Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-lts/patches-3.4/0128-3.4.29-all-fixes.patch

    Contents of /trunk/kernel-lts/patches-3.4/0128-3.4.29-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2065 - (show annotations) (download)
    Wed Feb 6 10:50:19 2013 UTC (11 years, 2 months ago) by niro
    File size: 32240 byte(s) 
    -linux-3.4.29
    1 diff --git a/Makefile b/Makefile
    2 index 8ccebba..23bcb1a 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 3
    7 PATCHLEVEL = 4
    8 -SUBLEVEL = 28
    9 +SUBLEVEL = 29
    10 EXTRAVERSION =
    11 NAME = Saber-toothed Squirrel
    12
    13 diff --git a/arch/arm/mach-at91/setup.c b/arch/arm/mach-at91/setup.c
    14 index 582142e..55293a7 100644
    15 --- a/arch/arm/mach-at91/setup.c
    16 +++ b/arch/arm/mach-at91/setup.c
    17 @@ -104,6 +104,8 @@ static void __init soc_detect(u32 dbgu_base)
    18 switch (socid) {
    19 case ARCH_ID_AT91RM9200:
    20 at91_soc_initdata.type = AT91_SOC_RM9200;
    21 + if (at91_soc_initdata.subtype == AT91_SOC_SUBTYPE_NONE)
    22 + at91_soc_initdata.subtype = AT91_SOC_RM9200_BGA;
    23 at91_boot_soc = at91rm9200_soc;
    24 break;
    25
    26 diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
    27 index db23ae4..a3e4adf 100644
    28 --- a/arch/arm/mm/dma-mapping.c
    29 +++ b/arch/arm/mm/dma-mapping.c
    30 @@ -503,25 +503,27 @@ static void dma_cache_maint_page(struct page *page, unsigned long offset,
    31 size_t size, enum dma_data_direction dir,
    32 void (*op)(const void *, size_t, int))
    33 {
    34 + unsigned long pfn;
    35 + size_t left = size;
    36 +
    37 + pfn = page_to_pfn(page) + offset / PAGE_SIZE;
    38 + offset %= PAGE_SIZE;
    39 +
    40 /*
    41 * A single sg entry may refer to multiple physically contiguous
    42 * pages. But we still need to process highmem pages individually.
    43 * If highmem is not configured then the bulk of this loop gets
    44 * optimized out.
    45 */
    46 - size_t left = size;
    47 do {
    48 size_t len = left;
    49 void *vaddr;
    50
    51 + page = pfn_to_page(pfn);
    52 +
    53 if (PageHighMem(page)) {
    54 - if (len + offset > PAGE_SIZE) {
    55 - if (offset >= PAGE_SIZE) {
    56 - page += offset / PAGE_SIZE;
    57 - offset %= PAGE_SIZE;
    58 - }
    59 + if (len + offset > PAGE_SIZE)
    60 len = PAGE_SIZE - offset;
    61 - }
    62 vaddr = kmap_high_get(page);
    63 if (vaddr) {
    64 vaddr += offset;
    65 @@ -538,7 +540,7 @@ static void dma_cache_maint_page(struct page *page, unsigned long offset,
    66 op(vaddr, len, dir);
    67 }
    68 offset = 0;
    69 - page++;
    70 + pfn++;
    71 left -= len;
    72 } while (left);
    73 }
    74 diff --git a/arch/arm/vfp/entry.S b/arch/arm/vfp/entry.S
    75 index cc926c9..323ce1a 100644
    76 --- a/arch/arm/vfp/entry.S
    77 +++ b/arch/arm/vfp/entry.S
    78 @@ -22,7 +22,7 @@
    79 @ IRQs disabled.
    80 @
    81 ENTRY(do_vfp)
    82 -#ifdef CONFIG_PREEMPT
    83 +#ifdef CONFIG_PREEMPT_COUNT
    84 ldr r4, [r10, #TI_PREEMPT] @ get preempt count
    85 add r11, r4, #1 @ increment it
    86 str r11, [r10, #TI_PREEMPT]
    87 @@ -35,7 +35,7 @@ ENTRY(do_vfp)
    88 ENDPROC(do_vfp)
    89
    90 ENTRY(vfp_null_entry)
    91 -#ifdef CONFIG_PREEMPT
    92 +#ifdef CONFIG_PREEMPT_COUNT
    93 get_thread_info r10
    94 ldr r4, [r10, #TI_PREEMPT] @ get preempt count
    95 sub r11, r4, #1 @ decrement it
    96 @@ -53,7 +53,7 @@ ENDPROC(vfp_null_entry)
    97
    98 __INIT
    99 ENTRY(vfp_testing_entry)
    100 -#ifdef CONFIG_PREEMPT
    101 +#ifdef CONFIG_PREEMPT_COUNT
    102 get_thread_info r10
    103 ldr r4, [r10, #TI_PREEMPT] @ get preempt count
    104 sub r11, r4, #1 @ decrement it
    105 diff --git a/arch/arm/vfp/vfphw.S b/arch/arm/vfp/vfphw.S
    106 index 3a0efaa..6ff903e 100644
    107 --- a/arch/arm/vfp/vfphw.S
    108 +++ b/arch/arm/vfp/vfphw.S
    109 @@ -167,7 +167,7 @@ vfp_hw_state_valid:
    110 @ else it's one 32-bit instruction, so
    111 @ always subtract 4 from the following
    112 @ instruction address.
    113 -#ifdef CONFIG_PREEMPT
    114 +#ifdef CONFIG_PREEMPT_COUNT
    115 get_thread_info r10
    116 ldr r4, [r10, #TI_PREEMPT] @ get preempt count
    117 sub r11, r4, #1 @ decrement it
    118 @@ -191,7 +191,7 @@ look_for_VFP_exceptions:
    119 @ not recognised by VFP
    120
    121 DBGSTR "not VFP"
    122 -#ifdef CONFIG_PREEMPT
    123 +#ifdef CONFIG_PREEMPT_COUNT
    124 get_thread_info r10
    125 ldr r4, [r10, #TI_PREEMPT] @ get preempt count
    126 sub r11, r4, #1 @ decrement it
    127 diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c
    128 index eb11369..8563b64 100644
    129 --- a/arch/x86/kernel/msr.c
    130 +++ b/arch/x86/kernel/msr.c
    131 @@ -174,6 +174,9 @@ static int msr_open(struct inode *inode, struct file *file)
    132 unsigned int cpu;
    133 struct cpuinfo_x86 *c;
    134
    135 + if (!capable(CAP_SYS_RAWIO))
    136 + return -EPERM;
    137 +
    138 cpu = iminor(file->f_path.dentry->d_inode);
    139 if (cpu >= nr_cpu_ids || !cpu_online(cpu))
    140 return -ENXIO; /* No such CPU */
    141 diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
    142 index d289ee7..b71e4a5 100644
    143 --- a/arch/x86/kernel/setup.c
    144 +++ b/arch/x86/kernel/setup.c
    145 @@ -622,6 +622,7 @@ static unsigned reserve_low = CONFIG_X86_RESERVE_LOW << 10;
    146
    147 static bool __init snb_gfx_workaround_needed(void)
    148 {
    149 +#ifdef CONFIG_PCI
    150 int i;
    151 u16 vendor, devid;
    152 static const u16 snb_ids[] = {
    153 @@ -646,6 +647,7 @@ static bool __init snb_gfx_workaround_needed(void)
    154 for (i = 0; i < ARRAY_SIZE(snb_ids); i++)
    155 if (devid == snb_ids[i])
    156 return true;
    157 +#endif
    158
    159 return false;
    160 }
    161 diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
    162 index 72d8899..6825327 100644
    163 --- a/arch/x86/platform/efi/efi.c
    164 +++ b/arch/x86/platform/efi/efi.c
    165 @@ -900,7 +900,7 @@ void __init efi_enter_virtual_mode(void)
    166 *
    167 * Call EFI services through wrapper functions.
    168 */
    169 - efi.runtime_version = efi_systab.fw_revision;
    170 + efi.runtime_version = efi_systab.hdr.revision;
    171 efi.get_time = virt_efi_get_time;
    172 efi.set_time = virt_efi_set_time;
    173 efi.get_wakeup_time = virt_efi_get_wakeup_time;
    174 diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
    175 index ac3aa54..0fba86d 100644
    176 --- a/arch/x86/platform/efi/efi_64.c
    177 +++ b/arch/x86/platform/efi/efi_64.c
    178 @@ -38,7 +38,7 @@
    179 #include <asm/cacheflush.h>
    180 #include <asm/fixmap.h>
    181
    182 -static pgd_t save_pgd __initdata;
    183 +static pgd_t *save_pgd __initdata;
    184 static unsigned long efi_flags __initdata;
    185
    186 static void __init early_code_mapping_set_exec(int executable)
    187 @@ -61,12 +61,20 @@ static void __init early_code_mapping_set_exec(int executable)
    188 void __init efi_call_phys_prelog(void)
    189 {
    190 unsigned long vaddress;
    191 + int pgd;
    192 + int n_pgds;
    193
    194 early_code_mapping_set_exec(1);
    195 local_irq_save(efi_flags);
    196 - vaddress = (unsigned long)__va(0x0UL);
    197 - save_pgd = *pgd_offset_k(0x0UL);
    198 - set_pgd(pgd_offset_k(0x0UL), *pgd_offset_k(vaddress));
    199 +
    200 + n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE);
    201 + save_pgd = kmalloc(n_pgds * sizeof(pgd_t), GFP_KERNEL);
    202 +
    203 + for (pgd = 0; pgd < n_pgds; pgd++) {
    204 + save_pgd[pgd] = *pgd_offset_k(pgd * PGDIR_SIZE);
    205 + vaddress = (unsigned long)__va(pgd * PGDIR_SIZE);
    206 + set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), *pgd_offset_k(vaddress));
    207 + }
    208 __flush_tlb_all();
    209 }
    210
    211 @@ -75,7 +83,11 @@ void __init efi_call_phys_epilog(void)
    212 /*
    213 * After the lock is released, the original page table is restored.
    214 */
    215 - set_pgd(pgd_offset_k(0x0UL), save_pgd);
    216 + int pgd;
    217 + int n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT) , PGDIR_SIZE);
    218 + for (pgd = 0; pgd < n_pgds; pgd++)
    219 + set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), save_pgd[pgd]);
    220 + kfree(save_pgd);
    221 __flush_tlb_all();
    222 local_irq_restore(efi_flags);
    223 early_code_mapping_set_exec(0);
    224 diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
    225 index 97f5064..686ac03 100644
    226 --- a/drivers/edac/edac_pci_sysfs.c
    227 +++ b/drivers/edac/edac_pci_sysfs.c
    228 @@ -257,7 +257,7 @@ static ssize_t edac_pci_dev_store(struct kobject *kobj,
    229 struct edac_pci_dev_attribute *edac_pci_dev;
    230 edac_pci_dev = (struct edac_pci_dev_attribute *)attr;
    231
    232 - if (edac_pci_dev->show)
    233 + if (edac_pci_dev->store)
    234 return edac_pci_dev->store(edac_pci_dev->value, buffer, count);
    235 return -EIO;
    236 }
    237 diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
    238 index 711e95a..8fb6f41 100644
    239 --- a/drivers/gpu/drm/radeon/radeon_cursor.c
    240 +++ b/drivers/gpu/drm/radeon/radeon_cursor.c
    241 @@ -238,7 +238,8 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
    242 y = 0;
    243 }
    244
    245 - if (ASIC_IS_AVIVO(rdev)) {
    246 + /* fixed on DCE6 and newer */
    247 + if (ASIC_IS_AVIVO(rdev) && !ASIC_IS_DCE6(rdev)) {
    248 int i = 0;
    249 struct drm_crtc *crtc_p;
    250
    251 diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
    252 index 173b97b..1f50727 100644
    253 --- a/drivers/gpu/drm/radeon/radeon_display.c
    254 +++ b/drivers/gpu/drm/radeon/radeon_display.c
    255 @@ -1136,7 +1136,7 @@ radeon_user_framebuffer_create(struct drm_device *dev,
    256 if (ret) {
    257 kfree(radeon_fb);
    258 drm_gem_object_unreference_unlocked(obj);
    259 - return NULL;
    260 + return ERR_PTR(ret);
    261 }
    262
    263 return &radeon_fb->base;
    264 diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
    265 index c04ddca..ef0ae93 100644
    266 --- a/drivers/iommu/amd_iommu_init.c
    267 +++ b/drivers/iommu/amd_iommu_init.c
    268 @@ -1002,6 +1002,38 @@ static void __init free_iommu_all(void)
    269 }
    270
    271 /*
    272 + * Family15h Model 10h-1fh erratum 746 (IOMMU Logging May Stall Translations)
    273 + * Workaround:
    274 + * BIOS should disable L2B micellaneous clock gating by setting
    275 + * L2_L2B_CK_GATE_CONTROL[CKGateL2BMiscDisable](D0F2xF4_x90[2]) = 1b
    276 + */
    277 +static void __init amd_iommu_erratum_746_workaround(struct amd_iommu *iommu)
    278 +{
    279 + u32 value;
    280 +
    281 + if ((boot_cpu_data.x86 != 0x15) ||
    282 + (boot_cpu_data.x86_model < 0x10) ||
    283 + (boot_cpu_data.x86_model > 0x1f))
    284 + return;
    285 +
    286 + pci_write_config_dword(iommu->dev, 0xf0, 0x90);
    287 + pci_read_config_dword(iommu->dev, 0xf4, &value);
    288 +
    289 + if (value & BIT(2))
    290 + return;
    291 +
    292 + /* Select NB indirect register 0x90 and enable writing */
    293 + pci_write_config_dword(iommu->dev, 0xf0, 0x90 | (1 << 8));
    294 +
    295 + pci_write_config_dword(iommu->dev, 0xf4, value | 0x4);
    296 + pr_info("AMD-Vi: Applying erratum 746 workaround for IOMMU at %s\n",
    297 + dev_name(&iommu->dev->dev));
    298 +
    299 + /* Clear the enable writing bit */
    300 + pci_write_config_dword(iommu->dev, 0xf0, 0x90);
    301 +}
    302 +
    303 +/*
    304 * This function clues the initialization function for one IOMMU
    305 * together and also allocates the command buffer and programs the
    306 * hardware. It does NOT enable the IOMMU. This is done afterwards.
    307 @@ -1062,6 +1094,8 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h)
    308 if (iommu->cap & (1UL << IOMMU_CAP_NPCACHE))
    309 amd_iommu_np_cache = true;
    310
    311 + amd_iommu_erratum_746_workaround(iommu);
    312 +
    313 return pci_enable_device(iommu->dev);
    314 }
    315
    316 diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
    317 index be66606..5d71873 100644
    318 --- a/drivers/iommu/intel-iommu.c
    319 +++ b/drivers/iommu/intel-iommu.c
    320 @@ -4193,6 +4193,21 @@ static struct iommu_ops intel_iommu_ops = {
    321 .pgsize_bitmap = INTEL_IOMMU_PGSIZES,
    322 };
    323
    324 +static void __devinit quirk_iommu_g4x_gfx(struct pci_dev *dev)
    325 +{
    326 + /* G4x/GM45 integrated gfx dmar support is totally busted. */
    327 + printk(KERN_INFO "DMAR: Disabling IOMMU for graphics on this chipset\n");
    328 + dmar_map_gfx = 0;
    329 +}
    330 +
    331 +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_g4x_gfx);
    332 +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e00, quirk_iommu_g4x_gfx);
    333 +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e10, quirk_iommu_g4x_gfx);
    334 +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e20, quirk_iommu_g4x_gfx);
    335 +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e30, quirk_iommu_g4x_gfx);
    336 +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e40, quirk_iommu_g4x_gfx);
    337 +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e90, quirk_iommu_g4x_gfx);
    338 +
    339 static void __devinit quirk_iommu_rwbf(struct pci_dev *dev)
    340 {
    341 /*
    342 @@ -4201,12 +4216,6 @@ static void __devinit quirk_iommu_rwbf(struct pci_dev *dev)
    343 */
    344 printk(KERN_INFO "DMAR: Forcing write-buffer flush capability\n");
    345 rwbf_quirk = 1;
    346 -
    347 - /* https://bugzilla.redhat.com/show_bug.cgi?id=538163 */
    348 - if (dev->revision == 0x07) {
    349 - printk(KERN_INFO "DMAR: Disabling IOMMU for graphics on this chipset\n");
    350 - dmar_map_gfx = 0;
    351 - }
    352 }
    353
    354 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf);
    355 diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
    356 index 86cd532..21a3d77 100644
    357 --- a/drivers/net/can/c_can/c_can.c
    358 +++ b/drivers/net/can/c_can/c_can.c
    359 @@ -914,7 +914,7 @@ static int c_can_handle_bus_err(struct net_device *dev,
    360 break;
    361 case LEC_ACK_ERROR:
    362 netdev_dbg(dev, "ack error\n");
    363 - cf->data[2] |= (CAN_ERR_PROT_LOC_ACK |
    364 + cf->data[3] |= (CAN_ERR_PROT_LOC_ACK |
    365 CAN_ERR_PROT_LOC_ACK_DEL);
    366 break;
    367 case LEC_BIT1_ERROR:
    368 @@ -927,7 +927,7 @@ static int c_can_handle_bus_err(struct net_device *dev,
    369 break;
    370 case LEC_CRC_ERROR:
    371 netdev_dbg(dev, "CRC error\n");
    372 - cf->data[2] |= (CAN_ERR_PROT_LOC_CRC_SEQ |
    373 + cf->data[3] |= (CAN_ERR_PROT_LOC_CRC_SEQ |
    374 CAN_ERR_PROT_LOC_CRC_DEL);
    375 break;
    376 default:
    377 diff --git a/drivers/net/can/pch_can.c b/drivers/net/can/pch_can.c
    378 index 2bb215e..ab13a57 100644
    379 --- a/drivers/net/can/pch_can.c
    380 +++ b/drivers/net/can/pch_can.c
    381 @@ -560,7 +560,7 @@ static void pch_can_error(struct net_device *ndev, u32 status)
    382 stats->rx_errors++;
    383 break;
    384 case PCH_CRC_ERR:
    385 - cf->data[2] |= CAN_ERR_PROT_LOC_CRC_SEQ |
    386 + cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ |
    387 CAN_ERR_PROT_LOC_CRC_DEL;
    388 priv->can.can_stats.bus_error++;
    389 stats->rx_errors++;
    390 diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
    391 index 5ec2700..19000aa 100644
    392 --- a/drivers/net/can/ti_hecc.c
    393 +++ b/drivers/net/can/ti_hecc.c
    394 @@ -746,12 +746,12 @@ static int ti_hecc_error(struct net_device *ndev, int int_status,
    395 }
    396 if (err_status & HECC_CANES_CRCE) {
    397 hecc_set_bit(priv, HECC_CANES, HECC_CANES_CRCE);
    398 - cf->data[2] |= CAN_ERR_PROT_LOC_CRC_SEQ |
    399 + cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ |
    400 CAN_ERR_PROT_LOC_CRC_DEL;
    401 }
    402 if (err_status & HECC_CANES_ACKE) {
    403 hecc_set_bit(priv, HECC_CANES, HECC_CANES_ACKE);
    404 - cf->data[2] |= CAN_ERR_PROT_LOC_ACK |
    405 + cf->data[3] |= CAN_ERR_PROT_LOC_ACK |
    406 CAN_ERR_PROT_LOC_ACK_DEL;
    407 }
    408 }
    409 diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
    410 index 5eb53c9..2e4243f 100644
    411 --- a/drivers/net/wireless/ath/ath9k/beacon.c
    412 +++ b/drivers/net/wireless/ath/ath9k/beacon.c
    413 @@ -154,6 +154,7 @@ static struct ath_buf *ath_beacon_generate(struct ieee80211_hw *hw,
    414 skb->len, DMA_TO_DEVICE);
    415 dev_kfree_skb_any(skb);
    416 bf->bf_buf_addr = 0;
    417 + bf->bf_mpdu = NULL;
    418 }
    419
    420 /* Get a new beacon from mac80211 */
    421 diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
    422 index c25226a..ec86d98 100644
    423 --- a/drivers/net/wireless/ath/ath9k/htc_hst.c
    424 +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
    425 @@ -342,6 +342,8 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle,
    426 endpoint->ep_callbacks.tx(endpoint->ep_callbacks.priv,
    427 skb, htc_hdr->endpoint_id,
    428 txok);
    429 + } else {
    430 + kfree_skb(skb);
    431 }
    432 }
    433
    434 diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
    435 index 90b8527..039bac7 100644
    436 --- a/drivers/net/wireless/ath/ath9k/recv.c
    437 +++ b/drivers/net/wireless/ath/ath9k/recv.c
    438 @@ -778,6 +778,7 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
    439 return NULL;
    440 }
    441
    442 + list_del(&bf->list);
    443 if (!bf->bf_mpdu)
    444 return bf;
    445
    446 @@ -1966,14 +1967,15 @@ requeue_drop_frag:
    447 sc->rx.frag = NULL;
    448 }
    449 requeue:
    450 + list_add_tail(&bf->list, &sc->rx.rxbuf);
    451 + if (flush)
    452 + continue;
    453 +
    454 if (edma) {
    455 - list_add_tail(&bf->list, &sc->rx.rxbuf);
    456 ath_rx_edma_buf_link(sc, qtype);
    457 } else {
    458 - list_move_tail(&bf->list, &sc->rx.rxbuf);
    459 ath_rx_buf_link(sc, bf);
    460 - if (!flush)
    461 - ath9k_hw_rxena(ah);
    462 + ath9k_hw_rxena(ah);
    463 }
    464 } while (1);
    465
    466 diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
    467 index 569ab8a..27f37c7 100644
    468 --- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
    469 +++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
    470 @@ -1400,9 +1400,10 @@ void brcms_add_timer(struct brcms_timer *t, uint ms, int periodic)
    471 #endif
    472 t->ms = ms;
    473 t->periodic = (bool) periodic;
    474 - t->set = true;
    475 -
    476 - atomic_inc(&t->wl->callbacks);
    477 + if (!t->set) {
    478 + t->set = true;
    479 + atomic_inc(&t->wl->callbacks);
    480 + }
    481
    482 ieee80211_queue_delayed_work(hw, &t->dly_wrk, msecs_to_jiffies(ms));
    483 }
    484 diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
    485 index 4bc2711..2ab6b96 100644
    486 --- a/drivers/net/wireless/iwlegacy/common.c
    487 +++ b/drivers/net/wireless/iwlegacy/common.c
    488 @@ -3957,17 +3957,21 @@ il_connection_init_rx_config(struct il_priv *il)
    489
    490 memset(&il->staging, 0, sizeof(il->staging));
    491
    492 - if (!il->vif) {
    493 + switch (il->iw_mode) {
    494 + case NL80211_IFTYPE_UNSPECIFIED:
    495 il->staging.dev_type = RXON_DEV_TYPE_ESS;
    496 - } else if (il->vif->type == NL80211_IFTYPE_STATION) {
    497 + break;
    498 + case NL80211_IFTYPE_STATION:
    499 il->staging.dev_type = RXON_DEV_TYPE_ESS;
    500 il->staging.filter_flags = RXON_FILTER_ACCEPT_GRP_MSK;
    501 - } else if (il->vif->type == NL80211_IFTYPE_ADHOC) {
    502 + break;
    503 + case NL80211_IFTYPE_ADHOC:
    504 il->staging.dev_type = RXON_DEV_TYPE_IBSS;
    505 il->staging.flags = RXON_FLG_SHORT_PREAMBLE_MSK;
    506 il->staging.filter_flags =
    507 RXON_FILTER_BCON_AWARE_MSK | RXON_FILTER_ACCEPT_GRP_MSK;
    508 - } else {
    509 + break;
    510 + default:
    511 IL_ERR("Unsupported interface type %d\n", il->vif->type);
    512 return;
    513 }
    514 @@ -4550,8 +4554,7 @@ out:
    515 EXPORT_SYMBOL(il_mac_add_interface);
    516
    517 static void
    518 -il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif,
    519 - bool mode_change)
    520 +il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif)
    521 {
    522 lockdep_assert_held(&il->mutex);
    523
    524 @@ -4560,9 +4563,7 @@ il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif,
    525 il_force_scan_end(il);
    526 }
    527
    528 - if (!mode_change)
    529 - il_set_mode(il);
    530 -
    531 + il_set_mode(il);
    532 }
    533
    534 void
    535 @@ -4575,8 +4576,8 @@ il_mac_remove_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
    536
    537 WARN_ON(il->vif != vif);
    538 il->vif = NULL;
    539 -
    540 - il_teardown_interface(il, vif, false);
    541 + il->iw_mode = NL80211_IFTYPE_UNSPECIFIED;
    542 + il_teardown_interface(il, vif);
    543 memset(il->bssid, 0, ETH_ALEN);
    544
    545 D_MAC80211("leave\n");
    546 @@ -4685,18 +4686,10 @@ il_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
    547 }
    548
    549 /* success */
    550 - il_teardown_interface(il, vif, true);
    551 vif->type = newtype;
    552 vif->p2p = false;
    553 - err = il_set_mode(il);
    554 - WARN_ON(err);
    555 - /*
    556 - * We've switched internally, but submitting to the
    557 - * device may have failed for some reason. Mask this
    558 - * error, because otherwise mac80211 will not switch
    559 - * (and set the interface type back) and we'll be
    560 - * out of sync with it.
    561 - */
    562 + il->iw_mode = newtype;
    563 + il_teardown_interface(il, vif);
    564 err = 0;
    565
    566 out:
    567 diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
    568 index 5867fac..6ca3d8a 100644
    569 --- a/drivers/net/wireless/mwifiex/pcie.c
    570 +++ b/drivers/net/wireless/mwifiex/pcie.c
    571 @@ -158,7 +158,7 @@ static int mwifiex_pcie_suspend(struct pci_dev *pdev, pm_message_t state)
    572
    573 if (pdev) {
    574 card = (struct pcie_service_card *) pci_get_drvdata(pdev);
    575 - if (!card || card->adapter) {
    576 + if (!card || !card->adapter) {
    577 pr_err("Card or adapter structure is not valid\n");
    578 return 0;
    579 }
    580 diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c
    581 index b009b89..817ba7c 100644
    582 --- a/drivers/target/target_core_fabric_configfs.c
    583 +++ b/drivers/target/target_core_fabric_configfs.c
    584 @@ -752,12 +752,6 @@ static int target_fabric_port_link(
    585 struct target_fabric_configfs *tf;
    586 int ret;
    587
    588 - if (dev->dev_link_magic != SE_DEV_LINK_MAGIC) {
    589 - pr_err("Bad dev->dev_link_magic, not a valid se_dev_ci pointer:"
    590 - " %p to struct se_device: %p\n", se_dev_ci, dev);
    591 - return -EFAULT;
    592 - }
    593 -
    594 tpg_ci = &lun_ci->ci_parent->ci_group->cg_item;
    595 se_tpg = container_of(to_config_group(tpg_ci),
    596 struct se_portal_group, tpg_group);
    597 @@ -775,6 +769,11 @@ static int target_fabric_port_link(
    598 ret = -ENODEV;
    599 goto out;
    600 }
    601 + if (dev->dev_link_magic != SE_DEV_LINK_MAGIC) {
    602 + pr_err("Bad dev->dev_link_magic, not a valid se_dev_ci pointer:"
    603 + " %p to struct se_device: %p\n", se_dev_ci, dev);
    604 + return -EFAULT;
    605 + }
    606
    607 lun_p = core_dev_add_lun(se_tpg, dev->se_hba, dev,
    608 lun->unpacked_lun);
    609 diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
    610 index 6873bb6..2263144 100644
    611 --- a/fs/cifs/cifs_dfs_ref.c
    612 +++ b/fs/cifs/cifs_dfs_ref.c
    613 @@ -226,6 +226,8 @@ compose_mount_options_out:
    614 compose_mount_options_err:
    615 kfree(mountdata);
    616 mountdata = ERR_PTR(rc);
    617 + kfree(*devname);
    618 + *devname = NULL;
    619 goto compose_mount_options_out;
    620 }
    621
    622 diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
    623 index 2257d1f..4327516 100644
    624 --- a/fs/nfs/namespace.c
    625 +++ b/fs/nfs/namespace.c
    626 @@ -253,11 +253,31 @@ out_nofree:
    627 return mnt;
    628 }
    629
    630 +static int
    631 +nfs_namespace_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
    632 +{
    633 + if (NFS_FH(dentry->d_inode)->size != 0)
    634 + return nfs_getattr(mnt, dentry, stat);
    635 + generic_fillattr(dentry->d_inode, stat);
    636 + return 0;
    637 +}
    638 +
    639 +static int
    640 +nfs_namespace_setattr(struct dentry *dentry, struct iattr *attr)
    641 +{
    642 + if (NFS_FH(dentry->d_inode)->size != 0)
    643 + return nfs_setattr(dentry, attr);
    644 + return -EACCES;
    645 +}
    646 +
    647 const struct inode_operations nfs_mountpoint_inode_operations = {
    648 .getattr = nfs_getattr,
    649 + .setattr = nfs_setattr,
    650 };
    651
    652 const struct inode_operations nfs_referral_inode_operations = {
    653 + .getattr = nfs_namespace_getattr,
    654 + .setattr = nfs_namespace_setattr,
    655 };
    656
    657 static void nfs_expire_automounts(struct work_struct *work)
    658 diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
    659 index 0dbb9e7..7a978c7 100644
    660 --- a/fs/xfs/xfs_aops.c
    661 +++ b/fs/xfs/xfs_aops.c
    662 @@ -89,11 +89,11 @@ xfs_destroy_ioend(
    663 }
    664
    665 if (ioend->io_iocb) {
    666 + inode_dio_done(ioend->io_inode);
    667 if (ioend->io_isasync) {
    668 aio_complete(ioend->io_iocb, ioend->io_error ?
    669 ioend->io_error : ioend->io_result, 0);
    670 }
    671 - inode_dio_done(ioend->io_inode);
    672 }
    673
    674 mempool_free(ioend, xfs_ioend_pool);
    675 diff --git a/kernel/smp.c b/kernel/smp.c
    676 index 2f8b10e..d5f3238 100644
    677 --- a/kernel/smp.c
    678 +++ b/kernel/smp.c
    679 @@ -31,6 +31,7 @@ struct call_function_data {
    680 struct call_single_data csd;
    681 atomic_t refs;
    682 cpumask_var_t cpumask;
    683 + cpumask_var_t cpumask_ipi;
    684 };
    685
    686 static DEFINE_PER_CPU_SHARED_ALIGNED(struct call_function_data, cfd_data);
    687 @@ -54,6 +55,9 @@ hotplug_cfd(struct notifier_block *nfb, unsigned long action, void *hcpu)
    688 if (!zalloc_cpumask_var_node(&cfd->cpumask, GFP_KERNEL,
    689 cpu_to_node(cpu)))
    690 return notifier_from_errno(-ENOMEM);
    691 + if (!zalloc_cpumask_var_node(&cfd->cpumask_ipi, GFP_KERNEL,
    692 + cpu_to_node(cpu)))
    693 + return notifier_from_errno(-ENOMEM);
    694 break;
    695
    696 #ifdef CONFIG_HOTPLUG_CPU
    697 @@ -63,6 +67,7 @@ hotplug_cfd(struct notifier_block *nfb, unsigned long action, void *hcpu)
    698 case CPU_DEAD:
    699 case CPU_DEAD_FROZEN:
    700 free_cpumask_var(cfd->cpumask);
    701 + free_cpumask_var(cfd->cpumask_ipi);
    702 break;
    703 #endif
    704 };
    705 @@ -524,6 +529,12 @@ void smp_call_function_many(const struct cpumask *mask,
    706 return;
    707 }
    708
    709 + /*
    710 + * After we put an entry into the list, data->cpumask
    711 + * may be cleared again when another CPU sends another IPI for
    712 + * a SMP function call, so data->cpumask will be zero.
    713 + */
    714 + cpumask_copy(data->cpumask_ipi, data->cpumask);
    715 raw_spin_lock_irqsave(&call_function.lock, flags);
    716 /*
    717 * Place entry at the _HEAD_ of the list, so that any cpu still
    718 @@ -547,7 +558,7 @@ void smp_call_function_many(const struct cpumask *mask,
    719 smp_mb();
    720
    721 /* Send a message to all CPUs in the map */
    722 - arch_send_call_function_ipi_mask(data->cpumask);
    723 + arch_send_call_function_ipi_mask(data->cpumask_ipi);
    724
    725 /* Optionally wait for the CPUs to complete */
    726 if (wait)
    727 diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
    728 index 25edda0..ef45e10 100644
    729 --- a/net/bluetooth/hci_event.c
    730 +++ b/net/bluetooth/hci_event.c
    731 @@ -2366,7 +2366,7 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk
    732 if (ev->opcode != HCI_OP_NOP)
    733 del_timer(&hdev->cmd_timer);
    734
    735 - if (ev->ncmd) {
    736 + if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
    737 atomic_set(&hdev->cmd_cnt, 1);
    738 if (!skb_queue_empty(&hdev->cmd_q))
    739 queue_work(hdev->workqueue, &hdev->cmd_work);
    740 diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
    741 index d478be1..7a0d984 100644
    742 --- a/net/bluetooth/hidp/core.c
    743 +++ b/net/bluetooth/hidp/core.c
    744 @@ -949,7 +949,7 @@ static int hidp_setup_hid(struct hidp_session *session,
    745 hid->version = req->version;
    746 hid->country = req->country;
    747
    748 - strncpy(hid->name, req->name, 128);
    749 + strncpy(hid->name, req->name, sizeof(req->name) - 1);
    750 strncpy(hid->phys, batostr(&bt_sk(session->ctrl_sock->sk)->src), 64);
    751 strncpy(hid->uniq, batostr(&bt_sk(session->ctrl_sock->sk)->dst), 64);
    752
    753 diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
    754 index 677d659..9443348 100644
    755 --- a/net/mac80211/cfg.c
    756 +++ b/net/mac80211/cfg.c
    757 @@ -151,7 +151,17 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
    758 sta = sta_info_get(sdata, mac_addr);
    759 else
    760 sta = sta_info_get_bss(sdata, mac_addr);
    761 - if (!sta) {
    762 + /*
    763 + * The ASSOC test makes sure the driver is ready to
    764 + * receive the key. When wpa_supplicant has roamed
    765 + * using FT, it attempts to set the key before
    766 + * association has completed, this rejects that attempt
    767 + * so it will set the key again after assocation.
    768 + *
    769 + * TODO: accept the key if we have a station entry and
    770 + * add it to the device after the station.
    771 + */
    772 + if (!sta || !test_sta_flag(sta, WLAN_STA_ASSOC)) {
    773 ieee80211_key_free(sdata->local, key);
    774 err = -ENOENT;
    775 goto out_unlock;
    776 diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
    777 index f8b5e75..05160db 100644
    778 --- a/net/mac80211/ieee80211_i.h
    779 +++ b/net/mac80211/ieee80211_i.h
    780 @@ -1264,10 +1264,8 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata);
    781 void ieee80211_sched_scan_stopped_work(struct work_struct *work);
    782
    783 /* off-channel helpers */
    784 -void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
    785 - bool offchannel_ps_enable);
    786 -void ieee80211_offchannel_return(struct ieee80211_local *local,
    787 - bool offchannel_ps_disable);
    788 +void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local);
    789 +void ieee80211_offchannel_return(struct ieee80211_local *local);
    790 void ieee80211_hw_roc_setup(struct ieee80211_local *local);
    791
    792 /* interface handling */
    793 diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
    794 index 935aa4b..c22f074 100644
    795 --- a/net/mac80211/offchannel.c
    796 +++ b/net/mac80211/offchannel.c
    797 @@ -103,8 +103,7 @@ static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
    798 ieee80211_sta_reset_conn_monitor(sdata);
    799 }
    800
    801 -void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
    802 - bool offchannel_ps_enable)
    803 +void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
    804 {
    805 struct ieee80211_sub_if_data *sdata;
    806
    807 @@ -129,8 +128,7 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
    808
    809 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
    810 netif_tx_stop_all_queues(sdata->dev);
    811 - if (offchannel_ps_enable &&
    812 - (sdata->vif.type == NL80211_IFTYPE_STATION) &&
    813 + if (sdata->vif.type == NL80211_IFTYPE_STATION &&
    814 sdata->u.mgd.associated)
    815 ieee80211_offchannel_ps_enable(sdata, true);
    816 }
    817 @@ -138,8 +136,7 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
    818 mutex_unlock(&local->iflist_mtx);
    819 }
    820
    821 -void ieee80211_offchannel_return(struct ieee80211_local *local,
    822 - bool offchannel_ps_disable)
    823 +void ieee80211_offchannel_return(struct ieee80211_local *local)
    824 {
    825 struct ieee80211_sub_if_data *sdata;
    826
    827 @@ -152,11 +149,9 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
    828 continue;
    829
    830 /* Tell AP we're back */
    831 - if (offchannel_ps_disable &&
    832 - sdata->vif.type == NL80211_IFTYPE_STATION) {
    833 - if (sdata->u.mgd.associated)
    834 - ieee80211_offchannel_ps_disable(sdata);
    835 - }
    836 + if (sdata->vif.type == NL80211_IFTYPE_STATION &&
    837 + sdata->u.mgd.associated)
    838 + ieee80211_offchannel_ps_disable(sdata);
    839
    840 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
    841 /*
    842 diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
    843 index e95d494..bcc57f9 100644
    844 --- a/net/mac80211/scan.c
    845 +++ b/net/mac80211/scan.c
    846 @@ -329,7 +329,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
    847 if (!was_hw_scan) {
    848 ieee80211_configure_filter(local);
    849 drv_sw_scan_complete(local);
    850 - ieee80211_offchannel_return(local, true);
    851 + ieee80211_offchannel_return(local);
    852 }
    853
    854 ieee80211_recalc_idle(local);
    855 @@ -374,7 +374,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
    856 local->next_scan_state = SCAN_DECISION;
    857 local->scan_channel_idx = 0;
    858
    859 - ieee80211_offchannel_stop_vifs(local, true);
    860 + ieee80211_offchannel_stop_vifs(local);
    861
    862 ieee80211_configure_filter(local);
    863
    864 @@ -629,12 +629,8 @@ static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
    865 local->scan_channel = NULL;
    866 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
    867
    868 - /*
    869 - * Re-enable vifs and beaconing. Leave PS
    870 - * in off-channel state..will put that back
    871 - * on-channel at the end of scanning.
    872 - */
    873 - ieee80211_offchannel_return(local, false);
    874 + /* disable PS */
    875 + ieee80211_offchannel_return(local);
    876
    877 *next_delay = HZ / 5;
    878 /* afterwards, resume scan & go to next channel */
    879 @@ -644,8 +640,7 @@ static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
    880 static void ieee80211_scan_state_resume(struct ieee80211_local *local,
    881 unsigned long *next_delay)
    882 {
    883 - /* PS already is in off-channel mode */
    884 - ieee80211_offchannel_stop_vifs(local, false);
    885 + ieee80211_offchannel_stop_vifs(local);
    886
    887 if (local->ops->flush) {
    888 drv_flush(local, false);
    889 diff --git a/net/mac80211/work.c b/net/mac80211/work.c
    890 index c6e230e..a74f538 100644
    891 --- a/net/mac80211/work.c
    892 +++ b/net/mac80211/work.c
    893 @@ -148,7 +148,7 @@ static void ieee80211_work_work(struct work_struct *work)
    894 }
    895
    896 if (!started && !local->tmp_channel) {
    897 - ieee80211_offchannel_stop_vifs(local, true);
    898 + ieee80211_offchannel_stop_vifs(local);
    899
    900 local->tmp_channel = wk->chan;
    901 local->tmp_channel_type = wk->chan_type;
    902 @@ -220,7 +220,7 @@ static void ieee80211_work_work(struct work_struct *work)
    903 local->tmp_channel = NULL;
    904 ieee80211_hw_config(local, 0);
    905
    906 - ieee80211_offchannel_return(local, true);
    907 + ieee80211_offchannel_return(local);
    908
    909 /* give connection some time to breathe */
    910 run_again(local, jiffies + HZ/2);
    911 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    912 index 7f2a109..f7f8776 100644
    913 --- a/sound/pci/hda/patch_realtek.c
    914 +++ b/sound/pci/hda/patch_realtek.c
    915 @@ -4741,6 +4741,7 @@ static const struct snd_pci_quirk alc880_fixup_tbl[] = {
    916 SND_PCI_QUIRK(0x1584, 0x9077, "Uniwill P53", ALC880_FIXUP_VOL_KNOB),
    917 SND_PCI_QUIRK(0x161f, 0x203d, "W810", ALC880_FIXUP_W810),
    918 SND_PCI_QUIRK(0x161f, 0x205d, "Medion Rim 2150", ALC880_FIXUP_MEDION_RIM),
    919 + SND_PCI_QUIRK(0x1631, 0xe011, "PB 13201056", ALC880_FIXUP_6ST),
    920 SND_PCI_QUIRK(0x1734, 0x107c, "FSC F1734", ALC880_FIXUP_F1734),
    921 SND_PCI_QUIRK(0x1734, 0x1094, "FSC Amilo M1451G", ALC880_FIXUP_FUJITSU),
    922 SND_PCI_QUIRK(0x1734, 0x10ac, "FSC AMILO Xi 1526", ALC880_FIXUP_F1734),
    923 diff --git a/sound/soc/codecs/wm2200.c b/sound/soc/codecs/wm2200.c
    924 index 86b84a1..8e0cf14 100644
    925 --- a/sound/soc/codecs/wm2200.c
    926 +++ b/sound/soc/codecs/wm2200.c
    927 @@ -897,8 +897,6 @@ static const char *wm2200_mixer_texts[] = {
    928 "EQR",
    929 "LHPF1",
    930 "LHPF2",
    931 - "LHPF3",
    932 - "LHPF4",
    933 "DSP1.1",
    934 "DSP1.2",
    935 "DSP1.3",
    936 @@ -931,7 +929,6 @@ static int wm2200_mixer_values[] = {
    937 0x25,
    938 0x50, /* EQ */
    939 0x51,
    940 - 0x52,
    941 0x60, /* LHPF1 */
    942 0x61, /* LHPF2 */
    943 0x68, /* DSP1 */
    944 diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
    945 index 29ae209..15b0712 100644
    946 --- a/sound/usb/mixer.c
    947 +++ b/sound/usb/mixer.c
    948 @@ -1239,16 +1239,23 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void
    949 }
    950 channels = (hdr->bLength - 7) / csize - 1;
    951 bmaControls = hdr->bmaControls;
    952 + if (hdr->bLength < 7 + csize) {
    953 + snd_printk(KERN_ERR "usbaudio: unit %u: "
    954 + "invalid UAC_FEATURE_UNIT descriptor\n",
    955 + unitid);
    956 + return -EINVAL;
    957 + }
    958 } else {
    959 struct uac2_feature_unit_descriptor *ftr = _ftr;
    960 csize = 4;
    961 channels = (hdr->bLength - 6) / 4 - 1;
    962 bmaControls = ftr->bmaControls;
    963 - }
    964 -
    965 - if (hdr->bLength < 7 || !csize || hdr->bLength < 7 + csize) {
    966 - snd_printk(KERN_ERR "usbaudio: unit %u: invalid UAC_FEATURE_UNIT descriptor\n", unitid);
    967 - return -EINVAL;
    968 + if (hdr->bLength < 6 + csize) {
    969 + snd_printk(KERN_ERR "usbaudio: unit %u: "
    970 + "invalid UAC_FEATURE_UNIT descriptor\n",
    971 + unitid);
    972 + return -EINVAL;
    973 + }
    974 }
    975
    976 /* parse the source unit */