sctp-prefer-struct_size-over-open-coded-arithmetic.patch
firmware-dmi-stop-decoding-on-broken-entry.patch
input-ff-core-prefer-struct_size-over-open-coded-ari.patch
-usb-xhci-prevent-potential-failure-in-handle_tx_even.patch
net-dsa-mv88e6xxx-correct-check-for-empty-list.patch
media-dvb-frontends-tda18271c2dd-remove-casting-duri.patch
media-s2255-use-refcount_t-instead-of-atomic_t-for-n.patch
+++ /dev/null
-From 0d0e8ec00e7578ccb973e76788d477b4a572ad55 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 29 Apr 2024 17:02:37 +0300
-Subject: usb: xhci: prevent potential failure in handle_tx_event() for
- Transfer events without TRB
-
-From: Niklas Neronin <niklas.neronin@linux.intel.com>
-
-[ Upstream commit 66cb618bf0bb82859875b00eeffaf223557cb416 ]
-
-Some transfer events don't always point to a TRB, and consequently don't
-have a endpoint ring. In these cases, function handle_tx_event() should
-not proceed, because if 'ep->skip' is set, the pointer to the endpoint
-ring is used.
-
-To prevent a potential failure and make the code logical, return after
-checking the completion code for a Transfer event without TRBs.
-
-Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com>
-Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
-Link: https://lore.kernel.org/r/20240429140245.3955523-11-mathias.nyman@linux.intel.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/xhci-ring.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
-index fbb7a5b51ef46..ff22ee5dd840d 100644
---- a/drivers/usb/host/xhci-ring.c
-+++ b/drivers/usb/host/xhci-ring.c
-@@ -2481,16 +2481,17 @@ static int handle_tx_event(struct xhci_hcd *xhci,
- else
- xhci_handle_halted_endpoint(xhci, ep, 0, NULL,
- EP_SOFT_RESET);
-- goto cleanup;
-+ break;
- case COMP_RING_UNDERRUN:
- case COMP_RING_OVERRUN:
- case COMP_STOPPED_LENGTH_INVALID:
-- goto cleanup;
-+ break;
- default:
- xhci_err(xhci, "ERROR Transfer event for unknown stream ring slot %u ep %u\n",
- slot_id, ep_index);
- goto err_out;
- }
-+ return 0;
- }
-
- /* Count current td numbers if ep->skip is set */
---
-2.43.0
-
sctp-prefer-struct_size-over-open-coded-arithmetic.patch
firmware-dmi-stop-decoding-on-broken-entry.patch
input-ff-core-prefer-struct_size-over-open-coded-ari.patch
-usb-xhci-prevent-potential-failure-in-handle_tx_even.patch
wifi-mt76-replace-skb_put-with-skb_put_zero.patch
net-dsa-mv88e6xxx-correct-check-for-empty-list.patch
media-dvb-frontends-tda18271c2dd-remove-casting-duri.patch
+++ /dev/null
-From 97070f1f720dbf1ac212cdbe20e754b9c70262d4 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 29 Apr 2024 17:02:37 +0300
-Subject: usb: xhci: prevent potential failure in handle_tx_event() for
- Transfer events without TRB
-
-From: Niklas Neronin <niklas.neronin@linux.intel.com>
-
-[ Upstream commit 66cb618bf0bb82859875b00eeffaf223557cb416 ]
-
-Some transfer events don't always point to a TRB, and consequently don't
-have a endpoint ring. In these cases, function handle_tx_event() should
-not proceed, because if 'ep->skip' is set, the pointer to the endpoint
-ring is used.
-
-To prevent a potential failure and make the code logical, return after
-checking the completion code for a Transfer event without TRBs.
-
-Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com>
-Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
-Link: https://lore.kernel.org/r/20240429140245.3955523-11-mathias.nyman@linux.intel.com
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/usb/host/xhci-ring.c | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
-index ddb5640a8bf39..16d4d2203e074 100644
---- a/drivers/usb/host/xhci-ring.c
-+++ b/drivers/usb/host/xhci-ring.c
-@@ -2695,16 +2695,17 @@ static int handle_tx_event(struct xhci_hcd *xhci,
- else
- xhci_handle_halted_endpoint(xhci, ep, 0, NULL,
- EP_SOFT_RESET);
-- goto cleanup;
-+ break;
- case COMP_RING_UNDERRUN:
- case COMP_RING_OVERRUN:
- case COMP_STOPPED_LENGTH_INVALID:
-- goto cleanup;
-+ break;
- default:
- xhci_err(xhci, "ERROR Transfer event for unknown stream ring slot %u ep %u\n",
- slot_id, ep_index);
- goto err_out;
- }
-+ return 0;
- }
-
- /* Count current td numbers if ep->skip is set */
---
-2.43.0
-