Contents of /trunk/kernel-alx/patches-5.4/0258-5.4.159-all-fixes.patch
Parent Directory | Revision Log
Revision 3635 -
(show annotations)
(download)
Mon Oct 24 12:34:12 2022 UTC (23 months ago) by niro
File size: 23948 byte(s)
Mon Oct 24 12:34:12 2022 UTC (23 months ago) by niro
File size: 23948 byte(s)
-sync kernel patches
1 | diff --git a/Makefile b/Makefile |
2 | index cef1d2704c410..602b5167dacd7 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,7 +1,7 @@ |
6 | # SPDX-License-Identifier: GPL-2.0 |
7 | VERSION = 5 |
8 | PATCHLEVEL = 4 |
9 | -SUBLEVEL = 158 |
10 | +SUBLEVEL = 159 |
11 | EXTRAVERSION = |
12 | NAME = Kleptomaniac Octopus |
13 | |
14 | diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c |
15 | index 642031b896f64..24a6905d60ee2 100644 |
16 | --- a/arch/x86/kvm/ioapic.c |
17 | +++ b/arch/x86/kvm/ioapic.c |
18 | @@ -91,7 +91,7 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic, |
19 | static void rtc_irq_eoi_tracking_reset(struct kvm_ioapic *ioapic) |
20 | { |
21 | ioapic->rtc_status.pending_eoi = 0; |
22 | - bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID + 1); |
23 | + bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID); |
24 | } |
25 | |
26 | static void kvm_rtc_eoi_tracking_restore_all(struct kvm_ioapic *ioapic); |
27 | diff --git a/arch/x86/kvm/ioapic.h b/arch/x86/kvm/ioapic.h |
28 | index 283f1f489bcac..ea1a4e0297dae 100644 |
29 | --- a/arch/x86/kvm/ioapic.h |
30 | +++ b/arch/x86/kvm/ioapic.h |
31 | @@ -43,13 +43,13 @@ struct kvm_vcpu; |
32 | |
33 | struct dest_map { |
34 | /* vcpu bitmap where IRQ has been sent */ |
35 | - DECLARE_BITMAP(map, KVM_MAX_VCPU_ID + 1); |
36 | + DECLARE_BITMAP(map, KVM_MAX_VCPU_ID); |
37 | |
38 | /* |
39 | * Vector sent to a given vcpu, only valid when |
40 | * the vcpu's bit in map is set |
41 | */ |
42 | - u8 vectors[KVM_MAX_VCPU_ID + 1]; |
43 | + u8 vectors[KVM_MAX_VCPU_ID]; |
44 | }; |
45 | |
46 | |
47 | diff --git a/drivers/android/binder.c b/drivers/android/binder.c |
48 | index 4eaef780844ea..2be6687c0148f 100644 |
49 | --- a/drivers/android/binder.c |
50 | +++ b/drivers/android/binder.c |
51 | @@ -2257,7 +2257,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, |
52 | binder_dec_node(buffer->target_node, 1, 0); |
53 | |
54 | off_start_offset = ALIGN(buffer->data_size, sizeof(void *)); |
55 | - off_end_offset = is_failure ? failed_at : |
56 | + off_end_offset = is_failure && failed_at ? failed_at : |
57 | off_start_offset + buffer->offsets_size; |
58 | for (buffer_offset = off_start_offset; buffer_offset < off_end_offset; |
59 | buffer_offset += sizeof(binder_size_t)) { |
60 | @@ -2343,9 +2343,8 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, |
61 | binder_size_t fd_buf_size; |
62 | binder_size_t num_valid; |
63 | |
64 | - if (proc->tsk != current->group_leader) { |
65 | + if (is_failure) { |
66 | /* |
67 | - * Nothing to do if running in sender context |
68 | * The fd fixups have not been applied so no |
69 | * fds need to be closed. |
70 | */ |
71 | @@ -3548,6 +3547,7 @@ err_invalid_target_handle: |
72 | * binder_free_buf() - free the specified buffer |
73 | * @proc: binder proc that owns buffer |
74 | * @buffer: buffer to be freed |
75 | + * @is_failure: failed to send transaction |
76 | * |
77 | * If buffer for an async transaction, enqueue the next async |
78 | * transaction from the node. |
79 | @@ -3557,7 +3557,7 @@ err_invalid_target_handle: |
80 | static void |
81 | binder_free_buf(struct binder_proc *proc, |
82 | struct binder_thread *thread, |
83 | - struct binder_buffer *buffer) |
84 | + struct binder_buffer *buffer, bool is_failure) |
85 | { |
86 | binder_inner_proc_lock(proc); |
87 | if (buffer->transaction) { |
88 | @@ -3585,7 +3585,7 @@ binder_free_buf(struct binder_proc *proc, |
89 | binder_node_inner_unlock(buf_node); |
90 | } |
91 | trace_binder_transaction_buffer_release(buffer); |
92 | - binder_transaction_buffer_release(proc, thread, buffer, 0, false); |
93 | + binder_transaction_buffer_release(proc, thread, buffer, 0, is_failure); |
94 | binder_alloc_free_buf(&proc->alloc, buffer); |
95 | } |
96 | |
97 | @@ -3786,7 +3786,7 @@ static int binder_thread_write(struct binder_proc *proc, |
98 | proc->pid, thread->pid, (u64)data_ptr, |
99 | buffer->debug_id, |
100 | buffer->transaction ? "active" : "finished"); |
101 | - binder_free_buf(proc, thread, buffer); |
102 | + binder_free_buf(proc, thread, buffer, false); |
103 | break; |
104 | } |
105 | |
106 | @@ -4474,7 +4474,7 @@ retry: |
107 | buffer->transaction = NULL; |
108 | binder_cleanup_transaction(t, "fd fixups failed", |
109 | BR_FAILED_REPLY); |
110 | - binder_free_buf(proc, thread, buffer); |
111 | + binder_free_buf(proc, thread, buffer, true); |
112 | binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, |
113 | "%d:%d %stransaction %d fd fixups failed %d/%d, line %d\n", |
114 | proc->pid, thread->pid, |
115 | diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c |
116 | index e8aa3d4bda885..1e5a2a0cc6700 100644 |
117 | --- a/drivers/net/wireless/rsi/rsi_91x_usb.c |
118 | +++ b/drivers/net/wireless/rsi/rsi_91x_usb.c |
119 | @@ -61,7 +61,7 @@ static int rsi_usb_card_write(struct rsi_hw *adapter, |
120 | (void *)seg, |
121 | (int)len, |
122 | &transfer, |
123 | - HZ * 5); |
124 | + USB_CTRL_SET_TIMEOUT); |
125 | |
126 | if (status < 0) { |
127 | rsi_dbg(ERR_ZONE, |
128 | diff --git a/drivers/staging/comedi/drivers/dt9812.c b/drivers/staging/comedi/drivers/dt9812.c |
129 | index 634f57730c1e0..704b04d2980d3 100644 |
130 | --- a/drivers/staging/comedi/drivers/dt9812.c |
131 | +++ b/drivers/staging/comedi/drivers/dt9812.c |
132 | @@ -32,6 +32,7 @@ |
133 | #include <linux/kernel.h> |
134 | #include <linux/module.h> |
135 | #include <linux/errno.h> |
136 | +#include <linux/slab.h> |
137 | #include <linux/uaccess.h> |
138 | |
139 | #include "../comedi_usb.h" |
140 | @@ -237,22 +238,42 @@ static int dt9812_read_info(struct comedi_device *dev, |
141 | { |
142 | struct usb_device *usb = comedi_to_usb_dev(dev); |
143 | struct dt9812_private *devpriv = dev->private; |
144 | - struct dt9812_usb_cmd cmd; |
145 | + struct dt9812_usb_cmd *cmd; |
146 | + size_t tbuf_size; |
147 | int count, ret; |
148 | + void *tbuf; |
149 | |
150 | - cmd.cmd = cpu_to_le32(DT9812_R_FLASH_DATA); |
151 | - cmd.u.flash_data_info.address = |
152 | + tbuf_size = max(sizeof(*cmd), buf_size); |
153 | + |
154 | + tbuf = kzalloc(tbuf_size, GFP_KERNEL); |
155 | + if (!tbuf) |
156 | + return -ENOMEM; |
157 | + |
158 | + cmd = tbuf; |
159 | + |
160 | + cmd->cmd = cpu_to_le32(DT9812_R_FLASH_DATA); |
161 | + cmd->u.flash_data_info.address = |
162 | cpu_to_le16(DT9812_DIAGS_BOARD_INFO_ADDR + offset); |
163 | - cmd.u.flash_data_info.numbytes = cpu_to_le16(buf_size); |
164 | + cmd->u.flash_data_info.numbytes = cpu_to_le16(buf_size); |
165 | |
166 | /* DT9812 only responds to 32 byte writes!! */ |
167 | ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), |
168 | - &cmd, 32, &count, DT9812_USB_TIMEOUT); |
169 | + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); |
170 | if (ret) |
171 | - return ret; |
172 | + goto out; |
173 | + |
174 | + ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), |
175 | + tbuf, buf_size, &count, DT9812_USB_TIMEOUT); |
176 | + if (!ret) { |
177 | + if (count == buf_size) |
178 | + memcpy(buf, tbuf, buf_size); |
179 | + else |
180 | + ret = -EREMOTEIO; |
181 | + } |
182 | +out: |
183 | + kfree(tbuf); |
184 | |
185 | - return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), |
186 | - buf, buf_size, &count, DT9812_USB_TIMEOUT); |
187 | + return ret; |
188 | } |
189 | |
190 | static int dt9812_read_multiple_registers(struct comedi_device *dev, |
191 | @@ -261,22 +282,42 @@ static int dt9812_read_multiple_registers(struct comedi_device *dev, |
192 | { |
193 | struct usb_device *usb = comedi_to_usb_dev(dev); |
194 | struct dt9812_private *devpriv = dev->private; |
195 | - struct dt9812_usb_cmd cmd; |
196 | + struct dt9812_usb_cmd *cmd; |
197 | int i, count, ret; |
198 | + size_t buf_size; |
199 | + void *buf; |
200 | |
201 | - cmd.cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG); |
202 | - cmd.u.read_multi_info.count = reg_count; |
203 | + buf_size = max_t(size_t, sizeof(*cmd), reg_count); |
204 | + |
205 | + buf = kzalloc(buf_size, GFP_KERNEL); |
206 | + if (!buf) |
207 | + return -ENOMEM; |
208 | + |
209 | + cmd = buf; |
210 | + |
211 | + cmd->cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG); |
212 | + cmd->u.read_multi_info.count = reg_count; |
213 | for (i = 0; i < reg_count; i++) |
214 | - cmd.u.read_multi_info.address[i] = address[i]; |
215 | + cmd->u.read_multi_info.address[i] = address[i]; |
216 | |
217 | /* DT9812 only responds to 32 byte writes!! */ |
218 | ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), |
219 | - &cmd, 32, &count, DT9812_USB_TIMEOUT); |
220 | + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); |
221 | if (ret) |
222 | - return ret; |
223 | + goto out; |
224 | + |
225 | + ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), |
226 | + buf, reg_count, &count, DT9812_USB_TIMEOUT); |
227 | + if (!ret) { |
228 | + if (count == reg_count) |
229 | + memcpy(value, buf, reg_count); |
230 | + else |
231 | + ret = -EREMOTEIO; |
232 | + } |
233 | +out: |
234 | + kfree(buf); |
235 | |
236 | - return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), |
237 | - value, reg_count, &count, DT9812_USB_TIMEOUT); |
238 | + return ret; |
239 | } |
240 | |
241 | static int dt9812_write_multiple_registers(struct comedi_device *dev, |
242 | @@ -285,19 +326,27 @@ static int dt9812_write_multiple_registers(struct comedi_device *dev, |
243 | { |
244 | struct usb_device *usb = comedi_to_usb_dev(dev); |
245 | struct dt9812_private *devpriv = dev->private; |
246 | - struct dt9812_usb_cmd cmd; |
247 | + struct dt9812_usb_cmd *cmd; |
248 | int i, count; |
249 | + int ret; |
250 | + |
251 | + cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); |
252 | + if (!cmd) |
253 | + return -ENOMEM; |
254 | |
255 | - cmd.cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG); |
256 | - cmd.u.read_multi_info.count = reg_count; |
257 | + cmd->cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG); |
258 | + cmd->u.read_multi_info.count = reg_count; |
259 | for (i = 0; i < reg_count; i++) { |
260 | - cmd.u.write_multi_info.write[i].address = address[i]; |
261 | - cmd.u.write_multi_info.write[i].value = value[i]; |
262 | + cmd->u.write_multi_info.write[i].address = address[i]; |
263 | + cmd->u.write_multi_info.write[i].value = value[i]; |
264 | } |
265 | |
266 | /* DT9812 only responds to 32 byte writes!! */ |
267 | - return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), |
268 | - &cmd, 32, &count, DT9812_USB_TIMEOUT); |
269 | + ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), |
270 | + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); |
271 | + kfree(cmd); |
272 | + |
273 | + return ret; |
274 | } |
275 | |
276 | static int dt9812_rmw_multiple_registers(struct comedi_device *dev, |
277 | @@ -306,17 +355,25 @@ static int dt9812_rmw_multiple_registers(struct comedi_device *dev, |
278 | { |
279 | struct usb_device *usb = comedi_to_usb_dev(dev); |
280 | struct dt9812_private *devpriv = dev->private; |
281 | - struct dt9812_usb_cmd cmd; |
282 | + struct dt9812_usb_cmd *cmd; |
283 | int i, count; |
284 | + int ret; |
285 | + |
286 | + cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); |
287 | + if (!cmd) |
288 | + return -ENOMEM; |
289 | |
290 | - cmd.cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG); |
291 | - cmd.u.rmw_multi_info.count = reg_count; |
292 | + cmd->cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG); |
293 | + cmd->u.rmw_multi_info.count = reg_count; |
294 | for (i = 0; i < reg_count; i++) |
295 | - cmd.u.rmw_multi_info.rmw[i] = rmw[i]; |
296 | + cmd->u.rmw_multi_info.rmw[i] = rmw[i]; |
297 | |
298 | /* DT9812 only responds to 32 byte writes!! */ |
299 | - return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), |
300 | - &cmd, 32, &count, DT9812_USB_TIMEOUT); |
301 | + ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), |
302 | + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT); |
303 | + kfree(cmd); |
304 | + |
305 | + return ret; |
306 | } |
307 | |
308 | static int dt9812_digital_in(struct comedi_device *dev, u8 *bits) |
309 | diff --git a/drivers/staging/comedi/drivers/ni_usb6501.c b/drivers/staging/comedi/drivers/ni_usb6501.c |
310 | index 360e86a19fe32..311632004f08a 100644 |
311 | --- a/drivers/staging/comedi/drivers/ni_usb6501.c |
312 | +++ b/drivers/staging/comedi/drivers/ni_usb6501.c |
313 | @@ -144,6 +144,10 @@ static const u8 READ_COUNTER_RESPONSE[] = {0x00, 0x01, 0x00, 0x10, |
314 | 0x00, 0x00, 0x00, 0x02, |
315 | 0x00, 0x00, 0x00, 0x00}; |
316 | |
317 | +/* Largest supported packets */ |
318 | +static const size_t TX_MAX_SIZE = sizeof(SET_PORT_DIR_REQUEST); |
319 | +static const size_t RX_MAX_SIZE = sizeof(READ_PORT_RESPONSE); |
320 | + |
321 | enum commands { |
322 | READ_PORT, |
323 | WRITE_PORT, |
324 | @@ -501,6 +505,12 @@ static int ni6501_find_endpoints(struct comedi_device *dev) |
325 | if (!devpriv->ep_rx || !devpriv->ep_tx) |
326 | return -ENODEV; |
327 | |
328 | + if (usb_endpoint_maxp(devpriv->ep_rx) < RX_MAX_SIZE) |
329 | + return -ENODEV; |
330 | + |
331 | + if (usb_endpoint_maxp(devpriv->ep_tx) < TX_MAX_SIZE) |
332 | + return -ENODEV; |
333 | + |
334 | return 0; |
335 | } |
336 | |
337 | diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c |
338 | index 7956abcbae22b..7769eadfaf61d 100644 |
339 | --- a/drivers/staging/comedi/drivers/vmk80xx.c |
340 | +++ b/drivers/staging/comedi/drivers/vmk80xx.c |
341 | @@ -90,6 +90,9 @@ enum { |
342 | #define IC3_VERSION BIT(0) |
343 | #define IC6_VERSION BIT(1) |
344 | |
345 | +#define MIN_BUF_SIZE 64 |
346 | +#define PACKET_TIMEOUT 10000 /* ms */ |
347 | + |
348 | enum vmk80xx_model { |
349 | VMK8055_MODEL, |
350 | VMK8061_MODEL |
351 | @@ -157,22 +160,21 @@ static void vmk80xx_do_bulk_msg(struct comedi_device *dev) |
352 | __u8 rx_addr; |
353 | unsigned int tx_pipe; |
354 | unsigned int rx_pipe; |
355 | - size_t size; |
356 | + size_t tx_size; |
357 | + size_t rx_size; |
358 | |
359 | tx_addr = devpriv->ep_tx->bEndpointAddress; |
360 | rx_addr = devpriv->ep_rx->bEndpointAddress; |
361 | tx_pipe = usb_sndbulkpipe(usb, tx_addr); |
362 | rx_pipe = usb_rcvbulkpipe(usb, rx_addr); |
363 | + tx_size = usb_endpoint_maxp(devpriv->ep_tx); |
364 | + rx_size = usb_endpoint_maxp(devpriv->ep_rx); |
365 | |
366 | - /* |
367 | - * The max packet size attributes of the K8061 |
368 | - * input/output endpoints are identical |
369 | - */ |
370 | - size = usb_endpoint_maxp(devpriv->ep_tx); |
371 | + usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, tx_size, NULL, |
372 | + PACKET_TIMEOUT); |
373 | |
374 | - usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, |
375 | - size, NULL, devpriv->ep_tx->bInterval); |
376 | - usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, size, NULL, HZ * 10); |
377 | + usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, rx_size, NULL, |
378 | + PACKET_TIMEOUT); |
379 | } |
380 | |
381 | static int vmk80xx_read_packet(struct comedi_device *dev) |
382 | @@ -191,7 +193,7 @@ static int vmk80xx_read_packet(struct comedi_device *dev) |
383 | pipe = usb_rcvintpipe(usb, ep->bEndpointAddress); |
384 | return usb_interrupt_msg(usb, pipe, devpriv->usb_rx_buf, |
385 | usb_endpoint_maxp(ep), NULL, |
386 | - HZ * 10); |
387 | + PACKET_TIMEOUT); |
388 | } |
389 | |
390 | static int vmk80xx_write_packet(struct comedi_device *dev, int cmd) |
391 | @@ -212,7 +214,7 @@ static int vmk80xx_write_packet(struct comedi_device *dev, int cmd) |
392 | pipe = usb_sndintpipe(usb, ep->bEndpointAddress); |
393 | return usb_interrupt_msg(usb, pipe, devpriv->usb_tx_buf, |
394 | usb_endpoint_maxp(ep), NULL, |
395 | - HZ * 10); |
396 | + PACKET_TIMEOUT); |
397 | } |
398 | |
399 | static int vmk80xx_reset_device(struct comedi_device *dev) |
400 | @@ -678,12 +680,12 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev) |
401 | struct vmk80xx_private *devpriv = dev->private; |
402 | size_t size; |
403 | |
404 | - size = usb_endpoint_maxp(devpriv->ep_rx); |
405 | + size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE); |
406 | devpriv->usb_rx_buf = kzalloc(size, GFP_KERNEL); |
407 | if (!devpriv->usb_rx_buf) |
408 | return -ENOMEM; |
409 | |
410 | - size = usb_endpoint_maxp(devpriv->ep_tx); |
411 | + size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE); |
412 | devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL); |
413 | if (!devpriv->usb_tx_buf) |
414 | return -ENOMEM; |
415 | diff --git a/drivers/staging/media/ipu3/ipu3-css-fw.c b/drivers/staging/media/ipu3/ipu3-css-fw.c |
416 | index 45aff76198e2c..981693eed8155 100644 |
417 | --- a/drivers/staging/media/ipu3/ipu3-css-fw.c |
418 | +++ b/drivers/staging/media/ipu3/ipu3-css-fw.c |
419 | @@ -124,12 +124,11 @@ int imgu_css_fw_init(struct imgu_css *css) |
420 | /* Check and display fw header info */ |
421 | |
422 | css->fwp = (struct imgu_fw_header *)css->fw->data; |
423 | - if (css->fw->size < sizeof(struct imgu_fw_header *) || |
424 | + if (css->fw->size < struct_size(css->fwp, binary_header, 1) || |
425 | css->fwp->file_header.h_size != sizeof(struct imgu_fw_bi_file_h)) |
426 | goto bad_fw; |
427 | - if (sizeof(struct imgu_fw_bi_file_h) + |
428 | - css->fwp->file_header.binary_nr * sizeof(struct imgu_fw_info) > |
429 | - css->fw->size) |
430 | + if (struct_size(css->fwp, binary_header, |
431 | + css->fwp->file_header.binary_nr) > css->fw->size) |
432 | goto bad_fw; |
433 | |
434 | dev_info(dev, "loaded firmware version %.64s, %u binaries, %zu bytes\n", |
435 | diff --git a/drivers/staging/media/ipu3/ipu3-css-fw.h b/drivers/staging/media/ipu3/ipu3-css-fw.h |
436 | index 79ffa70451390..650fd25fc79ee 100644 |
437 | --- a/drivers/staging/media/ipu3/ipu3-css-fw.h |
438 | +++ b/drivers/staging/media/ipu3/ipu3-css-fw.h |
439 | @@ -170,7 +170,7 @@ struct imgu_fw_bi_file_h { |
440 | |
441 | struct imgu_fw_header { |
442 | struct imgu_fw_bi_file_h file_header; |
443 | - struct imgu_fw_info binary_header[1]; /* binary_nr items */ |
444 | + struct imgu_fw_info binary_header[]; /* binary_nr items */ |
445 | }; |
446 | |
447 | /******************* Firmware functions *******************/ |
448 | diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c |
449 | index e739d1979c877..6f65a9c9d6cf3 100644 |
450 | --- a/drivers/staging/rtl8192u/r8192U_core.c |
451 | +++ b/drivers/staging/rtl8192u/r8192U_core.c |
452 | @@ -236,7 +236,7 @@ int write_nic_byte_E(struct net_device *dev, int indx, u8 data) |
453 | |
454 | status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), |
455 | RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, |
456 | - indx | 0xfe00, 0, usbdata, 1, HZ / 2); |
457 | + indx | 0xfe00, 0, usbdata, 1, 500); |
458 | kfree(usbdata); |
459 | |
460 | if (status < 0) { |
461 | @@ -258,7 +258,7 @@ int read_nic_byte_E(struct net_device *dev, int indx, u8 *data) |
462 | |
463 | status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), |
464 | RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, |
465 | - indx | 0xfe00, 0, usbdata, 1, HZ / 2); |
466 | + indx | 0xfe00, 0, usbdata, 1, 500); |
467 | *data = *usbdata; |
468 | kfree(usbdata); |
469 | |
470 | @@ -286,7 +286,7 @@ int write_nic_byte(struct net_device *dev, int indx, u8 data) |
471 | status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), |
472 | RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, |
473 | (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, |
474 | - usbdata, 1, HZ / 2); |
475 | + usbdata, 1, 500); |
476 | kfree(usbdata); |
477 | |
478 | if (status < 0) { |
479 | @@ -313,7 +313,7 @@ int write_nic_word(struct net_device *dev, int indx, u16 data) |
480 | status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), |
481 | RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, |
482 | (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, |
483 | - usbdata, 2, HZ / 2); |
484 | + usbdata, 2, 500); |
485 | kfree(usbdata); |
486 | |
487 | if (status < 0) { |
488 | @@ -340,7 +340,7 @@ int write_nic_dword(struct net_device *dev, int indx, u32 data) |
489 | status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), |
490 | RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, |
491 | (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, |
492 | - usbdata, 4, HZ / 2); |
493 | + usbdata, 4, 500); |
494 | kfree(usbdata); |
495 | |
496 | |
497 | @@ -367,7 +367,7 @@ int read_nic_byte(struct net_device *dev, int indx, u8 *data) |
498 | status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), |
499 | RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, |
500 | (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, |
501 | - usbdata, 1, HZ / 2); |
502 | + usbdata, 1, 500); |
503 | *data = *usbdata; |
504 | kfree(usbdata); |
505 | |
506 | @@ -394,7 +394,7 @@ int read_nic_word(struct net_device *dev, int indx, u16 *data) |
507 | status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), |
508 | RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, |
509 | (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, |
510 | - usbdata, 2, HZ / 2); |
511 | + usbdata, 2, 500); |
512 | *data = *usbdata; |
513 | kfree(usbdata); |
514 | |
515 | @@ -418,7 +418,7 @@ static int read_nic_word_E(struct net_device *dev, int indx, u16 *data) |
516 | |
517 | status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), |
518 | RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, |
519 | - indx | 0xfe00, 0, usbdata, 2, HZ / 2); |
520 | + indx | 0xfe00, 0, usbdata, 2, 500); |
521 | *data = *usbdata; |
522 | kfree(usbdata); |
523 | |
524 | @@ -444,7 +444,7 @@ int read_nic_dword(struct net_device *dev, int indx, u32 *data) |
525 | status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), |
526 | RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, |
527 | (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, |
528 | - usbdata, 4, HZ / 2); |
529 | + usbdata, 4, 500); |
530 | *data = *usbdata; |
531 | kfree(usbdata); |
532 | |
533 | diff --git a/drivers/staging/rtl8712/usb_ops_linux.c b/drivers/staging/rtl8712/usb_ops_linux.c |
534 | index 9d290bc2fdb7f..2202a0caa252e 100644 |
535 | --- a/drivers/staging/rtl8712/usb_ops_linux.c |
536 | +++ b/drivers/staging/rtl8712/usb_ops_linux.c |
537 | @@ -493,7 +493,7 @@ int r8712_usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value, |
538 | memcpy(pIo_buf, pdata, len); |
539 | } |
540 | status = usb_control_msg(udev, pipe, request, reqtype, value, index, |
541 | - pIo_buf, len, HZ / 2); |
542 | + pIo_buf, len, 500); |
543 | if (status > 0) { /* Success this control transfer. */ |
544 | if (requesttype == 0x01) { |
545 | /* For Control read transfer, we have to copy the read |
546 | diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig |
547 | index d354036ff6c86..f985bb4a42db2 100644 |
548 | --- a/drivers/usb/gadget/udc/Kconfig |
549 | +++ b/drivers/usb/gadget/udc/Kconfig |
550 | @@ -330,6 +330,7 @@ config USB_AMD5536UDC |
551 | config USB_FSL_QE |
552 | tristate "Freescale QE/CPM USB Device Controller" |
553 | depends on FSL_SOC && (QUICC_ENGINE || CPM) |
554 | + depends on !64BIT || BROKEN |
555 | help |
556 | Some of Freescale PowerPC processors have a Full Speed |
557 | QE/CPM2 USB controller, which support device mode with 4 |
558 | diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c |
559 | index 5c6ce1ef3f4b0..c0e344c3a8487 100644 |
560 | --- a/drivers/usb/host/ehci-hcd.c |
561 | +++ b/drivers/usb/host/ehci-hcd.c |
562 | @@ -634,7 +634,16 @@ static int ehci_run (struct usb_hcd *hcd) |
563 | /* Wait until HC become operational */ |
564 | ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */ |
565 | msleep(5); |
566 | - rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT, 0, 100 * 1000); |
567 | + |
568 | + /* For Aspeed, STS_HALT also depends on ASS/PSS status. |
569 | + * Check CMD_RUN instead. |
570 | + */ |
571 | + if (ehci->is_aspeed) |
572 | + rc = ehci_handshake(ehci, &ehci->regs->command, CMD_RUN, |
573 | + 1, 100 * 1000); |
574 | + else |
575 | + rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT, |
576 | + 0, 100 * 1000); |
577 | |
578 | up_write(&ehci_cf_port_reset_rwsem); |
579 | |
580 | diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c |
581 | index e4fc3f66d43bf..accbcc989c503 100644 |
582 | --- a/drivers/usb/host/ehci-platform.c |
583 | +++ b/drivers/usb/host/ehci-platform.c |
584 | @@ -286,6 +286,12 @@ static int ehci_platform_probe(struct platform_device *dev) |
585 | "has-transaction-translator")) |
586 | hcd->has_tt = 1; |
587 | |
588 | + if (of_device_is_compatible(dev->dev.of_node, |
589 | + "aspeed,ast2500-ehci") || |
590 | + of_device_is_compatible(dev->dev.of_node, |
591 | + "aspeed,ast2600-ehci")) |
592 | + ehci->is_aspeed = 1; |
593 | + |
594 | if (soc_device_match(quirk_poll_match)) |
595 | priv->quirk_poll = true; |
596 | |
597 | diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h |
598 | index ac5e967907d14..356738462ce45 100644 |
599 | --- a/drivers/usb/host/ehci.h |
600 | +++ b/drivers/usb/host/ehci.h |
601 | @@ -218,6 +218,7 @@ struct ehci_hcd { /* one per controller */ |
602 | unsigned frame_index_bug:1; /* MosChip (AKA NetMos) */ |
603 | unsigned need_oc_pp_cycle:1; /* MPC834X port power */ |
604 | unsigned imx28_write_fix:1; /* For Freescale i.MX28 */ |
605 | + unsigned is_aspeed:1; |
606 | |
607 | /* required for usb32 quirk */ |
608 | #define OHCI_CTRL_HCFS (3 << 6) |
609 | diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c |
610 | index ffe462a657b15..4622400ba4ddb 100644 |
611 | --- a/drivers/usb/musb/musb_gadget.c |
612 | +++ b/drivers/usb/musb/musb_gadget.c |
613 | @@ -1248,9 +1248,11 @@ static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req, |
614 | status = musb_queue_resume_work(musb, |
615 | musb_ep_restart_resume_work, |
616 | request); |
617 | - if (status < 0) |
618 | + if (status < 0) { |
619 | dev_err(musb->controller, "%s resume work: %i\n", |
620 | __func__, status); |
621 | + list_del(&request->list); |
622 | + } |
623 | } |
624 | |
625 | unlock: |
626 | diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h |
627 | index 7442793fe0502..3ba4e060fd051 100644 |
628 | --- a/drivers/usb/storage/unusual_devs.h |
629 | +++ b/drivers/usb/storage/unusual_devs.h |
630 | @@ -406,6 +406,16 @@ UNUSUAL_DEV( 0x04b8, 0x0602, 0x0110, 0x0110, |
631 | "785EPX Storage", |
632 | USB_SC_SCSI, USB_PR_BULK, NULL, US_FL_SINGLE_LUN), |
633 | |
634 | +/* |
635 | + * Reported by James Buren <braewoods+lkml@braewoods.net> |
636 | + * Virtual ISOs cannot be remounted if ejected while the device is locked |
637 | + * Disable locking to mimic Windows behavior that bypasses the issue |
638 | + */ |
639 | +UNUSUAL_DEV( 0x04c5, 0x2028, 0x0001, 0x0001, |
640 | + "iODD", |
641 | + "2531/2541", |
642 | + USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE), |
643 | + |
644 | /* |
645 | * Not sure who reported this originally but |
646 | * Pavel Machek <pavel@ucw.cz> reported that the extra US_FL_SINGLE_LUN |
647 | diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c |
648 | index bf30f6ce8dd10..74e487d63c62c 100644 |
649 | --- a/fs/isofs/inode.c |
650 | +++ b/fs/isofs/inode.c |
651 | @@ -1328,6 +1328,8 @@ static int isofs_read_inode(struct inode *inode, int relocated) |
652 | |
653 | de = (struct iso_directory_record *) (bh->b_data + offset); |
654 | de_len = *(unsigned char *) de; |
655 | + if (de_len < sizeof(struct iso_directory_record)) |
656 | + goto fail; |
657 | |
658 | if (offset + de_len > bufsize) { |
659 | int frag1 = bufsize - offset; |
660 | diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c |
661 | index 5569ef6bc1839..23e26a203a9e9 100644 |
662 | --- a/kernel/printk/printk.c |
663 | +++ b/kernel/printk/printk.c |
664 | @@ -2193,8 +2193,15 @@ static int __init console_setup(char *str) |
665 | char *s, *options, *brl_options = NULL; |
666 | int idx; |
667 | |
668 | - if (str[0] == 0) |
669 | + /* |
670 | + * console="" or console=null have been suggested as a way to |
671 | + * disable console output. Use ttynull that has been created |
672 | + * for exacly this purpose. |
673 | + */ |
674 | + if (str[0] == 0 || strcmp(str, "null") == 0) { |
675 | + __add_preferred_console("ttynull", 0, NULL, NULL); |
676 | return 1; |
677 | + } |
678 | |
679 | if (_braille_console_setup(&str, &brl_options)) |
680 | return 1; |