/drivers/staging/media/ipu3/ipu3-css-fw.c
418     +++ b/drivers/staging/media/ipu3/ipu3-css-fw.c
419     @@ -124,12 +124,11 @@ int imgu_css_fw_init(struct imgu_css *css)
420     /* Check and display fw header info */
421    
422     css->fwp = (struct imgu_fw_header *)css->fw->data;
423     - if (css->fw->size < sizeof(struct imgu_fw_header *) ||
424     + if (css->fw->size < struct_size(css->fwp, binary_header, 1) ||
425     css->fwp->file_header.h_size != sizeof(struct imgu_fw_bi_file_h))
426     goto bad_fw;
427     - if (sizeof(struct imgu_fw_bi_file_h) +
428     - css->fwp->file_header.binary_nr * sizeof(struct imgu_fw_info) >
429     - css->fw->size)
430     + if (struct_size(css->fwp, binary_header,
431     + css->fwp->file_header.binary_nr) > css->fw->size)
432     goto bad_fw;
433    
434     dev_info(dev, "loaded firmware version %.64s, %u binaries, %zu bytes\n",
435     diff --git a/drivers/staging/media/ipu3/ipu3-css-fw.h b/drivers/staging/media/ipu3/ipu3-css-fw.h
436     index 79ffa70451390..650fd25fc79ee 100644
437     --- a/drivers/staging/media/ipu3/ipu3-css-fw.h
438     +++ b/drivers/staging/media/ipu3/ipu3-css-fw.h
439     @@ -170,7 +170,7 @@ struct imgu_fw_bi_file_h {
440    
441     struct imgu_fw_header {
442     struct imgu_fw_bi_file_h file_header;
443     - struct imgu_fw_info binary_header[1]; /* binary_nr items */
444     + struct imgu_fw_info binary_header[]; /* binary_nr items */
445     };
446    
447     /******************* Firmware functions *******************/
448     diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
449     index e739d1979c877..6f65a9c9d6cf3 100644
450     --- a/drivers/staging/rtl8192u/r8192U_core.c
451     +++ b/drivers/staging/rtl8192u/r8192U_core.c
452     @@ -236,7 +236,7 @@ int write_nic_byte_E(struct net_device *dev, int indx, u8 data)
453    
454     status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
455     RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
456     - indx | 0xfe00, 0, usbdata, 1, HZ / 2);
457     + indx | 0xfe00, 0, usbdata, 1, 500);
458     kfree(usbdata);
459    
460     if (status < 0) {
461     @@ -258,7 +258,7 @@ int read_nic_byte_E(struct net_device *dev, int indx, u8 *data)
462    
463     status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
464     RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
465     - indx | 0xfe00, 0, usbdata, 1, HZ / 2);
466     + indx | 0xfe00, 0, usbdata, 1, 500);
467     *data = *usbdata;
468     kfree(usbdata);
469    
470     @@ -286,7 +286,7 @@ int write_nic_byte(struct net_device *dev, int indx, u8 data)
471     status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
472     RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
473     (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
474     - usbdata, 1, HZ / 2);
475     + usbdata, 1, 500);
476     kfree(usbdata);
477    
478     if (status < 0) {
479     @@ -313,7 +313,7 @@ int write_nic_word(struct net_device *dev, int indx, u16 data)
480     status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
481     RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
482     (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
483     - usbdata, 2, HZ / 2);
484     + usbdata, 2, 500);
485     kfree(usbdata);
486    
487     if (status < 0) {
488     @@ -340,7 +340,7 @@ int write_nic_dword(struct net_device *dev, int indx, u32 data)
489     status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
490     RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
491     (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
492     - usbdata, 4, HZ / 2);
493     + usbdata, 4, 500);
494     kfree(usbdata);
495    
496    
497     @@ -367,7 +367,7 @@ int read_nic_byte(struct net_device *dev, int indx, u8 *data)
498     status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
499     RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
500     (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
501     - usbdata, 1, HZ / 2);
502     + usbdata, 1, 500);
503     *data = *usbdata;
504     kfree(usbdata);
505    
506     @@ -394,7 +394,7 @@ int read_nic_word(struct net_device *dev, int indx, u16 *data)
507     status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
508     RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
509     (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
510     - usbdata, 2, HZ / 2);
511     + usbdata, 2, 500);
512     *data = *usbdata;
513     kfree(usbdata);
514    
515     @@ -418,7 +418,7 @@ static int read_nic_word_E(struct net_device *dev, int indx, u16 *data)
516    
517     status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
518     RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
519     - indx | 0xfe00, 0, usbdata, 2, HZ / 2);
520     + indx | 0xfe00, 0, usbdata, 2, 500);
521     *data = *usbdata;
522     kfree(usbdata);
523    
524     @@ -444,7 +444,7 @@ int read_nic_dword(struct net_device *dev, int indx, u32 *data)
525     status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
526     RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
527     (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
528     - usbdata, 4, HZ / 2);
529     + usbdata, 4, 500);
530     *data = *usbdata;
531     kfree(usbdata);
532    
533     diff --git a/drivers/staging/rtl8712/usb_ops_linux.c b/drivers/staging/rtl8712/usb_ops_linux.c
534     index 9d290bc2fdb7f..2202a0caa252e 100644
535     --- a/drivers/staging/rtl8712/usb_ops_linux.c
536     +++ b/drivers/staging/rtl8712/usb_ops_linux.c
537     @@ -493,7 +493,7 @@ int r8712_usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value,
538     memcpy(pIo_buf, pdata, len);
539     }
540     status = usb_control_msg(udev, pipe, request, reqtype, value, index,
541     - pIo_buf, len, HZ / 2);
542     + pIo_buf, len, 500);
543     if (status > 0) { /* Success this control transfer. */
544     if (requesttype == 0x01) {
545     /* For Control read transfer, we have to copy the read
546     diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig
547     index d354036ff6c86..f985bb4a42db2 100644
548     --- a/drivers/usb/gadget/udc/Kconfig
549     +++ b/drivers/usb/gadget/udc/Kconfig
550     @@ -330,6 +330,7 @@ config USB_AMD5536UDC
551     config USB_FSL_QE
552     tristate "Freescale QE/CPM USB Device Controller"
553     depends on FSL_SOC && (QUICC_ENGINE || CPM)
554     + depends on !64BIT || BROKEN
555     help
556     Some of Freescale PowerPC processors have a Full Speed
557     QE/CPM2 USB controller, which support device mode with 4
558     diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
559     index 5c6ce1ef3f4b0..c0e344c3a8487 100644
560     --- a/drivers/usb/host/ehci-hcd.c
561     +++ b/drivers/usb/host/ehci-hcd.c
562     @@ -634,7 +634,16 @@ static int ehci_run (struct usb_hcd *hcd)
563     /* Wait until HC become operational */
564     ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */
565     msleep(5);
566     - rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT, 0, 100 * 1000);
567     +
568     + /* For Aspeed, STS_HALT also depends on ASS/PSS status.
569     + * Check CMD_RUN instead.
570     + */
571     + if (ehci->is_aspeed)
572     + rc = ehci_handshake(ehci, &ehci->regs->command, CMD_RUN,
573     + 1, 100 * 1000);
574     + else
575     + rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT,
576     + 0, 100 * 1000);
577    
578     up_write(&ehci_cf_port_reset_rwsem);
579    
580     diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c
581     index e4fc3f66d43bf..accbcc989c503 100644
582     --- a/drivers/usb/host/ehci-platform.c
583     +++ b/drivers/usb/host/ehci-platform.c
584     @@ -286,6 +286,12 @@ static int ehci_platform_probe(struct platform_device *dev)
585     "has-transaction-translator"))
586     hcd->has_tt = 1;
587    
588     + if (of_device_is_compatible(dev->dev.of_node,
589     + "aspeed,ast2500-ehci") ||
590     + of_device_is_compatible(dev->dev.of_node,
591     + "aspeed,ast2600-ehci"))
592     + ehci->is_aspeed = 1;
593     +
594     if (soc_device_match(quirk_poll_match))
595     priv->quirk_poll = true;
596    
597     diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
598     index ac5e967907d14..356738462ce45 100644
599     --- a/drivers/usb/host/ehci.h
600     +++ b/drivers/usb/host/ehci.h
601     @@ -218,6 +218,7 @@ struct ehci_hcd { /* one per controller */
602     unsigned frame_index_bug:1; /* MosChip (AKA NetMos) */
603     unsigned need_oc_pp_cycle:1; /* MPC834X port power */
604     unsigned imx28_write_fix:1; /* For Freescale i.MX28 */
605     + unsigned is_aspeed:1;
606    
607     /* required for usb32 quirk */
608     #define OHCI_CTRL_HCFS (3 << 6)
609     diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
610     index ffe462a657b15..4622400ba4ddb 100644
611     --- a/drivers/usb/musb/musb_gadget.c
612     +++ b/drivers/usb/musb/musb_gadget.c
613     @@ -1248,9 +1248,11 @@ static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
614     status = musb_queue_resume_work(musb,
615     musb_ep_restart_resume_work,
616     request);
617     - if (status < 0)
618     + if (status < 0) {
619     dev_err(musb->controller, "%s resume work: %i\n",
620     __func__, status);
621     + list_del(&request->list);
622     + }
623     }
624    
625     unlock:
626     diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
627     index 7442793fe0502..3ba4e060fd051 100644
628     --- a/drivers/usb/storage/unusual_devs.h
629     +++ b/drivers/usb/storage/unusual_devs.h
630     @@ -406,6 +406,16 @@ UNUSUAL_DEV( 0x04b8, 0x0602, 0x0110, 0x0110,
631     "785EPX Storage",
632     USB_SC_SCSI, USB_PR_BULK, NULL, US_FL_SINGLE_LUN),
633    
634     +/*
635     + * Reported by James Buren <braewoods+lkml@braewoods.net>
636     + * Virtual ISOs cannot be remounted if ejected while the device is locked
637     + * Disable locking to mimic Windows behavior that bypasses the issue
638     + */
639     +UNUSUAL_DEV( 0x04c5, 0x2028, 0x0001, 0x0001,
640     + "iODD",
641     + "2531/2541",
642     + USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE),
643     +
644     /*
645     * Not sure who reported this originally but
646     * Pavel Machek <pavel@ucw.cz> reported that the extra US_FL_SINGLE_LUN
647     diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
648     index bf30f6ce8dd10..74e487d63c62c 100644
649     --- a/fs/isofs/inode.c
650     +++ b/fs/isofs/inode.c
651     @@ -1328,6 +1328,8 @@ static int isofs_read_inode(struct inode *inode, int relocated)
652    
653     de = (struct iso_directory_record *) (bh->b_data + offset);
654     de_len = *(unsigned char *) de;
655     + if (de_len < sizeof(struct iso_directory_record))
656     + goto fail;
657    
658     if (offset + de_len > bufsize) {
659     int frag1 = bufsize - offset;
660     diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
661     index 5569ef6bc1839..23e26a203a9e9 100644
662     --- a/kernel/printk/printk.c
663     +++ b/kernel/printk/printk.c
664     @@ -2193,8 +2193,15 @@ static int __init console_setup(char *str)
665     char *s, *options, *brl_options = NULL;
666     int idx;
667    
668     - if (str[0] == 0)
669     + /*
670     + * console="" or console=null have been suggested as a way to
671     + * disable console output. Use ttynull that has been created
672     + * for exacly this purpose.
673     + */
674     + if (str[0] == 0 || strcmp(str, "null") == 0) {
675     + __add_preferred_console("ttynull", 0, NULL, NULL);
676     return 1;
677     + }
678    
679     if (_braille_console_setup(&str, &brl_options))
680     return 1;