android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

This is the 5.10.79 stable release

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmGOczIACgkQONu9yGCS
 aT5QxA//cG42sQj6t9vDbhLm+cdT8nrjZgBX34ne+p7TkuABaUf13WRhRFYJCQm5
 VcwzrEiRw91pxZ/5QtANYaYu6lyT+vL9OQsMLGgevcCraYF71xrxZma019M6ygru
 /yWNjviUkcZXVCZTqQ/yK63x3PINW2vgYODy3oNemLW8Q4ADUW0Fe/ZWS+XBlcyn
 wMyGveQNeqy5E05B5oxwJVzqsot8q8vhc3DiTr5twLadlwRLhKjh6rFwtK6zWd6S
 UTFxaUQcTRcxgwPObLNxfiSri/w4HQzN18tGhrnxooncy03Ga7xo66Tnk99yQdD8
 fmyWXd1VAGft9vzbrxHVte69hYIUlP+flW1tE8bRdWqbBkJlMiQFFTYusS6pewmG
 xAdirBFtERtGS5LB3CsN9yky2tZ99o/6rZ5qTxjIIRxq7wmP1ycH55Sq6iEISCRA
 RYb5uvW0zbmzA/00a+XB7f3kBDbZgkQvz86JhANu8Q/c6hB5Tv55HRePRrOsXadt
 lx3Mz9Uoi0XGvUPhDStLr1JVODoQY8W9gyba6ax0SoIAdV/6+oCIOOdx5jw4mC9E
 ChLe07AfdgmfV1XAdB75IgFECWnUsdUNTn1Iqlf8P0rfZ27ePuYvmIVTJjGZZi17
 yPBOpSaGNGM/fiaDI2/JfvG6wbIHHKkDdd7dI3BS93MBnTYDceU=
 =v9l7
 -----END PGP SIGNATURE-----

Merge 5.10.79 into android12-5.10-lts

Changes in 5.10.79
	KVM: x86: avoid warning with -Wbitwise-instead-of-logical
	Revert "x86/kvm: fix vcpu-id indexed array sizes"
	usb: ehci: handshake CMD_RUN instead of STS_HALT
	usb: gadget: Mark USB_FSL_QE broken on 64-bit
	usb: musb: Balance list entry in musb_gadget_queue
	usb-storage: Add compatibility quirk flags for iODD 2531/2541
	binder: don't detect sender/target during buffer cleanup
	printk/console: Allow to disable console output by using console="" or console=null
	staging: rtl8712: fix use-after-free in rtl8712_dl_fw
	isofs: Fix out of bound access for corrupted isofs image
	comedi: dt9812: fix DMA buffers on stack
	comedi: ni_usb6501: fix NULL-deref in command paths
	comedi: vmk80xx: fix transfer-buffer overflows
	comedi: vmk80xx: fix bulk-buffer overflow
	comedi: vmk80xx: fix bulk and interrupt message timeouts
	staging: r8712u: fix control-message timeout
	staging: rtl8192u: fix control-message timeouts
	media: staging/intel-ipu3: css: Fix wrong size comparison imgu_css_fw_init
	rsi: fix control-message timeout
	Linux 5.10.79

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I418d4d95ae5550e1c98738c6a11f1933d0bdddb5
This commit is contained in:
Greg Kroah-Hartman 2021-11-12 15:12:12 +01:00
commit 525e61a871
22 changed files with 181 additions and 75 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0
VERSION = 5
PATCHLEVEL = 10
SUBLEVEL = 78
SUBLEVEL = 79
EXTRAVERSION =
NAME = Dare mighty things

2
arch/x86/kvm/ioapic.c
View File

@ -96,7 +96,7 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
static void rtc_irq_eoi_tracking_reset(struct kvm_ioapic *ioapic)
{
ioapic->rtc_status.pending_eoi = 0;
bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID + 1);
bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID);
}
static void kvm_rtc_eoi_tracking_restore_all(struct kvm_ioapic *ioapic);

4
arch/x86/kvm/ioapic.h
View File

@ -43,13 +43,13 @@ struct kvm_vcpu;
struct dest_map {
/* vcpu bitmap where IRQ has been sent */
DECLARE_BITMAP(map, KVM_MAX_VCPU_ID + 1);
DECLARE_BITMAP(map, KVM_MAX_VCPU_ID);
/*
* Vector sent to a given vcpu, only valid when
* the vcpu's bit in map is set
*/
u8 vectors[KVM_MAX_VCPU_ID + 1];
u8 vectors[KVM_MAX_VCPU_ID];
};

2
arch/x86/kvm/mmu/mmu.c
View File

@ -3545,7 +3545,7 @@ static bool get_mmio_spte(struct kvm_vcpu *vcpu, u64 addr, u64 *sptep)
* reserved bit and EPT's invalid memtype/XWR checks to avoid
* adding a Jcc in the loop.
*/
reserved |= __is_bad_mt_xwr(rsvd_check, sptes[level - 1]) |
reserved |= __is_bad_mt_xwr(rsvd_check, sptes[level - 1]) ||
__is_rsvd_bits_set(rsvd_check, sptes[level - 1],
level);
}

14
drivers/android/binder.c
View File

@ -1995,7 +1995,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
binder_dec_node(buffer->target_node, 1, 0);
off_start_offset = ALIGN(buffer->data_size, sizeof(void *));
off_end_offset = is_failure ? failed_at :
off_end_offset = is_failure && failed_at ? failed_at :
off_start_offset + buffer->offsets_size;
for (buffer_offset = off_start_offset; buffer_offset < off_end_offset;
buffer_offset += sizeof(binder_size_t)) {
@ -2081,9 +2081,8 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
binder_size_t fd_buf_size;
binder_size_t num_valid;
if (proc->tsk != current->group_leader) {
if (is_failure) {
/*
* Nothing to do if running in sender context
* The fd fixups have not been applied so no
* fds need to be closed.
*/
@ -3336,6 +3335,7 @@ static void binder_transaction(struct binder_proc *proc,
* binder_free_buf() - free the specified buffer
* @proc: binder proc that owns buffer
* @buffer: buffer to be freed
* @is_failure: failed to send transaction
*
* If buffer for an async transaction, enqueue the next async
* transaction from the node.
@ -3345,7 +3345,7 @@ static void binder_transaction(struct binder_proc *proc,
static void
binder_free_buf(struct binder_proc *proc,
struct binder_thread *thread,
struct binder_buffer *buffer)
struct binder_buffer *buffer, bool is_failure)
{
binder_inner_proc_lock(proc);
if (buffer->transaction) {
@ -3373,7 +3373,7 @@ binder_free_buf(struct binder_proc *proc,
binder_node_inner_unlock(buf_node);
}
trace_binder_transaction_buffer_release(buffer);
binder_transaction_buffer_release(proc, thread, buffer, 0, false);
binder_transaction_buffer_release(proc, thread, buffer, 0, is_failure);
binder_alloc_free_buf(&proc->alloc, buffer);
}
@ -3567,7 +3567,7 @@ static int binder_thread_write(struct binder_proc *proc,
proc->pid, thread->pid, (u64)data_ptr,
buffer->debug_id,
buffer->transaction ? "active" : "finished");
binder_free_buf(proc, thread, buffer);
binder_free_buf(proc, thread, buffer, false);
break;
}
@ -4261,7 +4261,7 @@ static int binder_thread_read(struct binder_proc *proc,
buffer->transaction = NULL;
binder_cleanup_transaction(t, "fd fixups failed",
BR_FAILED_REPLY);
binder_free_buf(proc, thread, buffer);
binder_free_buf(proc, thread, buffer, true);
binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
"%d:%d %stransaction %d fd fixups failed %d/%d, line %d\n",
proc->pid, thread->pid,

2
drivers/net/wireless/rsi/rsi_91x_usb.c
View File

@ -61,7 +61,7 @@ static int rsi_usb_card_write(struct rsi_hw *adapter,
(void *)seg,
(int)len,
&transfer,
HZ * 5);
USB_CTRL_SET_TIMEOUT);
if (status < 0) {
rsi_dbg(ERR_ZONE,

115
drivers/staging/comedi/drivers/dt9812.c
View File

@ -32,6 +32,7 @@
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/errno.h>
#include <linux/slab.h>
#include <linux/uaccess.h>
#include "../comedi_usb.h"
@ -237,22 +238,42 @@ static int dt9812_read_info(struct comedi_device *dev,
{
struct usb_device *usb = comedi_to_usb_dev(dev);
struct dt9812_private *devpriv = dev->private;
struct dt9812_usb_cmd cmd;
struct dt9812_usb_cmd *cmd;
size_t tbuf_size;
int count, ret;
void *tbuf;
cmd.cmd = cpu_to_le32(DT9812_R_FLASH_DATA);
cmd.u.flash_data_info.address =
tbuf_size = max(sizeof(*cmd), buf_size);
tbuf = kzalloc(tbuf_size, GFP_KERNEL);
if (!tbuf)
return -ENOMEM;
cmd = tbuf;
cmd->cmd = cpu_to_le32(DT9812_R_FLASH_DATA);
cmd->u.flash_data_info.address =
cpu_to_le16(DT9812_DIAGS_BOARD_INFO_ADDR + offset);
cmd.u.flash_data_info.numbytes = cpu_to_le16(buf_size);
cmd->u.flash_data_info.numbytes = cpu_to_le16(buf_size);
/* DT9812 only responds to 32 byte writes!! */
ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
&cmd, 32, &count, DT9812_USB_TIMEOUT);
cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
if (ret)
return ret;
goto out;
return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
buf, buf_size, &count, DT9812_USB_TIMEOUT);
ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
tbuf, buf_size, &count, DT9812_USB_TIMEOUT);
if (!ret) {
if (count == buf_size)
memcpy(buf, tbuf, buf_size);
else
ret = -EREMOTEIO;
}
out:
kfree(tbuf);
return ret;
}
static int dt9812_read_multiple_registers(struct comedi_device *dev,
@ -261,22 +282,42 @@ static int dt9812_read_multiple_registers(struct comedi_device *dev,
{
struct usb_device *usb = comedi_to_usb_dev(dev);
struct dt9812_private *devpriv = dev->private;
struct dt9812_usb_cmd cmd;
struct dt9812_usb_cmd *cmd;
int i, count, ret;
size_t buf_size;
void *buf;
cmd.cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG);
cmd.u.read_multi_info.count = reg_count;
buf_size = max_t(size_t, sizeof(*cmd), reg_count);
buf = kzalloc(buf_size, GFP_KERNEL);
if (!buf)
return -ENOMEM;
cmd = buf;
cmd->cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG);
cmd->u.read_multi_info.count = reg_count;
for (i = 0; i < reg_count; i++)
cmd.u.read_multi_info.address[i] = address[i];
cmd->u.read_multi_info.address[i] = address[i];
/* DT9812 only responds to 32 byte writes!! */
ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
&cmd, 32, &count, DT9812_USB_TIMEOUT);
cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
if (ret)
return ret;
goto out;
return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
value, reg_count, &count, DT9812_USB_TIMEOUT);
ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
buf, reg_count, &count, DT9812_USB_TIMEOUT);
if (!ret) {
if (count == reg_count)
memcpy(value, buf, reg_count);
else
ret = -EREMOTEIO;
}
out:
kfree(buf);
return ret;
}
static int dt9812_write_multiple_registers(struct comedi_device *dev,
@ -285,19 +326,27 @@ static int dt9812_write_multiple_registers(struct comedi_device *dev,
{
struct usb_device *usb = comedi_to_usb_dev(dev);
struct dt9812_private *devpriv = dev->private;
struct dt9812_usb_cmd cmd;
struct dt9812_usb_cmd *cmd;
int i, count;
int ret;
cmd.cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG);
cmd.u.read_multi_info.count = reg_count;
cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
if (!cmd)
return -ENOMEM;
cmd->cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG);
cmd->u.read_multi_info.count = reg_count;
for (i = 0; i < reg_count; i++) {
cmd.u.write_multi_info.write[i].address = address[i];
cmd.u.write_multi_info.write[i].value = value[i];
cmd->u.write_multi_info.write[i].address = address[i];
cmd->u.write_multi_info.write[i].value = value[i];
}
/* DT9812 only responds to 32 byte writes!! */
return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
&cmd, 32, &count, DT9812_USB_TIMEOUT);
ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
kfree(cmd);
return ret;
}
static int dt9812_rmw_multiple_registers(struct comedi_device *dev,
@ -306,17 +355,25 @@ static int dt9812_rmw_multiple_registers(struct comedi_device *dev,
{
struct usb_device *usb = comedi_to_usb_dev(dev);
struct dt9812_private *devpriv = dev->private;
struct dt9812_usb_cmd cmd;
struct dt9812_usb_cmd *cmd;
int i, count;
int ret;
cmd.cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG);
cmd.u.rmw_multi_info.count = reg_count;
cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
if (!cmd)
return -ENOMEM;
cmd->cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG);
cmd->u.rmw_multi_info.count = reg_count;
for (i = 0; i < reg_count; i++)
cmd.u.rmw_multi_info.rmw[i] = rmw[i];
cmd->u.rmw_multi_info.rmw[i] = rmw[i];
/* DT9812 only responds to 32 byte writes!! */
return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
&cmd, 32, &count, DT9812_USB_TIMEOUT);
ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
kfree(cmd);
return ret;
}
static int dt9812_digital_in(struct comedi_device *dev, u8 *bits)

10
drivers/staging/comedi/drivers/ni_usb6501.c
View File

@ -144,6 +144,10 @@ static const u8 READ_COUNTER_RESPONSE[] = {0x00, 0x01, 0x00, 0x10,
0x00, 0x00, 0x00, 0x02,
0x00, 0x00, 0x00, 0x00};
/* Largest supported packets */
static const size_t TX_MAX_SIZE = sizeof(SET_PORT_DIR_REQUEST);
static const size_t RX_MAX_SIZE = sizeof(READ_PORT_RESPONSE);
enum commands {
READ_PORT,
WRITE_PORT,
@ -501,6 +505,12 @@ static int ni6501_find_endpoints(struct comedi_device *dev)
if (!devpriv->ep_rx || !devpriv->ep_tx)
return -ENODEV;
if (usb_endpoint_maxp(devpriv->ep_rx) < RX_MAX_SIZE)
return -ENODEV;
if (usb_endpoint_maxp(devpriv->ep_tx) < TX_MAX_SIZE)
return -ENODEV;
return 0;
}

28
drivers/staging/comedi/drivers/vmk80xx.c
View File

@ -90,6 +90,9 @@ enum {
#define IC3_VERSION BIT(0)
#define IC6_VERSION BIT(1)
#define MIN_BUF_SIZE 64
#define PACKET_TIMEOUT 10000 /* ms */
enum vmk80xx_model {
VMK8055_MODEL,
VMK8061_MODEL
@ -157,22 +160,21 @@ static void vmk80xx_do_bulk_msg(struct comedi_device *dev)
__u8 rx_addr;
unsigned int tx_pipe;
unsigned int rx_pipe;
size_t size;
size_t tx_size;
size_t rx_size;
tx_addr = devpriv->ep_tx->bEndpointAddress;
rx_addr = devpriv->ep_rx->bEndpointAddress;
tx_pipe = usb_sndbulkpipe(usb, tx_addr);
rx_pipe = usb_rcvbulkpipe(usb, rx_addr);
tx_size = usb_endpoint_maxp(devpriv->ep_tx);
rx_size = usb_endpoint_maxp(devpriv->ep_rx);
/*
* The max packet size attributes of the K8061
* input/output endpoints are identical
*/
size = usb_endpoint_maxp(devpriv->ep_tx);
usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, tx_size, NULL,
PACKET_TIMEOUT);
usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf,
size, NULL, devpriv->ep_tx->bInterval);
usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, size, NULL, HZ * 10);
usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, rx_size, NULL,
PACKET_TIMEOUT);
}
static int vmk80xx_read_packet(struct comedi_device *dev)
@ -191,7 +193,7 @@ static int vmk80xx_read_packet(struct comedi_device *dev)
pipe = usb_rcvintpipe(usb, ep->bEndpointAddress);
return usb_interrupt_msg(usb, pipe, devpriv->usb_rx_buf,
usb_endpoint_maxp(ep), NULL,
HZ * 10);
PACKET_TIMEOUT);
}
static int vmk80xx_write_packet(struct comedi_device *dev, int cmd)
@ -212,7 +214,7 @@ static int vmk80xx_write_packet(struct comedi_device *dev, int cmd)
pipe = usb_sndintpipe(usb, ep->bEndpointAddress);
return usb_interrupt_msg(usb, pipe, devpriv->usb_tx_buf,
usb_endpoint_maxp(ep), NULL,
HZ * 10);
PACKET_TIMEOUT);
}
static int vmk80xx_reset_device(struct comedi_device *dev)
@ -678,12 +680,12 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev)
struct vmk80xx_private *devpriv = dev->private;
size_t size;
size = usb_endpoint_maxp(devpriv->ep_rx);
size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE);
devpriv->usb_rx_buf = kzalloc(size, GFP_KERNEL);
if (!devpriv->usb_rx_buf)
return -ENOMEM;
size = usb_endpoint_maxp(devpriv->ep_tx);
size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE);
devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
if (!devpriv->usb_tx_buf)
return -ENOMEM;

7
drivers/staging/media/ipu3/ipu3-css-fw.c
View File

@ -124,12 +124,11 @@ int imgu_css_fw_init(struct imgu_css *css)
/* Check and display fw header info */
css->fwp = (struct imgu_fw_header *)css->fw->data;
if (css->fw->size < sizeof(struct imgu_fw_header *) ||
if (css->fw->size < struct_size(css->fwp, binary_header, 1) ||
css->fwp->file_header.h_size != sizeof(struct imgu_fw_bi_file_h))
goto bad_fw;
if (sizeof(struct imgu_fw_bi_file_h) +
css->fwp->file_header.binary_nr * sizeof(struct imgu_fw_info) >
css->fw->size)
if (struct_size(css->fwp, binary_header,
css->fwp->file_header.binary_nr) > css->fw->size)
goto bad_fw;
dev_info(dev, "loaded firmware version %.64s, %u binaries, %zu bytes\n",

2
drivers/staging/media/ipu3/ipu3-css-fw.h
View File

@ -170,7 +170,7 @@ struct imgu_fw_bi_file_h {
struct imgu_fw_header {
struct imgu_fw_bi_file_h file_header;
struct imgu_fw_info binary_header[1]; /* binary_nr items */
struct imgu_fw_info binary_header[]; /* binary_nr items */
};
/******************* Firmware functions *******************/

18
drivers/staging/rtl8192u/r8192U_core.c
View File

@ -229,7 +229,7 @@ int write_nic_byte_E(struct net_device *dev, int indx, u8 data)
status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
indx | 0xfe00, 0, usbdata, 1, HZ / 2);
indx | 0xfe00, 0, usbdata, 1, 500);
kfree(usbdata);
if (status < 0) {
@ -251,7 +251,7 @@ int read_nic_byte_E(struct net_device *dev, int indx, u8 *data)
status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
indx | 0xfe00, 0, usbdata, 1, HZ / 2);
indx | 0xfe00, 0, usbdata, 1, 500);
*data = *usbdata;
kfree(usbdata);
@ -279,7 +279,7 @@ int write_nic_byte(struct net_device *dev, int indx, u8 data)
status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
(indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
usbdata, 1, HZ / 2);
usbdata, 1, 500);
kfree(usbdata);
if (status < 0) {
@ -305,7 +305,7 @@ int write_nic_word(struct net_device *dev, int indx, u16 data)
status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
(indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
usbdata, 2, HZ / 2);
usbdata, 2, 500);
kfree(usbdata);
if (status < 0) {
@ -331,7 +331,7 @@ int write_nic_dword(struct net_device *dev, int indx, u32 data)
status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
(indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
usbdata, 4, HZ / 2);
usbdata, 4, 500);
kfree(usbdata);
if (status < 0) {
@ -355,7 +355,7 @@ int read_nic_byte(struct net_device *dev, int indx, u8 *data)
status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
(indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
usbdata, 1, HZ / 2);
usbdata, 1, 500);
*data = *usbdata;
kfree(usbdata);
@ -380,7 +380,7 @@ int read_nic_word(struct net_device *dev, int indx, u16 *data)
status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
(indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
usbdata, 2, HZ / 2);
usbdata, 2, 500);
*data = *usbdata;
kfree(usbdata);
@ -404,7 +404,7 @@ static int read_nic_word_E(struct net_device *dev, int indx, u16 *data)
status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
indx | 0xfe00, 0, usbdata, 2, HZ / 2);
indx | 0xfe00, 0, usbdata, 2, 500);
*data = *usbdata;
kfree(usbdata);
@ -430,7 +430,7 @@ int read_nic_dword(struct net_device *dev, int indx, u32 *data)
status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
(indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
usbdata, 4, HZ / 2);
usbdata, 4, 500);
*data = *usbdata;
kfree(usbdata);

4
drivers/staging/rtl8712/usb_intf.c
View File

@ -598,12 +598,12 @@ static void r871xu_dev_remove(struct usb_interface *pusb_intf)
/* never exit with a firmware callback pending */
wait_for_completion(&padapter->rtl8712_fw_ready);
if (pnetdev->reg_state != NETREG_UNINITIALIZED)
unregister_netdev(pnetdev); /* will call netdev_close() */
usb_set_intfdata(pusb_intf, NULL);
release_firmware(padapter->fw);
if (drvpriv.drv_registered)
padapter->surprise_removed = true;
if (pnetdev->reg_state != NETREG_UNINITIALIZED)
unregister_netdev(pnetdev); /* will call netdev_close() */
r8712_flush_rwctrl_works(padapter);
r8712_flush_led_works(padapter);
udelay(1);

2
drivers/staging/rtl8712/usb_ops_linux.c
View File

@ -494,7 +494,7 @@ int r8712_usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value,
memcpy(pIo_buf, pdata, len);
}
status = usb_control_msg(udev, pipe, request, reqtype, value, index,
pIo_buf, len, HZ / 2);
pIo_buf, len, 500);
if (status > 0) { /* Success this control transfer. */
if (requesttype == 0x01) {
/* For Control read transfer, we have to copy the read

1
drivers/usb/gadget/udc/Kconfig
View File

@ -330,6 +330,7 @@ config USB_AMD5536UDC
config USB_FSL_QE
tristate "Freescale QE/CPM USB Device Controller"
depends on FSL_SOC && (QUICC_ENGINE || CPM)
depends on !64BIT || BROKEN
help
Some of Freescale PowerPC processors have a Full Speed
QE/CPM2 USB controller, which support device mode with 4

11
drivers/usb/host/ehci-hcd.c
View File

@ -634,7 +634,16 @@ static int ehci_run (struct usb_hcd *hcd)
/* Wait until HC become operational */
ehci_readl(ehci, &ehci->regs->command); /* unblock posted writes */
msleep(5);
rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT, 0, 100 * 1000);
/* For Aspeed, STS_HALT also depends on ASS/PSS status.
* Check CMD_RUN instead.
*/
if (ehci->is_aspeed)
rc = ehci_handshake(ehci, &ehci->regs->command, CMD_RUN,
1, 100 * 1000);
else
rc = ehci_handshake(ehci, &ehci->regs->status, STS_HALT,
0, 100 * 1000);
up_write(&ehci_cf_port_reset_rwsem);

6
drivers/usb/host/ehci-platform.c
View File

@ -294,6 +294,12 @@ static int ehci_platform_probe(struct platform_device *dev)
"has-transaction-translator"))
hcd->has_tt = 1;
if (of_device_is_compatible(dev->dev.of_node,
"aspeed,ast2500-ehci") ||
of_device_is_compatible(dev->dev.of_node,
"aspeed,ast2600-ehci"))
ehci->is_aspeed = 1;
if (soc_device_match(quirk_poll_match))
priv->quirk_poll = true;

1
drivers/usb/host/ehci.h
View File

@ -218,6 +218,7 @@ struct ehci_hcd { /* one per controller */
unsigned frame_index_bug:1; /* MosChip (AKA NetMos) */
unsigned need_oc_pp_cycle:1; /* MPC834X port power */
unsigned imx28_write_fix:1; /* For Freescale i.MX28 */
unsigned is_aspeed:1;
/* required for usb32 quirk */
#define OHCI_CTRL_HCFS (3 << 6)

4
drivers/usb/musb/musb_gadget.c
View File

@ -1247,9 +1247,11 @@ static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
status = musb_queue_resume_work(musb,
musb_ep_restart_resume_work,
request);
if (status < 0)
if (status < 0) {
dev_err(musb->controller, "%s resume work: %i\n",
__func__, status);
list_del(&request->list);
}
}
unlock:

10
drivers/usb/storage/unusual_devs.h
View File

@ -406,6 +406,16 @@ UNUSUAL_DEV( 0x04b8, 0x0602, 0x0110, 0x0110,
"785EPX Storage",
USB_SC_SCSI, USB_PR_BULK, NULL, US_FL_SINGLE_LUN),
/*
* Reported by James Buren <braewoods+lkml@braewoods.net>
* Virtual ISOs cannot be remounted if ejected while the device is locked
* Disable locking to mimic Windows behavior that bypasses the issue
*/
UNUSUAL_DEV( 0x04c5, 0x2028, 0x0001, 0x0001,
"iODD",
"2531/2541",
USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE),
/*
* Not sure who reported this originally but
* Pavel Machek <pavel@ucw.cz> reported that the extra US_FL_SINGLE_LUN

2
fs/isofs/inode.c
View File

@ -1321,6 +1321,8 @@ static int isofs_read_inode(struct inode *inode, int relocated)
de = (struct iso_directory_record *) (bh->b_data + offset);
de_len = *(unsigned char *) de;
if (de_len < sizeof(struct iso_directory_record))
goto fail;
if (offset + de_len > bufsize) {
int frag1 = bufsize - offset;

9
kernel/printk/printk.c
View File

@ -2222,8 +2222,15 @@ static int __init console_setup(char *str)
char *s, *options, *brl_options = NULL;
int idx;
if (str[0] == 0)
/*
* console="" or console=null have been suggested as a way to
* disable console output. Use ttynull that has been created
* for exacly this purpose.
*/
if (str[0] == 0 || strcmp(str, "null") == 0) {
__add_preferred_console("ttynull", 0, NULL, NULL, true);
return 1;
}
if (_braille_console_setup(&str, &brl_options))
return 1;