Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dab19c75 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge 3.18.76 into android-3.18 



Changes in 3.18.76
	ext4: in ext4_seek_{hole,data}, return -ENXIO for negative offsets
	CIFS: Reconnect expired SMB sessions
	HID: usbhid: fix out-of-bounds bug
	crypto: shash - Fix zero-length shash ahash digest crash
	KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit
	usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet
	iommu/amd: Finish TLB flush in amd_iommu_unmap()
	ALSA: usb-audio: Kill stray URB at exiting
	ALSA: seq: Fix use-after-free at creating a port
	ALSA: seq: Fix copy_from_user() call inside lock
	ALSA: caiaq: Fix stray URB at probe error path
	usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options
	direct-io: Prevent NULL pointer access in submit_page_section
	fix unbalanced page refcounting in bio_map_user_iov
	USB: serial: cp210x: add support for ELV TFD500
	USB: serial: option: add support for TP-Link LTE module
	USB: serial: qcserial: add Dell DW5818, DW5819
	USB: serial: console: fix use-after-free after failed setup
	ALSA: seq: Fix missing NULL check at remove_events ioctl
	Revert "usb: gadget: inode.c: fix unbalanced spin_lock in ep0_write"
	Linux 3.18.76

Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
parents a7f6d237 1e8e6b30

Makefile

+1 −1
Original line number Diff line number Diff line 
VERSION = 3

PATCHLEVEL = 18

SUBLEVEL = 75

SUBLEVEL = 76

EXTRAVERSION =

NAME = Diseased Newt

arch/x86/kvm/vmx.c

+1 −1
Original line number Diff line number Diff line
@@ -8904,7 +8904,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu, 
	 * (KVM doesn't change it)- no reason to call set_cr4_guest_host_mask();

	 */

	vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK);

	kvm_set_cr4(vcpu, vmcs12->host_cr4);

	vmx_set_cr4(vcpu, vmcs12->host_cr4);



	nested_ept_uninit_mmu_context(vcpu);

block/bio.c

+8 −0
Original line number Diff line number Diff line
@@ -1338,6 +1338,7 @@ static struct bio *__bio_map_user_iov(struct request_queue *q, 
		offset = uaddr & ~PAGE_MASK;

		for (j = cur_page; j < page_limit; j++) {

			unsigned int bytes = PAGE_SIZE - offset;

			unsigned short prev_bi_vcnt = bio->bi_vcnt;



			if (len <= 0)

				break;
@@ -1352,6 +1353,13 @@ static struct bio *__bio_map_user_iov(struct request_queue *q, 
					    bytes)

				break;



			/*

			 * check if vector was merged with previous

			 * drop page reference if needed

			 */

			if (bio->bi_vcnt == prev_bi_vcnt)

				put_page(pages[j]);



			len -= bytes;

			offset = 0;

		}

crypto/shash.c

+5 −3
Original line number Diff line number Diff line
@@ -274,12 +274,14 @@ static int shash_async_finup(struct ahash_request *req) 


int shash_ahash_digest(struct ahash_request *req, struct shash_desc *desc)

{

	struct scatterlist *sg = req->src;

	unsigned int offset = sg->offset;

	unsigned int nbytes = req->nbytes;

	struct scatterlist *sg;

	unsigned int offset;

	int err;



	if (nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset)) {

	if (nbytes &&

	    (sg = req->src, offset = sg->offset,

	     nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset))) {

		void *data;



		data = kmap_atomic(sg_page(sg));

drivers/hid/usbhid/hid-core.c

+11 −1
Original line number Diff line number Diff line
@@ -959,6 +959,8 @@ static int usbhid_parse(struct hid_device *hid) 
	unsigned int rsize = 0;

	char *rdesc;

	int ret, n;

	int num_descriptors;

	size_t offset = offsetof(struct hid_descriptor, desc);



	quirks = usbhid_lookup_quirk(le16_to_cpu(dev->descriptor.idVendor),

			le16_to_cpu(dev->descriptor.idProduct));
@@ -981,10 +983,18 @@ static int usbhid_parse(struct hid_device *hid) 
		return -ENODEV;

	}



	if (hdesc->bLength < sizeof(struct hid_descriptor)) {

		dbg_hid("hid descriptor is too short\n");

		return -EINVAL;

	}



	hid->version = le16_to_cpu(hdesc->bcdHID);

	hid->country = hdesc->bCountryCode;



	for (n = 0; n < hdesc->bNumDescriptors; n++)

	num_descriptors = min_t(int, hdesc->bNumDescriptors,

	       (hdesc->bLength - offset) / sizeof(struct hid_class_descriptor));



	for (n = 0; n < num_descriptors; n++)

		if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)

			rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);