Annotation of /trunk/kernel-alx/patches-5.4/0258-5.4.159-all-fixes.patch
Parent Directory | Revision Log
Revision 3635 -
(hide annotations)
(download)
Mon Oct 24 12:34:12 2022 UTC (19 months, 2 weeks ago) by niro
File size: 23948 byte(s)
Mon Oct 24 12:34:12 2022 UTC (19 months, 2 weeks ago) by niro
File size: 23948 byte(s)
-sync kernel patches
1 | niro | 3635 | diff --git a/Makefile b/Makefile |
2 | index cef1d2704c410..602b5167dacd7 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,7 +1,7 @@ | ||
6 | # SPDX-License-Identifier: GPL-2.0 | ||
7 | VERSION = 5 | ||
8 | PATCHLEVEL = 4 | ||
9 | -SUBLEVEL = 158 | ||
10 | +SUBLEVEL = 159 | ||
11 | EXTRAVERSION = | ||
12 | NAME = Kleptomaniac Octopus | ||
13 | |||
14 | diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c | ||
15 | index 642031b896f64..24a6905d60ee2 100644 | ||
16 | --- a/arch/x86/kvm/ioapic.c | ||
17 | +++ b/arch/x86/kvm/ioapic.c | ||
18 | @@ -91,7 +91,7 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic, | ||
19 | static void rtc_irq_eoi_tracking_reset(struct kvm_ioapic *ioapic) | ||
20 | { | ||
21 | ioapic->rtc_status.pending_eoi = 0; | ||
22 | - bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID + 1); | ||
23 | + bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID); | ||
24 | } | ||
25 | |||
26 | static void kvm_rtc_eoi_tracking_restore_all(struct kvm_ioapic *ioapic); | ||
27 | diff --git a/arch/x86/kvm/ioapic.h b/arch/x86/kvm/ioapic.h | ||
28 | index 283f1f489bcac..ea1a4e0297dae 100644 | ||
29 | --- a/arch/x86/kvm/ioapic.h | ||
30 | +++ b/arch/x86/kvm/ioapic.h | ||
31 | @@ -43,13 +43,13 @@ struct kvm_vcpu; | ||
32 | |||
33 | struct dest_map { | ||
34 | /* vcpu bitmap where IRQ has been sent */ | ||
35 | - DECLARE_BITMAP(map, KVM_MAX_VCPU_ID + 1); | ||
36 | + DECLARE_BITMAP(map, KVM_MAX_VCPU_ID); | ||
37 | |||
38 | /* | ||
39 | * Vector sent to a given vcpu, only valid when | ||
40 | * the vcpu's bit in map is set | ||
41 | */ | ||
42 | - u8 vectors[KVM_MAX_VCPU_ID + 1]; | ||
43 | + u8 vectors[KVM_MAX_VCPU_ID]; | ||
44 | }; | ||
45 | |||
46 | |||
47 | diff --git a/drivers/android/binder.c b/drivers/android/binder.c | ||
48 | index 4eaef780844ea..2be6687c0148f 100644 | ||
49 | --- a/drivers/android/binder.c | ||
50 | +++ b/drivers/android/binder.c | ||
51 | @@ -2257,7 +2257,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, | ||
52 | binder_dec_node(buffer->target_node, 1, 0); | ||
53 | |||
54 | off_start_offset = ALIGN(buffer->data_size, sizeof(void *)); | ||
55 | - off_end_offset = is_failure ? failed_at : | ||
56 | + off_end_offset = is_failure && failed_at ? failed_at : | ||
57 | off_start_offset + buffer->offsets_size; | ||
58 | for (buffer_offset = off_start_offset; buffer_offset < off_end_offset; | ||
59 | buffer_offset += sizeof(binder_size_t)) { | ||
60 | @@ -2343,9 +2343,8 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, | ||
61 | binder_size_t fd_buf_size; | ||
62 | binder_size_t num_valid; | ||
63 | |||
64 | - if (proc->tsk != current->group_leader) { | ||
65 | + if (is_failure) { | ||
66 | /* | ||
67 | - * Nothing to do if running in sender context | ||
68 | * The fd fixups have not been applied so no | ||
69 | * fds need to be closed. | ||
70 | */ | ||
71 | @@ -3548,6 +3547,7 @@ err_invalid_target_handle: | ||
72 | * binder_free_buf() - free the specified buffer | ||
73 | * @proc: binder proc that owns buffer | ||
74 | * @buffer: buffer to be freed | ||
75 | + * @is_failure: failed to send transaction | ||
76 | * | ||
77 | * If buffer for an async transaction, enqueue the next async | ||
78 | * transaction from the node. | ||
79 | @@ -3557,7 +3557,7 @@ err_invalid_target_handle: | ||
80 | static void | ||
81 | binder_free_buf(struct binder_proc *proc, | ||
82 | struct binder_thread *thread, | ||
83 | - struct binder_buffer *buffer) | ||
84 | + struct binder_buffer *buffer, bool is_failure) | ||
85 | { | ||
86 | binder_inner_proc_lock(proc); | ||
87 | if (buffer->transaction) { | ||
88 | @@ -3585,7 +3585,7 @@ binder_free_buf(struct binder_proc *proc, | ||
89 | binder_node_inner_unlock(buf_node); | ||
90 | } | ||
91 | trace_binder_transaction_buffer_release(buffer); | ||
92 | - binder_transaction_buffer_release(proc, thread, buffer, 0, false); | ||
93 | + binder_transaction_buffer_release(proc, thread, buffer, 0, is_failure); | ||
94 | binder_alloc_free_buf(&proc->alloc, buffer); | ||
95 | } | ||
96 | |||
97 | @@ -3786,7 +3786,7 @@ static int binder_thread_write(struct binder_proc *proc, | ||
98 | proc->pid, thread->pid, (u64)data_ptr, | ||
99 | buffer->debug_id, | ||
100 | buffer->transaction ? "active" : "finished"); | ||
101 | - binder_free_buf(proc, thread, buffer); | ||
102 | + binder_free_buf(proc, thread, buffer, false); | ||
103 | break; | ||
104 | } | ||
105 | |||
106 | @@ -4474,7 +4474,7 @@ retry: | ||
107 | buffer->transaction = NULL; | ||
108 | binder_cleanup_transaction(t, "fd fixups failed", | ||
109 | BR_FAILED_REPLY); | ||
110 | - binder_free_buf(proc, thread, buffer); | ||
111 | + binder_free_buf(proc, thread, buffer, true); | ||
112 | binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, | ||
113 | "%d:%d %stransaction %d fd fixups failed %d/%d, line %d\n", | ||
114 | proc->pid, thread->pid, | ||
115 | diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c | ||
116 | index e8aa3d4bda885..1e5a2a0cc6700 100644 | ||
117 | --- a/drivers/net/wireless/rsi/rsi_91x_usb.c | ||
118 | +++ b/drivers/net/wireless/rsi/rsi_91x_usb.c | ||
119 | @@ -61,7 +61,7 @@ static int rsi_usb_card_write(struct rsi_hw *adapter, | ||
120 | (void *)seg, | ||
121 | (int)len, | ||
122 | &transfer, | ||
123 | - HZ * 5); | ||
124 | + USB_CTRL_SET_TIMEOUT); | ||
125 | |||
126 | if (status < 0) { | ||
127 | rsi_dbg(ERR_ZONE, | ||
128 | diff --git a/drivers/staging/comedi/drivers/dt9812.c b/drivers/staging/comedi/drivers/dt9812.c | ||
129 | index 634f57730c1e0..704b04d2980d3 100644 | ||
130 | --- a/drivers/staging/comedi/drivers/dt9812.c | ||
131 | +++ b/drivers/staging/comedi/drivers/dt9812.c | ||
132 | @@ -32,6 +32,7 @@ | ||
133 | #include <linux/kernel.h> | ||
134 | #include <linux/module.h> | ||
135 | #include <linux/errno.h> | ||
136 | +#include <linux/slab.h> | ||
137 | #include <linux/uaccess.h> | ||
138 | |||
139 | #include "../comedi_usb.h" | ||
140 | @@ -237,22 +238,42 @@ static int dt9812_read_info(struct comedi_device *dev, | ||
141 | { | ||
142 | struct usb_device *usb = comedi_to_usb_dev(dev); | ||
143 | struct dt9812_private *devpriv = dev->private; | ||
144 | - struct dt9812_usb_cmd cmd; | ||
145 | + struct dt9812_usb_cmd *cmd; | ||
146 | + size_t tbuf_size; | ||
147 | int count, ret; | ||
148 | + void *tbuf; | ||
149 | |||
150 | - cmd.cmd = cpu_to_le32(DT9812_R_FLASH_DATA); | ||
151 | - cmd.u.flash_data_info.address = | ||
152 | + tbuf_size = max(sizeof(*cmd), buf_size); | ||
153 | + | ||
154 | + tbuf = kzalloc(tbuf_size, GFP_KERNEL); | ||
155 | + if (!tbuf) | ||
156 | + return -ENOMEM; | ||
157 | + | ||
158 | + cmd = tbuf; | ||
159 | + | ||
160 | + cmd->cmd = cpu_to_le32(DT9812_R_FLASH_DATA); | ||
161 | + cmd->u.flash_data_info.address = | ||
162 | cpu_to_le16(DT9812_DIAGS_BOARD_INFO_ADDR + offset); | ||
163 | - cmd.u.flash_data_info.numbytes = cpu_to_le16(buf_size); | ||
164 | + cmd->u.flash_data_info.numbytes = cpu_to_le16(buf_size); | ||
165 | |||
166 | /* DT9812 only responds to 32 byte writes!! */ | ||
167 | ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), | ||
168 | - &cmd, 32, &count, DT9812_USB_TIMEOUT); | ||
169 | + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); | ||
170 | if (ret) | ||
171 | - return ret; | ||
172 | + goto out; | ||
173 | + | ||
174 | + ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), | ||
175 | + tbuf, buf_size, &count, DT9812_USB_TIMEOUT); | ||
176 | + if (!ret) { | ||
177 | + if (count == buf_size) | ||
178 | + memcpy(buf, tbuf, buf_size); | ||
179 | + else | ||
180 | + ret = -EREMOTEIO; | ||
181 | + } | ||
182 | +out: | ||
183 | + kfree(tbuf); | ||
184 | |||
185 | - return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), | ||
186 | - buf, buf_size, &count, DT9812_USB_TIMEOUT); | ||
187 | + return ret; | ||
188 | } | ||
189 | |||
190 | static int dt9812_read_multiple_registers(struct comedi_device *dev, | ||
191 | @@ -261,22 +282,42 @@ static int dt9812_read_multiple_registers(struct comedi_device *dev, | ||
192 | { | ||
193 | struct usb_device *usb = comedi_to_usb_dev(dev); | ||
194 | struct dt9812_private *devpriv = dev->private; | ||
195 | - struct dt9812_usb_cmd cmd; | ||
196 | + struct dt9812_usb_cmd *cmd; | ||
197 | int i, count, ret; | ||
198 | + size_t buf_size; | ||
199 | + void *buf; | ||
200 | |||
201 | - cmd.cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG); | ||
202 | - cmd.u.read_multi_info.count = reg_count; | ||
203 | + buf_size = max_t(size_t, sizeof(*cmd), reg_count); | ||
204 | + | ||
205 | + buf = kzalloc(buf_size, GFP_KERNEL); | ||
206 | + if (!buf) | ||
207 | + return -ENOMEM; | ||
208 | + | ||
209 | + cmd = buf; | ||
210 | + | ||
211 | + cmd->cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG); | ||
212 | + cmd->u.read_multi_info.count = reg_count; | ||
213 | for (i = 0; i < reg_count; i++) | ||
214 | - cmd.u.read_multi_info.address[i] = address[i]; | ||
215 | + cmd->u.read_multi_info.address[i] = address[i]; | ||
216 | |||
217 | /* DT9812 only responds to 32 byte writes!! */ | ||
218 | ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), | ||
219 | - &cmd, 32, &count, DT9812_USB_TIMEOUT); | ||
220 | + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); | ||
221 | if (ret) | ||
222 | - return ret; | ||
223 | + goto out; | ||
224 | + | ||
225 | + ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), | ||
226 | + buf, reg_count, &count, DT9812_USB_TIMEOUT); | ||
227 | + if (!ret) { | ||
228 | + if (count == reg_count) | ||
229 | + memcpy(value, buf, reg_count); | ||
230 | + else | ||
231 | + ret = -EREMOTEIO; | ||
232 | + } | ||
233 | +out: | ||
234 | + kfree(buf); | ||
235 | |||
236 | - return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), | ||
237 | - value, reg_count, &count, DT9812_USB_TIMEOUT); | ||
238 | + return ret; | ||
239 | } | ||
240 | |||
241 | static int dt9812_write_multiple_registers(struct comedi_device *dev, | ||
242 | @@ -285,19 +326,27 @@ static int dt9812_write_multiple_registers(struct comedi_device *dev, | ||
243 | { | ||
244 | struct usb_device *usb = comedi_to_usb_dev(dev); | ||
245 | struct dt9812_private *devpriv = dev->private; | ||
246 | - struct dt9812_usb_cmd cmd; | ||
247 | + struct dt9812_usb_cmd *cmd; | ||
248 | int i, count; | ||
249 | + int ret; | ||
250 | + | ||
251 | + cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); | ||
252 | + if (!cmd) | ||
253 | + return -ENOMEM; | ||
254 | |||
255 | - cmd.cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG); | ||
256 | - cmd.u.read_multi_info.count = reg_count; | ||
257 | + cmd->cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG); | ||
258 | + cmd->u.read_multi_info.count = reg_count; | ||
259 | for (i = 0; i < reg_count; i++) { | ||
260 | - cmd.u.write_multi_info.write[i].address = address[i]; | ||
261 | - cmd.u.write_multi_info.write[i].value = value[i]; | ||
262 | + cmd->u.write_multi_info.write[i].address = address[i]; | ||
263 | + cmd->u.write_multi_info.write[i].value = value[i]; | ||
264 | } | ||
265 | |||
266 | /* DT9812 only responds to 32 byte writes!! */ | ||
267 | - return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), | ||
268 | - &cmd, 32, &count, DT9812_USB_TIMEOUT); | ||
269 | + ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), | ||
270 | + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); | ||
271 | + kfree(cmd); | ||
272 | + | ||
273 | + return ret; | ||
274 | } | ||
275 | |||
276 | static int dt9812_rmw_multiple_registers(struct comedi_device *dev, | ||
277 | @@ -306,17 +355,25 @@ static int dt9812_rmw_multiple_registers(struct comedi_device *dev, | ||
278 | { | ||
279 | struct usb_device *usb = comedi_to_usb_dev(dev); | ||
280 | struct dt9812_private *devpriv = dev->private; | ||
281 | - struct dt9812_usb_cmd cmd; | ||
282 | + struct dt9812_usb_cmd *cmd; | ||
283 | int i, count; | ||
284 | + int ret; | ||
285 | + | ||
286 | + cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); | ||
287 | + if (!cmd) | ||
288 | + return -ENOMEM; | ||
289 | |||
290 | - cmd.cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG); | ||
291 | - cmd.u.rmw_multi_info.count = reg_count; | ||
292 | + cmd->cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG); | ||
293 | + cmd->u.rmw_multi_info.count = reg_count; | ||
294 | for (i = 0; i < reg_count; i++) | ||
295 | - cmd.u.rmw_multi_info.rmw[i] = rmw[i]; | ||
296 | + cmd->u.rmw_multi_info.rmw[i] = rmw[i]; | ||
297 | |||
298 | /* DT9812 only responds to 32 byte writes!! */ | ||
299 | - return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), | ||
300 | - &cmd, 32, &count, DT9812_USB_TIMEOUT); | ||
301 | + ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), | ||
302 | + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); | ||
303 | + kfree(cmd); | ||
304 | + | ||
305 | + return ret; | ||
306 | } | ||
307 | |||
308 | static int dt9812_digital_in(struct comedi_device *dev, u8 *bits) | ||
309 | diff --git a/drivers/staging/comedi/drivers/ni_usb6501.c b/drivers/staging/comedi/drivers/ni_usb6501.c | ||
310 | index 360e86a19fe32..311632004f08a 100644 | ||
311 | --- a/drivers/staging/comedi/drivers/ni_usb6501.c | ||
312 | +++ b/drivers/staging/comedi/drivers/ni_usb6501.c | ||
313 | @@ -144,6 +144,10 @@ static const u8 READ_COUNTER_RESPONSE[] = {0x00, 0x01, 0x00, 0x10, | ||
314 | 0x00, 0x00, 0x00, 0x02, | ||
315 | 0x00, 0x00, 0x00, 0x00}; | ||
316 | |||
317 | +/* Largest supported packets */ | ||
318 | +static const size_t TX_MAX_SIZE = sizeof(SET_PORT_DIR_REQUEST); | ||
319 | +static const size_t RX_MAX_SIZE = sizeof(READ_PORT_RESPONSE); | ||
320 | + | ||
321 | enum commands { | ||
322 | READ_PORT, | ||
323 | WRITE_PORT, | ||
324 | @@ -501,6 +505,12 @@ static int ni6501_find_endpoints(struct comedi_device *dev) | ||
325 | if (!devpriv->ep_rx || !devpriv->ep_tx) | ||
326 | return -ENODEV; | ||
327 | |||
328 | + if (usb_endpoint_maxp(devpriv->ep_rx) < RX_MAX_SIZE) | ||
329 | + return -ENODEV; | ||
330 | + | ||
331 | + if (usb_endpoint_maxp(devpriv->ep_tx) < TX_MAX_SIZE) | ||
332 | + return -ENODEV; | ||
333 | + | ||
334 | return 0; | ||
335 | } | ||
336 | |||
337 | diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c | ||
338 | index 7956abcbae22b..7769eadfaf61d 100644 | ||
339 | --- a/drivers/staging/comedi/drivers/vmk80xx.c | ||
340 | +++ b/drivers/staging/comedi/drivers/vmk80xx.c | ||
341 | @@ -90,6 +90,9 @@ enum { | ||
342 | #define IC3_VERSION BIT(0) | ||
343 | #define IC6_VERSION BIT(1) | ||
344 | |||
345 | +#define MIN_BUF_SIZE 64 | ||
346 | +#define PACKET_TIMEOUT 10000 /* ms */ | ||
347 | + | ||
348 | enum vmk80xx_model { | ||
349 | VMK8055_MODEL, | ||
350 | VMK8061_MODEL | ||
351 | @@ -157,22 +160,21 @@ static void vmk80xx_do_bulk_msg(struct comedi_device *dev) | ||
352 | __u8 rx_addr; | ||
353 | unsigned int tx_pipe; | ||
354 | unsigned int rx_pipe; | ||
355 | - size_t size; | ||
356 | + size_t tx_size; | ||
357 | + size_t rx_size; | ||
358 | |||
359 | tx_addr = devpriv->ep_tx->bEndpointAddress; | ||
360 | rx_addr = devpriv->ep_rx->bEndpointAddress; | ||
361 | tx_pipe = usb_sndbulkpipe(usb, tx_addr); | ||
362 | rx_pipe = usb_rcvbulkpipe(usb, rx_addr); | ||
363 | + tx_size = usb_endpoint_maxp(devpriv->ep_tx); | ||
364 | + rx_size = usb_endpoint_maxp(devpriv->ep_rx); | ||
365 | |||
366 | - /* | ||
367 | - * The max packet size attributes of the K8061 | ||
368 | - * input/output endpoints are identical | ||
369 | - */ | ||
370 | - size = usb_endpoint_maxp(devpriv->ep_tx); | ||
371 | + usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, tx_size, NULL, | ||
372 | + PACKET_TIMEOUT); | ||
373 | |||
374 | - usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, | ||
375 | - size, NULL, devpriv->ep_tx->bInterval); | ||
376 | - usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, size, NULL, HZ * 10); | ||
377 | + usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, rx_size, NULL, | ||
378 | + PACKET_TIMEOUT); | ||
379 | } | ||
380 | |||
381 | static int vmk80xx_read_packet(struct comedi_device *dev) | ||
382 | @@ -191,7 +193,7 @@ static int vmk80xx_read_packet(struct comedi_device *dev) | ||
383 | pipe = usb_rcvintpipe(usb, ep->bEndpointAddress); | ||
384 | return usb_interrupt_msg(usb, pipe, devpriv->usb_rx_buf, | ||
385 | usb_endpoint_maxp(ep), NULL, | ||
386 | - HZ * 10); | ||
387 | + PACKET_TIMEOUT); | ||
388 | } | ||
389 | |||
390 | static int vmk80xx_write_packet(struct comedi_device *dev, int cmd) | ||
391 | @@ -212,7 +214,7 @@ static int vmk80xx_write_packet(struct comedi_device *dev, int cmd) | ||
392 | pipe = usb_sndintpipe(usb, ep->bEndpointAddress); | ||
393 | return usb_interrupt_msg(usb, pipe, devpriv->usb_tx_buf, | ||
394 | usb_endpoint_maxp(ep), NULL, | ||
395 | - HZ * 10); | ||
396 | + PACKET_TIMEOUT); | ||
397 | } | ||
398 | |||
399 | static int vmk80xx_reset_device(struct comedi_device *dev) | ||
400 | @@ -678,12 +680,12 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev) | ||
401 | struct vmk80xx_private *devpriv = dev->private; | ||
402 | size_t size; | ||
403 | |||
404 | - size = usb_endpoint_maxp(devpriv->ep_rx); | ||
405 | + size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE); | ||
406 | devpriv->usb_rx_buf = kzalloc(size, GFP_KERNEL); | ||
407 | if (!devpriv->usb_rx_buf) | ||
408 | return -ENOMEM; | ||
409 | |||
410 | - size = usb_endpoint_maxp(devpriv->ep_tx); | ||
411 | + size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE); | ||
412 | devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL); | ||
413 | if (!devpriv->usb_tx_buf) | ||
414 | return -ENOMEM; | ||
415 | diff --git a/drivers/staging/media/ipu3/ipu3-css-fw.c b/drivers/staging/media/ipu3/ipu3-css-fw.c | ||
416 | index 45aff76198e2c..981693eed8155 100644 | ||
417 | --- a/drivers/staging/media/ipu3/ipu3-css-fw.c | ||
418 | +++ b/drivers/staging/media/ipu3/ipu3-css-fw.c | ||
419 | @@ -124,12 +124,11 @@ int imgu_css_fw_init(struct imgu_css *css) | ||
420 | /* Check and display fw header info */ | ||
421 | |||
422 | css->fwp = (struct imgu_fw_header *)css->fw->data; | ||
423 | - if (css->fw->size < sizeof(struct imgu_fw_header *) || | ||
424 | + if (css->fw->size < struct_size(css->fwp, binary_header, 1) || | ||
425 | css->fwp->file_header.h_size != sizeof(struct imgu_fw_bi_file_h)) | ||
426 | goto bad_fw; | ||
427 | - if (sizeof(struct imgu_fw_bi_file_h) + | ||
428 | - css->fwp->file_header.binary_nr * sizeof(struct imgu_fw_info) > | ||
429 | - css->fw->size) | ||
430 | + if (struct_size(css->fwp, binary_header, | ||
431 | + css->fwp->file_header.binary_nr) > css->fw->size) | ||
432 | goto bad_fw; | ||
433 | |||
434 | dev_info(dev, "loaded firmware version %.64s, %u binaries, %zu bytes\n", | ||
435 | diff --git a/drivers/staging/media/ipu3/ipu3-css-fw.h b/drivers/staging/media/ipu3/ipu3-css-fw.h | ||
436 | index 79ffa70451390..650fd25fc79ee 100644 | ||
437 | --- a/drivers/staging/media/ipu3/ipu3-css-fw.h | ||
438 | +++ b/drivers/staging/media/ipu3/ipu3-css-fw.h | ||
439 | @@ -170,7 +170,7 @@ struct imgu_fw_bi_file_h { | ||
440 | |||
441 | struct imgu_fw_header { | ||
442 | struct imgu_fw_bi_file_h file_header; | ||
443 | - struct imgu_fw_info binary_header[1]; /* binary_nr items */ | ||
444 | + struct imgu_fw_info binary_header[]; /* binary_nr items */ | ||
445 | }; | ||
446 | |||
447 | /******************* Firmware functions *******************/ | ||
448 | diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c | ||
449 | index e739d1979c877..6f65a9c9d6cf3 100644 | ||
450 | --- a/drivers/staging/rtl8192u/r8192U_core.c | ||
451 | +++ b/drivers/staging/rtl8192u/r8192U_core.c | ||
452 | @@ -236,7 +236,7 @@ int write_nic_byte_E(struct net_device *dev, int indx, u8 data) | ||
453 | |||
454 | status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), | ||
455 | RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, | ||
456 | - indx | 0xfe00, 0, usbdata, 1, HZ / 2); | ||
457 | + indx | 0xfe00, 0, usbdata, 1, 500); | ||
458 | kfree(usbdata); | ||
459 | |||
460 | if (status < 0) { | ||
461 | @@ -258,7 +258,7 @@ int read_nic_byte_E(struct net_device *dev, int indx, u8 *data) | ||
462 | |||
463 | status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), | ||
464 | RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, | ||
465 | - indx | 0xfe00, 0, usbdata, 1, HZ / 2); | ||
466 | + indx | 0xfe00, 0, usbdata, 1, 500); | ||
467 | *data = *usbdata; | ||
468 | kfree(usbdata); | ||
469 | |||
470 | @@ -286,7 +286,7 @@ int write_nic_byte(struct net_device *dev, int indx, u8 data) | ||
471 | status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), | ||
472 | RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, | ||
473 | (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, | ||
474 | - usbdata, 1, HZ / 2); | ||
475 | + usbdata, 1, 500); | ||
476 | kfree(usbdata); | ||
477 | |||
478 | if (status < 0) { | ||
479 | @@ -313,7 +313,7 @@ int write_nic_word(struct net_device *dev, int indx, u16 data) | ||
480 | status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), | ||
481 | RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, | ||
482 | (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, | ||
483 | - usbdata, 2, HZ / 2); | ||
484 | + usbdata, 2, 500); | ||
485 | kfree(usbdata); | ||
486 | |||
487 | if (status < 0) { | ||
488 | @@ -340,7 +340,7 @@ int write_nic_dword(struct net_device *dev, int indx, u32 data) | ||
489 | status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), | ||
490 | RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, | ||
491 | (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, | ||
492 | - usbdata, 4, HZ / 2); | ||
493 | + usbdata, 4, 500); | ||
494 | kfree(usbdata); | ||
495 | |||
496 | |||
497 | @@ -367,7 +367,7 @@ int read_nic_byte(struct net_device *dev, int indx, u8 *data) | ||
498 | status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), | ||
499 | RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, | ||
500 | (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, | ||
501 | - usbdata, 1, HZ / 2); | ||
502 | + usbdata, 1, 500); | ||
503 | *data = *usbdata; | ||
504 | kfree(usbdata); | ||
505 | |||
506 | @@ -394,7 +394,7 @@ int read_nic_word(struct net_device *dev, int indx, u16 *data) | ||
507 | status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), | ||
508 | RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, | ||
509 | (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, | ||
510 | - usbdata, 2, HZ / 2); | ||
511 | + usbdata, 2, 500); | ||
512 | *data = *usbdata; | ||
513 | kfree(usbdata); | ||
514 | |||
515 | @@ -418,7 +418,7 @@ static int read_nic_word_E(struct net_device *dev, int indx, u16 *data) | ||
516 | |||
517 | status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), | ||
518 | RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, | ||
519 | - indx | 0xfe00, 0, usbdata, 2, HZ / 2); | ||
520 | + indx | 0xfe00, 0, usbdata, 2, 500); | ||
521 | *data = *usbdata; | ||
522 | kfree(usbdata); | ||
523 | |||
524 | @@ -444,7 +444,7 @@ int read_nic_dword(struct net_device *dev, int indx, u32 *data) | ||
525 | status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), | ||
526 | RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, | ||
527 | (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, | ||
528 | - usbdata, 4, HZ / 2); | ||
529 | + usbdata, 4, 500); | ||
530 | *data = *usbdata; | ||
531 | kfree(usbdata); | ||
532 | |||
533 | diff --git a/drivers/staging/rtl8712/usb_ops_linux.c b/drivers/staging/rtl8712/usb_ops_linux.c | ||
534 | index 9d290bc2fdb7f..2202a0caa252e 100644 | ||
535 | --- a/drivers/staging/rtl8712/usb_ops_linux.c | ||
536 | +++ b/drivers/staging/rtl8712/usb_ops_linux.c | ||
537 | @@ -493,7 +493,7 @@ int r8712_usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value, | ||
538 | memcpy(pIo_buf, pdata, len); | ||
539 | } | ||
540 | status = usb_control_msg(udev, pipe, request, reqtype, value, index, | ||
541 | - pIo_buf, len, HZ / 2); | ||
542 | + pIo_buf, len, 500); | ||
543 | if (status > 0) { /* Success this control transfer. */ | ||
544 | if (requesttype == 0x01) { | ||
545 | /* For Control read transfer, we have to copy the read | ||
546 | diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig | ||
547 | index d354036ff6c86..f985bb4a42db2 100644 | ||
548 | --- a/drivers/usb/gadget/udc/Kconfig | ||
549 | +++ b/drivers/usb/gadget/udc/Kconfig | ||
550 | @@ -330,6 +330,7 @@ config USB_AMD5536UDC | ||
551 | config USB_FSL_QE | ||
552 | tristate "Freescale QE/CPM USB Device Controller" | ||
553 | depends on FSL_SOC && (QUICC_ENGINE || CPM) | ||
554 | + depends on !64BIT || BROKEN | ||
555 | help | ||
556 | Some of Freescale PowerPC processors have a Full Speed | ||
557 | QE/CPM2 USB controller, which support device mode with 4 | ||
558 | diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c | ||
559 | index 5c6ce1ef3f4b0..c0e344c3a8487 100644 | ||
560 | --- a/drivers/usb/host/ehci-hcd.c | ||
561 | +++ b/drivers/usb/host/ehci-hcd.c | ||
562 | @@ -634,7 +634,16 @@ static int ehci_run (struct usb_hcd *hcd) | ||
563 | /* Wait until HC become operational */ | ||
564 | ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */ | ||
565 | msleep(5); | ||
566 | - rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT, 0, 100 * 1000); | ||
567 | + | ||
568 | + /* For Aspeed, STS_HALT also depends on ASS/PSS status. | ||
569 | + * Check CMD_RUN instead. | ||
570 | + */ | ||
571 | + if (ehci->is_aspeed) | ||
572 | + rc = ehci_handshake(ehci, &ehci->regs->command, CMD_RUN, | ||
573 | + 1, 100 * 1000); | ||
574 | + else | ||
575 | + rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT, | ||
576 | + 0, 100 * 1000); | ||
577 | |||
578 | up_write(&ehci_cf_port_reset_rwsem); | ||
579 | |||
580 | diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c | ||
581 | index e4fc3f66d43bf..accbcc989c503 100644 | ||
582 | --- a/drivers/usb/host/ehci-platform.c | ||
583 | +++ b/drivers/usb/host/ehci-platform.c | ||
584 | @@ -286,6 +286,12 @@ static int ehci_platform_probe(struct platform_device *dev) | ||
585 | "has-transaction-translator")) | ||
586 | hcd->has_tt = 1; | ||
587 | |||
588 | + if (of_device_is_compatible(dev->dev.of_node, | ||
589 | + "aspeed,ast2500-ehci") || | ||
590 | + of_device_is_compatible(dev->dev.of_node, | ||
591 | + "aspeed,ast2600-ehci")) | ||
592 | + ehci->is_aspeed = 1; | ||
593 | + | ||
594 | if (soc_device_match(quirk_poll_match)) | ||
595 | priv->quirk_poll = true; | ||
596 | |||
597 | diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h | ||
598 | index ac5e967907d14..356738462ce45 100644 | ||
599 | --- a/drivers/usb/host/ehci.h | ||
600 | +++ b/drivers/usb/host/ehci.h | ||
601 | @@ -218,6 +218,7 @@ struct ehci_hcd { /* one per controller */ | ||
602 | unsigned frame_index_bug:1; /* MosChip (AKA NetMos) */ | ||
603 | unsigned need_oc_pp_cycle:1; /* MPC834X port power */ | ||
604 | unsigned imx28_write_fix:1; /* For Freescale i.MX28 */ | ||
605 | + unsigned is_aspeed:1; | ||
606 | |||
607 | /* required for usb32 quirk */ | ||
608 | #define OHCI_CTRL_HCFS (3 << 6) | ||
609 | diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c | ||
610 | index ffe462a657b15..4622400ba4ddb 100644 | ||
611 | --- a/drivers/usb/musb/musb_gadget.c | ||
612 | +++ b/drivers/usb/musb/musb_gadget.c | ||
613 | @@ -1248,9 +1248,11 @@ static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req, | ||
614 | status = musb_queue_resume_work(musb, | ||
615 | musb_ep_restart_resume_work, | ||
616 | request); | ||
617 | - if (status < 0) | ||
618 | + if (status < 0) { | ||
619 | dev_err(musb->controller, "%s resume work: %i\n", | ||
620 | __func__, status); | ||
621 | + list_del(&request->list); | ||
622 | + } | ||
623 | } | ||
624 | |||
625 | unlock: | ||
626 | diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h | ||
627 | index 7442793fe0502..3ba4e060fd051 100644 | ||
628 | --- a/drivers/usb/storage/unusual_devs.h | ||
629 | +++ b/drivers/usb/storage/unusual_devs.h | ||
630 | @@ -406,6 +406,16 @@ UNUSUAL_DEV( 0x04b8, 0x0602, 0x0110, 0x0110, | ||
631 | "785EPX Storage", | ||
632 | USB_SC_SCSI, USB_PR_BULK, NULL, US_FL_SINGLE_LUN), | ||
633 | |||
634 | +/* | ||
635 | + * Reported by James Buren <braewoods+lkml@braewoods.net> | ||
636 | + * Virtual ISOs cannot be remounted if ejected while the device is locked | ||
637 | + * Disable locking to mimic Windows behavior that bypasses the issue | ||
638 | + */ | ||
639 | +UNUSUAL_DEV( 0x04c5, 0x2028, 0x0001, 0x0001, | ||
640 | + "iODD", | ||
641 | + "2531/2541", | ||
642 | + USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE), | ||
643 | + | ||
644 | /* | ||
645 | * Not sure who reported this originally but | ||
646 | * Pavel Machek <pavel@ucw.cz> reported that the extra US_FL_SINGLE_LUN | ||
647 | diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c | ||
648 | index bf30f6ce8dd10..74e487d63c62c 100644 | ||
649 | --- a/fs/isofs/inode.c | ||
650 | +++ b/fs/isofs/inode.c | ||
651 | @@ -1328,6 +1328,8 @@ static int isofs_read_inode(struct inode *inode, int relocated) | ||
652 | |||
653 | de = (struct iso_directory_record *) (bh->b_data + offset); | ||
654 | de_len = *(unsigned char *) de; | ||
655 | + if (de_len < sizeof(struct iso_directory_record)) | ||
656 | + goto fail; | ||
657 | |||
658 | if (offset + de_len > bufsize) { | ||
659 | int frag1 = bufsize - offset; | ||
660 | diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c | ||
661 | index 5569ef6bc1839..23e26a203a9e9 100644 | ||
662 | --- a/kernel/printk/printk.c | ||
663 | +++ b/kernel/printk/printk.c | ||
664 | @@ -2193,8 +2193,15 @@ static int __init console_setup(char *str) | ||
665 | char *s, *options, *brl_options = NULL; | ||
666 | int idx; | ||
667 | |||
668 | - if (str[0] == 0) | ||
669 | + /* | ||
670 | + * console="" or console=null have been suggested as a way to | ||
671 | + * disable console output. Use ttynull that has been created | ||
672 | + * for exacly this purpose. | ||
673 | + */ | ||
674 | + if (str[0] == 0 || strcmp(str, "null") == 0) { | ||
675 | + __add_preferred_console("ttynull", 0, NULL, NULL); | ||
676 | return 1; | ||
677 | + } | ||
678 | |||
679 | if (_braille_console_setup(&str, &brl_options)) | ||
680 | return 1; |