Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-5.4/0258-5.4.159-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-5.4/0258-5.4.159-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3635 - (show annotations) (download)
    Mon Oct 24 12:34:12 2022 UTC (18 months ago) by niro
    File size: 23948 byte(s) 
    -sync kernel patches
    1 diff --git a/Makefile b/Makefile
    2 index cef1d2704c410..602b5167dacd7 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,7 +1,7 @@
    6 # SPDX-License-Identifier: GPL-2.0
    7 VERSION = 5
    8 PATCHLEVEL = 4
    9 -SUBLEVEL = 158
    10 +SUBLEVEL = 159
    11 EXTRAVERSION =
    12 NAME = Kleptomaniac Octopus
    13
    14 diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
    15 index 642031b896f64..24a6905d60ee2 100644
    16 --- a/arch/x86/kvm/ioapic.c
    17 +++ b/arch/x86/kvm/ioapic.c
    18 @@ -91,7 +91,7 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
    19 static void rtc_irq_eoi_tracking_reset(struct kvm_ioapic *ioapic)
    20 {
    21 ioapic->rtc_status.pending_eoi = 0;
    22 - bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID + 1);
    23 + bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID);
    24 }
    25
    26 static void kvm_rtc_eoi_tracking_restore_all(struct kvm_ioapic *ioapic);
    27 diff --git a/arch/x86/kvm/ioapic.h b/arch/x86/kvm/ioapic.h
    28 index 283f1f489bcac..ea1a4e0297dae 100644
    29 --- a/arch/x86/kvm/ioapic.h
    30 +++ b/arch/x86/kvm/ioapic.h
    31 @@ -43,13 +43,13 @@ struct kvm_vcpu;
    32
    33 struct dest_map {
    34 /* vcpu bitmap where IRQ has been sent */
    35 - DECLARE_BITMAP(map, KVM_MAX_VCPU_ID + 1);
    36 + DECLARE_BITMAP(map, KVM_MAX_VCPU_ID);
    37
    38 /*
    39 * Vector sent to a given vcpu, only valid when
    40 * the vcpu's bit in map is set
    41 */
    42 - u8 vectors[KVM_MAX_VCPU_ID + 1];
    43 + u8 vectors[KVM_MAX_VCPU_ID];
    44 };
    45
    46
    47 diff --git a/drivers/android/binder.c b/drivers/android/binder.c
    48 index 4eaef780844ea..2be6687c0148f 100644
    49 --- a/drivers/android/binder.c
    50 +++ b/drivers/android/binder.c
    51 @@ -2257,7 +2257,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
    52 binder_dec_node(buffer->target_node, 1, 0);
    53
    54 off_start_offset = ALIGN(buffer->data_size, sizeof(void *));
    55 - off_end_offset = is_failure ? failed_at :
    56 + off_end_offset = is_failure && failed_at ? failed_at :
    57 off_start_offset + buffer->offsets_size;
    58 for (buffer_offset = off_start_offset; buffer_offset < off_end_offset;
    59 buffer_offset += sizeof(binder_size_t)) {
    60 @@ -2343,9 +2343,8 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
    61 binder_size_t fd_buf_size;
    62 binder_size_t num_valid;
    63
    64 - if (proc->tsk != current->group_leader) {
    65 + if (is_failure) {
    66 /*
    67 - * Nothing to do if running in sender context
    68 * The fd fixups have not been applied so no
    69 * fds need to be closed.
    70 */
    71 @@ -3548,6 +3547,7 @@ err_invalid_target_handle:
    72 * binder_free_buf() - free the specified buffer
    73 * @proc: binder proc that owns buffer
    74 * @buffer: buffer to be freed
    75 + * @is_failure: failed to send transaction
    76 *
    77 * If buffer for an async transaction, enqueue the next async
    78 * transaction from the node.
    79 @@ -3557,7 +3557,7 @@ err_invalid_target_handle:
    80 static void
    81 binder_free_buf(struct binder_proc *proc,
    82 struct binder_thread *thread,
    83 - struct binder_buffer *buffer)
    84 + struct binder_buffer *buffer, bool is_failure)
    85 {
    86 binder_inner_proc_lock(proc);
    87 if (buffer->transaction) {
    88 @@ -3585,7 +3585,7 @@ binder_free_buf(struct binder_proc *proc,
    89 binder_node_inner_unlock(buf_node);
    90 }
    91 trace_binder_transaction_buffer_release(buffer);
    92 - binder_transaction_buffer_release(proc, thread, buffer, 0, false);
    93 + binder_transaction_buffer_release(proc, thread, buffer, 0, is_failure);
    94 binder_alloc_free_buf(&proc->alloc, buffer);
    95 }
    96
    97 @@ -3786,7 +3786,7 @@ static int binder_thread_write(struct binder_proc *proc,
    98 proc->pid, thread->pid, (u64)data_ptr,
    99 buffer->debug_id,
    100 buffer->transaction ? "active" : "finished");
    101 - binder_free_buf(proc, thread, buffer);
    102 + binder_free_buf(proc, thread, buffer, false);
    103 break;
    104 }
    105
    106 @@ -4474,7 +4474,7 @@ retry:
    107 buffer->transaction = NULL;
    108 binder_cleanup_transaction(t, "fd fixups failed",
    109 BR_FAILED_REPLY);
    110 - binder_free_buf(proc, thread, buffer);
    111 + binder_free_buf(proc, thread, buffer, true);
    112 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
    113 "%d:%d %stransaction %d fd fixups failed %d/%d, line %d\n",
    114 proc->pid, thread->pid,
    115 diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
    116 index e8aa3d4bda885..1e5a2a0cc6700 100644
    117 --- a/drivers/net/wireless/rsi/rsi_91x_usb.c
    118 +++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
    119 @@ -61,7 +61,7 @@ static int rsi_usb_card_write(struct rsi_hw *adapter,
    120 (void *)seg,
    121 (int)len,
    122 &transfer,
    123 - HZ * 5);
    124 + USB_CTRL_SET_TIMEOUT);
    125
    126 if (status < 0) {
    127 rsi_dbg(ERR_ZONE,
    128 diff --git a/drivers/staging/comedi/drivers/dt9812.c b/drivers/staging/comedi/drivers/dt9812.c
    129 index 634f57730c1e0..704b04d2980d3 100644
    130 --- a/drivers/staging/comedi/drivers/dt9812.c
    131 +++ b/drivers/staging/comedi/drivers/dt9812.c
    132 @@ -32,6 +32,7 @@
    133 #include <linux/kernel.h>
    134 #include <linux/module.h>
    135 #include <linux/errno.h>
    136 +#include <linux/slab.h>
    137 #include <linux/uaccess.h>
    138
    139 #include "../comedi_usb.h"
    140 @@ -237,22 +238,42 @@ static int dt9812_read_info(struct comedi_device *dev,
    141 {
    142 struct usb_device *usb = comedi_to_usb_dev(dev);
    143 struct dt9812_private *devpriv = dev->private;
    144 - struct dt9812_usb_cmd cmd;
    145 + struct dt9812_usb_cmd *cmd;
    146 + size_t tbuf_size;
    147 int count, ret;
    148 + void *tbuf;
    149
    150 - cmd.cmd = cpu_to_le32(DT9812_R_FLASH_DATA);
    151 - cmd.u.flash_data_info.address =
    152 + tbuf_size = max(sizeof(*cmd), buf_size);
    153 +
    154 + tbuf = kzalloc(tbuf_size, GFP_KERNEL);
    155 + if (!tbuf)
    156 + return -ENOMEM;
    157 +
    158 + cmd = tbuf;
    159 +
    160 + cmd->cmd = cpu_to_le32(DT9812_R_FLASH_DATA);
    161 + cmd->u.flash_data_info.address =
    162 cpu_to_le16(DT9812_DIAGS_BOARD_INFO_ADDR + offset);
    163 - cmd.u.flash_data_info.numbytes = cpu_to_le16(buf_size);
    164 + cmd->u.flash_data_info.numbytes = cpu_to_le16(buf_size);
    165
    166 /* DT9812 only responds to 32 byte writes!! */
    167 ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
    168 - &cmd, 32, &count, DT9812_USB_TIMEOUT);
    169 + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
    170 if (ret)
    171 - return ret;
    172 + goto out;
    173 +
    174 + ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
    175 + tbuf, buf_size, &count, DT9812_USB_TIMEOUT);
    176 + if (!ret) {
    177 + if (count == buf_size)
    178 + memcpy(buf, tbuf, buf_size);
    179 + else
    180 + ret = -EREMOTEIO;
    181 + }
    182 +out:
    183 + kfree(tbuf);
    184
    185 - return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
    186 - buf, buf_size, &count, DT9812_USB_TIMEOUT);
    187 + return ret;
    188 }
    189
    190 static int dt9812_read_multiple_registers(struct comedi_device *dev,
    191 @@ -261,22 +282,42 @@ static int dt9812_read_multiple_registers(struct comedi_device *dev,
    192 {
    193 struct usb_device *usb = comedi_to_usb_dev(dev);
    194 struct dt9812_private *devpriv = dev->private;
    195 - struct dt9812_usb_cmd cmd;
    196 + struct dt9812_usb_cmd *cmd;
    197 int i, count, ret;
    198 + size_t buf_size;
    199 + void *buf;
    200
    201 - cmd.cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG);
    202 - cmd.u.read_multi_info.count = reg_count;
    203 + buf_size = max_t(size_t, sizeof(*cmd), reg_count);
    204 +
    205 + buf = kzalloc(buf_size, GFP_KERNEL);
    206 + if (!buf)
    207 + return -ENOMEM;
    208 +
    209 + cmd = buf;
    210 +
    211 + cmd->cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG);
    212 + cmd->u.read_multi_info.count = reg_count;
    213 for (i = 0; i < reg_count; i++)
    214 - cmd.u.read_multi_info.address[i] = address[i];
    215 + cmd->u.read_multi_info.address[i] = address[i];
    216
    217 /* DT9812 only responds to 32 byte writes!! */
    218 ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
    219 - &cmd, 32, &count, DT9812_USB_TIMEOUT);
    220 + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
    221 if (ret)
    222 - return ret;
    223 + goto out;
    224 +
    225 + ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
    226 + buf, reg_count, &count, DT9812_USB_TIMEOUT);
    227 + if (!ret) {
    228 + if (count == reg_count)
    229 + memcpy(value, buf, reg_count);
    230 + else
    231 + ret = -EREMOTEIO;
    232 + }
    233 +out:
    234 + kfree(buf);
    235
    236 - return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
    237 - value, reg_count, &count, DT9812_USB_TIMEOUT);
    238 + return ret;
    239 }
    240
    241 static int dt9812_write_multiple_registers(struct comedi_device *dev,
    242 @@ -285,19 +326,27 @@ static int dt9812_write_multiple_registers(struct comedi_device *dev,
    243 {
    244 struct usb_device *usb = comedi_to_usb_dev(dev);
    245 struct dt9812_private *devpriv = dev->private;
    246 - struct dt9812_usb_cmd cmd;
    247 + struct dt9812_usb_cmd *cmd;
    248 int i, count;
    249 + int ret;
    250 +
    251 + cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
    252 + if (!cmd)
    253 + return -ENOMEM;
    254
    255 - cmd.cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG);
    256 - cmd.u.read_multi_info.count = reg_count;
    257 + cmd->cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG);
    258 + cmd->u.read_multi_info.count = reg_count;
    259 for (i = 0; i < reg_count; i++) {
    260 - cmd.u.write_multi_info.write[i].address = address[i];
    261 - cmd.u.write_multi_info.write[i].value = value[i];
    262 + cmd->u.write_multi_info.write[i].address = address[i];
    263 + cmd->u.write_multi_info.write[i].value = value[i];
    264 }
    265
    266 /* DT9812 only responds to 32 byte writes!! */
    267 - return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
    268 - &cmd, 32, &count, DT9812_USB_TIMEOUT);
    269 + ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
    270 + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
    271 + kfree(cmd);
    272 +
    273 + return ret;
    274 }
    275
    276 static int dt9812_rmw_multiple_registers(struct comedi_device *dev,
    277 @@ -306,17 +355,25 @@ static int dt9812_rmw_multiple_registers(struct comedi_device *dev,
    278 {
    279 struct usb_device *usb = comedi_to_usb_dev(dev);
    280 struct dt9812_private *devpriv = dev->private;
    281 - struct dt9812_usb_cmd cmd;
    282 + struct dt9812_usb_cmd *cmd;
    283 int i, count;
    284 + int ret;
    285 +
    286 + cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
    287 + if (!cmd)
    288 + return -ENOMEM;
    289
    290 - cmd.cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG);
    291 - cmd.u.rmw_multi_info.count = reg_count;
    292 + cmd->cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG);
    293 + cmd->u.rmw_multi_info.count = reg_count;
    294 for (i = 0; i < reg_count; i++)
    295 - cmd.u.rmw_multi_info.rmw[i] = rmw[i];
    296 + cmd->u.rmw_multi_info.rmw[i] = rmw[i];
    297
    298 /* DT9812 only responds to 32 byte writes!! */
    299 - return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
    300 - &cmd, 32, &count, DT9812_USB_TIMEOUT);
    301 + ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
    302 + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
    303 + kfree(cmd);
    304 +
    305 + return ret;
    306 }
    307
    308 static int dt9812_digital_in(struct comedi_device *dev, u8 *bits)
    309 diff --git a/drivers/staging/comedi/drivers/ni_usb6501.c b/drivers/staging/comedi/drivers/ni_usb6501.c
    310 index 360e86a19fe32..311632004f08a 100644
    311 --- a/drivers/staging/comedi/drivers/ni_usb6501.c
    312 +++ b/drivers/staging/comedi/drivers/ni_usb6501.c
    313 @@ -144,6 +144,10 @@ static const u8 READ_COUNTER_RESPONSE[] = {0x00, 0x01, 0x00, 0x10,
    314 0x00, 0x00, 0x00, 0x02,
    315 0x00, 0x00, 0x00, 0x00};
    316
    317 +/* Largest supported packets */
    318 +static const size_t TX_MAX_SIZE = sizeof(SET_PORT_DIR_REQUEST);
    319 +static const size_t RX_MAX_SIZE = sizeof(READ_PORT_RESPONSE);
    320 +
    321 enum commands {
    322 READ_PORT,
    323 WRITE_PORT,
    324 @@ -501,6 +505,12 @@ static int ni6501_find_endpoints(struct comedi_device *dev)
    325 if (!devpriv->ep_rx || !devpriv->ep_tx)
    326 return -ENODEV;
    327
    328 + if (usb_endpoint_maxp(devpriv->ep_rx) < RX_MAX_SIZE)
    329 + return -ENODEV;
    330 +
    331 + if (usb_endpoint_maxp(devpriv->ep_tx) < TX_MAX_SIZE)
    332 + return -ENODEV;
    333 +
    334 return 0;
    335 }
    336
    337 diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
    338 index 7956abcbae22b..7769eadfaf61d 100644
    339 --- a/drivers/staging/comedi/drivers/vmk80xx.c
    340 +++ b/drivers/staging/comedi/drivers/vmk80xx.c
    341 @@ -90,6 +90,9 @@ enum {
    342 #define IC3_VERSION BIT(0)
    343 #define IC6_VERSION BIT(1)
    344
    345 +#define MIN_BUF_SIZE 64
    346 +#define PACKET_TIMEOUT 10000 /* ms */
    347 +
    348 enum vmk80xx_model {
    349 VMK8055_MODEL,
    350 VMK8061_MODEL
    351 @@ -157,22 +160,21 @@ static void vmk80xx_do_bulk_msg(struct comedi_device *dev)
    352 __u8 rx_addr;
    353 unsigned int tx_pipe;
    354 unsigned int rx_pipe;
    355 - size_t size;
    356 + size_t tx_size;
    357 + size_t rx_size;
    358
    359 tx_addr = devpriv->ep_tx->bEndpointAddress;
    360 rx_addr = devpriv->ep_rx->bEndpointAddress;
    361 tx_pipe = usb_sndbulkpipe(usb, tx_addr);
    362 rx_pipe = usb_rcvbulkpipe(usb, rx_addr);
    363 + tx_size = usb_endpoint_maxp(devpriv->ep_tx);
    364 + rx_size = usb_endpoint_maxp(devpriv->ep_rx);
    365
    366 - /*
    367 - * The max packet size attributes of the K8061
    368 - * input/output endpoints are identical
    369 - */
    370 - size = usb_endpoint_maxp(devpriv->ep_tx);
    371 + usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, tx_size, NULL,
    372 + PACKET_TIMEOUT);
    373
    374 - usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf,
    375 - size, NULL, devpriv->ep_tx->bInterval);
    376 - usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, size, NULL, HZ * 10);
    377 + usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, rx_size, NULL,
    378 + PACKET_TIMEOUT);
    379 }
    380
    381 static int vmk80xx_read_packet(struct comedi_device *dev)
    382 @@ -191,7 +193,7 @@ static int vmk80xx_read_packet(struct comedi_device *dev)
    383 pipe = usb_rcvintpipe(usb, ep->bEndpointAddress);
    384 return usb_interrupt_msg(usb, pipe, devpriv->usb_rx_buf,
    385 usb_endpoint_maxp(ep), NULL,
    386 - HZ * 10);
    387 + PACKET_TIMEOUT);
    388 }
    389
    390 static int vmk80xx_write_packet(struct comedi_device *dev, int cmd)
    391 @@ -212,7 +214,7 @@ static int vmk80xx_write_packet(struct comedi_device *dev, int cmd)
    392 pipe = usb_sndintpipe(usb, ep->bEndpointAddress);
    393 return usb_interrupt_msg(usb, pipe, devpriv->usb_tx_buf,
    394 usb_endpoint_maxp(ep), NULL,
    395 - HZ * 10);
    396 + PACKET_TIMEOUT);
    397 }
    398
    399 static int vmk80xx_reset_device(struct comedi_device *dev)
    400 @@ -678,12 +680,12 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev)
    401 struct vmk80xx_private *devpriv = dev->private;
    402 size_t size;
    403
    404 - size = usb_endpoint_maxp(devpriv->ep_rx);
    405 + size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE);
    406 devpriv->usb_rx_buf = kzalloc(size, GFP_KERNEL);
    407 if (!devpriv->usb_rx_buf)
    408 return -ENOMEM;
    409
    410 - size = usb_endpoint_maxp(devpriv->ep_tx);
    411 + size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE);
    412 devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
    413 if (!devpriv->usb_tx_buf)
    414 return -ENOMEM;
    415 diff --git a/drivers/staging/media/ipu3/ipu3-css-fw.c b/drivers/staging/media/ipu3/ipu3-css-fw.c
    416 index 45aff76198e2c..981693eed8155 100644
    417 --- a/drivers/staging/media/ipu3/ipu3-css-fw.c
    418 +++ b/drivers/staging/media/ipu3/ipu3-css-fw.c
    419 @@ -124,12 +124,11 @@ int imgu_css_fw_init(struct imgu_css *css)
    420 /* Check and display fw header info */
    421
    422 css->fwp = (struct imgu_fw_header *)css->fw->data;
    423 - if (css->fw->size < sizeof(struct imgu_fw_header *) ||
    424 + if (css->fw->size < struct_size(css->fwp, binary_header, 1) ||
    425 css->fwp->file_header.h_size != sizeof(struct imgu_fw_bi_file_h))
    426 goto bad_fw;
    427 - if (sizeof(struct imgu_fw_bi_file_h) +
    428 - css->fwp->file_header.binary_nr * sizeof(struct imgu_fw_info) >
    429 - css->fw->size)
    430 + if (struct_size(css->fwp, binary_header,
    431 + css->fwp->file_header.binary_nr) > css->fw->size)
    432 goto bad_fw;
    433
    434 dev_info(dev, "loaded firmware version %.64s, %u binaries, %zu bytes\n",
    435 diff --git a/drivers/staging/media/ipu3/ipu3-css-fw.h b/drivers/staging/media/ipu3/ipu3-css-fw.h
    436 index 79ffa70451390..650fd25fc79ee 100644
    437 --- a/drivers/staging/media/ipu3/ipu3-css-fw.h
    438 +++ b/drivers/staging/media/ipu3/ipu3-css-fw.h
    439 @@ -170,7 +170,7 @@ struct imgu_fw_bi_file_h {
    440
    441 struct imgu_fw_header {
    442 struct imgu_fw_bi_file_h file_header;
    443 - struct imgu_fw_info binary_header[1]; /* binary_nr items */
    444 + struct imgu_fw_info binary_header[]; /* binary_nr items */
    445 };
    446
    447 /******************* Firmware functions *******************/
    448 diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
    449 index e739d1979c877..6f65a9c9d6cf3 100644
    450 --- a/drivers/staging/rtl8192u/r8192U_core.c
    451 +++ b/drivers/staging/rtl8192u/r8192U_core.c
    452 @@ -236,7 +236,7 @@ int write_nic_byte_E(struct net_device *dev, int indx, u8 data)
    453
    454 status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
    455 RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
    456 - indx | 0xfe00, 0, usbdata, 1, HZ / 2);
    457 + indx | 0xfe00, 0, usbdata, 1, 500);
    458 kfree(usbdata);
    459
    460 if (status < 0) {
    461 @@ -258,7 +258,7 @@ int read_nic_byte_E(struct net_device *dev, int indx, u8 *data)
    462
    463 status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
    464 RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
    465 - indx | 0xfe00, 0, usbdata, 1, HZ / 2);
    466 + indx | 0xfe00, 0, usbdata, 1, 500);
    467 *data = *usbdata;
    468 kfree(usbdata);
    469
    470 @@ -286,7 +286,7 @@ int write_nic_byte(struct net_device *dev, int indx, u8 data)
    471 status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
    472 RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
    473 (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
    474 - usbdata, 1, HZ / 2);
    475 + usbdata, 1, 500);
    476 kfree(usbdata);
    477
    478 if (status < 0) {
    479 @@ -313,7 +313,7 @@ int write_nic_word(struct net_device *dev, int indx, u16 data)
    480 status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
    481 RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
    482 (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
    483 - usbdata, 2, HZ / 2);
    484 + usbdata, 2, 500);
    485 kfree(usbdata);
    486
    487 if (status < 0) {
    488 @@ -340,7 +340,7 @@ int write_nic_dword(struct net_device *dev, int indx, u32 data)
    489 status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
    490 RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
    491 (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
    492 - usbdata, 4, HZ / 2);
    493 + usbdata, 4, 500);
    494 kfree(usbdata);
    495
    496
    497 @@ -367,7 +367,7 @@ int read_nic_byte(struct net_device *dev, int indx, u8 *data)
    498 status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
    499 RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
    500 (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
    501 - usbdata, 1, HZ / 2);
    502 + usbdata, 1, 500);
    503 *data = *usbdata;
    504 kfree(usbdata);
    505
    506 @@ -394,7 +394,7 @@ int read_nic_word(struct net_device *dev, int indx, u16 *data)
    507 status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
    508 RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
    509 (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
    510 - usbdata, 2, HZ / 2);
    511 + usbdata, 2, 500);
    512 *data = *usbdata;
    513 kfree(usbdata);
    514
    515 @@ -418,7 +418,7 @@ static int read_nic_word_E(struct net_device *dev, int indx, u16 *data)
    516
    517 status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
    518 RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
    519 - indx | 0xfe00, 0, usbdata, 2, HZ / 2);
    520 + indx | 0xfe00, 0, usbdata, 2, 500);
    521 *data = *usbdata;
    522 kfree(usbdata);
    523
    524 @@ -444,7 +444,7 @@ int read_nic_dword(struct net_device *dev, int indx, u32 *data)
    525 status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
    526 RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
    527 (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
    528 - usbdata, 4, HZ / 2);
    529 + usbdata, 4, 500);
    530 *data = *usbdata;
    531 kfree(usbdata);
    532
    533 diff --git a/drivers/staging/rtl8712/usb_ops_linux.c b/drivers/staging/rtl8712/usb_ops_linux.c
    534 index 9d290bc2fdb7f..2202a0caa252e 100644
    535 --- a/drivers/staging/rtl8712/usb_ops_linux.c
    536 +++ b/drivers/staging/rtl8712/usb_ops_linux.c
    537 @@ -493,7 +493,7 @@ int r8712_usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value,
    538 memcpy(pIo_buf, pdata, len);
    539 }
    540 status = usb_control_msg(udev, pipe, request, reqtype, value, index,
    541 - pIo_buf, len, HZ / 2);
    542 + pIo_buf, len, 500);
    543 if (status > 0) { /* Success this control transfer. */
    544 if (requesttype == 0x01) {
    545 /* For Control read transfer, we have to copy the read
    546 diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig
    547 index d354036ff6c86..f985bb4a42db2 100644
    548 --- a/drivers/usb/gadget/udc/Kconfig
    549 +++ b/drivers/usb/gadget/udc/Kconfig
    550 @@ -330,6 +330,7 @@ config USB_AMD5536UDC
    551 config USB_FSL_QE
    552 tristate "Freescale QE/CPM USB Device Controller"
    553 depends on FSL_SOC && (QUICC_ENGINE || CPM)
    554 + depends on !64BIT || BROKEN
    555 help
    556 Some of Freescale PowerPC processors have a Full Speed
    557 QE/CPM2 USB controller, which support device mode with 4
    558 diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
    559 index 5c6ce1ef3f4b0..c0e344c3a8487 100644
    560 --- a/drivers/usb/host/ehci-hcd.c
    561 +++ b/drivers/usb/host/ehci-hcd.c
    562 @@ -634,7 +634,16 @@ static int ehci_run (struct usb_hcd *hcd)
    563 /* Wait until HC become operational */
    564 ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */
    565 msleep(5);
    566 - rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT, 0, 100 * 1000);
    567 +
    568 + /* For Aspeed, STS_HALT also depends on ASS/PSS status.
    569 + * Check CMD_RUN instead.
    570 + */
    571 + if (ehci->is_aspeed)
    572 + rc = ehci_handshake(ehci, &ehci->regs->command, CMD_RUN,
    573 + 1, 100 * 1000);
    574 + else
    575 + rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT,
    576 + 0, 100 * 1000);
    577
    578 up_write(&ehci_cf_port_reset_rwsem);
    579
    580 diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c
    581 index e4fc3f66d43bf..accbcc989c503 100644
    582 --- a/drivers/usb/host/ehci-platform.c
    583 +++ b/drivers/usb/host/ehci-platform.c
    584 @@ -286,6 +286,12 @@ static int ehci_platform_probe(struct platform_device *dev)
    585 "has-transaction-translator"))
    586 hcd->has_tt = 1;
    587
    588 + if (of_device_is_compatible(dev->dev.of_node,
    589 + "aspeed,ast2500-ehci") ||
    590 + of_device_is_compatible(dev->dev.of_node,
    591 + "aspeed,ast2600-ehci"))
    592 + ehci->is_aspeed = 1;
    593 +
    594 if (soc_device_match(quirk_poll_match))
    595 priv->quirk_poll = true;
    596
    597 diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
    598 index ac5e967907d14..356738462ce45 100644
    599 --- a/drivers/usb/host/ehci.h
    600 +++ b/drivers/usb/host/ehci.h
    601 @@ -218,6 +218,7 @@ struct ehci_hcd { /* one per controller */
    602 unsigned frame_index_bug:1; /* MosChip (AKA NetMos) */
    603 unsigned need_oc_pp_cycle:1; /* MPC834X port power */
    604 unsigned imx28_write_fix:1; /* For Freescale i.MX28 */
    605 + unsigned is_aspeed:1;
    606
    607 /* required for usb32 quirk */
    608 #define OHCI_CTRL_HCFS (3 << 6)
    609 diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
    610 index ffe462a657b15..4622400ba4ddb 100644
    611 --- a/drivers/usb/musb/musb_gadget.c
    612 +++ b/drivers/usb/musb/musb_gadget.c
    613 @@ -1248,9 +1248,11 @@ static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
    614 status = musb_queue_resume_work(musb,
    615 musb_ep_restart_resume_work,
    616 request);
    617 - if (status < 0)
    618 + if (status < 0) {
    619 dev_err(musb->controller, "%s resume work: %i\n",
    620 __func__, status);
    621 + list_del(&request->list);
    622 + }
    623 }
    624
    625 unlock:
    626 diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
    627 index 7442793fe0502..3ba4e060fd051 100644
    628 --- a/drivers/usb/storage/unusual_devs.h
    629 +++ b/drivers/usb/storage/unusual_devs.h
    630 @@ -406,6 +406,16 @@ UNUSUAL_DEV( 0x04b8, 0x0602, 0x0110, 0x0110,
    631 "785EPX Storage",
    632 USB_SC_SCSI, USB_PR_BULK, NULL, US_FL_SINGLE_LUN),
    633
    634 +/*
    635 + * Reported by James Buren <braewoods+lkml@braewoods.net>
    636 + * Virtual ISOs cannot be remounted if ejected while the device is locked
    637 + * Disable locking to mimic Windows behavior that bypasses the issue
    638 + */
    639 +UNUSUAL_DEV( 0x04c5, 0x2028, 0x0001, 0x0001,
    640 + "iODD",
    641 + "2531/2541",
    642 + USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE),
    643 +
    644 /*
    645 * Not sure who reported this originally but
    646 * Pavel Machek <pavel@ucw.cz> reported that the extra US_FL_SINGLE_LUN
    647 diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
    648 index bf30f6ce8dd10..74e487d63c62c 100644
    649 --- a/fs/isofs/inode.c
    650 +++ b/fs/isofs/inode.c
    651 @@ -1328,6 +1328,8 @@ static int isofs_read_inode(struct inode *inode, int relocated)
    652
    653 de = (struct iso_directory_record *) (bh->b_data + offset);
    654 de_len = *(unsigned char *) de;
    655 + if (de_len < sizeof(struct iso_directory_record))
    656 + goto fail;
    657
    658 if (offset + de_len > bufsize) {
    659 int frag1 = bufsize - offset;
    660 diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
    661 index 5569ef6bc1839..23e26a203a9e9 100644
    662 --- a/kernel/printk/printk.c
    663 +++ b/kernel/printk/printk.c
    664 @@ -2193,8 +2193,15 @@ static int __init console_setup(char *str)
    665 char *s, *options, *brl_options = NULL;
    666 int idx;
    667
    668 - if (str[0] == 0)
    669 + /*
    670 + * console="" or console=null have been suggested as a way to
    671 + * disable console output. Use ttynull that has been created
    672 + * for exacly this purpose.
    673 + */
    674 + if (str[0] == 0 || strcmp(str, "null") == 0) {
    675 + __add_preferred_console("ttynull", 0, NULL, NULL);
    676 return 1;
    677 + }
    678
    679 if (_braille_console_setup(&str, &brl_options))
    680 return 1;