--- /dev/null
+From f18ebc211e259d4f591e39e74b2aa2de226c9a1d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 5 May 2016 16:23:04 +0300
+Subject: ACPI / sysfs: fix error code in get_status()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit f18ebc211e259d4f591e39e74b2aa2de226c9a1d upstream.
+
+The problem with ornamental, do-nothing gotos is that they lead to
+"forgot to set the error code" bugs. We should be returning -EINVAL
+here but we don't. It leads to an uninitalized variable in
+counter_show():
+
+ drivers/acpi/sysfs.c:603 counter_show()
+ error: uninitialized symbol 'status'.
+
+Fixes: 1c8fce27e275 (ACPI: introduce drivers/acpi/sysfs.c)
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/sysfs.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/acpi/sysfs.c
++++ b/drivers/acpi/sysfs.c
+@@ -494,23 +494,22 @@ static void acpi_global_event_handler(u3
+ static int get_status(u32 index, acpi_event_status *status,
+ acpi_handle *handle)
+ {
+- int result = 0;
++ int result;
+
+ if (index >= num_gpes + ACPI_NUM_FIXED_EVENTS)
+- goto end;
++ return -EINVAL;
+
+ if (index < num_gpes) {
+ result = acpi_get_gpe_device(index, handle);
+ if (result) {
+ ACPI_EXCEPTION((AE_INFO, AE_NOT_FOUND,
+ "Invalid GPE 0x%x", index));
+- goto end;
++ return result;
+ }
+ result = acpi_get_gpe_status(*handle, index, status);
+ } else if (index < (num_gpes + ACPI_NUM_FIXED_EVENTS))
+ result = acpi_get_event_status(index - num_gpes, status);
+
+-end:
+ return result;
+ }
+
--- /dev/null
+From e514cc0a492a3f39ef71b31590a7ef67537ee04b Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 15 Jul 2016 14:09:13 +0300
+Subject: crypto: nx - off by one bug in nx_of_update_msc()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit e514cc0a492a3f39ef71b31590a7ef67537ee04b upstream.
+
+The props->ap[] array is defined like this:
+
+ struct alg_props ap[NX_MAX_FC][NX_MAX_MODE][3];
+
+So we can see that if msc->fc and msc->mode are == to NX_MAX_FC or
+NX_MAX_MODE then we're off by one.
+
+Fixes: ae0222b7289d ('powerpc/crypto: nx driver code supporting nx encryption')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/crypto/nx/nx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/crypto/nx/nx.c
++++ b/drivers/crypto/nx/nx.c
+@@ -330,7 +330,7 @@ static void nx_of_update_msc(struct devi
+ ((bytes_so_far + sizeof(struct msc_triplet)) <= lenp) &&
+ i < msc->triplets;
+ i++) {
+- if (msc->fc > NX_MAX_FC || msc->mode > NX_MAX_MODE) {
++ if (msc->fc >= NX_MAX_FC || msc->mode >= NX_MAX_MODE) {
+ dev_err(dev, "unknown function code/mode "
+ "combo: %d/%d (ignored)\n", msc->fc,
+ msc->mode);
--- /dev/null
+From 4097461897df91041382ff6fcd2bfa7ee6b2448c Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Mon, 25 Jul 2016 11:36:54 -0700
+Subject: Input: i8042 - break load dependency between atkbd/psmouse and i8042
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 4097461897df91041382ff6fcd2bfa7ee6b2448c upstream.
+
+As explained in 1407814240-4275-1-git-send-email-decui@microsoft.com we
+have a hard load dependency between i8042 and atkbd which prevents
+keyboard from working on Gen2 Hyper-V VMs.
+
+> hyperv_keyboard invokes serio_interrupt(), which needs a valid serio
+> driver like atkbd.c. atkbd.c depends on libps2.c because it invokes
+> ps2_command(). libps2.c depends on i8042.c because it invokes
+> i8042_check_port_owner(). As a result, hyperv_keyboard actually
+> depends on i8042.c.
+>
+> For a Generation 2 Hyper-V VM (meaning no i8042 device emulated), if a
+> Linux VM (like Arch Linux) happens to configure CONFIG_SERIO_I8042=m
+> rather than =y, atkbd.ko can't load because i8042.ko can't load(due to
+> no i8042 device emulated) and finally hyperv_keyboard can't work and
+> the user can't input: https://bugs.archlinux.org/task/39820
+> (Ubuntu/RHEL/SUSE aren't affected since they use CONFIG_SERIO_I8042=y)
+
+To break the dependency we move away from using i8042_check_port_owner()
+and instead allow serio port owner specify a mutex that clients should use
+to serialize PS/2 command stream.
+
+Reported-by: Mark Laws <mdl@60hz.org>
+Tested-by: Mark Laws <mdl@60hz.org>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/serio/i8042.c | 16 +---------------
+ drivers/input/serio/libps2.c | 10 ++++------
+ include/linux/i8042.h | 6 ------
+ include/linux/serio.h | 24 +++++++++++++++++++-----
+ 4 files changed, 24 insertions(+), 32 deletions(-)
+
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -1230,6 +1230,7 @@ static int __init i8042_create_kbd_port(
+ serio->start = i8042_start;
+ serio->stop = i8042_stop;
+ serio->close = i8042_port_close;
++ serio->ps2_cmd_mutex = &i8042_mutex;
+ serio->port_data = port;
+ serio->dev.parent = &i8042_platform_device->dev;
+ strlcpy(serio->name, "i8042 KBD port", sizeof(serio->name));
+@@ -1321,21 +1322,6 @@ static void i8042_unregister_ports(void)
+ }
+ }
+
+-/*
+- * Checks whether port belongs to i8042 controller.
+- */
+-bool i8042_check_port_owner(const struct serio *port)
+-{
+- int i;
+-
+- for (i = 0; i < I8042_NUM_PORTS; i++)
+- if (i8042_ports[i].serio == port)
+- return true;
+-
+- return false;
+-}
+-EXPORT_SYMBOL(i8042_check_port_owner);
+-
+ static void i8042_free_irqs(void)
+ {
+ if (i8042_aux_irq_registered)
+--- a/drivers/input/serio/libps2.c
++++ b/drivers/input/serio/libps2.c
+@@ -56,19 +56,17 @@ EXPORT_SYMBOL(ps2_sendbyte);
+
+ void ps2_begin_command(struct ps2dev *ps2dev)
+ {
+- mutex_lock(&ps2dev->cmd_mutex);
++ struct mutex *m = ps2dev->serio->ps2_cmd_mutex ?: &ps2dev->cmd_mutex;
+
+- if (i8042_check_port_owner(ps2dev->serio))
+- i8042_lock_chip();
++ mutex_lock(m);
+ }
+ EXPORT_SYMBOL(ps2_begin_command);
+
+ void ps2_end_command(struct ps2dev *ps2dev)
+ {
+- if (i8042_check_port_owner(ps2dev->serio))
+- i8042_unlock_chip();
++ struct mutex *m = ps2dev->serio->ps2_cmd_mutex ?: &ps2dev->cmd_mutex;
+
+- mutex_unlock(&ps2dev->cmd_mutex);
++ mutex_unlock(m);
+ }
+ EXPORT_SYMBOL(ps2_end_command);
+
+--- a/include/linux/i8042.h
++++ b/include/linux/i8042.h
+@@ -62,7 +62,6 @@ struct serio;
+ void i8042_lock_chip(void);
+ void i8042_unlock_chip(void);
+ int i8042_command(unsigned char *param, int command);
+-bool i8042_check_port_owner(const struct serio *);
+ int i8042_install_filter(bool (*filter)(unsigned char data, unsigned char str,
+ struct serio *serio));
+ int i8042_remove_filter(bool (*filter)(unsigned char data, unsigned char str,
+@@ -83,11 +82,6 @@ static inline int i8042_command(unsigned
+ return -ENODEV;
+ }
+
+-static inline bool i8042_check_port_owner(const struct serio *serio)
+-{
+- return false;
+-}
+-
+ static inline int i8042_install_filter(bool (*filter)(unsigned char data, unsigned char str,
+ struct serio *serio))
+ {
+--- a/include/linux/serio.h
++++ b/include/linux/serio.h
+@@ -29,7 +29,8 @@ struct serio {
+
+ struct serio_device_id id;
+
+- spinlock_t lock; /* protects critical sections from port's interrupt handler */
++ /* Protects critical sections from port's interrupt handler */
++ spinlock_t lock;
+
+ int (*write)(struct serio *, unsigned char);
+ int (*open)(struct serio *);
+@@ -38,16 +39,29 @@ struct serio {
+ void (*stop)(struct serio *);
+
+ struct serio *parent;
+- struct list_head child_node; /* Entry in parent->children list */
++ /* Entry in parent->children list */
++ struct list_head child_node;
+ struct list_head children;
+- unsigned int depth; /* level of nesting in serio hierarchy */
++ /* Level of nesting in serio hierarchy */
++ unsigned int depth;
+
+- struct serio_driver *drv; /* accessed from interrupt, must be protected by serio->lock and serio->sem */
+- struct mutex drv_mutex; /* protects serio->drv so attributes can pin driver */
++ /*
++ * serio->drv is accessed from interrupt handlers; when modifying
++ * caller should acquire serio->drv_mutex and serio->lock.
++ */
++ struct serio_driver *drv;
++ /* Protects serio->drv so attributes can pin current driver */
++ struct mutex drv_mutex;
+
+ struct device dev;
+
+ struct list_head node;
++
++ /*
++ * For use by PS/2 layer when several ports share hardware and
++ * may get indigestion when exposed to concurrent access (i8042).
++ */
++ struct mutex *ps2_cmd_mutex;
+ };
+ #define to_serio_port(d) container_of(d, struct serio, dev)
+
--- /dev/null
+From 47af45d684b5f3ae000ad448db02ce4f13f73273 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Tue, 16 Aug 2016 17:38:54 -0700
+Subject: Input: i8042 - set up shared ps2_cmd_mutex for AUX ports
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 47af45d684b5f3ae000ad448db02ce4f13f73273 upstream.
+
+The commit 4097461897df ("Input: i8042 - break load dependency ...")
+correctly set up ps2_cmd_mutex pointer for the KBD port but forgot to do
+the same for AUX port(s), which results in communication on KBD and AUX
+ports to clash with each other.
+
+Fixes: 4097461897df ("Input: i8042 - break load dependency ...")
+Reported-by: Bruno Wolff III <bruno@wolff.to>
+Tested-by: Bruno Wolff III <bruno@wolff.to>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/serio/i8042.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -1258,6 +1258,7 @@ static int __init i8042_create_aux_port(
+ serio->write = i8042_aux_write;
+ serio->start = i8042_start;
+ serio->stop = i8042_stop;
++ serio->ps2_cmd_mutex = &i8042_mutex;
+ serio->port_data = port;
+ serio->dev.parent = &i8042_platform_device->dev;
+ if (idx < 0) {
--- /dev/null
+From fae16989be77b09bab86c79233e4b511ea769cea Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Mon, 22 Aug 2016 13:25:56 -0700
+Subject: Input: tegra-kbc - fix inverted reset logic
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+commit fae16989be77b09bab86c79233e4b511ea769cea upstream.
+
+Commit fe6b0dfaba68 ("Input: tegra-kbc - use reset framework")
+accidentally converted _deassert to _assert, so there is no code
+to wake up this hardware.
+
+Fixes: fe6b0dfaba68 ("Input: tegra-kbc - use reset framework")
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Acked-by: Laxman Dewangan <ldewangan@nvidia.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/keyboard/tegra-kbc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/keyboard/tegra-kbc.c
++++ b/drivers/input/keyboard/tegra-kbc.c
+@@ -376,7 +376,7 @@ static int tegra_kbc_start(struct tegra_
+ /* Reset the KBC controller to clear all previous status.*/
+ reset_control_assert(kbc->rst);
+ udelay(100);
+- reset_control_assert(kbc->rst);
++ reset_control_deassert(kbc->rst);
+ udelay(100);
+
+ tegra_kbc_config_pins(kbc);
megaraid_sas-fix-probing-cards-without-io-port.patch
gpio-fix-of-build-problem-on-um.patch
fs-seq_file-fix-out-of-bounds-read.patch
+input-tegra-kbc-fix-inverted-reset-logic.patch
+input-i8042-break-load-dependency-between-atkbd-psmouse-and-i8042.patch
+input-i8042-set-up-shared-ps2_cmd_mutex-for-aux-ports.patch
+crypto-nx-off-by-one-bug-in-nx_of_update_msc.patch
+usb-fix-typo-in-wmaxpacketsize-validation.patch
+usb-serial-mos7720-fix-non-atomic-allocation-in-write-path.patch
+usb-serial-mos7840-fix-non-atomic-allocation-in-write-path.patch
+staging-comedi-daqboard2000-bug-fix-board-type-matching-code.patch
+acpi-sysfs-fix-error-code-in-get_status.patch
--- /dev/null
+From 80e162ee9b31d77d851b10f8c5299132be1e120f Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Wed, 29 Jun 2016 20:27:44 +0100
+Subject: staging: comedi: daqboard2000: bug fix board type matching code
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit 80e162ee9b31d77d851b10f8c5299132be1e120f upstream.
+
+`daqboard2000_find_boardinfo()` is supposed to check if the
+DaqBoard/2000 series model is supported, based on the PCI subvendor and
+subdevice ID. The current code is wrong as it is comparing the PCI
+device's subdevice ID to an expected, fixed value for the subvendor ID.
+It should be comparing the PCI device's subvendor ID to this fixed
+value. Correct it.
+
+Fixes: 7e8401b23e7f ("staging: comedi: daqboard2000: add back subsystem_device check")
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers/daqboard2000.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/comedi/drivers/daqboard2000.c
++++ b/drivers/staging/comedi/drivers/daqboard2000.c
+@@ -658,7 +658,7 @@ static const void *daqboard2000_find_boa
+ const struct daq200_boardtype *board;
+ int i;
+
+- if (pcidev->subsystem_device != PCI_VENDOR_ID_IOTECH)
++ if (pcidev->subsystem_vendor != PCI_VENDOR_ID_IOTECH)
+ return NULL;
+
+ for (i = 0; i < ARRAY_SIZE(boardtypes); i++) {
--- /dev/null
+From 6c73358c83ce870c0cf32413e5cadb3b9a39c606 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 22 Aug 2016 16:58:53 -0400
+Subject: USB: fix typo in wMaxPacketSize validation
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 6c73358c83ce870c0cf32413e5cadb3b9a39c606 upstream.
+
+The maximum value allowed for wMaxPacketSize of a high-speed interrupt
+endpoint is 1024 bytes, not 1023.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Fixes: aed9d65ac327 ("USB: validate wMaxPacketValue entries in endpoint descriptors")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/config.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -159,7 +159,7 @@ static const unsigned short high_speed_m
+ [USB_ENDPOINT_XFER_CONTROL] = 64,
+ [USB_ENDPOINT_XFER_ISOC] = 1024,
+ [USB_ENDPOINT_XFER_BULK] = 512,
+- [USB_ENDPOINT_XFER_INT] = 1023,
++ [USB_ENDPOINT_XFER_INT] = 1024,
+ };
+ static const unsigned short super_speed_maxpacket_maxes[4] = {
+ [USB_ENDPOINT_XFER_CONTROL] = 512,
--- /dev/null
+From 5a5a1d614287a647b36dff3f40c2b0ceabbc83ec Mon Sep 17 00:00:00 2001
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Date: Fri, 12 Aug 2016 01:05:08 +0300
+Subject: USB: serial: mos7720: fix non-atomic allocation in write path
+
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+
+commit 5a5a1d614287a647b36dff3f40c2b0ceabbc83ec upstream.
+
+There is an allocation with GFP_KERNEL flag in mos7720_write(),
+while it may be called from interrupt context.
+
+Follow-up for commit 191252837626 ("USB: kobil_sct: fix non-atomic
+allocation in write path")
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/mos7720.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -1239,7 +1239,7 @@ static int mos7720_write(struct tty_stru
+
+ if (urb->transfer_buffer == NULL) {
+ urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
+- GFP_KERNEL);
++ GFP_ATOMIC);
+ if (!urb->transfer_buffer)
+ goto exit;
+ }
--- /dev/null
+From 3b7c7e52efda0d4640060de747768360ba70a7c0 Mon Sep 17 00:00:00 2001
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Date: Fri, 12 Aug 2016 01:05:09 +0300
+Subject: USB: serial: mos7840: fix non-atomic allocation in write path
+
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+
+commit 3b7c7e52efda0d4640060de747768360ba70a7c0 upstream.
+
+There is an allocation with GFP_KERNEL flag in mos7840_write(),
+while it may be called from interrupt context.
+
+Follow-up for commit 191252837626 ("USB: kobil_sct: fix non-atomic
+allocation in write path")
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/mos7840.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -1372,8 +1372,8 @@ static int mos7840_write(struct tty_stru
+ }
+
+ if (urb->transfer_buffer == NULL) {
+- urb->transfer_buffer =
+- kmalloc(URB_TRANSFER_BUFFER_SIZE, GFP_KERNEL);
++ urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
++ GFP_ATOMIC);
+ if (!urb->transfer_buffer)
+ goto exit;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
