Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit 6c4be498 authored by derfelot's avatar derfelot
Browse files

Merge Linux 4.4.292 kernel 

Changes in 4.4.292: (20 commits)
        scsi: core: Put LLD module refcnt after SCSI device is released
        ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"
        net: hso: register netdev later to avoid a race condition
        IB/qib: Use struct_size() helper
        IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields
        usb: gadget: Mark USB_FSL_QE broken on 64-bit
        usb-storage: Add compatibility quirk flags for iODD 2531/2541
        printk/console: Allow to disable console output by using console="" or consol...
        usb: hso: fix error handling code of hso_create_net_device
        isofs: Fix out of bound access for corrupted isofs image
        comedi: dt9812: fix DMA buffers on stack
        comedi: ni_usb6501: fix NULL-deref in command paths
        staging: comedi: drivers: replace le16_to_cpu() with usb_endpoint_maxp()
        comedi: vmk80xx: fix transfer-buffer overflows
        comedi: vmk80xx: fix bulk-buffer overflow
        comedi: vmk80xx: fix bulk and interrupt message timeouts
        staging: r8712u: fix control-message timeout
        staging: rtl8192u: fix control-message timeouts
        rsi: fix control-message timeout
        Linux 4.4.292
parents 378fb240 18dc3b94

Makefile

+1 −1
Original line number Diff line number Diff line 
VERSION = 4

PATCHLEVEL = 4

SUBLEVEL = 291

SUBLEVEL = 292

EXTRAVERSION =

NAME = Blurry Fish Butt

drivers/amba/bus.c

+0 −3
Original line number Diff line number Diff line
@@ -360,9 +360,6 @@ int amba_device_add(struct amba_device *dev, struct resource *parent) 
	void __iomem *tmp;

	int i, ret;



	WARN_ON(dev->irq[0] == (unsigned int)-1);

	WARN_ON(dev->irq[1] == (unsigned int)-1);



	ret = request_resource(parent, &dev->res);

	if (ret)

		goto err_out;

drivers/infiniband/hw/qib/qib_user_sdma.c

+25 −10
Original line number Diff line number Diff line
@@ -41,6 +41,7 @@ 
#include <linux/rbtree.h>

#include <linux/spinlock.h>

#include <linux/delay.h>

#include <linux/overflow.h>



#include "qib.h"

#include "qib_user_sdma.h"
@@ -606,7 +607,7 @@ done: 
/*

 * How many pages in this iovec element?

 */

static int qib_user_sdma_num_pages(const struct iovec *iov)

static size_t qib_user_sdma_num_pages(const struct iovec *iov)

{

	const unsigned long addr  = (unsigned long) iov->iov_base;

	const unsigned long  len  = iov->iov_len;
@@ -662,7 +663,7 @@ static void qib_user_sdma_free_pkt_frag(struct device *dev, 
static int qib_user_sdma_pin_pages(const struct qib_devdata *dd,

				   struct qib_user_sdma_queue *pq,

				   struct qib_user_sdma_pkt *pkt,

				   unsigned long addr, int tlen, int npages)

				   unsigned long addr, int tlen, size_t npages)

{

	struct page *pages[8];

	int i, j;
@@ -726,7 +727,7 @@ static int qib_user_sdma_pin_pkt(const struct qib_devdata *dd, 
	unsigned long idx;



	for (idx = 0; idx < niov; idx++) {

		const int npages = qib_user_sdma_num_pages(iov + idx);

		const size_t npages = qib_user_sdma_num_pages(iov + idx);

		const unsigned long addr = (unsigned long) iov[idx].iov_base;



		ret = qib_user_sdma_pin_pages(dd, pq, pkt, addr,
@@ -828,8 +829,8 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, 
		unsigned pktnw;

		unsigned pktnwc;

		int nfrags = 0;

		int npages = 0;

		int bytes_togo = 0;

		size_t npages = 0;

		size_t bytes_togo = 0;

		int tiddma = 0;

		int cfur;
@@ -889,7 +890,11 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, 


			npages += qib_user_sdma_num_pages(&iov[idx]);



			bytes_togo += slen;

			if (check_add_overflow(bytes_togo, slen, &bytes_togo) ||

			    bytes_togo > type_max(typeof(pkt->bytes_togo))) {

				ret = -EINVAL;

				goto free_pbc;

			}

			pktnwc += slen >> 2;

			idx++;

			nfrags++;
@@ -908,10 +913,10 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, 
		}



		if (frag_size) {

			int pktsize, tidsmsize, n;

			size_t tidsmsize, n, pktsize, sz, addrlimit;



			n = npages*((2*PAGE_SIZE/frag_size)+1);

			pktsize = sizeof(*pkt) + sizeof(pkt->addr[0])*n;

			pktsize = struct_size(pkt, addr, n);



			/*

			 * Determine if this is tid-sdma or just sdma.
@@ -926,14 +931,24 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, 
			else

				tidsmsize = 0;



			pkt = kmalloc(pktsize+tidsmsize, GFP_KERNEL);

			if (check_add_overflow(pktsize, tidsmsize, &sz)) {

				ret = -EINVAL;

				goto free_pbc;

			}

			pkt = kmalloc(sz, GFP_KERNEL);

			if (!pkt) {

				ret = -ENOMEM;

				goto free_pbc;

			}

			pkt->largepkt = 1;

			pkt->frag_size = frag_size;

			pkt->addrlimit = n + ARRAY_SIZE(pkt->addr);

			if (check_add_overflow(n, ARRAY_SIZE(pkt->addr),

					       &addrlimit) ||

			    addrlimit > type_max(typeof(pkt->addrlimit))) {

				ret = -EINVAL;

				goto free_pbc;

			}

			pkt->addrlimit = addrlimit;



			if (tiddma) {

				char *tidsm = (char *)pkt + pktsize;

drivers/net/usb/hso.c

+29 −16
Original line number Diff line number Diff line
@@ -2522,7 +2522,7 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface, 
			   hso_net_init);

	if (!net) {

		dev_err(&interface->dev, "Unable to create ethernet device\n");

		goto exit;

		goto err_hso_dev;

	}



	hso_net = netdev_priv(net);
@@ -2535,54 +2535,67 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface, 
				      USB_DIR_IN);

	if (!hso_net->in_endp) {

		dev_err(&interface->dev, "Can't find BULK IN endpoint\n");

		goto exit;

		goto err_net;

	}

	hso_net->out_endp = hso_get_ep(interface, USB_ENDPOINT_XFER_BULK,

				       USB_DIR_OUT);

	if (!hso_net->out_endp) {

		dev_err(&interface->dev, "Can't find BULK OUT endpoint\n");

		goto exit;

		goto err_net;

	}

	SET_NETDEV_DEV(net, &interface->dev);

	SET_NETDEV_DEVTYPE(net, &hso_type);



	/* registering our net device */

	result = register_netdev(net);

	if (result) {

		dev_err(&interface->dev, "Failed to register device\n");

		goto exit;

	}



	/* start allocating */

	for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) {

		hso_net->mux_bulk_rx_urb_pool[i] = usb_alloc_urb(0, GFP_KERNEL);

		if (!hso_net->mux_bulk_rx_urb_pool[i]) {

			dev_err(&interface->dev, "Could not allocate rx urb\n");

			goto exit;

			goto err_mux_bulk_rx;

		}

		hso_net->mux_bulk_rx_buf_pool[i] = kzalloc(MUX_BULK_RX_BUF_SIZE,

							   GFP_KERNEL);

		if (!hso_net->mux_bulk_rx_buf_pool[i])

			goto exit;

			goto err_mux_bulk_rx;

	}

	hso_net->mux_bulk_tx_urb = usb_alloc_urb(0, GFP_KERNEL);

	if (!hso_net->mux_bulk_tx_urb) {

		dev_err(&interface->dev, "Could not allocate tx urb\n");

		goto exit;

		goto err_mux_bulk_rx;

	}

	hso_net->mux_bulk_tx_buf = kzalloc(MUX_BULK_TX_BUF_SIZE, GFP_KERNEL);

	if (!hso_net->mux_bulk_tx_buf)

		goto exit;

		goto err_free_tx_urb;



	add_net_device(hso_dev);



	/* registering our net device */

	result = register_netdev(net);

	if (result) {

		dev_err(&interface->dev, "Failed to register device\n");

		goto err_free_tx_buf;

	}



	hso_log_port(hso_dev);



	hso_create_rfkill(hso_dev, interface);



	return hso_dev;

exit:

	hso_free_net_device(hso_dev);



err_free_tx_buf:

	remove_net_device(hso_dev);

	kfree(hso_net->mux_bulk_tx_buf);

err_free_tx_urb:

	usb_free_urb(hso_net->mux_bulk_tx_urb);

err_mux_bulk_rx:

	for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) {

		usb_free_urb(hso_net->mux_bulk_rx_urb_pool[i]);

		kfree(hso_net->mux_bulk_rx_buf_pool[i]);

	}

err_net:

	free_netdev(net);

err_hso_dev:

	kfree(hso_dev);

	return NULL;

}

drivers/net/wireless/rsi/rsi_91x_usb.c

+1 −1
Original line number Diff line number Diff line
@@ -42,7 +42,7 @@ static int rsi_usb_card_write(struct rsi_hw *adapter, 
			      buf,

			      len,

			      &transfer,

			      HZ * 5);

			      USB_CTRL_SET_TIMEOUT);



	if (status < 0) {

		rsi_dbg(ERR_ZONE,