4.9.99-stable review
Greg Kroah-Hartman
maintainercover 4.9.99-stable review
This is the start of the stable review cycle for the 4.9.99 release. There are 32 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 10 07:39:44 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.99-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.9.99-rc1
Heiko Carstens <[email protected]>
s390/facilites: use stfle_fac_list array size for MAX_FACILITY_BIT
João Paulo Rechi Vita <[email protected]>
platform/x86: asus-wireless: Fix NULL pointer dereference
Bin Liu <[email protected]>
usb: musb: trace: fix NULL pointer dereference in musb_g_tx()
Bin Liu <[email protected]>
usb: musb: host: fix potential NULL pointer dereference
SZ Lin (林上智) <[email protected]>
USB: serial: option: adding support for ublox R410M
Johan Hovold <[email protected]>
USB: serial: option: reimplement interface masking
Alan Stern <[email protected]>
USB: Accept bulk endpoints with 1024-byte maxpacket
Greg Kroah-Hartman <[email protected]>
USB: serial: visor: handle potential invalid device configuration
Ben Hutchings <[email protected]>
test_firmware: fix setting old custom fw path back on exit, second try
Sean Paul <[email protected]>
drm/bridge: vga-dac: Fix edid memory leak
Thomas Hellstrom <[email protected]>
drm/vmwgfx: Fix a buffer object leak
Sebastian Sanchez <[email protected]>
IB/hfi1: Fix NULL pointer dereference when invalid num_vls is used
Danit Goldberg <[email protected]>
IB/mlx5: Use unlimited rate when static rate is not supported
SZ Lin (林上智) <[email protected]>
NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2
Leon Romanovsky <[email protected]>
RDMA/mlx5: Protect from shift operand overflow
Roland Dreier <[email protected]>
RDMA/ucma: Allow resolving address w/o specifying source address
Raju Rangoju <[email protected]>
RDMA/cxgb4: release hw resources on device removal
Darrick J. Wong <[email protected]>
xfs: prevent creating negative-sized file via INSERT_RANGE
Vittorio Gambaletta (VittGam) <[email protected]>
Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro
Dmitry Torokhov <[email protected]>
Input: leds - fix out of bound access
Mathieu Desnoyers <[email protected]>
tracepoint: Do not warn on ENOMEM
Takashi Iwai <[email protected]>
ALSA: aloop: Add missing cable lock to ctl API callbacks
Robert Rosengren <[email protected]>
ALSA: aloop: Mark paused device as inactive
Takashi Iwai <[email protected]>
ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger()
Takashi Iwai <[email protected]>
ALSA: pcm: Check PCM state at xfern compat ioctl
Kristian Evensen <[email protected]>
USB: serial: option: Add support for Quectel EP06
Uwe Kleine-König <[email protected]>
serial: imx: ensure UCR3 and UFCR are setup correctly
LEROY Christophe <[email protected]>
crypto: talitos - fix IPsec cipher in length
Marc Zyngier <[email protected]>
arm/arm64: KVM: Add PSCI version selection API
Teng Qin <[email protected]>
bpf: map_get_next_key to return first key on NULL
Tejun Heo <[email protected]>
percpu: include linux/sched.h for cond_resched()
Tan Xiaojun <[email protected]>
perf/core: Fix the perf_cpu_time_max_percent check
-------------
Diffstat:
Documentation/virtual/kvm/api.txt | 9 +- Documentation/virtual/kvm/arm/psci.txt | 30 ++ Makefile | 4 +- arch/arm/include/asm/kvm_host.h | 3 + arch/arm/include/uapi/asm/kvm.h | 6 + arch/arm/kvm/guest.c | 13 + arch/arm/kvm/psci.c | 60 +++ arch/arm64/include/asm/kvm_host.h | 3 + arch/arm64/include/uapi/asm/kvm.h | 6 + arch/arm64/kvm/guest.c | 14 +- arch/s390/include/asm/facility.h | 2 +- drivers/crypto/talitos.c | 41 +- drivers/gpu/drm/bridge/dumb-vga-dac.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 1 + drivers/infiniband/core/ucma.c | 2 +- drivers/infiniband/hw/cxgb4/device.c | 9 +- drivers/infiniband/hw/cxgb4/iw_cxgb4.h | 4 + drivers/infiniband/hw/cxgb4/resource.c | 26 +- drivers/infiniband/hw/hfi1/init.c | 2 + drivers/infiniband/hw/hfi1/pcie.c | 3 - drivers/infiniband/hw/mlx5/qp.c | 22 +- drivers/input/input-leds.c | 8 +- drivers/input/touchscreen/atmel_mxt_ts.c | 9 + drivers/net/usb/qmi_wwan.c | 1 + drivers/platform/x86/asus-wireless.c | 4 +- drivers/tty/serial/imx.c | 14 +- drivers/usb/core/config.c | 4 +- drivers/usb/musb/musb_gadget.c | 3 +- drivers/usb/musb/musb_host.c | 4 +- drivers/usb/serial/option.c | 448 ++++++++-------------- drivers/usb/serial/visor.c | 69 ++-- fs/xfs/xfs_file.c | 14 +- include/kvm/arm_psci.h | 16 +- kernel/bpf/arraymap.c | 2 +- kernel/bpf/hashtab.c | 9 +- kernel/bpf/syscall.c | 20 +- kernel/events/core.c | 2 +- kernel/tracepoint.c | 4 +- mm/percpu.c | 1 + sound/core/pcm_compat.c | 2 + sound/core/seq/seq_virmidi.c | 4 +- sound/drivers/aloop.c | 29 +- tools/testing/selftests/firmware/fw_filesystem.sh | 6 +- 43 files changed, 530 insertions(+), 407 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/32 perf/core: Fix the perf_cpu_time_max_percent check
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tan Xiaojun <[email protected]>
commit 1572e45a924f254d9570093abde46430c3172e3d upstream.
Use "proc_dointvec_minmax" instead of "proc_dointvec" to check the input value from user-space.
If not, we can set a big value and some vars will overflow like "sysctl_perf_event_sample_rate" which will cause a lot of unexpected problems.
--- kernel/events/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/core.c +1 -1
@@ -453,7 +453,7 @@ int perf_cpu_time_max_percent_handler(st void __user *buffer, size_t *lenp, loff_t *ppos) { - int ret = proc_dointvec(table, write, buffer, lenp, ppos); + int ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);if (ret || !write)return ret;
Greg Kroah-Hartman
maintainerPATCH 2/32 percpu: include linux/sched.h for cond_resched()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 71546d100422bcc2c543dadeb9328728997cd23a upstream.
microblaze build broke due to missing declaration of the cond_resched() invocation added recently. Let's include linux/sched.h explicitly.
--- mm/percpu.c | 1 + 1 file changed, 1 insertion(+)
mm/percpu.c +1 -0
@@ -70,6 +70,7 @@#include <linux/vmalloc.h> #include <linux/workqueue.h> #include <linux/kmemleak.h> +#include <linux/sched.h> #include <asm/cacheflush.h> #include <asm/sections.h>
Greg Kroah-Hartman
maintainerPATCH 3/32 bpf: map_get_next_key to return first key on NULL
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Teng Qin <[email protected]>
commit 8fe45924387be6b5c1be59a7eb330790c61d5d10 upstream.
When iterating through a map, we need to find a key that does not exist in the map so map_get_next_key will give us the first key of the map. This often requires a lot of guessing in production systems.
This patch makes map_get_next_key return the first key when the key pointer in the parameter is NULL.
--- kernel/bpf/arraymap.c | 2 +- kernel/bpf/hashtab.c | 9 +++++---- kernel/bpf/syscall.c | 18 +++++++++++------- 3 files changed, 17 insertions(+), 12 deletions(-)
kernel/bpf/arraymap.c +1 -1
@@ -190,7 +190,7 @@ int bpf_percpu_array_copy(struct bpf_mapstatic int array_map_get_next_key (struct bpf_map *map,void *key,void *next_key) { struct bpf_array *array = container_of(map, struct bpf_array, map); -u32 index = *(u32 *)key; +u32 index = key ? *(u32 *)key :U32_MAX ;u32 *next = (u32 *)next_key;if (index >= array->map.max_entries) {
kernel/bpf/hashtab.c +5 -4
@@ -326,12 +326,15 @@ static int htab_map_get_next_key(structstruct hlist_head *head;struct htab_elem *l, *next_l;u32 hash, key_size; -int i; +int i =0 ;WARN_ON_ONCE (!rcu_read_lock_held ()); key_size = map->key_size; +if (!key) + goto find_first_elem; + hash =htab_map_hash (key, key_size); head =select_bucket (htab, hash);
@@ -339,10 +342,8 @@ static int htab_map_get_next_key(struct/* lookup the key */ l =lookup_elem_raw (head, hash, key, key_size); -if (!l) { - i =0 ; +if (!l) goto find_first_elem; - }/* key was found, get next key in the same bucket */ next_l = hlist_entry_safe(rcu_dereference_raw(hlist_next_rcu(&l->hash_node)),
kernel/bpf/syscall.c +11 -7
@@ -508,14 +508,18 @@ static int map_get_next_key(union bpf_atif (IS_ERR (map))return PTR_ERR (map); - err = -ENOMEM ; - key =kmalloc (map->key_size,GFP_USER ); -if (!key) - goto err_put; +if (ukey) { + err = -ENOMEM ; + key =kmalloc (map->key_size,GFP_USER ); +if (!key) + goto err_put; - err = -EFAULT ; -if (copy_from_user (key, ukey, map->key_size) !=0 ) - goto free_key; + err = -EFAULT ; +if (copy_from_user (key, ukey, map->key_size) !=0 ) + goto free_key; + }else { + key =NULL ; + } err = -ENOMEM ; next_key =kmalloc (map->key_size,GFP_USER );
Greg Kroah-Hartman
maintainerPATCH 4/32 arm/arm64: KVM: Add PSCI version selection API
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 85bd0ba1ff9875798fad94218b627ea9f768f3c3 upstream.
Although we've implemented PSCI 0.1, 0.2 and 1.0, we expose either 0.1 or 1.0 to a guest, defaulting to the latest version of the PSCI implementation that is compatible with the requested version. This is no different from doing a firmware upgrade on KVM.
But in order to give a chance to hypothetical badly implemented guests that would have a fit by discovering something other than PSCI 0.2, let's provide a new API that allows userspace to pick one particular version of the API.
This is implemented as a new class of "firmware" registers, where we expose the PSCI version. This allows the PSCI version to be save/restored as part of a guest migration, and also set to any supported version if the guest requires it.
--- Documentation/virtual/kvm/api.txt | 9 ++++ Documentation/virtual/kvm/arm/psci.txt | 30 ++++++++++++++++ arch/arm/include/asm/kvm_host.h | 3 + arch/arm/include/uapi/asm/kvm.h | 6 +++ arch/arm/kvm/guest.c | 13 +++++++ arch/arm/kvm/psci.c | 60 +++++++++++++++++++++++++++++++++ arch/arm64/include/asm/kvm_host.h | 3 + arch/arm64/include/uapi/asm/kvm.h | 6 +++ arch/arm64/kvm/guest.c | 14 +++++++ include/kvm/arm_psci.h | 16 +++++++- 10 files changed, 156 insertions(+), 4 deletions(-) create mode 100644 Documentation/virtual/kvm/arm/psci.txt
Documentation/virtual/kvm/api.txt +8 -1
@@ -2118,6 +2118,9 @@ ARM 32-bit VFP control registers have th ARM 64-bit FP registers have the following id bit patterns: 0x4030 0000 0012 0 <regno:12> +ARM firmware pseudo-registers have the following bit pattern: + 0x4030 0000 0014 <regno:16> + arm64 registers are mapped using the lower 32 bits. The upper 16 of that is the register group type, or coprocessor number:
@@ -2134,6 +2137,9 @@ arm64 CCSIDR registers are demultiplexed arm64 system registers have the following id bit patterns: 0x6030 0000 0013 <op0:2> <op1:3> <crn:4> <crm:4> <op2:3> +arm64 firmware pseudo-registers have the following bit pattern: + 0x6030 0000 0014 <regno:16> + MIPS registers are mapped using the lower 32 bits. The upper 16 of that is the register group type:
@@ -2656,7 +2662,8 @@ Possible features: and execute guest code when KVM_RUN is called. - KVM_ARM_VCPU_EL1_32BIT: Starts the CPU in a 32bit mode. Depends on KVM_CAP_ARM_EL1_32BIT (arm64 only). - - KVM_ARM_VCPU_PSCI_0_2: Emulate PSCI v0.2 for the CPU. + - KVM_ARM_VCPU_PSCI_0_2: Emulate PSCI v0.2 (or a future revision + backward compatible with v0.2) for the CPU. Depends on KVM_CAP_ARM_PSCI_0_2. - KVM_ARM_VCPU_PMU_V3: Emulate PMUv3 for the CPU. Depends on KVM_CAP_ARM_PMU_V3.
Documentation/virtual/kvm/arm/psci.txt new file +30 -0
@@ -0,0 +1,30 @@ +KVM implements the PSCI (Power State Coordination Interface) +specification in order to provide services such as CPU on/off, reset +and power-off to the guest. + +The PSCI specification is regularly updated to provide new features, +and KVM implements these updates if they make sense from a virtualization +point of view. + +This means that a guest booted on two different versions of KVM can +observe two different "firmware" revisions. This could cause issues if +a given guest is tied to a particular PSCI revision (unlikely), or if +a migration causes a different PSCI version to be exposed out of the +blue to an unsuspecting guest. + +In order to remedy this situation, KVM exposes a set of "firmware +pseudo-registers" that can be manipulated using the GET/SET_ONE_REG +interface. These registers can be saved/restored by userspace, and set +to a convenient value if required. + +The following register is defined: + +* KVM_REG_ARM_PSCI_VERSION: + + - Only valid if the vcpu has the KVM_ARM_VCPU_PSCI_0_2 feature set + (and thus has already been initialized) + - Returns the current PSCI version on GET_ONE_REG (defaulting to the + highest PSCI version implemented by KVM and compatible with v0.2) + - Allows any PSCI version implemented by KVM and compatible with + v0.2 to be set with SET_ONE_REG + - Affects the whole VM (even if the register view is per-vcpu)
arch/arm/include/asm/kvm_host.h +3 -0
@@ -78,6 +78,9 @@ struct kvm_arch {/* Interrupt controller */ struct vgic_dist vgic;int max_vcpus; + +/* Mandated version of PSCI */ +u32 psci_version; };#define KVM_NR_MEM_OBJS 40
arch/arm/include/uapi/asm/kvm.h +6 -0
@@ -173,6 +173,12 @@ struct kvm_arch_memory_slot {#define KVM_REG_ARM_VFP_FPINST 0x1009#define KVM_REG_ARM_VFP_FPINST2 0x100A +/* KVM-as-firmware specific pseudo-registers */ +#define KVM_REG_ARM_FW (0x0014 << KVM_REG_ARM_COPROC_SHIFT) +#define KVM_REG_ARM_FW_REG (r) (KVM_REG_ARM | KVM_REG_SIZE_U64 | \ + KVM_REG_ARM_FW | ((r) & 0xffff)) +#define KVM_REG_ARM_PSCI_VERSION KVM_REG_ARM_FW_REG(0) +/* Device Control API: ARM VGIC */ #define KVM_DEV_ARM_VGIC_GRP_ADDR 0#define KVM_DEV_ARM_VGIC_GRP_DIST_REGS 1
arch/arm/kvm/guest.c +13 -0
@@ -22,6 +22,7 @@#include <linux/module.h> #include <linux/vmalloc.h> #include <linux/fs.h> +#include <kvm/arm_psci.h> #include <asm/cputype.h> #include <asm/uaccess.h> #include <asm/kvm.h>
@@ -176,6 +177,7 @@ static unsigned long num_core_regs(void)unsigned long kvm_arm_num_regs (struct kvm_vcpu *vcpu) {return num_core_regs () +kvm_arm_num_coproc_regs (vcpu) + +kvm_arm_get_fw_num_regs (vcpu) +NUM_TIMER_REGS ; }
@@ -196,6 +198,11 @@ int kvm_arm_copy_reg_indices(struct kvm_ uindices++; } + ret =kvm_arm_copy_fw_reg_indices (vcpu, uindices); +if (ret) +return ret; + uindices +=kvm_arm_get_fw_num_regs (vcpu); + ret =copy_timer_indices (vcpu, uindices);if (ret)return ret;
@@ -214,6 +221,9 @@ int kvm_arm_get_reg(struct kvm_vcpu *vcpif ((reg->id &KVM_REG_ARM_COPROC_MASK ) ==KVM_REG_ARM_CORE )return get_core_reg (vcpu, reg); +if ((reg->id &KVM_REG_ARM_COPROC_MASK ) ==KVM_REG_ARM_FW ) +return kvm_arm_get_fw_reg (vcpu, reg); +if (is_timer_reg (reg->id))return get_timer_reg (vcpu, reg);
@@ -230,6 +240,9 @@ int kvm_arm_set_reg(struct kvm_vcpu *vcpif ((reg->id &KVM_REG_ARM_COPROC_MASK ) ==KVM_REG_ARM_CORE )return set_core_reg (vcpu, reg); +if ((reg->id &KVM_REG_ARM_COPROC_MASK ) ==KVM_REG_ARM_FW ) +return kvm_arm_set_fw_reg (vcpu, reg); +if (is_timer_reg (reg->id))return set_timer_reg (vcpu, reg);
arch/arm/kvm/psci.c +60 -0
69 lines not on this page · raw message
arch/arm64/include/asm/kvm_host.h +3 -0
@@ -73,6 +73,9 @@ struct kvm_arch {/* Timer */ struct arch_timer_kvm timer; + +/* Mandated version of PSCI */ +u32 psci_version; };#define KVM_NR_MEM_OBJS 40
arch/arm64/include/uapi/asm/kvm.h +6 -0
@@ -195,6 +195,12 @@ struct kvm_arch_memory_slot {#define KVM_REG_ARM_TIMER_CNT ARM64_SYS_REG(3, 3, 14, 3, 2)#define KVM_REG_ARM_TIMER_CVAL ARM64_SYS_REG(3, 3, 14, 0, 2) +/* KVM-as-firmware specific pseudo-registers */ +#define KVM_REG_ARM_FW (0x0014 << KVM_REG_ARM_COPROC_SHIFT) +#define KVM_REG_ARM_FW_REG (r) (KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \ + KVM_REG_ARM_FW | ((r) & 0xffff)) +#define KVM_REG_ARM_PSCI_VERSION KVM_REG_ARM_FW_REG(0) +/* Device Control API: ARM VGIC */ #define KVM_DEV_ARM_VGIC_GRP_ADDR 0#define KVM_DEV_ARM_VGIC_GRP_DIST_REGS 1
arch/arm64/kvm/guest.c +13 -1
@@ -25,6 +25,7 @@#include <linux/module.h> #include <linux/vmalloc.h> #include <linux/fs.h> +#include <kvm/arm_psci.h> #include <asm/cputype.h> #include <asm/uaccess.h> #include <asm/kvm.h>
@@ -205,7 +206,7 @@ static int get_timer_reg(struct kvm_vcpuunsigned long kvm_arm_num_regs (struct kvm_vcpu *vcpu) {return num_core_regs () +kvm_arm_num_sys_reg_descs (vcpu) - +NUM_TIMER_REGS ; + +kvm_arm_get_fw_num_regs (vcpu) +NUM_TIMER_REGS ; }/**
@@ -225,6 +226,11 @@ int kvm_arm_copy_reg_indices(struct kvm_ uindices++; } + ret =kvm_arm_copy_fw_reg_indices (vcpu, uindices); +if (ret) +return ret; + uindices +=kvm_arm_get_fw_num_regs (vcpu); + ret =copy_timer_indices (vcpu, uindices);if (ret)return ret;
@@ -243,6 +249,9 @@ int kvm_arm_get_reg(struct kvm_vcpu *vcpif ((reg->id &KVM_REG_ARM_COPROC_MASK ) ==KVM_REG_ARM_CORE )return get_core_reg (vcpu, reg); +if ((reg->id &KVM_REG_ARM_COPROC_MASK ) ==KVM_REG_ARM_FW ) +return kvm_arm_get_fw_reg (vcpu, reg); +if (is_timer_reg (reg->id))return get_timer_reg (vcpu, reg);
@@ -259,6 +268,9 @@ int kvm_arm_set_reg(struct kvm_vcpu *vcpif ((reg->id &KVM_REG_ARM_COPROC_MASK ) ==KVM_REG_ARM_CORE )return set_core_reg (vcpu, reg); +if ((reg->id &KVM_REG_ARM_COPROC_MASK ) ==KVM_REG_ARM_FW ) +return kvm_arm_set_fw_reg (vcpu, reg); +if (is_timer_reg (reg->id))return set_timer_reg (vcpu, reg);
include/kvm/arm_psci.h +14 -2
@@ -37,10 +37,15 @@ static inline int kvm_psci_version(struc* Our PSCI implementation stays the same across versions from * v0.2 onward, only adding the few mandatory functions (such * as FEATURES with 1.0) that are required by newer -* revisions. It is thus safe to return the latest. +* revisions. It is thus safe to return the latest, unless +* userspace has instructed us otherwise. */ -if (test_bit (KVM_ARM_VCPU_PSCI_0_2 , vcpu->arch.features)) +if (test_bit (KVM_ARM_VCPU_PSCI_0_2 , vcpu->arch.features)) { +if (vcpu->kvm->arch.psci_version) +return vcpu->kvm->arch.psci_version; +return KVM_ARM_PSCI_LATEST ; + }return KVM_ARM_PSCI_0_1 ; }
@@ -48,4 +53,11 @@ static inline int kvm_psci_version(strucint kvm_hvc_call_handler (struct kvm_vcpu *vcpu); +struct kvm_one_reg ; + +int kvm_arm_get_fw_num_regs (struct kvm_vcpu *vcpu); +int kvm_arm_copy_fw_reg_indices (struct kvm_vcpu *vcpu,u64 __user *uindices); +int kvm_arm_get_fw_reg (struct kvm_vcpu *vcpu,const struct kvm_one_reg *reg); +int kvm_arm_set_fw_reg (struct kvm_vcpu *vcpu,const struct kvm_one_reg *reg); +#endif /* __KVM_ARM_PSCI_H__ */
Greg Kroah-Hartman
maintainerPATCH 5/32 crypto: talitos - fix IPsec cipher in length
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: LEROY Christophe <[email protected]>
commit 2b1227301a8e4729409694e323b72c064c47cb6b upstream.
For SEC 2.x+, cipher in length must contain only the ciphertext length. In case of using hardware ICV checking, the ICV length is provided via the "extent" field of the descriptor pointer.
--- drivers/crypto/talitos.c | 41 +++++++++++++++++++++-------------------- 1 file changed, 21 insertions(+), 20 deletions(-)
drivers/crypto/talitos.c +21 -20
@@ -1116,10 +1116,10 @@ next:return count; } -int talitos_sg_map (struct device *dev,struct scatterlist *src, -unsigned int len,struct talitos_edesc *edesc, -struct talitos_ptr *ptr, -int sg_count,unsigned int offset,int tbl_off) +static int talitos_sg_map_ext (struct device *dev,struct scatterlist *src, +unsigned int len,struct talitos_edesc *edesc, +struct talitos_ptr *ptr,int sg_count, +unsigned int offset,int tbl_off,int elen) {struct talitos_private *priv =dev_get_drvdata (dev);bool is_sec1 =has_ftr_sec1 (priv);
@@ -1130,7 +1130,7 @@ int talitos_sg_map(struct device *dev, s }to_talitos_ptr_len (ptr, len, is_sec1); -to_talitos_ptr_ext_set (ptr,0 , is_sec1); +to_talitos_ptr_ext_set (ptr, elen, is_sec1);if (sg_count ==1 ) {to_talitos_ptr (ptr,sg_dma_address (src) + offset, is_sec1);
@@ -1140,7 +1140,7 @@ int talitos_sg_map(struct device *dev, sto_talitos_ptr (ptr, edesc->dma_link_tbl + offset, is_sec1);return sg_count; } - sg_count =sg_to_link_tbl_offset (src, sg_count, offset, len, + sg_count =sg_to_link_tbl_offset (src, sg_count, offset, len + elen, &edesc->link_tbl[tbl_off]);if (sg_count ==1 ) {/* Only one segment now, so no link tbl needed*/
@@ -1154,6 +1154,15 @@ int talitos_sg_map(struct device *dev, sreturn sg_count; } +static int talitos_sg_map (struct device *dev,struct scatterlist *src, +unsigned int len,struct talitos_edesc *edesc, +struct talitos_ptr *ptr,int sg_count, +unsigned int offset,int tbl_off) +{ +return talitos_sg_map_ext (dev, src, len, edesc, ptr, sg_count, offset, + tbl_off,0 ); +} +/* * fill in and submit ipsec_esp descriptor */
@@ -1171,7 +1180,7 @@ static int ipsec_esp(struct talitos_edesunsigned int ivsize =crypto_aead_ivsize (aead);int tbl_off =0 ;int sg_count, ret; -int sg_link_tbl_len; +int elen =0 ;bool sync_needed = false;struct talitos_private *priv =dev_get_drvdata (dev);bool is_sec1 =has_ftr_sec1 (priv);
@@ -1225,20 +1234,12 @@ static int ipsec_esp(struct talitos_edes* extent is bytes of HMAC postpended to ciphertext, * typically 12 for ipsec */ -to_talitos_ptr_len (&desc->ptr[4 ], cryptlen, is_sec1); -to_talitos_ptr_ext_set (&desc->ptr[4 ],0 , is_sec1); - - sg_link_tbl_len = cryptlen; - -if (desc->hdr &DESC_HDR_TYPE_IPSEC_ESP ) { -to_talitos_ptr_ext_set (&desc->ptr[4 ], authsize, is_sec1); - -if (edesc->desc.hdr &DESC_HDR_MODE1_MDEU_CICV ) - sg_link_tbl_len += authsize; - } +if ((desc->hdr &DESC_HDR_TYPE_IPSEC_ESP ) && + (desc->hdr &DESC_HDR_MODE1_MDEU_CICV )) + elen = authsize; - ret =talitos_sg_map (dev, areq->src, sg_link_tbl_len, edesc, - &desc->ptr[4 ], sg_count, areq->assoclen, tbl_off); + ret =talitos_sg_map_ext (dev, areq->src, cryptlen, edesc, &desc->ptr[4 ], + sg_count, areq->assoclen, tbl_off, elen);if (ret >1 ) { tbl_off += ret;
Greg Kroah-Hartman
maintainerPATCH 6/32 serial: imx: ensure UCR3 and UFCR are setup correctly
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
commit 6df765dca378bddf994cfd2044acafa501bd800f upstream.
Commit e61c38d85b73 ("serial: imx: setup DCEDTE early and ensure DCD and RI irqs to be off") has a flaw: While UCR3 and UFCR were modified using read-modify-write before it switched to write register values independent of the previous state. That's a good idea in principle (and that's why I did it) but needs more care.
This patch reinstates read-modify-write for UFCR and for UCR3 ensures that RXDMUXSEL and ADNIMP are set for post imx1.
--- drivers/tty/serial/imx.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/tty/serial/imx.c +12 -2
@@ -2145,7 +2145,9 @@ static int serial_imx_probe(struct platf* and DCD (when they are outputs) or enables the respective * irqs. So set this bit early, i.e. before requesting irqs. */ -writel (UFCR_DCEDTE , sport->port.membase +UFCR ); + reg =readl (sport->port.membase +UFCR ); +if (!(reg &UFCR_DCEDTE )) +writel (reg |UFCR_DCEDTE , sport->port.membase +UFCR );/* * Disable UCR3_RI and UCR3_DCD irqs. They are also not
@@ -2156,7 +2158,15 @@ static int serial_imx_probe(struct platf sport->port.membase + UCR3); }else { -writel (0 , sport->port.membase +UFCR ); +unsigned long ucr3 =UCR3_DSR ; + + reg =readl (sport->port.membase +UFCR ); +if (reg &UFCR_DCEDTE ) +writel (reg & ~UFCR_DCEDTE , sport->port.membase +UFCR ); + +if (!is_imx1_uart (sport)) + ucr3 |=IMX21_UCR3_RXDMUXSEL |UCR3_ADNIMP ; +writel (ucr3, sport->port.membase +UCR3 ); }clk_disable_unprepare (sport->clk_ipg);
Greg Kroah-Hartman
maintainerPATCH 7/32 USB: serial: option: Add support for Quectel EP06
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kristian Evensen <[email protected]>
commit 71a0483d56e784b1e11f38f10d7e22d265dbe244 upstream.
The Quectel EP06 is a Cat. 6 LTE modem, and the interface mapping is as follows:
0: Diag
1: NMEA
2: AT
3: Modem
Interface 4 is QMI and interface 5 is ADB, so they are blacklisted.
This patch should also be considered for -stable. The QMI-patch for this modem is already in the -stable-queue.
v1->v2:
* Updated commit prefix (thanks Johan Hovold)
* Updated commit message slightly.
--- drivers/usb/serial/option.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/serial/option.c +7 -0
@@ -244,6 +244,7 @@ static void option_instat_callback(struc#define QUECTEL_PRODUCT_EC21 0x0121#define QUECTEL_PRODUCT_EC25 0x0125#define QUECTEL_PRODUCT_BG96 0x0296 +#define QUECTEL_PRODUCT_EP06 0x0306#define CMOTECH_VENDOR_ID 0x16d8#define CMOTECH_PRODUCT_6001 0x6001
@@ -692,6 +693,10 @@ static const struct option_blacklist_inf .reserved = BIT(1) | BIT(4), }; +static const struct option_blacklist_info quectel_ep06_blacklist = { + .reserved =BIT (4 ) |BIT (5 ), +}; +static const struct usb_device_id option_ids[] = { {USB_DEVICE (OPTION_VENDOR_ID ,OPTION_PRODUCT_COLT ) }, {USB_DEVICE (OPTION_VENDOR_ID ,OPTION_PRODUCT_RICOLA ) },
@@ -1206,6 +1211,8 @@ static const struct usb_device_id option .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96), .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06), + .driver_info = (kernel_ulong_t)&quectel_ep06_blacklist }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
Greg Kroah-Hartman
maintainerPATCH 8/32 ALSA: pcm: Check PCM state at xfern compat ioctl
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit f13876e2c33a657a71bcbb10f767c0951b165020 upstream.
Since snd_pcm_ioctl_xfern_compat() has no PCM state check, it may go further and hit the sanity check pcm_sanity_check() when the ioctl is called right after open. It may eventually spew a kernel warning, as triggered by syzbot, depending on kconfig.
The lack of PCM state check there was just an oversight. Although it's no real crash, the spurious kernel warning is annoying, so let's add the proper check.
--- sound/core/pcm_compat.c | 2 ++ 1 file changed, 2 insertions(+)
sound/core/pcm_compat.c +2 -0
@@ -426,6 +426,8 @@ static int snd_pcm_ioctl_xfern_compat(streturn -ENOTTY ;if (substream->stream != dir)return -EINVAL ; +if (substream->runtime->status->state ==SNDRV_PCM_STATE_OPEN ) +return -EBADFD ;if ((ch = substream->runtime->channels) >128 )return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 9/32 ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 8f22e52528cc372b218b5f100457469615c733ce upstream.
The sequencer virmidi code has an open race at its output trigger
callback: namely, virmidi keeps only one event packet for processing while it doesn't protect for concurrent output trigger calls.
snd_virmidi_output_trigger() tries to process the previously unfinished event before starting encoding the given MIDI stream, but this is done without any lock. Meanwhile, if another rawmidi stream starts the output trigger, this proceeds further, and overwrites the event package that is being processed in another thread. This eventually corrupts and may lead to the invalid memory access if the event type is like SYSEX.
The fix is just to move the spinlock to cover both the pending event and the new stream.
The bug was spotted by a new fuzzer, RaceFuzzer.
--- sound/core/seq/seq_virmidi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/core/seq/seq_virmidi.c +2 -2
@@ -174,12 +174,12 @@ static void snd_virmidi_output_trigger(s }return ; } +spin_lock_irqsave (&substream->runtime->lock, flags);if (vmidi->event.type !=SNDRV_SEQ_EVENT_NONE ) {if (snd_seq_kernel_client_dispatch (vmidi->client, &vmidi->event,in_atomic (),0 ) <0 ) -return ; + goto out; vmidi->event.type =SNDRV_SEQ_EVENT_NONE ; } -spin_lock_irqsave (&substream->runtime->lock, flags);while (1 ) { count =__snd_rawmidi_transmit_peek (substream, buf,sizeof (buf));if (count <=0 )
Greg Kroah-Hartman
maintainerPATCH 10/32 ALSA: aloop: Mark paused device as inactive
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Rosengren <[email protected]>
commit 306a4f3ca7f3c7dfa473ebd19d66e40e59d99734 upstream.
Show paused ALSA aloop device as inactive, i.e. the control "PCM Slave Active" set as false. Notification sent upon state change.
This makes it possible for client capturing from aloop device to know if data is expected. Without it the client expects data even if playback is paused.
--- sound/drivers/aloop.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
sound/drivers/aloop.c +9 -3
@@ -296,6 +296,8 @@ static int loopback_trigger(struct snd_p cable->pause |= stream;loopback_timer_stop (dpcm);spin_unlock (&cable->lock); +if (substream->stream ==SNDRV_PCM_STREAM_PLAYBACK ) +loopback_active_notify (dpcm);break ;case SNDRV_PCM_TRIGGER_PAUSE_RELEASE :case SNDRV_PCM_TRIGGER_RESUME :
@@ -304,6 +306,8 @@ static int loopback_trigger(struct snd_p cable->pause &= ~stream;loopback_timer_start (dpcm);spin_unlock (&cable->lock); +if (substream->stream ==SNDRV_PCM_STREAM_PLAYBACK ) +loopback_active_notify (dpcm);break ;default :return -EINVAL ;
@@ -893,9 +897,11 @@ static int loopback_active_get(struct sn [kcontrol->id.subdevice][kcontrol->id.device ^1 ];unsigned int val =0 ; -if (cable !=NULL ) - val = (cable->running & (1 <<SNDRV_PCM_STREAM_PLAYBACK )) ? -1 :0 ; +if (cable !=NULL ) { +unsigned int running = cable->running ^ cable->pause; + + val = (running & (1 <<SNDRV_PCM_STREAM_PLAYBACK )) ?1 :0 ; + } ucontrol->value.integer.value[0 ] = val;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 11/32 ALSA: aloop: Add missing cable lock to ctl API callbacks
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 76b3421b39bd610546931fc923edcf90c18fa395 upstream.
Some control API callbacks in aloop driver are too lazy to take the loopback->cable_lock and it results in possible races of cable access while it's being freed. It eventually lead to a UAF, as reported by fuzzer recently.
This patch covers such control API callbacks and add the proper mutex locks.
--- sound/drivers/aloop.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
sound/drivers/aloop.c +15 -2
@@ -832,9 +832,11 @@ static int loopback_rate_shift_get(struc {struct loopback *loopback =snd_kcontrol_chip (kcontrol); +mutex_lock (&loopback->cable_lock); ucontrol->value.integer.value[0 ] = loopback->setup[kcontrol->id.subdevice] [kcontrol->id.device].rate_shift; +mutex_unlock (&loopback->cable_lock);return 0 ; }
@@ -866,9 +868,11 @@ static int loopback_notify_get(struct sn {struct loopback *loopback =snd_kcontrol_chip (kcontrol); +mutex_lock (&loopback->cable_lock); ucontrol->value.integer.value[0 ] = loopback->setup[kcontrol->id.subdevice] [kcontrol->id.device].notify; +mutex_unlock (&loopback->cable_lock);return 0 ; }
@@ -880,12 +884,14 @@ static int loopback_notify_put(struct snint change =0 ; val = ucontrol->value.integer.value[0 ] ?1 :0 ; +mutex_lock (&loopback->cable_lock);if (val != loopback->setup[kcontrol->id.subdevice] [kcontrol->id.device].notify) { loopback->setup[kcontrol->id.subdevice] [kcontrol->id.device].notify = val; change =1 ; } +mutex_unlock (&loopback->cable_lock);return change; }
@@ -893,15 +899,18 @@ static int loopback_active_get(struct sn struct snd_ctl_elem_value *ucontrol) {struct loopback *loopback =snd_kcontrol_chip (kcontrol); -struct loopback_cable *cable = loopback->cables - [kcontrol->id.subdevice][kcontrol->id.device ^1 ]; +struct loopback_cable *cable; +unsigned int val =0 ; +mutex_lock (&loopback->cable_lock); + cable = loopback->cables[kcontrol->id.subdevice][kcontrol->id.device ^1 ];if (cable !=NULL ) {unsigned int running = cable->running ^ cable->pause; val = (running & (1 <<SNDRV_PCM_STREAM_PLAYBACK )) ?1 :0 ; } +mutex_unlock (&loopback->cable_lock); ucontrol->value.integer.value[0 ] = val;return 0 ; }
@@ -944,9 +953,11 @@ static int loopback_rate_get(struct snd_ {struct loopback *loopback =snd_kcontrol_chip (kcontrol); +mutex_lock (&loopback->cable_lock); ucontrol->value.integer.value[0 ] = loopback->setup[kcontrol->id.subdevice] [kcontrol->id.device].rate; +mutex_unlock (&loopback->cable_lock);return 0 ; }
@@ -966,9 +977,11 @@ static int loopback_channels_get(struct {struct loopback *loopback =snd_kcontrol_chip (kcontrol); +mutex_lock (&loopback->cable_lock); ucontrol->value.integer.value[0 ] = loopback->setup[kcontrol->id.subdevice] [kcontrol->id.device].channels; +mutex_unlock (&loopback->cable_lock);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 12/32 tracepoint: Do not warn on ENOMEM
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathieu Desnoyers <[email protected]>
commit d66a270be3310d7aa132fec0cea77d3d32a0ff75 upstream.
Tracepoint should only warn when a kernel API user does not respect the required preconditions (e.g. same tracepoint enabled twice, or called to remove a tracepoint that does not exist).
Silence warning in out-of-memory conditions, given that the error is returned to the caller.
This ensures that out-of-memory error-injection testing does not trigger warnings in tracepoint.c, which were seen by syzbot.
--- kernel/tracepoint.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/tracepoint.c +2 -2
@@ -202,7 +202,7 @@ static int tracepoint_add_func(struct tr lockdep_is_held(&tracepoints_mutex)); old =func_add (&tp_funcs, func, prio);if (IS_ERR (old)) { -WARN_ON_ONCE (1 ); +WARN_ON_ONCE (PTR_ERR (old) != -ENOMEM );return PTR_ERR (old); }
@@ -235,7 +235,7 @@ static int tracepoint_remove_func(struct lockdep_is_held(&tracepoints_mutex)); old =func_remove (&tp_funcs, func);if (IS_ERR (old)) { -WARN_ON_ONCE (1 ); +WARN_ON_ONCE (PTR_ERR (old) != -ENOMEM );return PTR_ERR (old); }
Greg Kroah-Hartman
maintainerPATCH 13/32 Input: leds - fix out of bound access
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 6bd6ae639683c0b41f46990d5c64ff9fbfa019dc upstream.
UI_SET_LEDBIT ioctl() causes the following KASAN splat when used with led > LED_CHARGING:
[ 1274.663418] BUG: KASAN: slab-out-of-bounds in input_leds_connect+0x611/0x730 [input_leds] [ 1274.663426] Write of size 8 at addr ffff88003377b2c0 by task ckb-next-daemon/5128
This happens because we were writing to the led structure before making sure that it exists.
--- drivers/input/input-leds.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/input/input-leds.c +4 -4
@@ -88,6 +88,7 @@ static int input_leds_connect(struct inp const struct input_device_id *id) {struct input_leds *leds; +struct input_led *led;unsigned int num_leds;unsigned int led_code;int led_no;
@@ -119,14 +120,13 @@ static int input_leds_connect(struct inp led_no =0 ;for_each_set_bit (led_code, dev->ledbit,LED_CNT ) { -struct input_led *led = &leds->leds[led_no]; +if (!input_led_info[led_code].name) +continue ; + led = &leds->leds[led_no]; led->handle = &leds->handle; led->code = led_code; -if (!input_led_info[led_code].name) -continue ; - led->cdev.name =kasprintf (GFP_KERNEL ,"%s::%s" ,dev_name (&dev->dev), input_led_info[led_code].name);
Greg Kroah-Hartman
maintainerPATCH 14/32 Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vittorio Gambaletta (VittGam) <[email protected]>
commit f372b81101e6895252298e563d634d5e44ae81e7 upstream.
This patch adds the correct platform data information for the Caroline Chromebook, so that the mouse button does not get stuck in pressed state after the first click.
The Samus button keymap and platform data definition are the correct ones for Caroline, so they have been reused here.
--- drivers/input/touchscreen/atmel_mxt_ts.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/input/touchscreen/atmel_mxt_ts.c +9 -0
@@ -3028,6 +3028,15 @@ static const struct dmi_system_id mxt_dm .driver_data = samus_platform_data, }, { +/* Samsung Chromebook Pro */ + .ident = "Samsung Chromebook Pro", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Google" ), + DMI_MATCH(DMI_PRODUCT_NAME, "Caroline"), + }, + .driver_data = samus_platform_data, + }, + {/* Other Google Chromebooks */ .ident ="Chromebook" , .matches = {
Greg Kroah-Hartman
maintainerPATCH 15/32 xfs: prevent creating negative-sized file via INSERT_RANGE
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <[email protected]>
commit 7d83fb14258b9961920cd86f0b921caaeb3ebe85 upstream.
During the "insert range" fallocate operation, i_size grows by the specified 'len' bytes. XFS verifies that i_size + len < s_maxbytes, as it should. But this comparison is done using the signed 'loff_t', and 'i_size + len' can wrap around to a negative value, causing the check to incorrectly pass, resulting in an inode with "negative" i_size. This is possible on 64-bit platforms, where XFS sets s_maxbytes = LLONG_MAX. ext4 and f2fs don't run into this because they set a smaller s_maxbytes.
Fix it by using subtraction instead.
Reproducer:
xfs_io -f file -c "truncate $(((1<<63)-1))" -c "finsert 0 4096"
Originally-From: Eric Biggers <[email protected]>
--- fs/xfs/xfs_file.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
fs/xfs/xfs_file.c +9 -5
@@ -846,22 +846,26 @@ xfs_file_fallocate(if (error) goto out_unlock; }else if (mode &FALLOC_FL_INSERT_RANGE ) { -unsigned int blksize_mask =i_blocksize (inode) -1 ; +unsigned int blksize_mask =i_blocksize (inode) -1 ; +loff_t isize =i_size_read (inode); - new_size =i_size_read (inode) + len;if (offset & blksize_mask || len & blksize_mask) { error = -EINVAL ; goto out_unlock; } -/* check the new inode size does not wrap through zero */ -if (new_size > inode->i_sb->s_maxbytes) { +/* +* New inode size must not exceed ->s_maxbytes, accounting for +* possible signed overflow. +*/ +if (inode->i_sb->s_maxbytes - isize < len) { error = -EFBIG ; goto out_unlock; } + new_size = isize + len;/* Offset should be less than i_size */ -if (offset >=i_size_read (inode)) { +if (offset >= isize) { error = -EINVAL ; goto out_unlock; }
Greg Kroah-Hartman
maintainerPATCH 16/32 RDMA/cxgb4: release hw resources on device removal
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Rangoju <[email protected]>
commit 26bff1bd74a4f7417509a83295614e9dab995b2a upstream.
The c4iw_rdev_close() logic was not releasing all the hw resources (PBL and RQT memory) during the device removal event (driver unload / system reboot). This can cause panic in gen_pool_destroy().
The module remove function will wait for all the hw resources to be released during the device removal event.
Fixes c12a67fe(iw_cxgb4: free EQ queue memory on last deref)
--- drivers/infiniband/hw/cxgb4/device.c | 9 ++++++++- drivers/infiniband/hw/cxgb4/iw_cxgb4.h | 4 ++++ drivers/infiniband/hw/cxgb4/resource.c | 26 ++++++++++++++++++++++++-- 3 files changed, 36 insertions(+), 3 deletions(-)
drivers/infiniband/hw/cxgb4/device.c +8 -1
@@ -856,6 +856,11 @@ static int c4iw_rdev_open(struct c4iw_rd rdev->status_page->db_off =0 ; +init_completion (&rdev->rqt_compl); +init_completion (&rdev->pbl_compl); +kref_init (&rdev->rqt_kref); +kref_init (&rdev->pbl_kref); +return 0 ; err_free_status_page:free_page ((unsigned long )rdev->status_page);
@@ -872,12 +877,14 @@ destroy_resource:static void c4iw_rdev_close (struct c4iw_rdev *rdev) { -destroy_workqueue (rdev->free_workq);kfree (rdev->wr_log);free_page ((unsigned long )rdev->status_page);c4iw_pblpool_destroy (rdev);c4iw_rqtpool_destroy (rdev); +wait_for_completion (&rdev->pbl_compl); +wait_for_completion (&rdev->rqt_compl);c4iw_destroy_resource (&rdev->resource); +destroy_workqueue (rdev->free_workq); }static void c4iw_dealloc (struct uld_ctx *ctx)
drivers/infiniband/hw/cxgb4/iw_cxgb4.h +4 -0
@@ -186,6 +186,10 @@ struct c4iw_rdev {struct wr_log_entry *wr_log;int wr_log_size;struct workqueue_struct *free_workq; +struct completion rqt_compl; +struct completion pbl_compl; +struct kref rqt_kref; +struct kref pbl_kref; };static inline int c4iw_fatal_error (struct c4iw_rdev *rdev)
drivers/infiniband/hw/cxgb4/resource.c +24 -2
@@ -260,12 +260,22 @@ u32 c4iw_pblpool_alloc(struct c4iw_rdev rdev->stats.pbl.cur +=roundup (size,1 <<MIN_PBL_SHIFT );if (rdev->stats.pbl.cur > rdev->stats.pbl.max) rdev->stats.pbl.max = rdev->stats.pbl.cur; +kref_get (&rdev->pbl_kref); }else rdev->stats.pbl.fail++;mutex_unlock (&rdev->stats.lock);return (u32 )addr; } +static void destroy_pblpool (struct kref *kref) +{ +struct c4iw_rdev *rdev; + + rdev = container_of(kref, struct c4iw_rdev, pbl_kref); +gen_pool_destroy (rdev->pbl_pool); +complete (&rdev->pbl_compl); +} +void c4iw_pblpool_free (struct c4iw_rdev *rdev,u32 addr,int size) {PDBG ("%s addr 0x%x size %d\n" , __func__, addr, size);
@@ -273,6 +283,7 @@ void c4iw_pblpool_free(struct c4iw_rdev rdev->stats.pbl.cur -=roundup (size,1 <<MIN_PBL_SHIFT );mutex_unlock (&rdev->stats.lock);gen_pool_free (rdev->pbl_pool, (unsigned long )addr, size); +kref_put (&rdev->pbl_kref, destroy_pblpool); }int c4iw_pblpool_create (struct c4iw_rdev *rdev)
@@ -312,7 +323,7 @@ int c4iw_pblpool_create(struct c4iw_rdevvoid c4iw_pblpool_destroy (struct c4iw_rdev *rdev) { -gen_pool_destroy (rdev->pbl_pool); +kref_put (&rdev->pbl_kref, destroy_pblpool); }/*
@@ -333,12 +344,22 @@ u32 c4iw_rqtpool_alloc(struct c4iw_rdev rdev->stats.rqt.cur +=roundup (size <<6 ,1 <<MIN_RQT_SHIFT );if (rdev->stats.rqt.cur > rdev->stats.rqt.max) rdev->stats.rqt.max = rdev->stats.rqt.cur; +kref_get (&rdev->rqt_kref); }else rdev->stats.rqt.fail++;mutex_unlock (&rdev->stats.lock);return (u32 )addr; } +static void destroy_rqtpool (struct kref *kref) +{ +struct c4iw_rdev *rdev; + + rdev = container_of(kref, struct c4iw_rdev, rqt_kref); +gen_pool_destroy (rdev->rqt_pool); +complete (&rdev->rqt_compl); +} +void c4iw_rqtpool_free (struct c4iw_rdev *rdev,u32 addr,int size) {PDBG ("%s addr 0x%x size %d\n" , __func__, addr, size <<6 );
@@ -346,6 +367,7 @@ void c4iw_rqtpool_free(struct c4iw_rdev rdev->stats.rqt.cur -=roundup (size <<6 ,1 <<MIN_RQT_SHIFT );mutex_unlock (&rdev->stats.lock);gen_pool_free (rdev->rqt_pool, (unsigned long )addr, size <<6 ); +kref_put (&rdev->rqt_kref, destroy_rqtpool); }int c4iw_rqtpool_create (struct c4iw_rdev *rdev)
@@ -383,7 +405,7 @@ int c4iw_rqtpool_create(struct c4iw_rdevvoid c4iw_rqtpool_destroy (struct c4iw_rdev *rdev) { -gen_pool_destroy (rdev->rqt_pool); +kref_put (&rdev->rqt_kref, destroy_rqtpool); }/*
Greg Kroah-Hartman
maintainerPATCH 17/32 RDMA/ucma: Allow resolving address w/o specifying source address
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roland Dreier <[email protected]>
commit 09abfe7b5b2f442a85f4c4d59ecf582ad76088d7 upstream.
The RDMA CM will select a source device and address by consulting the routing table if no source address is passed into rdma_resolve_address(). Userspace will ask for this by passing an all-zero source address in the RESOLVE_IP command. Unfortunately the new check for non-zero address size rejects this with EINVAL, which breaks valid userspace applications.
Fix this by explicitly allowing a zero address family for the source.
--- drivers/infiniband/core/ucma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/core/ucma.c +1 -1
@@ -676,7 +676,7 @@ static ssize_t ucma_resolve_ip(struct ucif (copy_from_user (&cmd, inbuf,sizeof (cmd)))return -EFAULT ; -if (!rdma_addr_size_in6 (&cmd.src_addr) || +if ((cmd.src_addr.sin6_family && !rdma_addr_size_in6 (&cmd.src_addr)) || !rdma_addr_size_in6 (&cmd.dst_addr))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 18/32 RDMA/mlx5: Protect from shift operand overflow
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
commit 002bf2282b2d7318e444dca9ffcb994afc5d5f15 upstream.
Ensure that user didn't supply values too large that can cause overflow.
UBSAN: Undefined behaviour in drivers/infiniband/hw/mlx5/qp.c:263:23 shift exponent -2147483648 is negative CPU: 0 PID: 292 Comm: syzkaller612609 Not tainted 4.16.0-rc1+ #131 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-project.org 04/01/2014 Call Trace: dump_stack+0xde/0x164 ubsan_epilogue+0xe/0x81 set_rq_size+0x7c2/0xa90 create_qp_common+0xc18/0x43c0 mlx5_ib_create_qp+0x379/0x1ca0 create_qp.isra.5+0xc94/0x2260 ib_uverbs_create_qp+0x21b/0x2a0 ib_uverbs_write+0xc2c/0x1010 vfs_write+0x1b0/0x550 SyS_write+0xc7/0x1a0 do_syscall_64+0x1aa/0x740 entry_SYSCALL_64_after_hwframe+0x26/0x9b RIP: 0033:0x433569 RSP: 002b:00007ffc6e62f448 EFLAGS: 00000217 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00000000004002f8 RCX: 0000000000433569 RDX: 0000000000000070 RSI: 00000000200042c0 RDI: 0000000000000003 RBP: 00000000006d5018 R08: 00000000004002f8 R09: 00000000004002f8 R10: 00000000004002f8 R11: 0000000000000217 R12: 0000000000000000 R13: 000000000040c9f0 R14: 000000000040ca80 R15: 0000000000000006
--- drivers/infiniband/hw/mlx5/qp.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/infiniband/hw/mlx5/qp.c +4 -0
@@ -253,7 +253,11 @@ static int set_rq_size(struct mlx5_ib_de }else {if (ucmd) { qp->rq.wqe_cnt = ucmd->rq_wqe_count; +if (ucmd->rq_wqe_shift >BITS_PER_BYTE *sizeof (ucmd->rq_wqe_shift)) +return -EINVAL ; qp->rq.wqe_shift = ucmd->rq_wqe_shift; +if ((1 << qp->rq.wqe_shift) /sizeof (struct mlx5_wqe_data_seg ) < qp->wq_sig) +return -EINVAL ; qp->rq.max_gs = (1 << qp->rq.wqe_shift) /sizeof (struct mlx5_wqe_data_seg ) - qp->wq_sig; qp->rq.max_post = qp->rq.wqe_cnt; }else {
Greg Kroah-Hartman
maintainerPATCH 19/32 NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: SZ Lin (林上智) <[email protected]>
commit 9306b38e42cb266f98bff6f6f4c1c652aa79ba45 upstream.
This patch adds support for PID 0x90b2 of ublox R410M.
qmicli -d /dev/cdc-wdm0 --dms-get-manufacturer
[/dev/cdc-wdm0] Device manufacturer retrieved:
Manufacturer: 'u-blox'
qmicli -d /dev/cdc-wdm0 --dms-get-model
[/dev/cdc-wdm0] Device model retrieved:
Model: 'SARA-R410M-02B'
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -803,6 +803,7 @@ static const struct usb_device_id produc {QMI_FIXED_INTF(0x05c6, 0x9080, 8)}, {QMI_FIXED_INTF(0x05c6, 0x9083, 3)}, {QMI_FIXED_INTF(0x05c6, 0x9084, 4)}, + {QMI_FIXED_INTF(0x05c6, 0x90b2, 3)}, /* ublox R410M */ {QMI_FIXED_INTF(0x05c6, 0x920d, 0)}, {QMI_FIXED_INTF(0x05c6, 0x920d, 5)}, {QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)}, /* YUGA CLM920-NC5 */
Greg Kroah-Hartman
maintainerPATCH 20/32 IB/mlx5: Use unlimited rate when static rate is not supported
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danit Goldberg <[email protected]>
commit 4f32ac2e452c2180cd2df581cbadac183e27ecd0 upstream.
Before the change, if the user passed a static rate value different than zero and the FW doesn't support static rate,
it would end up configuring rate of 2.5 GBps.
Fix this by using rate 0; unlimited, in cases where FW doesn't support static rate configuration.
--- drivers/infiniband/hw/mlx5/qp.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/infiniband/hw/mlx5/qp.c +9 -9
@@ -2168,18 +2168,18 @@ enum {static int ib_rate_to_mlx5 (struct mlx5_ib_dev *dev,u8 rate) { -if (rate ==IB_RATE_PORT_CURRENT ) { +if (rate ==IB_RATE_PORT_CURRENT )return 0 ; - }else if (rate <IB_RATE_2_5_GBPS || rate >IB_RATE_300_GBPS ) { + +if (rate <IB_RATE_2_5_GBPS || rate >IB_RATE_300_GBPS )return -EINVAL ; - }else { -while (rate !=IB_RATE_2_5_GBPS && - !(1 << (rate +MLX5_STAT_RATE_OFFSET ) & -MLX5_CAP_GEN (dev->mdev, stat_rate_support))) - --rate; - } -return rate +MLX5_STAT_RATE_OFFSET ; +while (rate !=IB_RATE_PORT_CURRENT && + !(1 << (rate +MLX5_STAT_RATE_OFFSET ) & +MLX5_CAP_GEN (dev->mdev, stat_rate_support))) + --rate; + +return rate ? rate +MLX5_STAT_RATE_OFFSET : rate; } static int modify_raw_packet_eth_prio(struct mlx5_core_dev *dev,
Greg Kroah-Hartman
maintainerPATCH 21/32 IB/hfi1: Fix NULL pointer dereference when invalid num_vls is used
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Sanchez <[email protected]>
commit 45d924571a5e1329580811f2419da61b07ac3613 upstream.
When an invalid num_vls is used as a module parameter, the code execution follows an exception path where the macro dd_dev_err() expects dd->pcidev->dev not to be NULL in hfi1_init_dd(). This causes a NULL pointer dereference.
Fix hfi1_init_dd() by initializing dd->pcidev and dd->pcidev->dev earlier in the code. If a dd exists, then dd->pcidev and dd->pcidev->dev always exists.
BUG: unable to handle kernel NULL pointer dereference at 00000000000000f0 IP: __dev_printk+0x15/0x90 Workqueue: events work_for_cpu_fn RIP: 0010:__dev_printk+0x15/0x90 Call Trace: dev_err+0x6c/0x90 ? hfi1_init_pportdata+0x38d/0x3f0 [hfi1] hfi1_init_dd+0xdd/0x2530 [hfi1] ? pci_conf1_read+0xb2/0xf0 ? pci_read_config_word.part.9+0x64/0x80 ? pci_conf1_write+0xb0/0xf0 ? pcie_capability_clear_and_set_word+0x57/0x80 init_one+0x141/0x490 [hfi1] local_pci_probe+0x3f/0xa0 work_for_cpu_fn+0x10/0x20 process_one_work+0x152/0x350 worker_thread+0x1cf/0x3e0 kthread+0xf5/0x130 ? max_active_store+0x80/0x80 ? kthread_bind+0x10/0x10 ? do_syscall_64+0x6e/0x1a0 ? SyS_exit_group+0x10/0x10 ret_from_fork+0x35/0x40
--- drivers/infiniband/hw/hfi1/init.c | 2 ++ drivers/infiniband/hw/hfi1/pcie.c | 3 --- 2 files changed, 2 insertions(+), 3 deletions(-)
drivers/infiniband/hw/hfi1/init.c +2 -0
@@ -1049,6 +1049,8 @@ struct hfi1_devdata *hfi1_alloc_devdata(return ERR_PTR (-ENOMEM ); dd->num_pports = nports; dd->pport = (struct hfi1_pportdata *)(dd +1 ); + dd->pcidev = pdev; +pci_set_drvdata (pdev, dd);INIT_LIST_HEAD (&dd->list);idr_preload (GFP_KERNEL );
drivers/infiniband/hw/hfi1/pcie.c +0 -3
@@ -162,9 +162,6 @@ int hfi1_pcie_ddinit(struct hfi1_devdataunsigned long len;resource_size_t addr; - dd->pcidev = pdev; -pci_set_drvdata (pdev, dd); - addr =pci_resource_start (pdev,0 ); len =pci_resource_len (pdev,0 );
Greg Kroah-Hartman
maintainerPATCH 22/32 drm/vmwgfx: Fix a buffer object leak
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellstrom <[email protected]>
commit 13f149d47392782baafd96d54d4e65f3b5ca342f upstream.
A buffer object leak was introduced when fixing a premature buffer object release. Fix this.
--- drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +1 -0
@@ -2014,6 +2014,7 @@ void vmw_kms_helper_resource_finish(struvmw_kms_helper_buffer_finish (res->dev_priv,NULL , ctx->buf, out_fence,NULL ); +vmw_dmabuf_unreference (&ctx->buf);vmw_resource_unreserve (res, false,NULL ,0 );mutex_unlock (&res->dev_priv->cmdbuf_mutex); }
Greg Kroah-Hartman
maintainerPATCH 23/32 drm/bridge: vga-dac: Fix edid memory leak
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Paul <[email protected]>
commit 49ceda9de2da4d1827941d06701f3017c27c1855 upstream.
edid should be freed once it's finished being used.
--- drivers/gpu/drm/bridge/dumb-vga-dac.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/bridge/dumb-vga-dac.c +3 -1
@@ -53,7 +53,9 @@ static int dumb_vga_get_modes(struct drm }drm_mode_connector_update_edid_property (connector, edid); -return drm_add_edid_modes (connector, edid); + ret =drm_add_edid_modes (connector, edid); +kfree (edid); +return ret; fallback:/*
Greg Kroah-Hartman
maintainerPATCH 24/32 test_firmware: fix setting old custom fw path back on exit, second try
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
commit e538409257d0217a9bc715686100a5328db75a15 upstream.
Commit 65c79230576 tried to clear the custom firmware path on exit by writing a single space to the firmware_class.path parameter. This doesn't work because nothing strips this space from the value stored and fw_get_filesystem_firmware() only ignores zero-length paths.
Instead, write a null byte.
--- tools/testing/selftests/firmware/fw_filesystem.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
tools/testing/selftests/firmware/fw_filesystem.sh +4 -2
@@ -29,9 +29,11 @@ test_finish() echo "$OLD_TIMEOUT" >/sys/class/firmware/timeout fi if [ "$OLD_FWPATH" = "" ]; then - OLD_FWPATH=" " + # A zero-length write won't work; write a null byte + printf '\000' >/sys/module/firmware_class/parameters/path + else + echo -n "$OLD_FWPATH" >/sys/module/firmware_class/parameters/path fi - echo -n "$OLD_FWPATH" >/sys/module/firmware_class/parameters/path rm -f "$FW" rmdir "$FWPATH" }
Greg Kroah-Hartman
maintainerPATCH 25/32 USB: serial: visor: handle potential invalid device configuration
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 4842ed5bfcb9daf6660537d70503c18d38dbdbb8 upstream.
If we get an invalid device configuration from a palm 3 type device, we might incorrectly parse things, and we have the potential to crash in "interesting" ways.
Fix this up by verifying the size of the configuration passed to us by the device, and only if it is correct, will we handle it.
Note that this also fixes an information leak of slab data.
--- drivers/usb/serial/visor.c | 69 ++++++++++++++++++++++----------------------- 1 file changed, 35 insertions(+), 34 deletions(-)
drivers/usb/serial/visor.c +35 -34
@@ -338,47 +338,48 @@ static int palm_os_3_probe(struct usb_se goto exit; } -if (retval ==sizeof (*connection_info)) { - connection_info = (struct visor_connection_info *) - transfer_buffer; - - num_ports =le16_to_cpu (connection_info->num_ports); -for (i =0 ; i < num_ports; ++i) { -switch ( - connection_info->connections[i].port_function_id) { -case VISOR_FUNCTION_GENERIC : - string ="Generic" ; -break ; -case VISOR_FUNCTION_DEBUGGER : - string ="Debugger" ; -break ; -case VISOR_FUNCTION_HOTSYNC : - string ="HotSync" ; -break ; -case VISOR_FUNCTION_CONSOLE : - string ="Console" ; -break ; -case VISOR_FUNCTION_REMOTE_FILE_SYS : - string ="Remote File System" ; -break ; -default : - string ="unknown" ; -break ; - } -dev_info (dev,"%s: port %d, is for %s use\n" , - serial->type->description, - connection_info->connections[i].port, string); - } +if (retval !=sizeof (*connection_info)) { +dev_err (dev,"Invalid connection information received from device\n" ); + retval = -ENODEV ; + goto exit; } -/* -* Handle devices that report invalid stuff here. -*/ + + connection_info = (struct visor_connection_info *)transfer_buffer; + + num_ports =le16_to_cpu (connection_info->num_ports); + +/* Handle devices that report invalid stuff here. */ if (num_ports ==0 || num_ports >2 ) {dev_warn (dev,"%s: No valid connect info available\n" , serial->type->description); num_ports =2 ; } +for (i =0 ; i < num_ports; ++i) { +switch (connection_info->connections[i].port_function_id) { +case VISOR_FUNCTION_GENERIC : + string ="Generic" ; +break ; +case VISOR_FUNCTION_DEBUGGER : + string ="Debugger" ; +break ; +case VISOR_FUNCTION_HOTSYNC : + string ="HotSync" ; +break ; +case VISOR_FUNCTION_CONSOLE : + string ="Console" ; +break ; +case VISOR_FUNCTION_REMOTE_FILE_SYS : + string ="Remote File System" ; +break ; +default : + string ="unknown" ; +break ; + } +dev_info (dev,"%s: port %d, is for %s use\n" , + serial->type->description, + connection_info->connections[i].port, string); + }dev_info (dev,"%s: Number of ports: %d\n" , serial->type->description, num_ports);
Greg Kroah-Hartman
maintainerPATCH 26/32 USB: Accept bulk endpoints with 1024-byte maxpacket
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit fb5ee84ea72c5f1b6cabdd1c9d6e8648995ca7c6 upstream.
Some non-compliant high-speed USB devices have bulk endpoints with a 1024-byte maxpacket size. Although such endpoints don't work with xHCI host controllers, they do work with EHCI controllers. We used to accept these invalid sizes (with a warning), but we no longer do because of an unintentional change introduced by commit aed9d65ac327 ("USB: validate wMaxPacketValue entries in endpoint descriptors").
This patch restores the old behavior, so that people with these peculiar devices can use them without patching their kernels by hand.
--- drivers/usb/core/config.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/core/config.c +3 -1
@@ -186,7 +186,9 @@ static const unsigned short full_speed_mstatic const unsigned short high_speed_maxpacket_maxes[4 ] = { [USB_ENDPOINT_XFER_CONTROL ] =64 , [USB_ENDPOINT_XFER_ISOC ] =1024 , - [USB_ENDPOINT_XFER_BULK ] =512 , + +/* Bulk should be 512, but some devices use 1024: we will warn below */ + [USB_ENDPOINT_XFER_BULK ] =1024 , [USB_ENDPOINT_XFER_INT ] =1024 , };static const unsigned short super_speed_maxpacket_maxes[4 ] = {
Greg Kroah-Hartman
maintainerPATCH 27/32 USB: serial: option: reimplement interface masking
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit c3a65808f04a8426481b63a4fbd9392f009f6330 upstream.
Reimplement interface masking using device flags stored directly in the device-id table. This will make it easier to add and maintain device-id entries by using a more compact and readable notation compared to the current implementation (which manages pairs of masks in separate blacklist structs).
Two convenience macros are used to flag an interface as either reserved or as not supporting modem-control requests:
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
.driver_info = NCTRL(0) | RSVD(3) },For now, we limit the highest maskable interface number to seven, which allows for (up to 16) additional device flags to be added later should need arise.
Note that this will likely need to be backported to stable in order to make future device-id backports more manageable.
--- drivers/usb/serial/option.c | 446 ++++++++++++++------------------------------ 1 file changed, 152 insertions(+), 294 deletions(-)
drivers/usb/serial/option.c +152 -294
@@ -551,151 +551,15 @@ static void option_instat_callback(struc#define WETELECOM_PRODUCT_6802 0x6802#define WETELECOM_PRODUCT_WMD300 0x6803 -struct option_blacklist_info { -/* bitmask of interface numbers blacklisted for send_setup */ -const unsigned long sendsetup; -/* bitmask of interface numbers that are reserved */ -const unsigned long reserved; -}; - -static const struct option_blacklist_info four_g_w14_blacklist = { - .sendsetup =BIT (0 ) |BIT (1 ), -}; - -static const struct option_blacklist_info four_g_w100_blacklist = { - .sendsetup =BIT (1 ) |BIT (2 ), - .reserved =BIT (3 ), -}; - -static const struct option_blacklist_info alcatel_x200_blacklist = { - .sendsetup =BIT (0 ) |BIT (1 ), - .reserved =BIT (4 ), -}; - -static const struct option_blacklist_info zte_0037_blacklist = { - .sendsetup =BIT (0 ) |BIT (1 ), -}; - -static const struct option_blacklist_info zte_k3765_z_blacklist = { - .sendsetup =BIT (0 ) |BIT (1 ) |BIT (2 ), - .reserved =BIT (4 ), -}; - -static const struct option_blacklist_info zte_ad3812_z_blacklist = { - .sendsetup =BIT (0 ) |BIT (1 ) |BIT (2 ), -}; - -static const struct option_blacklist_info zte_mc2718_z_blacklist = { - .sendsetup =BIT (1 ) |BIT (2 ) |BIT (3 ) |BIT (4 ), -}; - -static const struct option_blacklist_info zte_mc2716_z_blacklist = { - .sendsetup =BIT (1 ) |BIT (2 ) |BIT (3 ), -}; - -static const struct option_blacklist_info zte_me3620_mbim_blacklist = { - .reserved =BIT (2 ) |BIT (3 ) |BIT (4 ), -}; - -static const struct option_blacklist_info zte_me3620_xl_blacklist = { - .reserved =BIT (3 ) |BIT (4 ) |BIT (5 ), -}; - -static const struct option_blacklist_info zte_zm8620_x_blacklist = { - .reserved =BIT (3 ) |BIT (4 ) |BIT (5 ), -}; - -static const struct option_blacklist_info huawei_cdc12_blacklist = { - .reserved =BIT (1 ) |BIT (2 ), -}; - -static const struct option_blacklist_info net_intf0_blacklist = { - .reserved =BIT (0 ), -}; - -static const struct option_blacklist_info net_intf1_blacklist = { - .reserved =BIT (1 ), -}; - -static const struct option_blacklist_info net_intf2_blacklist = { - .reserved =BIT (2 ), -}; - -static const struct option_blacklist_info net_intf3_blacklist = { - .reserved =BIT (3 ), -}; - -static const struct option_blacklist_info net_intf4_blacklist = { - .reserved =BIT (4 ), -}; - -static const struct option_blacklist_info net_intf5_blacklist = { - .reserved =BIT (5 ), -}; - -static const struct option_blacklist_info net_intf6_blacklist = { - .reserved =BIT (6 ), -}; - -static const struct option_blacklist_info zte_mf626_blacklist = { - .sendsetup =BIT (0 ) |BIT (1 ), - .reserved =BIT (4 ), -}; - -static const struct option_blacklist_info zte_1255_blacklist = { - .reserved =BIT (3 ) |BIT (4 ), -}; - -static const struct option_blacklist_info simcom_sim7100e_blacklist = { - .reserved =BIT (5 ) |BIT (6 ), -}; - -static const struct option_blacklist_info telit_me910_blacklist = { - .sendsetup =BIT (0 ), - .reserved =BIT (1 ) |BIT (3 ), -}; - -static const struct option_blacklist_info telit_me910_dual_modem_blacklist = { - .sendsetup =BIT (0 ), - .reserved =BIT (3 ), -}; - -static const struct option_blacklist_info telit_le910_blacklist = { - .sendsetup =BIT (0 ), - .reserved =BIT (1 ) |BIT (2 ), -}; - -static const struct option_blacklist_info telit_le920_blacklist = { - .sendsetup =BIT (0 ), - .reserved =BIT (1 ) |BIT (5 ), -}; - -static const struct option_blacklist_info telit_le920a4_blacklist_1 = { - .sendsetup =BIT (0 ), - .reserved =BIT (1 ), -}; - -static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = { - .sendsetup =BIT (2 ), - .reserved =BIT (0 ) |BIT (1 ) |BIT (3 ), -}; -static const struct option_blacklist_info telit_le922_blacklist_usbcfg3 = { - .sendsetup =BIT (0 ), - .reserved =BIT (1 ) |BIT (2 ) |BIT (3 ), -}; +/* Device flags */ -static const struct option_blacklist_info cinterion_rmnet2_blacklist = { - .reserved =BIT (4 ) |BIT (5 ), -}; +/* Interface does not support modem-control requests */ +#define NCTRL (ifnum) ((BIT(ifnum) & 0xff) << 8) -static const struct option_blacklist_info yuga_clm920_nc5_blacklist = { - .reserved =BIT (1 ) |BIT (4 ), -}; +/* Interface is reserved */ +#define RSVD (ifnum) ((BIT(ifnum) & 0xff) << 0) -static const struct option_blacklist_info quectel_ep06_blacklist = { - .reserved =BIT (4 ) |BIT (5 ), -};static const struct usb_device_id option_ids[] = { {USB_DEVICE (OPTION_VENDOR_ID ,OPTION_PRODUCT_COLT ) },
@@ -729,26 +593,26 @@ static const struct usb_device_id option { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GKE) }, { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GLE) }, { USB_DEVICE(QUANTA_VENDOR_ID, 0xea42), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c05, USB_CLASS_COMM, 0x02, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c1f, USB_CLASS_COMM, 0x02, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c23, USB_CLASS_COMM, 0x02, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t) &net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173S6, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t) &net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1750, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t) &net_intf2_blacklist }, + .driver_info = RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1441, USB_CLASS_COMM, 0x02, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1442, USB_CLASS_COMM, 0x02, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist }, + .driver_info = RSVD(1) | RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist }, + .driver_info = RSVD(1) | RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x14ac, 0xff, 0xff, 0xff), /* Huawei E1820 */ - .driver_info = (kernel_ulong_t) &net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist }, + .driver_info = RSVD(1) | RSVD(2) }, { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0xff, 0xff) }, { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x01) }, { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x02) },
@@ -1193,67 +1057,67 @@ static const struct usb_device_id option { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) }, { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */ { USB_DEVICE_AND_INTERFACE_INFO(QUALCOMM_VENDOR_ID, 0x6001, 0xff, 0xff, 0xff), /* 4G LTE usb-modem U901 */ - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 *//* Quectel products using Qualcomm vendor ID */ { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)}, { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) },/* Yuga products use Qualcomm vendor ID */ { USB_DEVICE(QUALCOMM_VENDOR_ID, YUGA_PRODUCT_CLM920_NC5), - .driver_info = (kernel_ulong_t)&yuga_clm920_nc5_blacklist }, + .driver_info = RSVD(1) | RSVD(4) },/* Quectel products using Quectel vendor ID */ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06), - .driver_info = (kernel_ulong_t)&quectel_ep06_blacklist }, + .driver_info = RSVD(4) | RSVD(5) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003), - .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, + .driver_info = RSVD(0) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6004) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6005) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_628A) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHE_628S), - .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, + .driver_info = RSVD(0) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_301), - .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, + .driver_info = RSVD(0) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628), - .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, + .driver_info = RSVD(0) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628S) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_680) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_685A) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720S), - .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, + .driver_info = RSVD(0) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7002), - .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, + .driver_info = RSVD(0) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629K), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7004), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7005) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_629), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629S), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720I), - .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, + .driver_info = RSVD(0) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7212), - .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, + .driver_info = RSVD(0) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7213), - .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, + .driver_info = RSVD(0) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7251), - .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7252), - .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7253), - .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864G) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_DUAL) },
@@ -1261,38 +1125,38 @@ static const struct usb_device_id option { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0), - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, + .driver_info = RSVD(0) | RSVD(1) | NCTRL(2) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG1), - .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG2), - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3), - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff), - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, + .driver_info = RSVD(0) | RSVD(1) | NCTRL(2) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), - .driver_info = (kernel_ulong_t)&telit_me910_blacklist }, + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), - .driver_info = (kernel_ulong_t)&telit_me910_dual_modem_blacklist }, + .driver_info = NCTRL(0) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), - .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), - .driver_info = (kernel_ulong_t)&telit_le920_blacklist }, + .driver_info = NCTRL(0) | RSVD(1) | RSVD(5) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1207) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1208), - .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 }, + .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1211), - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1212), - .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 }, + .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214), - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0003, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0004, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0005, 0xff, 0xff, 0xff) },
@@ -1308,58 +1172,58 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0010, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0011, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0012, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0013, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0016, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0017, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0018, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0019, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0020, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0021, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0022, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0023, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0024, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0025, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0028, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0029, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0030, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF626, 0xff, - 0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_mf626_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF626, 0xff, 0xff, 0xff), + .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0032, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0033, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0034, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0037, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&zte_0037_blacklist }, + .driver_info = NCTRL(0) | NCTRL(1) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0038, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0039, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0040, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0042, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0043, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0044, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0048, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0049, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0050, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0051, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0052, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0054, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0055, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0056, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0057, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0058, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0061, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0062, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0063, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0064, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0065, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0066, 0xff, 0xff, 0xff) },
@@ -1384,26 +1248,26 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0096, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0097, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0104, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0105, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0106, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0108, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0113, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0117, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0118, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0121, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0122, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0123, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0124, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0125, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + .driver_info = RSVD(6) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0126, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0128, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0135, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0136, 0xff, 0xff, 0xff) },
@@ -1419,50 +1283,50 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0155, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0156, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0159, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0164, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0165, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0167, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0189, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0191, 0xff, 0xff, 0xff), /* ZTE EuFi890 */ - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0196, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0197, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0199, 0xff, 0xff, 0xff), /* ZTE MF820S */ - .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0200, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0201, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0254, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0257, 0xff, 0xff, 0xff), /* ZTE MF821 */ - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0265, 0xff, 0xff, 0xff), /* ONDA MT8205 */ - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0284, 0xff, 0xff, 0xff), /* ZTE MF880 */ - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0317, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0326, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0330, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0395, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0412, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G */ - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0414, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0417, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1018, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1021, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + .driver_info = RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) },
@@ -1579,23 +1443,23 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1170, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1244, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1245, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1246, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1247, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1248, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1249, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1250, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1251, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1252, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1253, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1254, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1255, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&zte_1255_blacklist }, + .driver_info = RSVD(3) | RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1256, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1257, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1258, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1259, 0xff, 0xff, 0xff) },
@@ -1610,7 +1474,7 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1268, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1269, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1270, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1271, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1272, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1273, 0xff, 0xff, 0xff) },
@@ -1646,17 +1510,17 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1303, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1333, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1401, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + .driver_info = RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1402, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + .driver_info = RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1424, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + .driver_info = RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1425, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + .driver_info = RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff), /* ZTE MF91 */ - .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + .driver_info = RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G v2 */ - .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + .driver_info = RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
@@ -1674,8 +1538,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1596, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1598, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1600, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, - 0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff), + .driver_info = NCTRL(0) | NCTRL(1) | NCTRL(2) | RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, /* ZTE CDMA products */
@@ -1686,20 +1550,20 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0094, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0168, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0170, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0176, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff42, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff43, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff44, 0xff, 0xff, 0xff) },
@@ -1851,19 +1715,19 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710T, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2718, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&zte_mc2718_z_blacklist }, + .driver_info = NCTRL(1) | NCTRL(2) | NCTRL(3) | NCTRL(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AD3812, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist }, + .driver_info = NCTRL(0) | NCTRL(1) | NCTRL(2) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist }, + .driver_info = NCTRL(1) | NCTRL(2) | NCTRL(3) }, { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_L), - .driver_info = (kernel_ulong_t)&zte_me3620_xl_blacklist }, + .driver_info = RSVD(3) | RSVD(4) | RSVD(5) }, { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_MBIM), - .driver_info = (kernel_ulong_t)&zte_me3620_mbim_blacklist }, + .driver_info = RSVD(2) | RSVD(3) | RSVD(4) }, { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_X), - .driver_info = (kernel_ulong_t)&zte_me3620_xl_blacklist }, + .driver_info = RSVD(3) | RSVD(4) | RSVD(5) }, { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ZM8620_X), - .driver_info = (kernel_ulong_t)&zte_zm8620_x_blacklist }, + .driver_info = RSVD(3) | RSVD(4) | RSVD(5) }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
@@ -1883,37 +1747,34 @@ static const struct usb_device_id option { USB_DEVICE(ALINK_VENDOR_ID, ALINK_PRODUCT_PH300) }, { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) }, { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E), - .driver_info = (kernel_ulong_t)&simcom_sim7100e_blacklist }, + .driver_info = RSVD(5) | RSVD(6) }, { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200), - .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist - }, + .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) }, { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D), - .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + .driver_info = RSVD(6) }, { USB_DEVICE(ALCATEL_VENDOR_ID, 0x0052), - .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + .driver_info = RSVD(6) }, { USB_DEVICE(ALCATEL_VENDOR_ID, 0x00b6), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE(ALCATEL_VENDOR_ID, 0x00b7), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L100V), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L800MA), - .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + .driver_info = RSVD(2) }, { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) }, { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) }, { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14), - .driver_info = (kernel_ulong_t)&four_g_w14_blacklist - }, + .driver_info = NCTRL(0) | NCTRL(1) }, { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W100), - .driver_info = (kernel_ulong_t)&four_g_w100_blacklist - }, + .driver_info = NCTRL(1) | NCTRL(2) | RSVD(3) }, {USB_DEVICE(LONGCHEER_VENDOR_ID, FUJISOFT_PRODUCT_FS040U), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist}, + .driver_info = RSVD(3)}, { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) }, { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, 0x9801, 0xff), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, 0x9803, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
@@ -1939,14 +1800,14 @@ static const struct usb_device_id option { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_E) }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX, 0xff) }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_2RMNET, 0xff), - .driver_info = (kernel_ulong_t)&cinterion_rmnet2_blacklist }, + .driver_info = RSVD(4) | RSVD(5) }, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_AUDIO, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_2RMNET, 0xff) }, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_AUDIO, 0xff) }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
@@ -1956,20 +1817,20 @@ static const struct usb_device_id option { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */ { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD140), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD155), - .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + .driver_info = RSVD(6) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200), - .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + .driver_info = RSVD(6) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD160), - .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + .driver_info = RSVD(6) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */ { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/ { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
@@ -2046,9 +1907,9 @@ static const struct usb_device_id option { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) }, { USB_DEVICE_AND_INTERFACE_INFO(TPLINK_VENDOR_ID, TPLINK_PRODUCT_LTE, 0xff, 0x00, 0x00) }, /* TP-Link LTE Module */ { USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(TPLINK_VENDOR_ID, 0x9000), /* TP-Link MA260 */ - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(CHANGHONG_VENDOR_ID, CHANGHONG_PRODUCT_CH690) }, { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x02, 0x01) }, /* D-Link DWM-156 (variant) */ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x00, 0x00) }, /* D-Link DWM-156 (variant) */
@@ -2059,9 +1920,9 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) }, /* D-Link DWM-158 */ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d0e, 0xff) }, /* D-Link DWM-157 C1 */ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */ - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */ - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
@@ -2121,7 +1982,7 @@ static int option_probe(struct usb_seriastruct usb_interface_descriptor *iface_desc = &serial->interface->cur_altsetting->desc;struct usb_device_descriptor *dev_desc = &serial->dev->descriptor; -const struct option_blacklist_info *blacklist; +unsigned long device_flags = id->driver_info;/* Never bind to the CD-Rom emulation interface */ if (iface_desc->bInterfaceClass ==0x08 )
@@ -2132,9 +1993,7 @@ static int option_probe(struct usb_seria* the same class/subclass/protocol as the serial interfaces. Look at * the Windows driver .INF files for reserved interface numbers. */ - blacklist = (void *)id->driver_info; -if (blacklist &&test_bit (iface_desc->bInterfaceNumber, - &blacklist->reserved)) +if (device_flags &RSVD (iface_desc->bInterfaceNumber))return -ENODEV ;/* * Don't bind network interface on Samsung GT-B3730, it is handled by
@@ -2145,8 +2004,8 @@ static int option_probe(struct usb_seria iface_desc->bInterfaceClass != USB_CLASS_CDC_DATA) return -ENODEV; -/* Store the blacklist info so we can use it during attach. */ -usb_set_serial_data (serial, (void *)blacklist); +/* Store the device flags so we can use them during attach. */ +usb_set_serial_data (serial, (void *)device_flags);return 0 ; }
@@ -2154,22 +2013,21 @@ static int option_probe(struct usb_seriastatic int option_attach (struct usb_serial *serial) {struct usb_interface_descriptor *iface_desc; -const struct option_blacklist_info *blacklist;struct usb_wwan_intf_private *data; +unsigned long device_flags; data =kzalloc (sizeof (struct usb_wwan_intf_private ),GFP_KERNEL );if (!data)return -ENOMEM ; -/* Retrieve blacklist info stored at probe. */ - blacklist =usb_get_serial_data (serial); +/* Retrieve device flags stored at probe. */ + device_flags = (unsigned long )usb_get_serial_data (serial); iface_desc = &serial->interface->cur_altsetting->desc; -if (!blacklist || !test_bit (iface_desc->bInterfaceNumber, - &blacklist->sendsetup)) { +if (!(device_flags &NCTRL (iface_desc->bInterfaceNumber))) data->use_send_setup =1 ; - } +spin_lock_init (&data->susp_lock);usb_set_serial_data (serial, data);
Greg Kroah-Hartman
maintainerPATCH 28/32 USB: serial: option: adding support for ublox R410M
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: SZ Lin (林上智) <[email protected]>
commit 4205cb01f6e9ef2ae6daa7be4e8ac1edeb4c9d64 upstream.
This patch adds support for ublox R410M PID 0x90b2 USB modem to option driver, this module supports LTE Cat M1 / NB1.
Interface layout:
0: QCDM/DIAG
1: ADB
2: AT
3: RMNET
--- drivers/usb/serial/option.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/serial/option.c +5 -0
@@ -236,6 +236,8 @@ static void option_instat_callback(struc/* These Quectel products use Qualcomm's vendor ID */ #define QUECTEL_PRODUCT_UC20 0x9003#define QUECTEL_PRODUCT_UC15 0x9090 +/* These u-blox products use Qualcomm's vendor ID */ +#define UBLOX_PRODUCT_R410M 0x90b2/* These Yuga products use Qualcomm's vendor ID */ #define YUGA_PRODUCT_CLM920_NC5 0x9625
@@ -1068,6 +1070,9 @@ static const struct usb_device_id option/* Yuga products use Qualcomm vendor ID */ { USB_DEVICE(QUALCOMM_VENDOR_ID, YUGA_PRODUCT_CLM920_NC5), .driver_info = RSVD(1) | RSVD(4) }, + /* u-blox products using Qualcomm vendor ID */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R410M), + .driver_info = RSVD(1) | RSVD(3) }, /* Quectel products using Quectel vendor ID */ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21), .driver_info = RSVD(4) },
Greg Kroah-Hartman
maintainerPATCH 29/32 usb: musb: host: fix potential NULL pointer dereference
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bin Liu <[email protected]>
commit 2b63f1329df2cd814c1f8353fae4853ace6521d1 upstream.
musb_start_urb() doesn't check the pass-in parameter if it is NULL. But in musb_bulk_nak_timeout() the parameter passed to musb_start_urb() is returned from first_qh(), which could be NULL.
So wrap the musb_start_urb() call here with a if condition check to avoid the potential NULL pointer dereference.
--- drivers/usb/musb/musb_host.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/musb/musb_host.c +3 -1
@@ -1023,7 +1023,9 @@ static void musb_bulk_nak_timeout(struct/* set tx_reinit and schedule the next qh */ ep->tx_reinit =1 ; } -musb_start_urb (musb, is_in, next_qh); + +if (next_qh) +musb_start_urb (musb, is_in, next_qh); } }
Greg Kroah-Hartman
maintainerPATCH 30/32 usb: musb: trace: fix NULL pointer dereference in musb_g_tx()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bin Liu <[email protected]>
commit 9aea9b6cc78d2b99b23d84fb2e0bc6e464c6569e upstream.
The usb_request pointer could be NULL in musb_g_tx(), where the tracepoint call would trigger the NULL pointer dereference failure when parsing the members of the usb_request pointer.
Move the tracepoint call to where the usb_request pointer is already checked to solve the issue.
--- drivers/usb/musb/musb_gadget.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/musb/musb_gadget.c +2 -1
@@ -442,7 +442,6 @@ void musb_g_tx(struct musb *musb, u8 epn req =next_request (musb_ep); request = &req->request; -trace_musb_req_tx (req); csr =musb_readw (epio,MUSB_TXCSR );musb_dbg (musb,"<== %s, txcsr %04x" , musb_ep->end_point.name, csr);
@@ -481,6 +480,8 @@ void musb_g_tx(struct musb *musb, u8 epnu8 is_dma =0 ;bool short_packet = false; +trace_musb_req_tx (req); +if (dma && (csr &MUSB_TXCSR_DMAENAB )) { is_dma =1 ; csr |=MUSB_TXCSR_P_WZC_BITS ;
Greg Kroah-Hartman
maintainerPATCH 31/32 platform/x86: asus-wireless: Fix NULL pointer dereference
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: João Paulo Rechi Vita <[email protected]>
commit 9f0a93de9139c2b0a59299cd36b61564522458f8 upstream.
When the module is removed the led workqueue is destroyed in the remove callback, before the led device is unregistered from the led subsystem.
This leads to a NULL pointer derefence when the led device is unregistered automatically later as part of the module removal cleanup. Bellow is the backtrace showing the problem.
BUG: unable to handle kernel NULL pointer dereference at (null) IP: __queue_work+0x8c/0x410 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI Modules linked in: ccm edac_mce_amd kvm_amd kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 joydev crypto_simd asus_nb_wmi glue_helper uvcvideo snd_hda_codec_conexant snd_hda_codec_generic snd_hda_codec_hdmi snd_hda_intel asus_wmi snd_hda_codec cryptd snd_hda_core sparse_keymap videobuf2_vmalloc arc4 videobuf2_memops snd_hwdep input_leds videobuf2_v4l2 ath9k psmouse videobuf2_core videodev ath9k_common snd_pcm ath9k_hw media fam15h_power ath k10temp snd_timer mac80211 i2c_piix4 r8169 mii mac_hid cfg80211 asus_wireless(-) snd soundcore wmi shpchp 8250_dw ip_tables x_tables amdkfd amd_iommu_v2 amdgpu radeon chash i2c_algo_bit drm_kms_helper syscopyarea serio_raw sysfillrect sysimgblt fb_sys_fops ahci ttm libahci drm video CPU: 3 PID: 2177 Comm: rmmod Not tainted 4.15.0-5-generic #6+dev94.b4287e5bem1-Endless Hardware name: ASUSTeK COMPUTER INC. X555DG/X555DG, BIOS 5.011 05/05/2015 RIP: 0010:__queue_work+0x8c/0x410 RSP: 0018:ffffbe8cc249fcd8 EFLAGS: 00010086 RAX: ffff992ac6810800 RBX: 0000000000000000 RCX: 0000000000000008 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff992ac6400e18 RBP: ffffbe8cc249fd18 R08: ffff992ac6400db0 R09: 0000000000000000 R10: 0000000000000040 R11: ffff992ac6400dd8 R12: 0000000000002000 R13: ffff992abd762e00 R14: ffff992abd763e38 R15: 000000000001ebe0 FS: 00007f318203e700(0000) GS:ffff992aced80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000001c720e000 CR4: 00000000001406e0 Call Trace: queue_work_on+0x38/0x40 led_state_set+0x2c/0x40 [asus_wireless] led_set_brightness_nopm+0x14/0x40 led_set_brightness+0x37/0x60 led_trigger_set+0xfc/0x1d0 led_classdev_unregister+0x32/0xd0 devm_led_classdev_release+0x11/0x20 release_nodes+0x109/0x1f0 devres_release_all+0x3c/0x50 device_release_driver_internal+0x16d/0x220 driver_detach+0x3f/0x80 bus_remove_driver+0x55/0xd0 driver_unregister+0x2c/0x40 acpi_bus_unregister_driver+0x15/0x20 asus_wireless_driver_exit+0x10/0xb7c [asus_wireless] SyS_delete_module+0x1da/0x2b0 entry_SYSCALL_64_fastpath+0x24/0x87 RIP: 0033:0x7f3181b65fd7 RSP: 002b:00007ffe74bcbe18 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3181b65fd7 RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000555ea2559258 RBP: 0000555ea25591f0 R08: 00007ffe74bcad91 R09: 000000000000000a R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000003 R13: 00007ffe74bcae00 R14: 0000000000000000 R15: 0000555ea25591f0 Code: 01 00 00 02 0f 85 7d 01 00 00 48 63 45 d4 48 c7 c6 00 f4 fa 87 49 8b 9d 08 01 00 00 48 03 1c c6 4c 89 f7 e8 87 fb ff ff 48 85 c0 <48> 8b 3b 0f 84 c5 01 00 00 48 39 f8 0f 84 bc 01 00 00 48 89 c7 RIP: __queue_work+0x8c/0x410 RSP: ffffbe8cc249fcd8 CR2: 0000000000000000 ---[ end trace 7aa4f4a232e9c39c ]---
Unregistering the led device on the remove callback before destroying the workqueue avoids this problem.
https://bugzilla.kernel.org/show_bug.cgi?id=196097
--- drivers/platform/x86/asus-wireless.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/platform/x86/asus-wireless.c +3 -1
@@ -145,8 +145,10 @@ static int asus_wireless_remove(struct a {struct asus_wireless_data *data =acpi_driver_data (adev); -if (data->wq) +if (data->wq) { +devm_led_classdev_unregister (&adev->dev, &data->led);destroy_workqueue (data->wq); + }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 32/32 s390/facilites: use stfle_fac_list array size for MAX_FACILITY_BIT
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
commit 6f5165e864d240d15675cc2fb5a369d57e1f60d0 upstream.
Use the actual size of the facility list array within the lowcore structure for the MAX_FACILITY_BIT define instead of a comment which states what this is good for. This makes it a bit harder to break things.
--- arch/s390/include/asm/facility.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/include/asm/facility.h +1 -1
@@ -15,7 +15,7 @@#include <linux/preempt.h> #include <asm/lowcore.h> -#define MAX_FACILITY_BIT (256*8)/* stfle_fac_list has 256 bytes */ +#define MAX_FACILITY_BIT (sizeof(((struct lowcore *)0)->stfle_fac_list) * 8)static inline void __set_facility (unsigned long nr,void *facilities) {
stable-rc/linux-4.9.y boot: 103 boots: 0 failed, 97 passed with 5 offline, 1 conflict (v4.9.98-33-g6e28bacfe4aa)
stable-rc/linux-4.9.y boot: 103 boots: 0 failed, 97 passed with 5 offline, 1 conflict (v4.9.98-33-g6e28bacfe4aa)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.9.y/kernel/v4.9.98-33-g6e28bacfe4aa/
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.9.y/kernel/v4.9.98-33-g6e28bacfe4aa/
Tree: stable-rc
Branch: linux-4.9.y
Git Describe: v4.9.98-33-g6e28bacfe4aa
Git Commit: 6e28bacfe4aa523ece3838a9d50e7612d41be723
Git URL: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 48 unique boards, 22 SoC families, 16 builds out of 183
Boot Regressions Detected:
arm:
multi_v7_defconfig:
tegra124-jetson-tk1:
lab-mhart: new failure (last pass: v4.9.98-8-g5918d4b6b7ff)Offline Platforms:
arm:
multi_v7_defconfig:
qcom-apq8064-cm-qs600: 1 offline lab
qcom-apq8064-ifc6410: 1 offline lab
qcom_defconfig:
qcom-apq8064-cm-qs600: 1 offline lab
qcom-apq8064-ifc6410: 1 offline labarm64:
defconfig:
apq8016-sbc: 1 offline labConflicting Boot Failure Detected: (These likely are not failures as other labs are reporting PASS. Needs review.)
arm:
multi_v7_defconfig:
tegra124-jetson-tk1:
lab-collabora: PASS
lab-mhart: FAIL
lab-baylibre-seattle: PASS---
For more info write to <[email protected]>
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.99 release. There are 32 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 10 07:39:44 UTC 2018. Anything received after that time might be too late.
Build results:
total: 146 pass: 146 fail: 0 Qemu test results: total: 137 pass: 137 fail: 0
Details are available at http://kerneltests.org/builders/.
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.99 release. There are 32 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 10 07:39:44 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.99-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm and x86_64.
Summary
------------------------------------------------------------------------
kernel: 4.9.99-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.9.y
git commit: 6e28bacfe4aa523ece3838a9d50e7612d41be723
git describe: v4.9.98-33-g6e28bacfe4aa
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.9-oe/build/v4.9.98-33-g6e28bacfe4aa
No regressions (compared to build v4.9.98-8-g5918d4b6b7ff)
Boards, architectures and test suites:
-------------------------------------
dragonboard-410c
* boot - pass: 20
* kselftest - skip: 32, pass: 34
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 6, pass: 57
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - skip: 1, pass: 21
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - pass: 14
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 135, pass: 1015
* ltp-timers-tests - pass: 13
hi6220-hikey - arm64
* boot - pass: 20
* kselftest - skip: 29, pass: 36
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 6, pass: 57
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - skip: 1, pass: 21
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 4, pass: 10
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 136, pass: 1014
* ltp-timers-tests - pass: 13
juno-r2 - arm64
* boot - pass: 20
* kselftest - skip: 29, pass: 37
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 6, pass: 57
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - pass: 22
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 4, pass: 10
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 135, pass: 1015
* ltp-timers-tests - pass: 13
qemu_arm
* boot - fail: 12, pass: 8
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 18, pass: 63
* ltp-fcntl-locktests-tests - pass: 2
* ltp-hugetlb-tests - skip: 1, pass: 21
* ltp-ipc-tests - pass: 9
* ltp-pty-tests - pass: 4
* ltp-syscalls-tests - skip: 92, fail: 3, pass: 1055
qemu_arm64
* boot - pass: 20
* kselftest - skip: 33, pass: 35
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 6, pass: 57
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - pass: 22
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 6, pass: 8
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 157, fail: 2, pass: 991
* ltp-timers-tests - pass: 13
qemu_x86_64
* boot - pass: 22
* kselftest - skip: 33, pass: 47
* kselftest-vsyscall-mode-native - skip: 33, pass: 47
* kselftest-vsyscall-mode-none - skip: 33, pass: 47
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 6, pass: 57
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - pass: 22
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 1, pass: 13
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 152, pass: 998
* ltp-timers-tests - pass: 13
x15 - arm
* boot - pass: 20
* kselftest - skip: 29, pass: 36
* libhugetlbfs - skip: 1, pass: 87
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 18, pass: 63
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 5, pass: 58
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - skip: 2, pass: 20
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 1, pass: 13
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 75, pass: 1075
* ltp-timers-tests - pass: 13
x86_64
* boot - pass: 22
* kselftest - skip: 30, pass: 50
* kselftest-vsyscall-mode-native - skip: 30, fail: 1, pass: 49
* kselftest-vsyscall-mode-none - skip: 30, pass: 50
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 5, pass: 58
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 1
* ltp-hugetlb-tests - pass: 22
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 5, pass: 9
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 116, pass: 1034
* ltp-timers-tests - pass: 13
Signature · 2 lines
Linaro QA (BETA) https://qa-reports.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.99 release. There are 32 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 10 07:39:44 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.99-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah