android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge 74c63fd016 ("ACPICA: Fix memory leak if acpi_ps_get_next_field() fails") into android12-5.10-lts

Browse Source 
Steps on the way to 5.10.227

Change-Id: Ie190b64ce17dea26ec0ac8910bbcb5fb144aede0
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This commit is contained in:
Greg Kroah-Hartman 2024-11-14 11:30:34 +00:00
commit baa474b078
21 changed files with 195 additions and 109 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
drivers/acpi/acpica/psargs.c
View File

@ -25,6 +25,8 @@ acpi_ps_get_next_package_length(struct acpi_parse_state *parser_state);
static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_state
*parser_state);
static void acpi_ps_free_field_list(union acpi_parse_object *start);
/*******************************************************************************
*
* FUNCTION: acpi_ps_get_next_package_length
@ -683,6 +685,39 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_state
return_PTR(field);
}
/*******************************************************************************
*
* FUNCTION: acpi_ps_free_field_list
*
* PARAMETERS: start - First Op in field list
*
* RETURN: None.
*
* DESCRIPTION: Free all Op objects inside a field list.
*
******************************************************************************/
static void acpi_ps_free_field_list(union acpi_parse_object *start)
{
union acpi_parse_object *cur = start;
union acpi_parse_object *next;
union acpi_parse_object *arg;
while (cur) {
next = cur->common.next;
/* AML_INT_CONNECTION_OP can have a single argument */
arg = acpi_ps_get_arg(cur, 0);
if (arg) {
acpi_ps_free_op(arg);
}
acpi_ps_free_op(cur);
cur = next;
}
}
/*******************************************************************************
*
* FUNCTION: acpi_ps_get_next_arg
@ -751,6 +786,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,
while (parser_state->aml < parser_state->pkg_end) {
field = acpi_ps_get_next_field(parser_state);
if (!field) {
if (arg) {
acpi_ps_free_field_list(arg);
}
return_ACPI_STATUS(AE_NO_MEMORY);
}
@ -820,6 +859,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,
acpi_ps_get_next_namepath(walk_state, parser_state,
arg,
ACPI_NOT_METHOD_CALL);
if (ACPI_FAILURE(status)) {
acpi_ps_free_op(arg);
return_ACPI_STATUS(status);
}
} else {
/* Single complex argument, nothing returned */
@ -854,6 +897,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,
acpi_ps_get_next_namepath(walk_state, parser_state,
arg,
ACPI_POSSIBLE_METHOD_CALL);
if (ACPI_FAILURE(status)) {
acpi_ps_free_op(arg);
return_ACPI_STATUS(status);
}
if (arg->common.aml_opcode == AML_INT_METHODCALL_OP) {

3
drivers/bluetooth/btmrvl_sdio.c
View File

@ -105,7 +105,7 @@ static int btmrvl_sdio_probe_of(struct device *dev,
} else {
ret = devm_request_irq(dev, cfg->irq_bt,
btmrvl_wake_irq_bt,
0, "bt_wake", card);
IRQF_NO_AUTOEN, "bt_wake", card);
if (ret) {
dev_err(dev,
"Failed to request irq_bt %d (%d)\n",
@ -114,7 +114,6 @@ static int btmrvl_sdio_probe_of(struct device *dev,
/* Configure wakeup (enabled by default) */
device_init_wakeup(dev, true);
disable_irq(cfg->irq_bt);
}
}

97
drivers/i2c/busses/i2c-xiic.c
View File

@ -23,7 +23,7 @@
#include <linux/platform_device.h>
#include <linux/i2c.h>
#include <linux/interrupt.h>
#include <linux/wait.h>
#include <linux/completion.h>
#include <linux/platform_data/i2c-xiic.h>
#include <linux/io.h>
#include <linux/slab.h>
@ -48,7 +48,7 @@ enum xiic_endian {
* struct xiic_i2c - Internal representation of the XIIC I2C bus
* @dev: Pointer to device structure
* @base: Memory base of the HW registers
* @wait: Wait queue for callers
* @completion: Completion for callers
* @adap: Kernel adapter representation
* @tx_msg: Messages from above to be sent
* @lock: Mutual exclusion
@ -64,7 +64,7 @@ enum xiic_endian {
struct xiic_i2c {
struct device *dev;
void __iomem *base;
wait_queue_head_t wait;
struct completion completion;
struct i2c_adapter adap;
struct i2c_msg *tx_msg;
struct mutex lock;
@ -160,6 +160,9 @@ struct xiic_i2c {
#define XIIC_PM_TIMEOUT 1000 /* ms */
/* timeout waiting for the controller to respond */
#define XIIC_I2C_TIMEOUT (msecs_to_jiffies(1000))
/* timeout waiting for the controller finish transfers */
#define XIIC_XFER_TIMEOUT (msecs_to_jiffies(10000))
/*
* The following constant is used for the device global interrupt enable
* register, to enable all interrupts for the device, this is the only bit
@ -170,7 +173,7 @@ struct xiic_i2c {
#define xiic_tx_space(i2c) ((i2c)->tx_msg->len - (i2c)->tx_pos)
#define xiic_rx_space(i2c) ((i2c)->rx_msg->len - (i2c)->rx_pos)
static int xiic_start_xfer(struct xiic_i2c *i2c);
static int xiic_start_xfer(struct xiic_i2c *i2c, struct i2c_msg *msgs, int num);
static void __xiic_start_xfer(struct xiic_i2c *i2c);
/*
@ -367,7 +370,7 @@ static void xiic_wakeup(struct xiic_i2c *i2c, int code)
i2c->rx_msg = NULL;
i2c->nmsgs = 0;
i2c->state = code;
wake_up(&i2c->wait);
complete(&i2c->completion);
}
static irqreturn_t xiic_process(int irq, void *dev_id)
@ -537,23 +540,11 @@ static int xiic_bus_busy(struct xiic_i2c *i2c)
return (sr & XIIC_SR_BUS_BUSY_MASK) ? -EBUSY : 0;
}
static int xiic_busy(struct xiic_i2c *i2c)
static int xiic_wait_not_busy(struct xiic_i2c *i2c)
{
int tries = 3;
int err;
if (i2c->tx_msg)
return -EBUSY;
/* In single master mode bus can only be busy, when in use by this
* driver. If the register indicates bus being busy for some reason we
* should ignore it, since bus will never be released and i2c will be
* stuck forever.
*/
if (i2c->singlemaster) {
return 0;
}
/* for instance if previous transfer was terminated due to TX error
* it might be that the bus is on it's way to become available
* give it at most 3 ms to wake
@ -701,15 +692,52 @@ static void __xiic_start_xfer(struct xiic_i2c *i2c)
}
static int xiic_start_xfer(struct xiic_i2c *i2c)
static int xiic_start_xfer(struct xiic_i2c *i2c, struct i2c_msg *msgs, int num)
{
int ret;
mutex_lock(&i2c->lock);
if (i2c->tx_msg || i2c->rx_msg) {
dev_err(i2c->adap.dev.parent,
"cannot start a transfer while busy\n");
ret = -EBUSY;
goto out;
}
/* In single master mode bus can only be busy, when in use by this
* driver. If the register indicates bus being busy for some reason we
* should ignore it, since bus will never be released and i2c will be
* stuck forever.
*/
if (!i2c->singlemaster) {
ret = xiic_wait_not_busy(i2c);
if (ret) {
/* If the bus is stuck in a busy state, such as due to spurious low
* pulses on the bus causing a false start condition to be detected,
* then try to recover by re-initializing the controller and check
* again if the bus is still busy.
*/
dev_warn(i2c->adap.dev.parent, "I2C bus busy timeout, reinitializing\n");
ret = xiic_reinit(i2c);
if (ret)
goto out;
ret = xiic_wait_not_busy(i2c);
if (ret)
goto out;
}
}
i2c->tx_msg = msgs;
i2c->rx_msg = NULL;
i2c->nmsgs = num;
init_completion(&i2c->completion);
ret = xiic_reinit(i2c);
if (!ret)
__xiic_start_xfer(i2c);
out:
mutex_unlock(&i2c->lock);
return ret;
@ -727,30 +755,26 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
if (err < 0)
return err;
err = xiic_busy(i2c);
if (err)
err = xiic_start_xfer(i2c, msgs, num);
if (err < 0)
goto out;
i2c->tx_msg = msgs;
i2c->nmsgs = num;
err = xiic_start_xfer(i2c);
if (err < 0) {
dev_err(adap->dev.parent, "Error xiic_start_xfer\n");
goto out;
}
if (wait_event_timeout(i2c->wait, (i2c->state == STATE_ERROR) ||
(i2c->state == STATE_DONE), HZ)) {
err = (i2c->state == STATE_DONE) ? num : -EIO;
goto out;
} else {
err = wait_for_completion_timeout(&i2c->completion, XIIC_XFER_TIMEOUT);
mutex_lock(&i2c->lock);
if (err == 0) { /* Timeout */
i2c->tx_msg = NULL;
i2c->rx_msg = NULL;
i2c->nmsgs = 0;
err = -ETIMEDOUT;
goto out;
} else if (err < 0) { /* Completion error */
i2c->tx_msg = NULL;
i2c->rx_msg = NULL;
i2c->nmsgs = 0;
} else {
err = (i2c->state == STATE_DONE) ? num : -EIO;
}
mutex_unlock(&i2c->lock);
out:
pm_runtime_mark_last_busy(i2c->dev);
pm_runtime_put_autosuspend(i2c->dev);
@ -813,7 +837,6 @@ static int xiic_i2c_probe(struct platform_device *pdev)
DRIVER_NAME " %s", pdev->name);
mutex_init(&i2c->lock);
init_waitqueue_head(&i2c->wait);
i2c->clk = devm_clk_get(&pdev->dev, NULL);
if (IS_ERR(i2c->clk)) {

7
drivers/media/usb/usbtv/usbtv-video.c
View File

@ -959,15 +959,8 @@ int usbtv_video_init(struct usbtv *usbtv)
void usbtv_video_free(struct usbtv *usbtv)
{
mutex_lock(&usbtv->vb2q_lock);
mutex_lock(&usbtv->v4l2_lock);
usbtv_stop(usbtv);
vb2_video_unregister_device(&usbtv->vdev);
v4l2_device_disconnect(&usbtv->v4l2_dev);
mutex_unlock(&usbtv->v4l2_lock);
mutex_unlock(&usbtv->vb2q_lock);
v4l2_device_put(&usbtv->v4l2_dev);
}

1
drivers/net/ethernet/hisilicon/hip04_eth.c
View File

@ -943,6 +943,7 @@ static int hip04_mac_probe(struct platform_device *pdev)
priv->tx_coalesce_timer.function = tx_done;
priv->map = syscon_node_to_regmap(arg.np);
of_node_put(arg.np);
if (IS_ERR(priv->map)) {
dev_warn(d, "no syscon hisilicon,hip04-ppe\n");
ret = PTR_ERR(priv->map);

1
drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
View File

@ -933,6 +933,7 @@ static int hns_mac_get_info(struct hns_mac_cb *mac_cb)
mac_cb->cpld_ctrl = NULL;
} else {
syscon = syscon_node_to_regmap(cpld_args.np);
of_node_put(cpld_args.np);
if (IS_ERR_OR_NULL(syscon)) {
dev_dbg(mac_cb->dev, "no cpld-syscon found!\n");
mac_cb->cpld_ctrl = NULL;

1
drivers/net/ethernet/hisilicon/hns_mdio.c
View File

@ -497,6 +497,7 @@ static int hns_mdio_probe(struct platform_device *pdev)
MDIO_SC_RESET_ST;
}
}
of_node_put(reg_args.np);
} else {
dev_warn(&pdev->dev, "find syscon ret = %#x\n", ret);
mdio_dev->subctrl_vbase = NULL;

6
drivers/net/ethernet/intel/ice/ice_sched.c
View File

@ -27,9 +27,8 @@ ice_sched_add_root_node(struct ice_port_info *pi,
if (!root)
return ICE_ERR_NO_MEMORY;
/* coverity[suspicious_sizeof] */
root->children = devm_kcalloc(ice_hw_to_dev(hw), hw->max_children[0],
sizeof(*root), GFP_KERNEL);
sizeof(*root->children), GFP_KERNEL);
if (!root->children) {
devm_kfree(ice_hw_to_dev(hw), root);
return ICE_ERR_NO_MEMORY;
@ -181,10 +180,9 @@ ice_sched_add_node(struct ice_port_info *pi, u8 layer,
if (!node)
return ICE_ERR_NO_MEMORY;
if (hw->max_children[layer]) {
/* coverity[suspicious_sizeof] */
node->children = devm_kcalloc(ice_hw_to_dev(hw),
hw->max_children[layer],
sizeof(*node), GFP_KERNEL);
sizeof(*node->children), GFP_KERNEL);
if (!node->children) {
devm_kfree(ice_hw_to_dev(hw), node);
return ICE_ERR_NO_MEMORY;

4
drivers/net/ethernet/lantiq_etop.c
View File

@ -464,7 +464,9 @@ ltq_etop_tx(struct sk_buff *skb, struct net_device *dev)
unsigned long flags;
u32 byte_offset;
len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len;
if (skb_put_padto(skb, ETH_ZLEN))
return NETDEV_TX_OK;
len = skb->len;
if ((desc->ctl & (LTQ_DMA_OWN | LTQ_DMA_C)) || ch->skb[ch->dma.desc]) {
netdev_err(dev, "tx ring full\n");

4
drivers/net/wireless/ath/ath9k/debug.c
View File

@ -1316,11 +1316,11 @@ void ath9k_get_et_stats(struct ieee80211_hw *hw,
struct ath_softc *sc = hw->priv;
int i = 0;
data[i++] = (sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BE)].tx_pkts_all +
data[i++] = ((u64)sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BE)].tx_pkts_all +
sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BK)].tx_pkts_all +
sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VI)].tx_pkts_all +
sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VO)].tx_pkts_all);
data[i++] = (sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BE)].tx_bytes_all +
data[i++] = ((u64)sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BE)].tx_bytes_all +
sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_BK)].tx_bytes_all +
sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VI)].tx_bytes_all +
sc->debug.stats.txstats[PR_QNUM(IEEE80211_AC_VO)].tx_bytes_all);

6
drivers/net/wireless/ath/ath9k/hif_usb.c
View File

@ -718,8 +718,7 @@ static void ath9k_hif_usb_rx_cb(struct urb *urb)
}
resubmit:
skb_reset_tail_pointer(skb);
skb_trim(skb, 0);
__skb_set_length(skb, 0);
usb_anchor_urb(urb, &hif_dev->rx_submitted);
ret = usb_submit_urb(urb, GFP_ATOMIC);
@ -756,8 +755,7 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
case -ESHUTDOWN:
goto free_skb;
default:
skb_reset_tail_pointer(skb);
skb_trim(skb, 0);
__skb_set_length(skb, 0);
goto resubmit;
}

5
drivers/net/xen-netback/hash.c
View File

@ -95,7 +95,7 @@ static u32 xenvif_new_hash(struct xenvif *vif, const u8 *data,
static void xenvif_flush_hash(struct xenvif *vif)
{
struct xenvif_hash_cache_entry *entry;
struct xenvif_hash_cache_entry *entry, *n;
unsigned long flags;
if (xenvif_hash_cache_size == 0)
@ -103,8 +103,7 @@ static void xenvif_flush_hash(struct xenvif *vif)
spin_lock_irqsave(&vif->hash.cache.lock, flags);
list_for_each_entry_rcu(entry, &vif->hash.cache.list, link,
lockdep_is_held(&vif->hash.cache.lock)) {
list_for_each_entry_safe(entry, n, &vif->hash.cache.list, link) {
list_del_rcu(&entry->link);
vif->hash.cache.count--;
kfree_rcu(entry, rcu);

15
fs/f2fs/file.c
View File

@ -2033,6 +2033,9 @@ static int f2fs_ioc_start_atomic_write(struct file *filp)
struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
int ret;
if (!(filp->f_mode & FMODE_WRITE))
return -EBADF;
if (!inode_owner_or_capable(inode))
return -EACCES;
@ -2103,6 +2106,9 @@ static int f2fs_ioc_commit_atomic_write(struct file *filp)
struct inode *inode = file_inode(filp);
int ret;
if (!(filp->f_mode & FMODE_WRITE))
return -EBADF;
if (!inode_owner_or_capable(inode))
return -EACCES;
@ -2145,6 +2151,9 @@ static int f2fs_ioc_start_volatile_write(struct file *filp)
struct inode *inode = file_inode(filp);
int ret;
if (!(filp->f_mode & FMODE_WRITE))
return -EBADF;
if (!inode_owner_or_capable(inode))
return -EACCES;
@ -2180,6 +2189,9 @@ static int f2fs_ioc_release_volatile_write(struct file *filp)
struct inode *inode = file_inode(filp);
int ret;
if (!(filp->f_mode & FMODE_WRITE))
return -EBADF;
if (!inode_owner_or_capable(inode))
return -EACCES;
@ -2209,6 +2221,9 @@ static int f2fs_ioc_abort_volatile_write(struct file *filp)
struct inode *inode = file_inode(filp);
int ret;
if (!(filp->f_mode & FMODE_WRITE))
return -EBADF;
if (!inode_owner_or_capable(inode))
return -EACCES;

52
net/bluetooth/l2cap_sock.c
View File

@ -745,7 +745,7 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
struct sock *sk = sock->sk;
struct l2cap_chan *chan = l2cap_pi(sk)->chan;
struct l2cap_options opts;
int len, err = 0;
int err = 0;
u32 opt;
BT_DBG("sk %p", sk);
@ -772,11 +772,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
opts.max_tx = chan->max_tx;
opts.txwin_size = chan->tx_win;
len = min_t(unsigned int, sizeof(opts), optlen);
if (copy_from_sockptr(&opts, optval, len)) {
err = -EFAULT;
err = bt_copy_from_sockptr(&opts, sizeof(opts), optval, optlen);
if (err)
break;
}
if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
err = -EINVAL;
@ -819,10 +817,9 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
break;
case L2CAP_LM:
if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
err = -EFAULT;
err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
if (err)
break;
}
if (opt & L2CAP_LM_FIPS) {
err = -EINVAL;
@ -903,7 +900,7 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
struct bt_security sec;
struct bt_power pwr;
struct l2cap_conn *conn;
int len, err = 0;
int err = 0;
u32 opt;
u16 mtu;
u8 mode;
@ -929,11 +926,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
sec.level = BT_SECURITY_LOW;
len = min_t(unsigned int, sizeof(sec), optlen);
if (copy_from_sockptr(&sec, optval, len)) {
err = -EFAULT;
err = bt_copy_from_sockptr(&sec, sizeof(sec), optval, optlen);
if (err)
break;
}
if (sec.level < BT_SECURITY_LOW ||
sec.level > BT_SECURITY_FIPS) {
@ -978,10 +973,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break;
}
if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
err = -EFAULT;
err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
if (err)
break;
}
if (opt) {
set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
@ -993,10 +987,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break;
case BT_FLUSHABLE:
if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
err = -EFAULT;
err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
if (err)
break;
}
if (opt > BT_FLUSHABLE_ON) {
err = -EINVAL;
@ -1028,11 +1021,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
len = min_t(unsigned int, sizeof(pwr), optlen);
if (copy_from_sockptr(&pwr, optval, len)) {
err = -EFAULT;
err = bt_copy_from_sockptr(&pwr, sizeof(pwr), optval, optlen);
if (err)
break;
}
if (pwr.force_active)
set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
@ -1041,10 +1032,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break;
case BT_CHANNEL_POLICY:
if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
err = -EFAULT;
err = bt_copy_from_sockptr(&opt, sizeof(opt), optval, optlen);
if (err)
break;
}
if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
err = -EINVAL;
@ -1089,10 +1079,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break;
}
if (copy_from_sockptr(&mtu, optval, sizeof(u16))) {
err = -EFAULT;
err = bt_copy_from_sockptr(&mtu, sizeof(mtu), optval, optlen);
if (err)
break;
}
if (chan->mode == L2CAP_MODE_EXT_FLOWCTL &&
sk->sk_state == BT_CONNECTED)
@ -1120,10 +1109,9 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
break;
}
if (copy_from_sockptr(&mode, optval, sizeof(u8))) {
err = -EFAULT;
err = bt_copy_from_sockptr(&mode, sizeof(mode), optval, optlen);
if (err)
break;
}
BT_DBG("mode %u", mode);

12
net/core/dev.c
View File

@ -3764,7 +3764,7 @@ static void qdisc_pkt_len_init(struct sk_buff *skb)
sizeof(_tcphdr), &_tcphdr);
if (likely(th))
hdr_len += __tcp_hdrlen(th);
} else {
} else if (shinfo->gso_type & SKB_GSO_UDP_L4) {
struct udphdr _udphdr;
if (skb_header_pointer(skb, skb_transport_offset(skb),
@ -3772,10 +3772,14 @@ static void qdisc_pkt_len_init(struct sk_buff *skb)
hdr_len += sizeof(struct udphdr);
}
if (shinfo->gso_type & SKB_GSO_DODGY)
gso_segs = DIV_ROUND_UP(skb->len - hdr_len,
shinfo->gso_size);
if (unlikely(shinfo->gso_type & SKB_GSO_DODGY)) {
int payload = skb->len - hdr_len;
/* Malicious packet. */
if (payload <= 0)
return;
gso_segs = DIV_ROUND_UP(payload, shinfo->gso_size);
}
qdisc_skb_cb(skb)->pkt_len += (gso_segs - 1) * hdr_len;
}
}

6
net/ipv4/ip_gre.c
View File

@ -639,11 +639,11 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
if (skb_cow_head(skb, 0))
goto free_skb;
tnl_params = (const struct iphdr *)skb->data;
if (!pskb_network_may_pull(skb, pull_len))
if (!pskb_may_pull(skb, pull_len))
goto free_skb;
tnl_params = (const struct iphdr *)skb->data;
/* ip_tunnel_xmit() needs skb->data pointing to gre header. */
skb_pull(skb, pull_len);
skb_reset_mac_header(skb);

4
net/sctp/socket.c
View File

@ -8288,8 +8288,10 @@ static int sctp_listen_start(struct sock *sk, int backlog)
*/
inet_sk_set_state(sk, SCTP_SS_LISTENING);
if (!ep->base.bind_addr.port) {
if (sctp_autobind(sk))
if (sctp_autobind(sk)) {
inet_sk_set_state(sk, SCTP_SS_CLOSED);
return -EAGAIN;
}
} else {
if (sctp_get_port(sk, inet_sk(sk)->inet_num)) {
inet_sk_set_state(sk, SCTP_SS_CLOSED);

4
sound/core/oss/mixer_oss.c
View File

@ -957,8 +957,8 @@ static void snd_mixer_oss_slot_free(struct snd_mixer_oss_slot *chn)
struct slot *p = chn->private_data;
if (p) {
if (p->allocated && p->assigned) {
kfree_const(p->assigned->name);
kfree_const(p->assigned);
kfree(p->assigned->name);
kfree(p->assigned);
}
kfree(p);
}

4
sound/pci/hda/hda_generic.c
View File

@ -1377,7 +1377,7 @@ static int try_assign_dacs(struct hda_codec *codec, int num_outs,
struct nid_path *path;
hda_nid_t pin = pins[i];
if (!spec->obey_preferred_dacs) {
if (!spec->preferred_dacs) {
path = snd_hda_get_path_from_idx(codec, path_idx[i]);
if (path) {
badness += assign_out_path_ctls(codec, path);
@ -1389,7 +1389,7 @@ static int try_assign_dacs(struct hda_codec *codec, int num_outs,
if (dacs[i]) {
if (is_dac_already_used(codec, dacs[i]))
badness += bad->shared_primary;
} else if (spec->obey_preferred_dacs) {
} else if (spec->preferred_dacs) {
badness += BAD_NO_PRIMARY_DAC;
}

24
sound/pci/hda/patch_conexant.c
View File

@ -747,6 +747,23 @@ static const struct hda_pintbl cxt_pincfg_sws_js201d[] = {
{}
};
/* pincfg quirk for Tuxedo Sirius;
* unfortunately the (PCI) SSID conflicts with System76 Pangolin pang14,
* which has incompatible pin setup, so we check the codec SSID (luckily
* different one!) and conditionally apply the quirk here
*/
static void cxt_fixup_sirius_top_speaker(struct hda_codec *codec,
const struct hda_fixup *fix,
int action)
{
/* ignore for incorrectly picked-up pang14 */
if (codec->core.subsystem_id == 0x278212b3)
return;
/* set up the top speaker pin */
if (action == HDA_FIXUP_ACT_PRE_PROBE)
snd_hda_codec_set_pincfg(codec, 0x1d, 0x82170111);
}
static const struct hda_fixup cxt_fixups[] = {
[CXT_PINCFG_LENOVO_X200] = {
.type = HDA_FIXUP_PINS,
@ -907,11 +924,8 @@ static const struct hda_fixup cxt_fixups[] = {
.v.pins = cxt_pincfg_sws_js201d,
},
[CXT_PINCFG_TOP_SPEAKER] = {
.type = HDA_FIXUP_PINS,
.v.pins = (const struct hda_pintbl[]) {
{ 0x1d, 0x82170111 },
{ }
},
.type = HDA_FIXUP_FUNC,
.v.func = cxt_fixup_sirius_top_speaker,
},
};

1
sound/pci/hda/patch_realtek.c
View File

@ -578,6 +578,7 @@ static void alc_shutup_pins(struct hda_codec *codec)
switch (codec->core.vendor_id) {
case 0x10ec0236:
case 0x10ec0256:
case 0x10ec0257:
case 0x19e58326:
case 0x10ec0283:
case 0x10ec0285: