xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge 5.10.79 into android12-5.10-lts

Browse Source 
Changes in 5.10.79
	KVM: x86: avoid warning with -Wbitwise-instead-of-logical
	Revert "x86/kvm: fix vcpu-id indexed array sizes"
	usb: ehci: handshake CMD_RUN instead of STS_HALT
	usb: gadget: Mark USB_FSL_QE broken on 64-bit
	usb: musb: Balance list entry in musb_gadget_queue
	usb-storage: Add compatibility quirk flags for iODD 2531/2541
	binder: don't detect sender/target during buffer cleanup
	printk/console: Allow to disable console output by using console="" or console=null
	staging: rtl8712: fix use-after-free in rtl8712_dl_fw
	isofs: Fix out of bound access for corrupted isofs image
	comedi: dt9812: fix DMA buffers on stack
	comedi: ni_usb6501: fix NULL-deref in command paths
	comedi: vmk80xx: fix transfer-buffer overflows
	comedi: vmk80xx: fix bulk-buffer overflow
	comedi: vmk80xx: fix bulk and interrupt message timeouts
	staging: r8712u: fix control-message timeout
	staging: rtl8192u: fix control-message timeouts
	media: staging/intel-ipu3: css: Fix wrong size comparison imgu_css_fw_init
	rsi: fix control-message timeout
	Linux 5.10.79

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I418d4d95ae5550e1c98738c6a11f1933d0bdddb5
This commit is contained in:
Greg Kroah-Hartman
2021-11-12 15:12:12 +01:00
parent be686d451e bd816c2783
commit 525e61a871
22 changed files with 181 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0 # SPDX-License-Identifier: GPL-2.0
VERSION = 5 VERSION = 5
PATCHLEVEL = 10 PATCHLEVEL = 10
SUBLEVEL = 78 SUBLEVEL = 79
EXTRAVERSION = EXTRAVERSION =
NAME = Dare mighty things NAME = Dare mighty things

2
arch/x86/kvm/ioapic.c
View File

@@ -96,7 +96,7 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
static void rtc_irq_eoi_tracking_reset(struct kvm_ioapic *ioapic) static void rtc_irq_eoi_tracking_reset(struct kvm_ioapic *ioapic)
{ {
ioapic->rtc_status.pending_eoi = 0; ioapic->rtc_status.pending_eoi = 0;
bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID + 1); bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID);
} }
static void kvm_rtc_eoi_tracking_restore_all(struct kvm_ioapic *ioapic); static void kvm_rtc_eoi_tracking_restore_all(struct kvm_ioapic *ioapic);

4
arch/x86/kvm/ioapic.h
View File

@@ -43,13 +43,13 @@ struct kvm_vcpu;
struct dest_map { struct dest_map {
/* vcpu bitmap where IRQ has been sent */ /* vcpu bitmap where IRQ has been sent */
DECLARE_BITMAP(map, KVM_MAX_VCPU_ID + 1); DECLARE_BITMAP(map, KVM_MAX_VCPU_ID);
/* /*
* Vector sent to a given vcpu, only valid when * Vector sent to a given vcpu, only valid when
* the vcpu's bit in map is set * the vcpu's bit in map is set
*/ */
u8 vectors[KVM_MAX_VCPU_ID + 1]; u8 vectors[KVM_MAX_VCPU_ID];
}; };

2
arch/x86/kvm/mmu/mmu.c
View File

@@ -3545,7 +3545,7 @@ static bool get_mmio_spte(struct kvm_vcpu *vcpu, u64 addr, u64 *sptep)
* reserved bit and EPT's invalid memtype/XWR checks to avoid * reserved bit and EPT's invalid memtype/XWR checks to avoid
* adding a Jcc in the loop. * adding a Jcc in the loop.
*/ */
reserved |= __is_bad_mt_xwr(rsvd_check, sptes[level - 1]) | reserved |= __is_bad_mt_xwr(rsvd_check, sptes[level - 1]) ||
__is_rsvd_bits_set(rsvd_check, sptes[level - 1], __is_rsvd_bits_set(rsvd_check, sptes[level - 1],
level); level);
} }

14
drivers/android/binder.c
View File

@@ -1995,7 +1995,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
binder_dec_node(buffer->target_node, 1, 0); binder_dec_node(buffer->target_node, 1, 0);
off_start_offset = ALIGN(buffer->data_size, sizeof(void *)); off_start_offset = ALIGN(buffer->data_size, sizeof(void *));
off_end_offset = is_failure ? failed_at : off_end_offset = is_failure && failed_at ? failed_at :
off_start_offset + buffer->offsets_size; off_start_offset + buffer->offsets_size;
for (buffer_offset = off_start_offset; buffer_offset < off_end_offset; for (buffer_offset = off_start_offset; buffer_offset < off_end_offset;
buffer_offset += sizeof(binder_size_t)) { buffer_offset += sizeof(binder_size_t)) {
@@ -2081,9 +2081,8 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
binder_size_t fd_buf_size; binder_size_t fd_buf_size;
binder_size_t num_valid; binder_size_t num_valid;
if (proc->tsk != current->group_leader) { if (is_failure) {
/* /*
* Nothing to do if running in sender context
* The fd fixups have not been applied so no * The fd fixups have not been applied so no
* fds need to be closed. * fds need to be closed.
*/ */
@@ -3336,6 +3335,7 @@ err_invalid_target_handle:
* binder_free_buf() - free the specified buffer * binder_free_buf() - free the specified buffer
* @proc: binder proc that owns buffer * @proc: binder proc that owns buffer
* @buffer: buffer to be freed * @buffer: buffer to be freed
* @is_failure: failed to send transaction
* *
* If buffer for an async transaction, enqueue the next async * If buffer for an async transaction, enqueue the next async
* transaction from the node. * transaction from the node.
@@ -3345,7 +3345,7 @@ err_invalid_target_handle:
static void static void
binder_free_buf(struct binder_proc *proc, binder_free_buf(struct binder_proc *proc,
struct binder_thread *thread, struct binder_thread *thread,
struct binder_buffer *buffer) struct binder_buffer *buffer, bool is_failure)
{ {
binder_inner_proc_lock(proc); binder_inner_proc_lock(proc);
if (buffer->transaction) { if (buffer->transaction) {
@@ -3373,7 +3373,7 @@ binder_free_buf(struct binder_proc *proc,
binder_node_inner_unlock(buf_node); binder_node_inner_unlock(buf_node);
} }
trace_binder_transaction_buffer_release(buffer); trace_binder_transaction_buffer_release(buffer);
binder_transaction_buffer_release(proc, thread, buffer, 0, false); binder_transaction_buffer_release(proc, thread, buffer, 0, is_failure);
binder_alloc_free_buf(&proc->alloc, buffer); binder_alloc_free_buf(&proc->alloc, buffer);
} }
@@ -3567,7 +3567,7 @@ static int binder_thread_write(struct binder_proc *proc,
proc->pid, thread->pid, (u64)data_ptr, proc->pid, thread->pid, (u64)data_ptr,
buffer->debug_id, buffer->debug_id,
buffer->transaction ? "active" : "finished"); buffer->transaction ? "active" : "finished");
binder_free_buf(proc, thread, buffer); binder_free_buf(proc, thread, buffer, false);
break; break;
} }
@@ -4261,7 +4261,7 @@ retry:
buffer->transaction = NULL; buffer->transaction = NULL;
binder_cleanup_transaction(t, "fd fixups failed", binder_cleanup_transaction(t, "fd fixups failed",
BR_FAILED_REPLY); BR_FAILED_REPLY);
binder_free_buf(proc, thread, buffer); binder_free_buf(proc, thread, buffer, true);
binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
"%d:%d %stransaction %d fd fixups failed %d/%d, line %d\n", "%d:%d %stransaction %d fd fixups failed %d/%d, line %d\n",
proc->pid, thread->pid, proc->pid, thread->pid,

2
drivers/net/wireless/rsi/rsi_91x_usb.c
View File

@@ -61,7 +61,7 @@ static int rsi_usb_card_write(struct rsi_hw *adapter,
(void *)seg, (void *)seg,
(int)len, (int)len,
&transfer, &transfer,
HZ * 5); USB_CTRL_SET_TIMEOUT);
if (status < 0) { if (status < 0) {
rsi_dbg(ERR_ZONE, rsi_dbg(ERR_ZONE,

115
drivers/staging/comedi/drivers/dt9812.c
View File

@@ -32,6 +32,7 @@
#include <linux/kernel.h> #include <linux/kernel.h>
#include <linux/module.h> #include <linux/module.h>
#include <linux/errno.h> #include <linux/errno.h>
#include <linux/slab.h>
#include <linux/uaccess.h> #include <linux/uaccess.h>
#include "../comedi_usb.h" #include "../comedi_usb.h"
@@ -237,22 +238,42 @@ static int dt9812_read_info(struct comedi_device *dev,
{ {
struct usb_device *usb = comedi_to_usb_dev(dev); struct usb_device *usb = comedi_to_usb_dev(dev);
struct dt9812_private *devpriv = dev->private; struct dt9812_private *devpriv = dev->private;
struct dt9812_usb_cmd cmd; struct dt9812_usb_cmd *cmd;
size_t tbuf_size;
int count, ret; int count, ret;
void *tbuf;
cmd.cmd = cpu_to_le32(DT9812_R_FLASH_DATA); tbuf_size = max(sizeof(*cmd), buf_size);
cmd.u.flash_data_info.address =
tbuf = kzalloc(tbuf_size, GFP_KERNEL);
if (!tbuf)
return -ENOMEM;
cmd = tbuf;
cmd->cmd = cpu_to_le32(DT9812_R_FLASH_DATA);
cmd->u.flash_data_info.address =
cpu_to_le16(DT9812_DIAGS_BOARD_INFO_ADDR + offset); cpu_to_le16(DT9812_DIAGS_BOARD_INFO_ADDR + offset);
cmd.u.flash_data_info.numbytes = cpu_to_le16(buf_size); cmd->u.flash_data_info.numbytes = cpu_to_le16(buf_size);
/* DT9812 only responds to 32 byte writes!! */ /* DT9812 only responds to 32 byte writes!! */
ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
&cmd, 32, &count, DT9812_USB_TIMEOUT); cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
if (ret) if (ret)
return ret; goto out;
return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
buf, buf_size, &count, DT9812_USB_TIMEOUT); tbuf, buf_size, &count, DT9812_USB_TIMEOUT);
if (!ret) {
if (count == buf_size)
memcpy(buf, tbuf, buf_size);
else
ret = -EREMOTEIO;
}
out:
kfree(tbuf);
return ret;
} }
static int dt9812_read_multiple_registers(struct comedi_device *dev, static int dt9812_read_multiple_registers(struct comedi_device *dev,
@@ -261,22 +282,42 @@ static int dt9812_read_multiple_registers(struct comedi_device *dev,
{ {
struct usb_device *usb = comedi_to_usb_dev(dev); struct usb_device *usb = comedi_to_usb_dev(dev);
struct dt9812_private *devpriv = dev->private; struct dt9812_private *devpriv = dev->private;
struct dt9812_usb_cmd cmd; struct dt9812_usb_cmd *cmd;
int i, count, ret; int i, count, ret;
size_t buf_size;
void *buf;
cmd.cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG); buf_size = max_t(size_t, sizeof(*cmd), reg_count);
cmd.u.read_multi_info.count = reg_count;
buf = kzalloc(buf_size, GFP_KERNEL);
if (!buf)
return -ENOMEM;
cmd = buf;
cmd->cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG);
cmd->u.read_multi_info.count = reg_count;
for (i = 0; i < reg_count; i++) for (i = 0; i < reg_count; i++)
cmd.u.read_multi_info.address[i] = address[i]; cmd->u.read_multi_info.address[i] = address[i];
/* DT9812 only responds to 32 byte writes!! */ /* DT9812 only responds to 32 byte writes!! */
ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
&cmd, 32, &count, DT9812_USB_TIMEOUT); cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
if (ret) if (ret)
return ret; goto out;
return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr), ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
value, reg_count, &count, DT9812_USB_TIMEOUT); buf, reg_count, &count, DT9812_USB_TIMEOUT);
if (!ret) {
if (count == reg_count)
memcpy(value, buf, reg_count);
else
ret = -EREMOTEIO;
}
out:
kfree(buf);
return ret;
} }
static int dt9812_write_multiple_registers(struct comedi_device *dev, static int dt9812_write_multiple_registers(struct comedi_device *dev,
@@ -285,19 +326,27 @@ static int dt9812_write_multiple_registers(struct comedi_device *dev,
{ {
struct usb_device *usb = comedi_to_usb_dev(dev); struct usb_device *usb = comedi_to_usb_dev(dev);
struct dt9812_private *devpriv = dev->private; struct dt9812_private *devpriv = dev->private;
struct dt9812_usb_cmd cmd; struct dt9812_usb_cmd *cmd;
int i, count; int i, count;
int ret;
cmd.cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG); cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
cmd.u.read_multi_info.count = reg_count; if (!cmd)
return -ENOMEM;
cmd->cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG);
cmd->u.read_multi_info.count = reg_count;
for (i = 0; i < reg_count; i++) { for (i = 0; i < reg_count; i++) {
cmd.u.write_multi_info.write[i].address = address[i]; cmd->u.write_multi_info.write[i].address = address[i];
cmd.u.write_multi_info.write[i].value = value[i]; cmd->u.write_multi_info.write[i].value = value[i];
} }
/* DT9812 only responds to 32 byte writes!! */ /* DT9812 only responds to 32 byte writes!! */
return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
&cmd, 32, &count, DT9812_USB_TIMEOUT); cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
kfree(cmd);
return ret;
} }
static int dt9812_rmw_multiple_registers(struct comedi_device *dev, static int dt9812_rmw_multiple_registers(struct comedi_device *dev,
@@ -306,17 +355,25 @@ static int dt9812_rmw_multiple_registers(struct comedi_device *dev,
{ {
struct usb_device *usb = comedi_to_usb_dev(dev); struct usb_device *usb = comedi_to_usb_dev(dev);
struct dt9812_private *devpriv = dev->private; struct dt9812_private *devpriv = dev->private;
struct dt9812_usb_cmd cmd; struct dt9812_usb_cmd *cmd;
int i, count; int i, count;
int ret;
cmd.cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG); cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
cmd.u.rmw_multi_info.count = reg_count; if (!cmd)
return -ENOMEM;
cmd->cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG);
cmd->u.rmw_multi_info.count = reg_count;
for (i = 0; i < reg_count; i++) for (i = 0; i < reg_count; i++)
cmd.u.rmw_multi_info.rmw[i] = rmw[i]; cmd->u.rmw_multi_info.rmw[i] = rmw[i];
/* DT9812 only responds to 32 byte writes!! */ /* DT9812 only responds to 32 byte writes!! */
return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr), ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
&cmd, 32, &count, DT9812_USB_TIMEOUT); cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
kfree(cmd);
return ret;
} }
static int dt9812_digital_in(struct comedi_device *dev, u8 *bits) static int dt9812_digital_in(struct comedi_device *dev, u8 *bits)

10
drivers/staging/comedi/drivers/ni_usb6501.c
View File

@@ -144,6 +144,10 @@ static const u8 READ_COUNTER_RESPONSE[] = {0x00, 0x01, 0x00, 0x10,
0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x02,
0x00, 0x00, 0x00, 0x00}; 0x00, 0x00, 0x00, 0x00};
/* Largest supported packets */
static const size_t TX_MAX_SIZE = sizeof(SET_PORT_DIR_REQUEST);
static const size_t RX_MAX_SIZE = sizeof(READ_PORT_RESPONSE);
enum commands { enum commands {
READ_PORT, READ_PORT,
WRITE_PORT, WRITE_PORT,
@@ -501,6 +505,12 @@ static int ni6501_find_endpoints(struct comedi_device *dev)
if (!devpriv->ep_rx || !devpriv->ep_tx) if (!devpriv->ep_rx || !devpriv->ep_tx)
return -ENODEV; return -ENODEV;
if (usb_endpoint_maxp(devpriv->ep_rx) < RX_MAX_SIZE)
return -ENODEV;
if (usb_endpoint_maxp(devpriv->ep_tx) < TX_MAX_SIZE)
return -ENODEV;
return 0; return 0;
} }

28
drivers/staging/comedi/drivers/vmk80xx.c
View File

@@ -90,6 +90,9 @@ enum {
#define IC3_VERSION BIT(0) #define IC3_VERSION BIT(0)
#define IC6_VERSION BIT(1) #define IC6_VERSION BIT(1)
#define MIN_BUF_SIZE 64
#define PACKET_TIMEOUT 10000 /* ms */
enum vmk80xx_model { enum vmk80xx_model {
VMK8055_MODEL, VMK8055_MODEL,
VMK8061_MODEL VMK8061_MODEL
@@ -157,22 +160,21 @@ static void vmk80xx_do_bulk_msg(struct comedi_device *dev)
__u8 rx_addr; __u8 rx_addr;
unsigned int tx_pipe; unsigned int tx_pipe;
unsigned int rx_pipe; unsigned int rx_pipe;
size_t size; size_t tx_size;
size_t rx_size;
tx_addr = devpriv->ep_tx->bEndpointAddress; tx_addr = devpriv->ep_tx->bEndpointAddress;
rx_addr = devpriv->ep_rx->bEndpointAddress; rx_addr = devpriv->ep_rx->bEndpointAddress;
tx_pipe = usb_sndbulkpipe(usb, tx_addr); tx_pipe = usb_sndbulkpipe(usb, tx_addr);
rx_pipe = usb_rcvbulkpipe(usb, rx_addr); rx_pipe = usb_rcvbulkpipe(usb, rx_addr);
tx_size = usb_endpoint_maxp(devpriv->ep_tx);
rx_size = usb_endpoint_maxp(devpriv->ep_rx);
/* usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, tx_size, NULL,
* The max packet size attributes of the K8061 PACKET_TIMEOUT);
* input/output endpoints are identical
*/
size = usb_endpoint_maxp(devpriv->ep_tx);
usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, rx_size, NULL,
size, NULL, devpriv->ep_tx->bInterval); PACKET_TIMEOUT);
usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, size, NULL, HZ * 10);
} }
static int vmk80xx_read_packet(struct comedi_device *dev) static int vmk80xx_read_packet(struct comedi_device *dev)
@@ -191,7 +193,7 @@ static int vmk80xx_read_packet(struct comedi_device *dev)
pipe = usb_rcvintpipe(usb, ep->bEndpointAddress); pipe = usb_rcvintpipe(usb, ep->bEndpointAddress);
return usb_interrupt_msg(usb, pipe, devpriv->usb_rx_buf, return usb_interrupt_msg(usb, pipe, devpriv->usb_rx_buf,
usb_endpoint_maxp(ep), NULL, usb_endpoint_maxp(ep), NULL,
HZ * 10); PACKET_TIMEOUT);
} }
static int vmk80xx_write_packet(struct comedi_device *dev, int cmd) static int vmk80xx_write_packet(struct comedi_device *dev, int cmd)
@@ -212,7 +214,7 @@ static int vmk80xx_write_packet(struct comedi_device *dev, int cmd)
pipe = usb_sndintpipe(usb, ep->bEndpointAddress); pipe = usb_sndintpipe(usb, ep->bEndpointAddress);
return usb_interrupt_msg(usb, pipe, devpriv->usb_tx_buf, return usb_interrupt_msg(usb, pipe, devpriv->usb_tx_buf,
usb_endpoint_maxp(ep), NULL, usb_endpoint_maxp(ep), NULL,
HZ * 10); PACKET_TIMEOUT);
} }
static int vmk80xx_reset_device(struct comedi_device *dev) static int vmk80xx_reset_device(struct comedi_device *dev)
@@ -678,12 +680,12 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev)
struct vmk80xx_private *devpriv = dev->private; struct vmk80xx_private *devpriv = dev->private;
size_t size; size_t size;
size = usb_endpoint_maxp(devpriv->ep_rx); size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE);
devpriv->usb_rx_buf = kzalloc(size, GFP_KERNEL); devpriv->usb_rx_buf = kzalloc(size, GFP_KERNEL);
if (!devpriv->usb_rx_buf) if (!devpriv->usb_rx_buf)
return -ENOMEM; return -ENOMEM;
size = usb_endpoint_maxp(devpriv->ep_tx); size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE);
devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL); devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
if (!devpriv->usb_tx_buf) if (!devpriv->usb_tx_buf)
return -ENOMEM; return -ENOMEM;

7
drivers/staging/media/ipu3/ipu3-css-fw.c
View File

@@ -124,12 +124,11 @@ int imgu_css_fw_init(struct imgu_css *css)
/* Check and display fw header info */ /* Check and display fw header info */
css->fwp = (struct imgu_fw_header *)css->fw->data; css->fwp = (struct imgu_fw_header *)css->fw->data;
if (css->fw->size < sizeof(struct imgu_fw_header *) || if (css->fw->size < struct_size(css->fwp, binary_header, 1) ||
css->fwp->file_header.h_size != sizeof(struct imgu_fw_bi_file_h)) css->fwp->file_header.h_size != sizeof(struct imgu_fw_bi_file_h))
goto bad_fw; goto bad_fw;
if (sizeof(struct imgu_fw_bi_file_h) + if (struct_size(css->fwp, binary_header,
css->fwp->file_header.binary_nr * sizeof(struct imgu_fw_info) > css->fwp->file_header.binary_nr) > css->fw->size)
css->fw->size)
goto bad_fw; goto bad_fw;
dev_info(dev, "loaded firmware version %.64s, %u binaries, %zu bytes\n", dev_info(dev, "loaded firmware version %.64s, %u binaries, %zu bytes\n",

2
drivers/staging/media/ipu3/ipu3-css-fw.h
View File

@@ -170,7 +170,7 @@ struct imgu_fw_bi_file_h {
struct imgu_fw_header { struct imgu_fw_header {
struct imgu_fw_bi_file_h file_header; struct imgu_fw_bi_file_h file_header;
struct imgu_fw_info binary_header[1]; /* binary_nr items */ struct imgu_fw_info binary_header[]; /* binary_nr items */
}; };
/******************* Firmware functions *******************/ /******************* Firmware functions *******************/

18
drivers/staging/rtl8192u/r8192U_core.c
View File

@@ -229,7 +229,7 @@ int write_nic_byte_E(struct net_device *dev, int indx, u8 data)
status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
indx | 0xfe00, 0, usbdata, 1, HZ / 2); indx | 0xfe00, 0, usbdata, 1, 500);
kfree(usbdata); kfree(usbdata);
if (status < 0) { if (status < 0) {
@@ -251,7 +251,7 @@ int read_nic_byte_E(struct net_device *dev, int indx, u8 *data)
status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
indx | 0xfe00, 0, usbdata, 1, HZ / 2); indx | 0xfe00, 0, usbdata, 1, 500);
*data = *usbdata; *data = *usbdata;
kfree(usbdata); kfree(usbdata);
@@ -279,7 +279,7 @@ int write_nic_byte(struct net_device *dev, int indx, u8 data)
status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
(indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
usbdata, 1, HZ / 2); usbdata, 1, 500);
kfree(usbdata); kfree(usbdata);
if (status < 0) { if (status < 0) {
@@ -305,7 +305,7 @@ int write_nic_word(struct net_device *dev, int indx, u16 data)
status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
(indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
usbdata, 2, HZ / 2); usbdata, 2, 500);
kfree(usbdata); kfree(usbdata);
if (status < 0) { if (status < 0) {
@@ -331,7 +331,7 @@ int write_nic_dword(struct net_device *dev, int indx, u32 data)
status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE, RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
(indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
usbdata, 4, HZ / 2); usbdata, 4, 500);
kfree(usbdata); kfree(usbdata);
if (status < 0) { if (status < 0) {
@@ -355,7 +355,7 @@ int read_nic_byte(struct net_device *dev, int indx, u8 *data)
status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
(indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
usbdata, 1, HZ / 2); usbdata, 1, 500);
*data = *usbdata; *data = *usbdata;
kfree(usbdata); kfree(usbdata);
@@ -380,7 +380,7 @@ int read_nic_word(struct net_device *dev, int indx, u16 *data)
status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
(indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
usbdata, 2, HZ / 2); usbdata, 2, 500);
*data = *usbdata; *data = *usbdata;
kfree(usbdata); kfree(usbdata);
@@ -404,7 +404,7 @@ static int read_nic_word_E(struct net_device *dev, int indx, u16 *data)
status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
indx | 0xfe00, 0, usbdata, 2, HZ / 2); indx | 0xfe00, 0, usbdata, 2, 500);
*data = *usbdata; *data = *usbdata;
kfree(usbdata); kfree(usbdata);
@@ -430,7 +430,7 @@ int read_nic_dword(struct net_device *dev, int indx, u32 *data)
status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
RTL8187_REQ_GET_REGS, RTL8187_REQT_READ, RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
(indx & 0xff) | 0xff00, (indx >> 8) & 0x0f, (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
usbdata, 4, HZ / 2); usbdata, 4, 500);
*data = *usbdata; *data = *usbdata;
kfree(usbdata); kfree(usbdata);

4
drivers/staging/rtl8712/usb_intf.c
View File

@@ -598,12 +598,12 @@ static void r871xu_dev_remove(struct usb_interface *pusb_intf)
/* never exit with a firmware callback pending */ /* never exit with a firmware callback pending */
wait_for_completion(&padapter->rtl8712_fw_ready); wait_for_completion(&padapter->rtl8712_fw_ready);
if (pnetdev->reg_state != NETREG_UNINITIALIZED)
unregister_netdev(pnetdev); /* will call netdev_close() */
usb_set_intfdata(pusb_intf, NULL); usb_set_intfdata(pusb_intf, NULL);
release_firmware(padapter->fw); release_firmware(padapter->fw);
if (drvpriv.drv_registered) if (drvpriv.drv_registered)
padapter->surprise_removed = true; padapter->surprise_removed = true;
if (pnetdev->reg_state != NETREG_UNINITIALIZED)
unregister_netdev(pnetdev); /* will call netdev_close() */
r8712_flush_rwctrl_works(padapter); r8712_flush_rwctrl_works(padapter);
r8712_flush_led_works(padapter); r8712_flush_led_works(padapter);
udelay(1); udelay(1);

2
drivers/staging/rtl8712/usb_ops_linux.c
View File

@@ -494,7 +494,7 @@ int r8712_usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value,
memcpy(pIo_buf, pdata, len); memcpy(pIo_buf, pdata, len);
} }
status = usb_control_msg(udev, pipe, request, reqtype, value, index, status = usb_control_msg(udev, pipe, request, reqtype, value, index,
pIo_buf, len, HZ / 2); pIo_buf, len, 500);
if (status > 0) { /* Success this control transfer. */ if (status > 0) { /* Success this control transfer. */
if (requesttype == 0x01) { if (requesttype == 0x01) {
/* For Control read transfer, we have to copy the read /* For Control read transfer, we have to copy the read

1
drivers/usb/gadget/udc/Kconfig
View File

@@ -330,6 +330,7 @@ config USB_AMD5536UDC
config USB_FSL_QE config USB_FSL_QE
tristate "Freescale QE/CPM USB Device Controller" tristate "Freescale QE/CPM USB Device Controller"
depends on FSL_SOC && (QUICC_ENGINE || CPM) depends on FSL_SOC && (QUICC_ENGINE || CPM)
depends on !64BIT || BROKEN
help help
Some of Freescale PowerPC processors have a Full Speed Some of Freescale PowerPC processors have a Full Speed
QE/CPM2 USB controller, which support device mode with 4 QE/CPM2 USB controller, which support device mode with 4

11
drivers/usb/host/ehci-hcd.c
View File

@@ -634,7 +634,16 @@ static int ehci_run (struct usb_hcd *hcd)
/* Wait until HC become operational */ /* Wait until HC become operational */
ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */ ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */
msleep(5); msleep(5);
rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT, 0, 100 * 1000);
/* For Aspeed, STS_HALT also depends on ASS/PSS status.
* Check CMD_RUN instead.
*/
if (ehci->is_aspeed)
rc = ehci_handshake(ehci, &ehci->regs->command, CMD_RUN,
1, 100 * 1000);
else
rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT,
0, 100 * 1000);
up_write(&ehci_cf_port_reset_rwsem); up_write(&ehci_cf_port_reset_rwsem);

6
drivers/usb/host/ehci-platform.c
View File

@@ -294,6 +294,12 @@ static int ehci_platform_probe(struct platform_device *dev)
"has-transaction-translator")) "has-transaction-translator"))
hcd->has_tt = 1; hcd->has_tt = 1;
if (of_device_is_compatible(dev->dev.of_node,
"aspeed,ast2500-ehci") ||
of_device_is_compatible(dev->dev.of_node,
"aspeed,ast2600-ehci"))
ehci->is_aspeed = 1;
if (soc_device_match(quirk_poll_match)) if (soc_device_match(quirk_poll_match))
priv->quirk_poll = true; priv->quirk_poll = true;

1
drivers/usb/host/ehci.h
View File

@@ -218,6 +218,7 @@ struct ehci_hcd { /* one per controller */
unsigned frame_index_bug:1; /* MosChip (AKA NetMos) */ unsigned frame_index_bug:1; /* MosChip (AKA NetMos) */
unsigned need_oc_pp_cycle:1; /* MPC834X port power */ unsigned need_oc_pp_cycle:1; /* MPC834X port power */
unsigned imx28_write_fix:1; /* For Freescale i.MX28 */ unsigned imx28_write_fix:1; /* For Freescale i.MX28 */
unsigned is_aspeed:1;
/* required for usb32 quirk */ /* required for usb32 quirk */
#define OHCI_CTRL_HCFS (3 << 6) #define OHCI_CTRL_HCFS (3 << 6)

4
drivers/usb/musb/musb_gadget.c
View File

@@ -1247,9 +1247,11 @@ static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
status = musb_queue_resume_work(musb, status = musb_queue_resume_work(musb,
musb_ep_restart_resume_work, musb_ep_restart_resume_work,
request); request);
if (status < 0) if (status < 0) {
dev_err(musb->controller, "%s resume work: %i\n", dev_err(musb->controller, "%s resume work: %i\n",
__func__, status); __func__, status);
list_del(&request->list);
}
} }
unlock: unlock:

10
drivers/usb/storage/unusual_devs.h
View File

@@ -406,6 +406,16 @@ UNUSUAL_DEV( 0x04b8, 0x0602, 0x0110, 0x0110,
"785EPX Storage", "785EPX Storage",
USB_SC_SCSI, USB_PR_BULK, NULL, US_FL_SINGLE_LUN), USB_SC_SCSI, USB_PR_BULK, NULL, US_FL_SINGLE_LUN),
/*
* Reported by James Buren <braewoods+lkml@braewoods.net>
* Virtual ISOs cannot be remounted if ejected while the device is locked
* Disable locking to mimic Windows behavior that bypasses the issue
*/
UNUSUAL_DEV( 0x04c5, 0x2028, 0x0001, 0x0001,
"iODD",
"2531/2541",
USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE),
/* /*
* Not sure who reported this originally but * Not sure who reported this originally but
* Pavel Machek <pavel@ucw.cz> reported that the extra US_FL_SINGLE_LUN * Pavel Machek <pavel@ucw.cz> reported that the extra US_FL_SINGLE_LUN

2
fs/isofs/inode.c
View File

@@ -1321,6 +1321,8 @@ static int isofs_read_inode(struct inode *inode, int relocated)
de = (struct iso_directory_record *) (bh->b_data + offset); de = (struct iso_directory_record *) (bh->b_data + offset);
de_len = *(unsigned char *) de; de_len = *(unsigned char *) de;
if (de_len < sizeof(struct iso_directory_record))
goto fail;
if (offset + de_len > bufsize) { if (offset + de_len > bufsize) {
int frag1 = bufsize - offset; int frag1 = bufsize - offset;

9
kernel/printk/printk.c
View File

@@ -2222,8 +2222,15 @@ static int __init console_setup(char *str)
char *s, *options, *brl_options = NULL; char *s, *options, *brl_options = NULL;
int idx; int idx;
if (str[0] == 0) /*
* console="" or console=null have been suggested as a way to
* disable console output. Use ttynull that has been created
* for exacly this purpose.
*/
if (str[0] == 0 || strcmp(str, "null") == 0) {
__add_preferred_console("ttynull", 0, NULL, NULL, true);
return 1; return 1;
}
if (_braille_console_setup(&str, &brl_options)) if (_braille_console_setup(&str, &brl_options))
return 1; return 1;