4.14.40-stable review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 4.14.40-stable review
This is the start of the stable review cycle for the 4.14.40 release. There are 43 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 10 07:39:32 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.40-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.14.40-rc1
Song Liu <[email protected]>
tracing: Fix bad use of igrab in trace_uprobe.c
Agustin Vega-Frias <[email protected]>
irqchip/qcom: Fix check for spurious interrupts
João Paulo Rechi Vita <[email protected]>
platform/x86: asus-wireless: Fix NULL pointer dereference
Bin Liu <[email protected]>
usb: musb: trace: fix NULL pointer dereference in musb_g_tx()
Bin Liu <[email protected]>
usb: musb: host: fix potential NULL pointer dereference
SZ Lin (林上智) <[email protected]>
USB: serial: option: adding support for ublox R410M
Johan Hovold <[email protected]>
USB: serial: option: reimplement interface masking
Alan Stern <[email protected]>
USB: Accept bulk endpoints with 1024-byte maxpacket
Mayank Rana <[email protected]>
usb: dwc3: gadget: Fix list_del corruption in dwc3_ep_dequeue
Greg Kroah-Hartman <[email protected]>
USB: serial: visor: handle potential invalid device configuration
Matthew Wilcox <[email protected]>
errseq: Always report a writeback error once
Ben Hutchings <[email protected]>
test_firmware: fix setting old custom fw path back on exit, second try
Sean Paul <[email protected]>
drm/bridge: vga-dac: Fix edid memory leak
Thomas Hellstrom <[email protected]>
drm/vmwgfx: Fix a buffer object leak
Bharat Potnuri <[email protected]>
iw_cxgb4: Atomically flush per QP HW CQEs
Sebastian Sanchez <[email protected]>
IB/hfi1: Fix NULL pointer dereference when invalid num_vls is used
Mike Marciniszyn <[email protected]>
IB/hfi1: Fix loss of BECN with AHG
Mike Marciniszyn <[email protected]>
IB/hfi1: Fix handling of FECN marked multicast packet
Danit Goldberg <[email protected]>
IB/mlx5: Use unlimited rate when static rate is not supported
SZ Lin (林上智) <[email protected]>
NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2
Leon Romanovsky <[email protected]>
RDMA/mlx5: Protect from shift operand overflow
Leon Romanovsky <[email protected]>
RDMA/mlx5: Fix multiple NULL-ptr deref errors in rereg_mr flow
Roland Dreier <[email protected]>
RDMA/ucma: Allow resolving address w/o specifying source address
Raju Rangoju <[email protected]>
RDMA/cxgb4: release hw resources on device removal
Darrick J. Wong <[email protected]>
xfs: prevent creating negative-sized file via INSERT_RANGE
Ping-Ke Shih <[email protected]>
rtlwifi: cleanup 8723be ant_sel definition
Ping-Ke Shih <[email protected]>
rtlwifi: btcoex: Add power_on_setting routine
Vittorio Gambaletta (VittGam) <[email protected]>
Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro
Dmitry Torokhov <[email protected]>
Input: leds - fix out of bound access
Bryant G Ly <[email protected]>
scsi: target: Fix fortify_panic kernel exception
Mathieu Desnoyers <[email protected]>
tracepoint: Do not warn on ENOMEM
Takashi Iwai <[email protected]>
ALSA: aloop: Add missing cable lock to ctl API callbacks
Robert Rosengren <[email protected]>
ALSA: aloop: Mark paused device as inactive
Takashi Sakamoto <[email protected]>
ALSA: dice: fix kernel NULL pointer dereference due to invalid calculation for array index
Takashi Iwai <[email protected]>
ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger()
Takashi Iwai <[email protected]>
ALSA: pcm: Check PCM state at xfern compat ioctl
Takashi Iwai <[email protected]>
ALSA: hda - Fix incorrect usage of IS_REACHABLE()
Kristian Evensen <[email protected]>
USB: serial: option: Add support for Quectel EP06
Ard Biesheuvel <[email protected]>
ACPI / button: make module loadable when booted in non-ACPI mode
LEROY Christophe <[email protected]>
crypto: talitos - fix IPsec cipher in length
Tejun Heo <[email protected]>
percpu: include linux/sched.h for cond_resched()
Nicolas Dichtel <[email protected]>
net: don't call update_pmtu unconditionally
Xin Long <[email protected]>
geneve: update skb dst pmtu on tx path
-------------
Diffstat:
Makefile | 4 +- drivers/acpi/button.c | 24 +- drivers/crypto/talitos.c | 41 +- drivers/gpu/drm/bridge/dumb-vga-dac.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 1 + drivers/infiniband/core/ucma.c | 2 +- drivers/infiniband/hw/cxgb4/cq.c | 11 +- drivers/infiniband/hw/cxgb4/device.c | 9 +- drivers/infiniband/hw/cxgb4/iw_cxgb4.h | 6 +- drivers/infiniband/hw/cxgb4/qp.c | 4 +- drivers/infiniband/hw/cxgb4/resource.c | 26 +- drivers/infiniband/hw/hfi1/driver.c | 19 +- drivers/infiniband/hw/hfi1/hfi.h | 8 +- drivers/infiniband/hw/hfi1/init.c | 2 + drivers/infiniband/hw/hfi1/pcie.c | 3 - drivers/infiniband/hw/hfi1/ruc.c | 50 ++- drivers/infiniband/hw/hfi1/ud.c | 4 +- drivers/infiniband/hw/mlx5/mr.c | 32 +- drivers/infiniband/hw/mlx5/qp.c | 22 +- drivers/infiniband/ulp/ipoib/ipoib_cm.c | 3 +- drivers/input/input-leds.c | 8 +- drivers/input/touchscreen/atmel_mxt_ts.c | 9 + drivers/irqchip/qcom-irq-combiner.c | 4 +- drivers/net/geneve.c | 14 + drivers/net/usb/qmi_wwan.c | 1 + drivers/net/vxlan.c | 6 +- .../realtek/rtlwifi/btcoexist/halbtcoutsrc.c | 15 - .../realtek/rtlwifi/btcoexist/halbtcoutsrc.h | 1 + .../wireless/realtek/rtlwifi/btcoexist/rtl_btc.c | 6 + .../wireless/realtek/rtlwifi/btcoexist/rtl_btc.h | 1 + .../net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 11 +- drivers/net/wireless/realtek/rtlwifi/wifi.h | 6 + drivers/platform/x86/asus-wireless.c | 4 +- drivers/target/target_core_iblock.c | 8 +- drivers/usb/core/config.c | 4 +- drivers/usb/dwc3/gadget.c | 2 +- drivers/usb/musb/musb_gadget.c | 3 +- drivers/usb/musb/musb_host.c | 4 +- drivers/usb/serial/option.c | 448 ++++++++------------- drivers/usb/serial/visor.c | 69 ++-- fs/xfs/xfs_file.c | 14 +- include/net/dst.h | 8 + kernel/trace/trace_uprobe.c | 24 +- kernel/tracepoint.c | 4 +- lib/errseq.c | 25 +- mm/percpu.c | 1 + net/ipv4/ip_tunnel.c | 3 +- net/ipv4/ip_vti.c | 2 +- net/ipv6/ip6_tunnel.c | 5 +- net/ipv6/ip6_vti.c | 2 +- net/ipv6/sit.c | 4 +- sound/core/pcm_compat.c | 2 + sound/core/seq/seq_virmidi.c | 4 +- sound/drivers/aloop.c | 29 +- sound/firewire/amdtp-stream.c | 5 +- sound/pci/hda/patch_realtek.c | 2 +- tools/testing/selftests/firmware/fw_filesystem.sh | 6 +- 57 files changed, 547 insertions(+), 492 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/43 geneve: update skb dst pmtu on tx path
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
commit 52a589d51f1008f62569bf89e95b26221ee76690 upstream.
Commit a93bf0ff4490 ("vxlan: update skb dst pmtu on tx path") has fixed a performance issue caused by the change of lower dev's mtu for vxlan.
The same thing needs to be done for geneve as well.
Note that geneve cannot adjust it's mtu according to lower dev's mtu when creating it. The performance is very low later when netperfing over it without fixing the mtu manually. This patch could also avoid this issue.
--- drivers/net/geneve.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/net/geneve.c +14 -0
@@ -825,6 +825,13 @@ static int geneve_xmit_skb(struct sk_bufif (IS_ERR (rt))return PTR_ERR (rt); +if (skb_dst (skb)) { +int mtu =dst_mtu (&rt->dst) -sizeof (struct iphdr ) - +GENEVE_BASE_HLEN - info->options_len -14 ; + +skb_dst (skb)->ops->update_pmtu (skb_dst (skb),NULL , skb, mtu); + } + sport =udp_flow_src_port (geneve->net, skb,1 ,USHRT_MAX , true);if (geneve->collect_md) { tos =ip_tunnel_ecn_encap (key->tos,ip_hdr (skb), skb);
@@ -864,6 +871,13 @@ static int geneve6_xmit_skb(struct sk_buif (IS_ERR (dst))return PTR_ERR (dst); +if (skb_dst (skb)) { +int mtu =dst_mtu (dst) -sizeof (struct ipv6hdr ) - +GENEVE_BASE_HLEN - info->options_len -14 ; + +skb_dst (skb)->ops->update_pmtu (skb_dst (skb),NULL , skb, mtu); + } + sport =udp_flow_src_port (geneve->net, skb,1 ,USHRT_MAX , true);if (geneve->collect_md) { prio =ip_tunnel_ecn_encap (key->tos,ip_hdr (skb), skb);
Greg Kroah-Hartman
maintainerPATCH 2/43 net: dont call update_pmtu unconditionally
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Dichtel <[email protected]>
commit f15ca723c1ebe6c1a06bc95fda6b62cd87b44559 upstream.
Some dst_ops (e.g. md_dst_ops)) doesn't set this handler. It may result to:
"BUG: unable to handle kernel NULL pointer dereference at (null)"
Let's add a helper to check if update_pmtu is available before calling it.
--- drivers/infiniband/ulp/ipoib/ipoib_cm.c | 3 +-- drivers/net/geneve.c | 4 ++-- drivers/net/vxlan.c | 6 ++---- include/net/dst.h | 8 ++++++++ net/ipv4/ip_tunnel.c | 3 +-- net/ipv4/ip_vti.c | 2 +- net/ipv6/ip6_tunnel.c | 5 ++--- net/ipv6/ip6_vti.c | 2 +- net/ipv6/sit.c | 4 ++-- 9 files changed, 20 insertions(+), 17 deletions(-)
drivers/infiniband/ulp/ipoib/ipoib_cm.c +1 -2
@@ -1447,8 +1447,7 @@ void ipoib_cm_skb_too_long(struct net_destruct ipoib_dev_priv *priv =ipoib_priv (dev);int e =skb_queue_empty (&priv->cm.skb_queue); -if (skb_dst (skb)) -skb_dst (skb)->ops->update_pmtu (skb_dst (skb),NULL , skb, mtu); +skb_dst_update_pmtu (skb, mtu);skb_queue_tail (&priv->cm.skb_queue, skb);if (e)
drivers/net/geneve.c +2 -2
@@ -829,7 +829,7 @@ static int geneve_xmit_skb(struct sk_bufint mtu =dst_mtu (&rt->dst) -sizeof (struct iphdr ) -GENEVE_BASE_HLEN - info->options_len -14 ; -skb_dst (skb)->ops->update_pmtu (skb_dst (skb),NULL , skb, mtu); +skb_dst_update_pmtu (skb, mtu); } sport =udp_flow_src_port (geneve->net, skb,1 ,USHRT_MAX , true);
@@ -875,7 +875,7 @@ static int geneve6_xmit_skb(struct sk_buint mtu =dst_mtu (dst) -sizeof (struct ipv6hdr ) -GENEVE_BASE_HLEN - info->options_len -14 ; -skb_dst (skb)->ops->update_pmtu (skb_dst (skb),NULL , skb, mtu); +skb_dst_update_pmtu (skb, mtu); } sport =udp_flow_src_port (geneve->net, skb,1 ,USHRT_MAX , true);
drivers/net/vxlan.c +2 -4
@@ -2158,8 +2158,7 @@ static void vxlan_xmit_one(struct sk_bufif (skb_dst (skb)) {int mtu =dst_mtu (ndst) -VXLAN_HEADROOM ; -skb_dst (skb)->ops->update_pmtu (skb_dst (skb),NULL , - skb, mtu); +skb_dst_update_pmtu (skb, mtu); } tos =ip_tunnel_ecn_encap (tos, old_iph, skb);
@@ -2200,8 +2199,7 @@ static void vxlan_xmit_one(struct sk_bufif (skb_dst (skb)) {int mtu =dst_mtu (ndst) -VXLAN6_HEADROOM ; -skb_dst (skb)->ops->update_pmtu (skb_dst (skb),NULL , - skb, mtu); +skb_dst_update_pmtu (skb, mtu); } tos =ip_tunnel_ecn_encap (tos, old_iph, skb);
include/net/dst.h +8 -0
@@ -520,4 +520,12 @@ static inline struct xfrm_state *dst_xfr }#endif +static inline void skb_dst_update_pmtu (struct sk_buff *skb,u32 mtu) +{ +struct dst_entry *dst =skb_dst (skb); + +if (dst && dst->ops->update_pmtu) + dst->ops->update_pmtu (dst,NULL , skb, mtu); +} +#endif /* _NET_DST_H */
net/ipv4/ip_tunnel.c +1 -2
@@ -521,8 +521,7 @@ static int tnl_update_pmtu(struct net_deelse mtu =skb_dst (skb) ?dst_mtu (skb_dst (skb)) : dev->mtu; -if (skb_dst (skb)) -skb_dst (skb)->ops->update_pmtu (skb_dst (skb),NULL , skb, mtu); +skb_dst_update_pmtu (skb, mtu);if (skb->protocol ==htons (ETH_P_IP )) { if (!skb_is_gso(skb) &&
net/ipv4/ip_vti.c +1 -1
@@ -209,7 +209,7 @@ static netdev_tx_t vti_xmit(struct sk_bu mtu =dst_mtu (dst);if (skb->len > mtu) { -skb_dst (skb)->ops->update_pmtu (skb_dst (skb),NULL , skb, mtu); +skb_dst_update_pmtu (skb, mtu);if (skb->protocol ==htons (ETH_P_IP )) {icmp_send (skb,ICMP_DEST_UNREACH ,ICMP_FRAG_NEEDED ,htonl (mtu));
net/ipv6/ip6_tunnel.c +2 -3
@@ -652,7 +652,7 @@ ip4ip6_err(struct sk_buff *skb, struct iif (rel_info >dst_mtu (skb_dst (skb2))) goto out; -skb_dst (skb2)->ops->update_pmtu (skb_dst (skb2),NULL , skb2, rel_info); +skb_dst_update_pmtu (skb2, rel_info); }if (rel_type ==ICMP_REDIRECT )skb_dst (skb2)->ops->redirect (skb_dst (skb2),NULL , skb2);
@@ -1141,8 +1141,7 @@ route_lookup: mtu =576 ; } -if (skb_dst (skb) && !t->parms.collect_md) -skb_dst (skb)->ops->update_pmtu (skb_dst (skb),NULL , skb, mtu); +skb_dst_update_pmtu (skb, mtu);if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso (skb)) { *pmtu = mtu; err = -EMSGSIZE ;
net/ipv6/ip6_vti.c +1 -1
@@ -486,7 +486,7 @@ vti6_xmit(struct sk_buff *skb, struct ne mtu =dst_mtu (dst);if (!skb->ignore_df && skb->len > mtu) { -skb_dst (skb)->ops->update_pmtu (dst,NULL , skb, mtu); +skb_dst_update_pmtu (skb, mtu);if (skb->protocol ==htons (ETH_P_IPV6 )) {if (mtu <IPV6_MIN_MTU )
net/ipv6/sit.c +2 -2
@@ -925,8 +925,8 @@ static netdev_tx_t ipip6_tunnel_xmit(str df =0 ; } -if (tunnel->parms.iph.daddr &&skb_dst (skb)) -skb_dst (skb)->ops->update_pmtu (skb_dst (skb),NULL , skb, mtu); +if (tunnel->parms.iph.daddr) +skb_dst_update_pmtu (skb, mtu);if (skb->len > mtu && !skb_is_gso (skb)) {icmpv6_send (skb,ICMPV6_PKT_TOOBIG ,0 , mtu);
Greg Kroah-Hartman
maintainerPATCH 3/43 percpu: include linux/sched.h for cond_resched()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 71546d100422bcc2c543dadeb9328728997cd23a upstream.
microblaze build broke due to missing declaration of the cond_resched() invocation added recently. Let's include linux/sched.h explicitly.
--- mm/percpu.c | 1 + 1 file changed, 1 insertion(+)
mm/percpu.c +1 -0
@@ -80,6 +80,7 @@#include <linux/vmalloc.h> #include <linux/workqueue.h> #include <linux/kmemleak.h> +#include <linux/sched.h> #include <asm/cacheflush.h> #include <asm/sections.h>
Greg Kroah-Hartman
maintainerPATCH 4/43 crypto: talitos - fix IPsec cipher in length
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: LEROY Christophe <[email protected]>
commit 2b1227301a8e4729409694e323b72c064c47cb6b upstream.
For SEC 2.x+, cipher in length must contain only the ciphertext length. In case of using hardware ICV checking, the ICV length is provided via the "extent" field of the descriptor pointer.
--- drivers/crypto/talitos.c | 41 +++++++++++++++++++++-------------------- 1 file changed, 21 insertions(+), 20 deletions(-)
drivers/crypto/talitos.c +21 -20
@@ -1116,10 +1116,10 @@ next:return count; } -int talitos_sg_map (struct device *dev,struct scatterlist *src, -unsigned int len,struct talitos_edesc *edesc, -struct talitos_ptr *ptr, -int sg_count,unsigned int offset,int tbl_off) +static int talitos_sg_map_ext (struct device *dev,struct scatterlist *src, +unsigned int len,struct talitos_edesc *edesc, +struct talitos_ptr *ptr,int sg_count, +unsigned int offset,int tbl_off,int elen) {struct talitos_private *priv =dev_get_drvdata (dev);bool is_sec1 =has_ftr_sec1 (priv);
@@ -1130,7 +1130,7 @@ int talitos_sg_map(struct device *dev, s }to_talitos_ptr_len (ptr, len, is_sec1); -to_talitos_ptr_ext_set (ptr,0 , is_sec1); +to_talitos_ptr_ext_set (ptr, elen, is_sec1);if (sg_count ==1 ) {to_talitos_ptr (ptr,sg_dma_address (src) + offset, is_sec1);
@@ -1140,7 +1140,7 @@ int talitos_sg_map(struct device *dev, sto_talitos_ptr (ptr, edesc->dma_link_tbl + offset, is_sec1);return sg_count; } - sg_count =sg_to_link_tbl_offset (src, sg_count, offset, len, + sg_count =sg_to_link_tbl_offset (src, sg_count, offset, len + elen, &edesc->link_tbl[tbl_off]);if (sg_count ==1 ) {/* Only one segment now, so no link tbl needed*/
@@ -1154,6 +1154,15 @@ int talitos_sg_map(struct device *dev, sreturn sg_count; } +static int talitos_sg_map (struct device *dev,struct scatterlist *src, +unsigned int len,struct talitos_edesc *edesc, +struct talitos_ptr *ptr,int sg_count, +unsigned int offset,int tbl_off) +{ +return talitos_sg_map_ext (dev, src, len, edesc, ptr, sg_count, offset, + tbl_off,0 ); +} +/* * fill in and submit ipsec_esp descriptor */
@@ -1171,7 +1180,7 @@ static int ipsec_esp(struct talitos_edesunsigned int ivsize =crypto_aead_ivsize (aead);int tbl_off =0 ;int sg_count, ret; -int sg_link_tbl_len; +int elen =0 ;bool sync_needed = false;struct talitos_private *priv =dev_get_drvdata (dev);bool is_sec1 =has_ftr_sec1 (priv);
@@ -1225,20 +1234,12 @@ static int ipsec_esp(struct talitos_edes* extent is bytes of HMAC postpended to ciphertext, * typically 12 for ipsec */ -to_talitos_ptr_len (&desc->ptr[4 ], cryptlen, is_sec1); -to_talitos_ptr_ext_set (&desc->ptr[4 ],0 , is_sec1); - - sg_link_tbl_len = cryptlen; - -if (desc->hdr &DESC_HDR_TYPE_IPSEC_ESP ) { -to_talitos_ptr_ext_set (&desc->ptr[4 ], authsize, is_sec1); - -if (edesc->desc.hdr &DESC_HDR_MODE1_MDEU_CICV ) - sg_link_tbl_len += authsize; - } +if ((desc->hdr &DESC_HDR_TYPE_IPSEC_ESP ) && + (desc->hdr &DESC_HDR_MODE1_MDEU_CICV )) + elen = authsize; - ret =talitos_sg_map (dev, areq->src, sg_link_tbl_len, edesc, - &desc->ptr[4 ], sg_count, areq->assoclen, tbl_off); + ret =talitos_sg_map_ext (dev, areq->src, cryptlen, edesc, &desc->ptr[4 ], + sg_count, areq->assoclen, tbl_off, elen);if (ret >1 ) { tbl_off += ret;
Greg Kroah-Hartman
maintainerPATCH 5/43 ACPI / button: make module loadable when booted in non-ACPI mode
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
commit ac1e55b1fdb27c1b07a0a6fe519f1291ff1e7d40 upstream.
Modules such as nouveau.ko and i915.ko have a link time dependency on acpi_lid_open(), and due to its use of acpi_bus_register_driver(), the button.ko module that provides it is only loadable when booted in ACPI mode. However, the ACPI button driver can be built into the core kernel as well, in which case the dependency can always be satisfied, and the dependent modules can be loaded regardless of whether the system was booted in ACPI mode or not.
So let's fix this asymmetry by making the ACPI button driver loadable as a module even if not booted in ACPI mode, so it can provide the acpi_lid_open() symbol in the same way as when built into the kernel.
--- drivers/acpi/button.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-)
drivers/acpi/button.c +23 -1
@@ -595,4 +595,26 @@ module_param_call(lid_init_state, NULL, 0644);MODULE_PARM_DESC (lid_init_state,"Behavior for reporting LID initial state" ); -module_acpi_driver (acpi_button_driver); +static int acpi_button_register_driver (struct acpi_driver *driver) +{ +/* +* Modules such as nouveau.ko and i915.ko have a link time dependency +* on acpi_lid_open(), and would therefore not be loadable on ACPI +* capable kernels booted in non-ACPI mode if the return value of +* acpi_bus_register_driver() is returned from here with ACPI disabled +* when this driver is built as a module. +*/ +if (acpi_disabled) +return 0 ; + +return acpi_bus_register_driver (driver); +} + +static void acpi_button_unregister_driver (struct acpi_driver *driver) +{ +if (!acpi_disabled) +acpi_bus_unregister_driver (driver); +} + +module_driver (acpi_button_driver, acpi_button_register_driver, + acpi_button_unregister_driver);
Greg Kroah-Hartman
maintainerPATCH 6/43 USB: serial: option: Add support for Quectel EP06
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kristian Evensen <[email protected]>
commit 71a0483d56e784b1e11f38f10d7e22d265dbe244 upstream.
The Quectel EP06 is a Cat. 6 LTE modem, and the interface mapping is as follows:
0: Diag
1: NMEA
2: AT
3: Modem
Interface 4 is QMI and interface 5 is ADB, so they are blacklisted.
This patch should also be considered for -stable. The QMI-patch for this modem is already in the -stable-queue.
v1->v2:
* Updated commit prefix (thanks Johan Hovold)
* Updated commit message slightly.
--- drivers/usb/serial/option.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/serial/option.c +7 -0
@@ -244,6 +244,7 @@ static void option_instat_callback(struc#define QUECTEL_PRODUCT_EC21 0x0121#define QUECTEL_PRODUCT_EC25 0x0125#define QUECTEL_PRODUCT_BG96 0x0296 +#define QUECTEL_PRODUCT_EP06 0x0306#define CMOTECH_VENDOR_ID 0x16d8#define CMOTECH_PRODUCT_6001 0x6001
@@ -692,6 +693,10 @@ static const struct option_blacklist_inf .reserved = BIT(1) | BIT(4), }; +static const struct option_blacklist_info quectel_ep06_blacklist = { + .reserved =BIT (4 ) |BIT (5 ), +}; +static const struct usb_device_id option_ids[] = { {USB_DEVICE (OPTION_VENDOR_ID ,OPTION_PRODUCT_COLT ) }, {USB_DEVICE (OPTION_VENDOR_ID ,OPTION_PRODUCT_RICOLA ) },
@@ -1206,6 +1211,8 @@ static const struct usb_device_id option .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96), .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06), + .driver_info = (kernel_ulong_t)&quectel_ep06_blacklist }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
Greg Kroah-Hartman
maintainerPATCH 7/43 ALSA: hda - Fix incorrect usage of IS_REACHABLE()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 6a30abaa40b62aed46ef12ea4c16c48565bdb376 upstream.
The commit c469652bb5e8 ("ALSA: hda - Use IS_REACHABLE() for dependency on input") simplified the dependencies with IS_REACHABLE() macro, but it broke due to its incorrect usage: it should have been IS_REACHABLE(CONFIG_INPUT) instead of IS_REACHABLE(INPUT).
--- sound/pci/hda/patch_realtek.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +1 -1
@@ -3722,7 +3722,7 @@ static void alc280_fixup_hp_gpio4(struct } } -#if IS_REACHABLE (INPUT ) +#if IS_REACHABLE (CONFIG_INPUT )static void gpio2_mic_hotkey_event (struct hda_codec *codec,struct hda_jack_callback *event) {
Greg Kroah-Hartman
maintainerPATCH 8/43 ALSA: pcm: Check PCM state at xfern compat ioctl
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit f13876e2c33a657a71bcbb10f767c0951b165020 upstream.
Since snd_pcm_ioctl_xfern_compat() has no PCM state check, it may go further and hit the sanity check pcm_sanity_check() when the ioctl is called right after open. It may eventually spew a kernel warning, as triggered by syzbot, depending on kconfig.
The lack of PCM state check there was just an oversight. Although it's no real crash, the spurious kernel warning is annoying, so let's add the proper check.
--- sound/core/pcm_compat.c | 2 ++ 1 file changed, 2 insertions(+)
sound/core/pcm_compat.c +2 -0
@@ -423,6 +423,8 @@ static int snd_pcm_ioctl_xfern_compat(streturn -ENOTTY ;if (substream->stream != dir)return -EINVAL ; +if (substream->runtime->status->state ==SNDRV_PCM_STATE_OPEN ) +return -EBADFD ;if ((ch = substream->runtime->channels) >128 )return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 9/43 ALSA: seq: Fix races at MIDI encoding in snd_virmidi_output_trigger()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 8f22e52528cc372b218b5f100457469615c733ce upstream.
The sequencer virmidi code has an open race at its output trigger
callback: namely, virmidi keeps only one event packet for processing while it doesn't protect for concurrent output trigger calls.
snd_virmidi_output_trigger() tries to process the previously unfinished event before starting encoding the given MIDI stream, but this is done without any lock. Meanwhile, if another rawmidi stream starts the output trigger, this proceeds further, and overwrites the event package that is being processed in another thread. This eventually corrupts and may lead to the invalid memory access if the event type is like SYSEX.
The fix is just to move the spinlock to cover both the pending event and the new stream.
The bug was spotted by a new fuzzer, RaceFuzzer.
--- sound/core/seq/seq_virmidi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/core/seq/seq_virmidi.c +2 -2
@@ -174,12 +174,12 @@ static void snd_virmidi_output_trigger(s }return ; } +spin_lock_irqsave (&substream->runtime->lock, flags);if (vmidi->event.type !=SNDRV_SEQ_EVENT_NONE ) {if (snd_seq_kernel_client_dispatch (vmidi->client, &vmidi->event,in_atomic (),0 ) <0 ) -return ; + goto out; vmidi->event.type =SNDRV_SEQ_EVENT_NONE ; } -spin_lock_irqsave (&substream->runtime->lock, flags);while (1 ) { count =__snd_rawmidi_transmit_peek (substream, buf,sizeof (buf));if (count <=0 )
Greg Kroah-Hartman
maintainerPATCH 10/43 ALSA: dice: fix kernel NULL pointer dereference due to invalid calculation for array index
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <[email protected]>
commit 52759c0963510a2843774aac9b65ccaed3308dc0 upstream.
At a commit f91c9d7610a ('ALSA: firewire-lib: cache maximum length of payload to reduce function calls'), maximum size of payload for tx isochronous packet is cached to reduce the number of function calls.
This cache was programmed to updated at a first callback of ohci1394 IR context. However, the maximum size is required to queueing packets before starting the isochronous context.
As a result, the cached value is reused to queue packets in next time to starting the isochronous context. Then the cache is updated in a first callback of the isochronous context. This can cause kernel NULL pointer dereference in a below call graph:
(sound/firewire/amdtp-stream.c)amdtp_stream_start()
->queue_in_packet()
->queue_packet()
(drivers/firewire/core-iso.c)
->fw_iso_context_queue()
->struct fw_card_driver.queue_iso()
(drivers/firewire/ohci.c)
= ohci_queue_iso()
->queue_iso_packet_per_buffer()
buffer->pages[page]The issued dereference occurs in a case that:
- target unit supports different stream formats for sampling transmission frequency.
- maximum length of payload for tx stream in a first trial is bigger than the length in a second trial.
In this case, correct number of pages are allocated for DMA and the 'pages' array has enough elements, while index of the element is wrongly calculated according to the old value of length of payload in a call of 'queue_in_packet()'. Then it causes the issue.
This commit fixes the critical bug. This affects all of drivers in ALSA firewire stack in Linux kernel v4.12 or later.
[12665.302360] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030 [12665.302415] IP: ohci_queue_iso+0x47c/0x800 [firewire_ohci] [12665.302439] PGD 0 [12665.302440] P4D 0 [12665.302450] [12665.302470] Oops: 0000 [#1] SMP PTI [12665.302487] Modules linked in: ... [12665.303096] CPU: 1 PID: 12760 Comm: jackd Tainted: P OE 4.13.0-38-generic #43-Ubuntu [12665.303154] Hardware name: /DH77DF, BIOS KCH7710H.86A.0069.2012.0224.1825 02/24/2012 [12665.303215] task: ffff9ce87da2ae80 task.stack: ffffb5b8823d0000 [12665.303258] RIP: 0010:ohci_queue_iso+0x47c/0x800 [firewire_ohci] [12665.303301] RSP: 0018:ffffb5b8823d3ab8 EFLAGS: 00010086 [12665.303337] RAX: ffff9ce4f4876930 RBX: 0000000000000008 RCX: ffff9ce88a3955e0 [12665.303384] RDX: 0000000000000000 RSI: 0000000034877f00 RDI: 0000000000000000 [12665.303427] RBP: ffffb5b8823d3b68 R08: ffff9ce8ccb390a0 R09: ffff9ce877639ab0 [12665.303475] R10: 0000000000000108 R11: 0000000000000000 R12: 0000000000000003 [12665.303513] R13: 0000000000000000 R14: ffff9ce4f4876950 R15: 0000000000000000 [12665.303554] FS: 00007f2ec467f8c0(0000) GS:ffff9ce8df280000(0000) knlGS:0000000000000000 [12665.303600] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [12665.303633] CR2: 0000000000000030 CR3: 00000002dcf90004 CR4: 00000000000606e0 [12665.303674] Call Trace: [12665.303698] fw_iso_context_queue+0x18/0x20 [firewire_core] [12665.303735] queue_packet+0x88/0xe0 [snd_firewire_lib] [12665.303770] amdtp_stream_start+0x19b/0x270 [snd_firewire_lib] [12665.303811] start_streams+0x276/0x3c0 [snd_dice] [12665.303840] snd_dice_stream_start_duplex+0x1bf/0x480 [snd_dice] [12665.303882] ? vma_gap_callbacks_rotate+0x1e/0x30 [12665.303914] ? __rb_insert_augmented+0xab/0x240 [12665.303936] capture_prepare+0x3c/0x70 [snd_dice] [12665.303961] snd_pcm_do_prepare+0x1d/0x30 [snd_pcm] [12665.303985] snd_pcm_action_single+0x3b/0x90 [snd_pcm] [12665.304009] snd_pcm_action_nonatomic+0x68/0x70 [snd_pcm] [12665.304035] snd_pcm_prepare+0x68/0x90 [snd_pcm] [12665.304058] snd_pcm_common_ioctl1+0x4c0/0x940 [snd_pcm] [12665.304083] snd_pcm_capture_ioctl1+0x19b/0x250 [snd_pcm] [12665.304108] snd_pcm_capture_ioctl+0x27/0x40 [snd_pcm] [12665.304131] do_vfs_ioctl+0xa8/0x630 [12665.304148] ? entry_SYSCALL_64_after_hwframe+0xe9/0x139 [12665.304172] ? entry_SYSCALL_64_after_hwframe+0xe2/0x139 [12665.304195] ? entry_SYSCALL_64_after_hwframe+0xdb/0x139 [12665.304218] ? entry_SYSCALL_64_after_hwframe+0xd4/0x139 [12665.304242] ? entry_SYSCALL_64_after_hwframe+0xcd/0x139 [12665.304265] ? entry_SYSCALL_64_after_hwframe+0xc6/0x139 [12665.304288] ? entry_SYSCALL_64_after_hwframe+0xbf/0x139 [12665.304312] ? entry_SYSCALL_64_after_hwframe+0xb8/0x139 [12665.304335] ? entry_SYSCALL_64_after_hwframe+0xb1/0x139 [12665.304358] SyS_ioctl+0x79/0x90 [12665.304374] ? entry_SYSCALL_64_after_hwframe+0x72/0x139 [12665.304397] entry_SYSCALL_64_fastpath+0x24/0xab [12665.304417] RIP: 0033:0x7f2ec3750ef7 [12665.304433] RSP: 002b:00007fff99e31388 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [12665.304465] RAX: ffffffffffffffda RBX: 00007fff99e312f0 RCX: 00007f2ec3750ef7 [12665.304494] RDX: 0000000000000000 RSI: 0000000000004140 RDI: 0000000000000007 [12665.304522] RBP: 0000556ebc63fd60 R08: 0000556ebc640560 R09: 0000000000000000 [12665.304553] R10: 0000000000000001 R11: 0000000000000246 R12: 0000556ebc63fcf0 [12665.304584] R13: 0000000000000000 R14: 0000000000000007 R15: 0000000000000000 [12665.304612] Code: 01 00 00 44 89 eb 45 31 ed 45 31 db 66 41 89 1e 66 41 89 5e 0c 66 45 89 5e 0e 49 8b 49 08 49 63 d4 4d 85 c0 49 63 ff 48 8b 14 d1 <48> 8b 72 30 41 8d 14 37 41 89 56 04 48 63 d3 0f 84 ce 00 00 00 [12665.304713] RIP: ohci_queue_iso+0x47c/0x800 [firewire_ohci] RSP: ffffb5b8823d3ab8 [12665.304743] CR2: 0000000000000030 [12665.317701] ---[ end trace 9d55b056dd52a19f ]---
--- sound/firewire/amdtp-stream.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
sound/firewire/amdtp-stream.c +3 -2
@@ -773,8 +773,6 @@ static void amdtp_stream_first_callback(u32 cycle;unsigned int packets; - s->max_payload_length =amdtp_stream_get_max_payload (s); -/* * For in-stream, first packet has come. * For out-stream, prepared to transmit first packet
@@ -879,6 +877,9 @@ int amdtp_stream_start(struct amdtp_streamdtp_stream_update (s); +if (s->direction ==AMDTP_IN_STREAM ) + s->max_payload_length =amdtp_stream_get_max_payload (s); +if (s->flags &CIP_NO_HEADER ) s->tag =TAG_NO_CIP_HEADER ;else
Greg Kroah-Hartman
maintainerPATCH 11/43 ALSA: aloop: Mark paused device as inactive
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Rosengren <[email protected]>
commit 306a4f3ca7f3c7dfa473ebd19d66e40e59d99734 upstream.
Show paused ALSA aloop device as inactive, i.e. the control "PCM Slave Active" set as false. Notification sent upon state change.
This makes it possible for client capturing from aloop device to know if data is expected. Without it the client expects data even if playback is paused.
--- sound/drivers/aloop.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
sound/drivers/aloop.c +9 -3
@@ -296,6 +296,8 @@ static int loopback_trigger(struct snd_p cable->pause |= stream;loopback_timer_stop (dpcm);spin_unlock (&cable->lock); +if (substream->stream ==SNDRV_PCM_STREAM_PLAYBACK ) +loopback_active_notify (dpcm);break ;case SNDRV_PCM_TRIGGER_PAUSE_RELEASE :case SNDRV_PCM_TRIGGER_RESUME :
@@ -304,6 +306,8 @@ static int loopback_trigger(struct snd_p cable->pause &= ~stream;loopback_timer_start (dpcm);spin_unlock (&cable->lock); +if (substream->stream ==SNDRV_PCM_STREAM_PLAYBACK ) +loopback_active_notify (dpcm);break ;default :return -EINVAL ;
@@ -893,9 +897,11 @@ static int loopback_active_get(struct sn [kcontrol->id.subdevice][kcontrol->id.device ^1 ];unsigned int val =0 ; -if (cable !=NULL ) - val = (cable->running & (1 <<SNDRV_PCM_STREAM_PLAYBACK )) ? -1 :0 ; +if (cable !=NULL ) { +unsigned int running = cable->running ^ cable->pause; + + val = (running & (1 <<SNDRV_PCM_STREAM_PLAYBACK )) ?1 :0 ; + } ucontrol->value.integer.value[0 ] = val;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 12/43 ALSA: aloop: Add missing cable lock to ctl API callbacks
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 76b3421b39bd610546931fc923edcf90c18fa395 upstream.
Some control API callbacks in aloop driver are too lazy to take the loopback->cable_lock and it results in possible races of cable access while it's being freed. It eventually lead to a UAF, as reported by fuzzer recently.
This patch covers such control API callbacks and add the proper mutex locks.
--- sound/drivers/aloop.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
sound/drivers/aloop.c +15 -2
@@ -832,9 +832,11 @@ static int loopback_rate_shift_get(struc {struct loopback *loopback =snd_kcontrol_chip (kcontrol); +mutex_lock (&loopback->cable_lock); ucontrol->value.integer.value[0 ] = loopback->setup[kcontrol->id.subdevice] [kcontrol->id.device].rate_shift; +mutex_unlock (&loopback->cable_lock);return 0 ; }
@@ -866,9 +868,11 @@ static int loopback_notify_get(struct sn {struct loopback *loopback =snd_kcontrol_chip (kcontrol); +mutex_lock (&loopback->cable_lock); ucontrol->value.integer.value[0 ] = loopback->setup[kcontrol->id.subdevice] [kcontrol->id.device].notify; +mutex_unlock (&loopback->cable_lock);return 0 ; }
@@ -880,12 +884,14 @@ static int loopback_notify_put(struct snint change =0 ; val = ucontrol->value.integer.value[0 ] ?1 :0 ; +mutex_lock (&loopback->cable_lock);if (val != loopback->setup[kcontrol->id.subdevice] [kcontrol->id.device].notify) { loopback->setup[kcontrol->id.subdevice] [kcontrol->id.device].notify = val; change =1 ; } +mutex_unlock (&loopback->cable_lock);return change; }
@@ -893,15 +899,18 @@ static int loopback_active_get(struct sn struct snd_ctl_elem_value *ucontrol) {struct loopback *loopback =snd_kcontrol_chip (kcontrol); -struct loopback_cable *cable = loopback->cables - [kcontrol->id.subdevice][kcontrol->id.device ^1 ]; +struct loopback_cable *cable; +unsigned int val =0 ; +mutex_lock (&loopback->cable_lock); + cable = loopback->cables[kcontrol->id.subdevice][kcontrol->id.device ^1 ];if (cable !=NULL ) {unsigned int running = cable->running ^ cable->pause; val = (running & (1 <<SNDRV_PCM_STREAM_PLAYBACK )) ?1 :0 ; } +mutex_unlock (&loopback->cable_lock); ucontrol->value.integer.value[0 ] = val;return 0 ; }
@@ -944,9 +953,11 @@ static int loopback_rate_get(struct snd_ {struct loopback *loopback =snd_kcontrol_chip (kcontrol); +mutex_lock (&loopback->cable_lock); ucontrol->value.integer.value[0 ] = loopback->setup[kcontrol->id.subdevice] [kcontrol->id.device].rate; +mutex_unlock (&loopback->cable_lock);return 0 ; }
@@ -966,9 +977,11 @@ static int loopback_channels_get(struct {struct loopback *loopback =snd_kcontrol_chip (kcontrol); +mutex_lock (&loopback->cable_lock); ucontrol->value.integer.value[0 ] = loopback->setup[kcontrol->id.subdevice] [kcontrol->id.device].channels; +mutex_unlock (&loopback->cable_lock);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 13/43 tracepoint: Do not warn on ENOMEM
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathieu Desnoyers <[email protected]>
commit d66a270be3310d7aa132fec0cea77d3d32a0ff75 upstream.
Tracepoint should only warn when a kernel API user does not respect the required preconditions (e.g. same tracepoint enabled twice, or called to remove a tracepoint that does not exist).
Silence warning in out-of-memory conditions, given that the error is returned to the caller.
This ensures that out-of-memory error-injection testing does not trigger warnings in tracepoint.c, which were seen by syzbot.
--- kernel/tracepoint.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/tracepoint.c +2 -2
@@ -207,7 +207,7 @@ static int tracepoint_add_func(struct tr lockdep_is_held(&tracepoints_mutex)); old =func_add (&tp_funcs, func, prio);if (IS_ERR (old)) { -WARN_ON_ONCE (1 ); +WARN_ON_ONCE (PTR_ERR (old) != -ENOMEM );return PTR_ERR (old); }
@@ -240,7 +240,7 @@ static int tracepoint_remove_func(struct lockdep_is_held(&tracepoints_mutex)); old =func_remove (&tp_funcs, func);if (IS_ERR (old)) { -WARN_ON_ONCE (1 ); +WARN_ON_ONCE (PTR_ERR (old) != -ENOMEM );return PTR_ERR (old); }
Greg Kroah-Hartman
maintainerPATCH 14/43 scsi: target: Fix fortify_panic kernel exception
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryant G Ly <[email protected]>
commit f5957dade4f373b04fa1f5315a489f18cc2c4cb4 upstream.
memcmp() requires the two buffers passed as arguments to be at least 'size' bytes long, otherwise a fortify_panic will trigger.
Use memchr_inv() instead of memcmp() to determine whether the received payload is zeroed or not.
The bug was found by running a block backstore via LIO.
[ 496.212958] Call Trace: [ 496.212960] [c0000007e58e3800] [c000000000cbbefc] fortify_panic+0x24/0x38 (unreliable) [ 496.212965] [c0000007e58e3860] [d00000000f150c28] iblock_execute_write_same+0x3b8/0x3c0 [target_core_iblock] [ 496.212976] [c0000007e58e3910] [d000000006c737d4] __target_execute_cmd+0x54/0x150 [target_core_mod] [ 496.212982] [c0000007e58e3940] [d000000006d32ce4] ibmvscsis_write_pending+0x74/0xe0 [ibmvscsis] [ 496.212991] [c0000007e58e39b0] [d000000006c74fc8] transport_generic_new_cmd+0x318/0x370 [target_core_mod] [ 496.213001] [c0000007e58e3a30] [d000000006c75084] transport_handle_cdb_direct+0x64/0xd0 [target_core_mod] [ 496.213011] [c0000007e58e3aa0] [d000000006c75298] target_submit_cmd_map_sgls+0x1a8/0x320 [target_core_mod] [ 496.213021] [c0000007e58e3b30] [d000000006c75458] target_submit_cmd+0x48/0x60 [target_core_mod] [ 496.213026] [c0000007e58e3bd0] [d000000006d34c20] ibmvscsis_scheduler+0x370/0x600 [ibmvscsis] [ 496.213031] [c0000007e58e3c90] [c00000000013135c] process_one_work+0x1ec/0x580 [ 496.213035] [c0000007e58e3d20] [c000000000131798] worker_thread+0xa8/0x600 [ 496.213039] [c0000007e58e3dc0] [c00000000013a468] kthread+0x168/0x1b0 [ 496.213044] [c0000007e58e3e30] [c00000000000b528] ret_from_kernel_thread+0x5c/0xb4
[mkp: tweaked commit message]
--- drivers/target/target_core_iblock.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/target/target_core_iblock.c +4 -4
@@ -427,8 +427,8 @@ iblock_execute_zero_out(struct block_dev {struct se_device *dev = cmd->se_dev;struct scatterlist *sg = &cmd->t_data_sg[0 ]; -unsigned char *buf, zero =0x00 , *p = &zero; -int rc, ret; +unsigned char *buf, *not_zero; +int ret; buf =kmap (sg_page (sg)) + sg->offset;if (!buf)
@@ -437,10 +437,10 @@ iblock_execute_zero_out(struct block_dev* Fall back to block_execute_write_same() slow-path if * incoming WRITE_SAME payload does not contain zeros. */ - rc =memcmp (buf, p, cmd->data_length); + not_zero =memchr_inv (buf,0x00 , cmd->data_length);kunmap (sg_page (sg)); -if (rc) +if (not_zero)return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE ; ret = blkdev_issue_zeroout(bdev,
Greg Kroah-Hartman
maintainerPATCH 15/43 Input: leds - fix out of bound access
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit 6bd6ae639683c0b41f46990d5c64ff9fbfa019dc upstream.
UI_SET_LEDBIT ioctl() causes the following KASAN splat when used with led > LED_CHARGING:
[ 1274.663418] BUG: KASAN: slab-out-of-bounds in input_leds_connect+0x611/0x730 [input_leds] [ 1274.663426] Write of size 8 at addr ffff88003377b2c0 by task ckb-next-daemon/5128
This happens because we were writing to the led structure before making sure that it exists.
--- drivers/input/input-leds.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/input/input-leds.c +4 -4
@@ -88,6 +88,7 @@ static int input_leds_connect(struct inp const struct input_device_id *id) {struct input_leds *leds; +struct input_led *led;unsigned int num_leds;unsigned int led_code;int led_no;
@@ -119,14 +120,13 @@ static int input_leds_connect(struct inp led_no =0 ;for_each_set_bit (led_code, dev->ledbit,LED_CNT ) { -struct input_led *led = &leds->leds[led_no]; +if (!input_led_info[led_code].name) +continue ; + led = &leds->leds[led_no]; led->handle = &leds->handle; led->code = led_code; -if (!input_led_info[led_code].name) -continue ; - led->cdev.name =kasprintf (GFP_KERNEL ,"%s::%s" ,dev_name (&dev->dev), input_led_info[led_code].name);
Greg Kroah-Hartman
maintainerPATCH 16/43 Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vittorio Gambaletta (VittGam) <[email protected]>
commit f372b81101e6895252298e563d634d5e44ae81e7 upstream.
This patch adds the correct platform data information for the Caroline Chromebook, so that the mouse button does not get stuck in pressed state after the first click.
The Samus button keymap and platform data definition are the correct ones for Caroline, so they have been reused here.
--- drivers/input/touchscreen/atmel_mxt_ts.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/input/touchscreen/atmel_mxt_ts.c +9 -0
@@ -3031,6 +3031,15 @@ static const struct dmi_system_id mxt_dm .driver_data = samus_platform_data, }, { +/* Samsung Chromebook Pro */ + .ident = "Samsung Chromebook Pro", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Google" ), + DMI_MATCH(DMI_PRODUCT_NAME, "Caroline"), + }, + .driver_data = samus_platform_data, + }, + {/* Other Google Chromebooks */ .ident ="Chromebook" , .matches = {
Greg Kroah-Hartman
maintainerPATCH 17/43 rtlwifi: btcoex: Add power_on_setting routine
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <[email protected]>
commit a44709bba70fb9badc44b6a551415b152db13182 upstream.
After mac power-on sequence, wifi will start to work so notify btcoex the event to configure registers especially related to antenna. This will not only help to assign antenna but also to yield better user experience.
--- drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h | 1 + drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c | 6 ++++++ drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.h | 1 + drivers/net/wireless/realtek/rtlwifi/wifi.h | 1 + 4 files changed, 9 insertions(+)
drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h +1 -0
@@ -601,6 +601,7 @@ extern struct btc_coexist gl_bt_coexist;bool exhalbtc_initlize_variables (void );bool exhalbtc_bind_bt_coex_withadapter (void *adapter); +void exhalbtc_power_on_setting (struct btc_coexist *btcoexist);void exhalbtc_init_hw_config (struct btc_coexist *btcoexist,bool wifi_only);void exhalbtc_init_coex_dm (struct btc_coexist *btcoexist);void exhalbtc_ips_notify (struct btc_coexist *btcoexist,u8 type);
drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c +6 -0
@@ -32,6 +32,7 @@static struct rtl_btc_ops rtl_btc_operation = { .btc_init_variables = rtl_btc_init_variables, .btc_init_hal_vars = rtl_btc_init_hal_vars, + .btc_power_on_setting = rtl_btc_power_on_setting, .btc_init_hw_config = rtl_btc_init_hw_config, .btc_ips_notify = rtl_btc_ips_notify, .btc_lps_notify = rtl_btc_lps_notify,
@@ -110,6 +111,11 @@ void rtl_btc_init_hal_vars(struct rtl_pr*/ } +void rtl_btc_power_on_setting (struct rtl_priv *rtlpriv) +{ +exhalbtc_power_on_setting (&gl_bt_coexist); +} +void rtl_btc_init_hw_config (struct rtl_priv *rtlpriv) {u8 bt_exist;
drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.h +1 -0
@@ -29,6 +29,7 @@void rtl_btc_init_variables (struct rtl_priv *rtlpriv);void rtl_btc_init_hal_vars (struct rtl_priv *rtlpriv); +void rtl_btc_power_on_setting (struct rtl_priv *rtlpriv);void rtl_btc_init_hw_config (struct rtl_priv *rtlpriv);void rtl_btc_ips_notify (struct rtl_priv *rtlpriv,u8 type);void rtl_btc_lps_notify (struct rtl_priv *rtlpriv,u8 type);
drivers/net/wireless/realtek/rtlwifi/wifi.h +1 -0
@@ -2545,6 +2545,7 @@ struct bt_coexist_info {struct rtl_btc_ops {void (*btc_init_variables) (struct rtl_priv *rtlpriv);void (*btc_init_hal_vars) (struct rtl_priv *rtlpriv); +void (*btc_power_on_setting)(struct rtl_priv *rtlpriv);void (*btc_init_hw_config) (struct rtl_priv *rtlpriv);void (*btc_ips_notify) (struct rtl_priv *rtlpriv,u8 type);void (*btc_lps_notify)(struct rtl_priv *rtlpriv,u8 type);
Greg Kroah-Hartman
maintainerPATCH 18/43 rtlwifi: cleanup 8723be ant_sel definition
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <[email protected]>
commit af8a41cccf8f469165c6debc8fe07c5fd2ca501a upstream.
Some HP laptops have only a single wifi antenna. This would not be a problem except that they were shipped with an incorrectly encoded EFUSE. It should have been possible to open the computer and transfer the antenna connection to the other terminal except that such action might void the warranty, and moving the antenna broke the Windows driver. The fix was to add a module option that would override the EFUSE encoding. That was done with commit c18d8f509571 ("rtlwifi:
rtl8723be: Add antenna select module parameter"). There was still a problem with Bluetooth coexistence, which was addressed with commit baa170229095 ("rtlwifi: btcoexist: Implement antenna selection"). There were still problems, thus there were commit 0ff78adeef11 ("rtlwifi: rtl8723be: fix ant_sel code") and commit 6d6226928369 ("rtlwifi: btcoexist: Fix antenna selection code"). Despite all these attempts at fixing the problem, the code is not yet right. A proper fix is important as there are now instances of laptops having RTL8723DE chips with the same problem.
The module parameter ant_sel is used to control antenna number and path. At present enum ANT_{X2,X1} is used to define the antenna number, but this choice is not intuitive, thus change to a new enum ANT_{MAIN,AUX} to make it more readable. This change showed examples where incorrect values were used. It was also possible to remove a workaround in halbtcoutsrc.c.
The experimental results with single antenna connected to specific path are now as follows:
ant_sel ANT_MAIN(#1) ANT_AUX(#2)
0 -8 -62
1 -62 -10
2 -6 -60--- drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c | 15 ---------- drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 11 ++++--- drivers/net/wireless/realtek/rtlwifi/wifi.h | 5 +++ 3 files changed, 12 insertions(+), 19 deletions(-)
drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c +0 -15
@@ -173,16 +173,6 @@ static u8 halbtc_get_wifi_central_chnl(su8 rtl_get_hwpg_single_ant_path (struct rtl_priv *rtlpriv) { -struct rtl_mod_params *mod_params = rtlpriv->cfg->mod_params; - -/* override ant_num / ant_path */ -if (mod_params->ant_sel) { - rtlpriv->btcoexist.btc_info.ant_num = - (mod_params->ant_sel ==1 ?ANT_X2 :ANT_X1 ); - - rtlpriv->btcoexist.btc_info.single_ant_path = - (mod_params->ant_sel ==1 ?0 :1 ); - }return rtlpriv->btcoexist.btc_info.single_ant_path; }
@@ -193,7 +183,6 @@ u8 rtl_get_hwpg_bt_type(struct rtl_privu8 rtl_get_hwpg_ant_num (struct rtl_priv *rtlpriv) { -struct rtl_mod_params *mod_params = rtlpriv->cfg->mod_params;u8 num;if (rtlpriv->btcoexist.btc_info.ant_num ==ANT_X2 )
@@ -201,10 +190,6 @@ u8 rtl_get_hwpg_ant_num(struct rtl_privelse num =1 ; -/* override ant_num / ant_path */ -if (mod_params->ant_sel) - num = (mod_params->ant_sel ==1 ?ANT_X2 :ANT_X1 ) +1 ; -return num; }
drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +7 -4
@@ -846,6 +846,9 @@ static bool _rtl8723be_init_mac(struct ireturn false; } +if (rtlpriv->cfg->ops->get_btc_status ()) + rtlpriv->btcoexist.btc_ops->btc_power_on_setting (rtlpriv); + bytetmp =rtl_read_byte (rtlpriv,REG_MULTI_FUNC_CTRL );rtl_write_byte (rtlpriv,REG_MULTI_FUNC_CTRL , bytetmp |BIT (3 ));
@@ -2696,21 +2699,21 @@ void rtl8723be_read_bt_coexist_info_from rtlpriv->btcoexist.btc_info.bt_type =BT_RTL8723B ; rtlpriv->btcoexist.btc_info.ant_num = (value &0x1 ); rtlpriv->btcoexist.btc_info.single_ant_path = - (value &0x40 );/*0xc3[6]*/ + (value &0x40 ?ANT_AUX :ANT_MAIN );/*0xc3[6]*/ }else { rtlpriv->btcoexist.btc_info.btcoexist =0 ; rtlpriv->btcoexist.btc_info.bt_type =BT_RTL8723B ; rtlpriv->btcoexist.btc_info.ant_num =ANT_X2 ; - rtlpriv->btcoexist.btc_info.single_ant_path =0 ; + rtlpriv->btcoexist.btc_info.single_ant_path =ANT_MAIN ; }/* override ant_num / ant_path */ if (mod_params->ant_sel) { rtlpriv->btcoexist.btc_info.ant_num = - (mod_params->ant_sel ==1 ?ANT_X2 :ANT_X1 ); + (mod_params->ant_sel ==1 ?ANT_X1 :ANT_X2 ); rtlpriv->btcoexist.btc_info.single_ant_path = - (mod_params->ant_sel ==1 ?0 :1 ); + (mod_params->ant_sel ==1 ?ANT_AUX :ANT_MAIN ); } }
drivers/net/wireless/realtek/rtlwifi/wifi.h +5 -0
@@ -2708,6 +2708,11 @@ enum bt_ant_num { ANT_X1 = 1, }; +enum bt_ant_path { +ANT_MAIN =0 , +ANT_AUX =1 , +}; +enum bt_co_type {BT_2WIRE =0 ,BT_ISSC_3WIRE =1 ,
Greg Kroah-Hartman
maintainerPATCH 19/43 xfs: prevent creating negative-sized file via INSERT_RANGE
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <[email protected]>
commit 7d83fb14258b9961920cd86f0b921caaeb3ebe85 upstream.
During the "insert range" fallocate operation, i_size grows by the specified 'len' bytes. XFS verifies that i_size + len < s_maxbytes, as it should. But this comparison is done using the signed 'loff_t', and 'i_size + len' can wrap around to a negative value, causing the check to incorrectly pass, resulting in an inode with "negative" i_size. This is possible on 64-bit platforms, where XFS sets s_maxbytes = LLONG_MAX. ext4 and f2fs don't run into this because they set a smaller s_maxbytes.
Fix it by using subtraction instead.
Reproducer:
xfs_io -f file -c "truncate $(((1<<63)-1))" -c "finsert 0 4096"
Originally-From: Eric Biggers <[email protected]>
--- fs/xfs/xfs_file.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
fs/xfs/xfs_file.c +9 -5
@@ -811,22 +811,26 @@ xfs_file_fallocate(if (error) goto out_unlock; }else if (mode &FALLOC_FL_INSERT_RANGE ) { -unsigned int blksize_mask =i_blocksize (inode) -1 ; +unsigned int blksize_mask =i_blocksize (inode) -1 ; +loff_t isize =i_size_read (inode); - new_size =i_size_read (inode) + len;if (offset & blksize_mask || len & blksize_mask) { error = -EINVAL ; goto out_unlock; } -/* check the new inode size does not wrap through zero */ -if (new_size > inode->i_sb->s_maxbytes) { +/* +* New inode size must not exceed ->s_maxbytes, accounting for +* possible signed overflow. +*/ +if (inode->i_sb->s_maxbytes - isize < len) { error = -EFBIG ; goto out_unlock; } + new_size = isize + len;/* Offset should be less than i_size */ -if (offset >=i_size_read (inode)) { +if (offset >= isize) { error = -EINVAL ; goto out_unlock; }
Greg Kroah-Hartman
maintainerPATCH 20/43 RDMA/cxgb4: release hw resources on device removal
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raju Rangoju <[email protected]>
commit 26bff1bd74a4f7417509a83295614e9dab995b2a upstream.
The c4iw_rdev_close() logic was not releasing all the hw resources (PBL and RQT memory) during the device removal event (driver unload / system reboot). This can cause panic in gen_pool_destroy().
The module remove function will wait for all the hw resources to be released during the device removal event.
Fixes c12a67fe(iw_cxgb4: free EQ queue memory on last deref)
--- drivers/infiniband/hw/cxgb4/device.c | 9 ++++++++- drivers/infiniband/hw/cxgb4/iw_cxgb4.h | 4 ++++ drivers/infiniband/hw/cxgb4/resource.c | 26 ++++++++++++++++++++++++-- 3 files changed, 36 insertions(+), 3 deletions(-)
drivers/infiniband/hw/cxgb4/device.c +8 -1
@@ -884,6 +884,11 @@ static int c4iw_rdev_open(struct c4iw_rd rdev->status_page->db_off =0 ; +init_completion (&rdev->rqt_compl); +init_completion (&rdev->pbl_compl); +kref_init (&rdev->rqt_kref); +kref_init (&rdev->pbl_kref); +return 0 ; err_free_status_page_and_wr_log:if (c4iw_wr_log && rdev->wr_log)
@@ -902,13 +907,15 @@ destroy_resource:static void c4iw_rdev_close (struct c4iw_rdev *rdev) { -destroy_workqueue (rdev->free_workq);kfree (rdev->wr_log);c4iw_release_dev_ucontext (rdev, &rdev->uctx);free_page ((unsigned long )rdev->status_page);c4iw_pblpool_destroy (rdev);c4iw_rqtpool_destroy (rdev); +wait_for_completion (&rdev->pbl_compl); +wait_for_completion (&rdev->rqt_compl);c4iw_ocqp_pool_destroy (rdev); +destroy_workqueue (rdev->free_workq);c4iw_destroy_resource (&rdev->resource); }
drivers/infiniband/hw/cxgb4/iw_cxgb4.h +4 -0
@@ -185,6 +185,10 @@ struct c4iw_rdev {struct wr_log_entry *wr_log;int wr_log_size;struct workqueue_struct *free_workq; +struct completion rqt_compl; +struct completion pbl_compl; +struct kref rqt_kref; +struct kref pbl_kref; };static inline int c4iw_fatal_error (struct c4iw_rdev *rdev)
drivers/infiniband/hw/cxgb4/resource.c +24 -2
@@ -260,12 +260,22 @@ u32 c4iw_pblpool_alloc(struct c4iw_rdev rdev->stats.pbl.cur +=roundup (size,1 <<MIN_PBL_SHIFT );if (rdev->stats.pbl.cur > rdev->stats.pbl.max) rdev->stats.pbl.max = rdev->stats.pbl.cur; +kref_get (&rdev->pbl_kref); }else rdev->stats.pbl.fail++;mutex_unlock (&rdev->stats.lock);return (u32 )addr; } +static void destroy_pblpool (struct kref *kref) +{ +struct c4iw_rdev *rdev; + + rdev = container_of(kref, struct c4iw_rdev, pbl_kref); +gen_pool_destroy (rdev->pbl_pool); +complete (&rdev->pbl_compl); +} +void c4iw_pblpool_free (struct c4iw_rdev *rdev,u32 addr,int size) {pr_debug ("%s addr 0x%x size %d\n" , __func__, addr, size);
@@ -273,6 +283,7 @@ void c4iw_pblpool_free(struct c4iw_rdev rdev->stats.pbl.cur -=roundup (size,1 <<MIN_PBL_SHIFT );mutex_unlock (&rdev->stats.lock);gen_pool_free (rdev->pbl_pool, (unsigned long )addr, size); +kref_put (&rdev->pbl_kref, destroy_pblpool); }int c4iw_pblpool_create (struct c4iw_rdev *rdev)
@@ -310,7 +321,7 @@ int c4iw_pblpool_create(struct c4iw_rdevvoid c4iw_pblpool_destroy (struct c4iw_rdev *rdev) { -gen_pool_destroy (rdev->pbl_pool); +kref_put (&rdev->pbl_kref, destroy_pblpool); }/*
@@ -331,12 +342,22 @@ u32 c4iw_rqtpool_alloc(struct c4iw_rdev rdev->stats.rqt.cur +=roundup (size <<6 ,1 <<MIN_RQT_SHIFT );if (rdev->stats.rqt.cur > rdev->stats.rqt.max) rdev->stats.rqt.max = rdev->stats.rqt.cur; +kref_get (&rdev->rqt_kref); }else rdev->stats.rqt.fail++;mutex_unlock (&rdev->stats.lock);return (u32 )addr; } +static void destroy_rqtpool (struct kref *kref) +{ +struct c4iw_rdev *rdev; + + rdev = container_of(kref, struct c4iw_rdev, rqt_kref); +gen_pool_destroy (rdev->rqt_pool); +complete (&rdev->rqt_compl); +} +void c4iw_rqtpool_free (struct c4iw_rdev *rdev,u32 addr,int size) {pr_debug ("%s addr 0x%x size %d\n" , __func__, addr, size <<6 );
@@ -344,6 +365,7 @@ void c4iw_rqtpool_free(struct c4iw_rdev rdev->stats.rqt.cur -=roundup (size <<6 ,1 <<MIN_RQT_SHIFT );mutex_unlock (&rdev->stats.lock);gen_pool_free (rdev->rqt_pool, (unsigned long )addr, size <<6 ); +kref_put (&rdev->rqt_kref, destroy_rqtpool); }int c4iw_rqtpool_create (struct c4iw_rdev *rdev)
@@ -380,7 +402,7 @@ int c4iw_rqtpool_create(struct c4iw_rdevvoid c4iw_rqtpool_destroy (struct c4iw_rdev *rdev) { -gen_pool_destroy (rdev->rqt_pool); +kref_put (&rdev->rqt_kref, destroy_rqtpool); }/*
Greg Kroah-Hartman
maintainerPATCH 21/43 RDMA/ucma: Allow resolving address w/o specifying source address
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roland Dreier <[email protected]>
commit 09abfe7b5b2f442a85f4c4d59ecf582ad76088d7 upstream.
The RDMA CM will select a source device and address by consulting the routing table if no source address is passed into rdma_resolve_address(). Userspace will ask for this by passing an all-zero source address in the RESOLVE_IP command. Unfortunately the new check for non-zero address size rejects this with EINVAL, which breaks valid userspace applications.
Fix this by explicitly allowing a zero address family for the source.
--- drivers/infiniband/core/ucma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/core/ucma.c +1 -1
@@ -678,7 +678,7 @@ static ssize_t ucma_resolve_ip(struct ucif (copy_from_user (&cmd, inbuf,sizeof (cmd)))return -EFAULT ; -if (!rdma_addr_size_in6 (&cmd.src_addr) || +if ((cmd.src_addr.sin6_family && !rdma_addr_size_in6 (&cmd.src_addr)) || !rdma_addr_size_in6 (&cmd.dst_addr))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 22/43 RDMA/mlx5: Fix multiple NULL-ptr deref errors in rereg_mr flow
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
commit b4bd701ac469075d94ed9699a28755f2862252b9 upstream.
Failure in rereg MR releases UMEM but leaves the MR to be destroyed by the user. As a result the following scenario may happen:
"create MR -> rereg MR with failure -> call to rereg MR again" and hit "NULL-ptr deref or user memory access" errors.
Ensure that rereg MR is only performed on a non-dead MR.
--- drivers/infiniband/hw/mlx5/mr.c | 32 +++++++++++++++++++++++--------- 1 file changed, 23 insertions(+), 9 deletions(-)
drivers/infiniband/hw/mlx5/mr.c +23 -9
@@ -833,25 +833,28 @@ static int mr_umem_get(struct ib_pd *pd, int *order) {struct mlx5_ib_dev *dev =to_mdev (pd->device); +struct ib_umem *u;int err; - *umem =ib_umem_get (pd->uobject->context, start, length, - access_flags,0 ); - err =PTR_ERR_OR_ZERO (*umem); + *umem =NULL ; + + u =ib_umem_get (pd->uobject->context, start, length, access_flags,0 ); + err =PTR_ERR_OR_ZERO (u);if (err) { - *umem =NULL ; -mlx5_ib_err (dev,"umem get failed (%d)\n" , err); +mlx5_ib_dbg (dev,"umem get failed (%d)\n" , err);return err; } -mlx5_ib_cont_pages (*umem, start,MLX5_MKEY_PAGE_SHIFT_MASK , npages, +mlx5_ib_cont_pages (u, start,MLX5_MKEY_PAGE_SHIFT_MASK , npages, page_shift, ncont, order);if (!*npages) {mlx5_ib_warn (dev,"avoid zero region\n" ); -ib_umem_release (*umem); +ib_umem_release (u);return -EINVAL ; } + *umem = u; +mlx5_ib_dbg (dev,"npages %d, ncont %d, order %d, page_shift %d\n" , *npages, *ncont, *order, *page_shift);
@@ -1340,13 +1343,12 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *int access_flags = flags &IB_MR_REREG_ACCESS ? new_access_flags : mr->access_flags; -u64 addr = (flags &IB_MR_REREG_TRANS ) ? virt_addr : mr->umem->address; -u64 len = (flags &IB_MR_REREG_TRANS ) ? length : mr->umem->length;int page_shift =0 ;int upd_flags =0 ;int npages =0 ;int ncont =0 ;int order =0 ; +u64 addr, len;int err; mlx5_ib_dbg(dev, "start 0x%llx, virt_addr 0x%llx, length 0x%llx, access_flags 0x%x\n",
@@ -1354,6 +1356,17 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *atomic_sub (mr->npages, &dev->mdev->priv.reg_pages); +if (!mr->umem) +return -EINVAL ; + +if (flags &IB_MR_REREG_TRANS ) { + addr = virt_addr; + len = length; + }else { + addr = mr->umem->address; + len = mr->umem->length; + } +if (flags !=IB_MR_REREG_PD ) {/* * Replace umem. This needs to be done whether or not UMR is
@@ -1361,6 +1374,7 @@ int mlx5_ib_rereg_user_mr(struct ib_mr **/ flags |=IB_MR_REREG_TRANS ;ib_umem_release (mr->umem); + mr->umem =NULL ; err =mr_umem_get (pd, addr, len, access_flags, &mr->umem, &npages, &page_shift, &ncont, &order);if (err <0 ) {
Greg Kroah-Hartman
maintainerPATCH 23/43 RDMA/mlx5: Protect from shift operand overflow
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
commit 002bf2282b2d7318e444dca9ffcb994afc5d5f15 upstream.
Ensure that user didn't supply values too large that can cause overflow.
UBSAN: Undefined behaviour in drivers/infiniband/hw/mlx5/qp.c:263:23 shift exponent -2147483648 is negative CPU: 0 PID: 292 Comm: syzkaller612609 Not tainted 4.16.0-rc1+ #131 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-project.org 04/01/2014 Call Trace: dump_stack+0xde/0x164 ubsan_epilogue+0xe/0x81 set_rq_size+0x7c2/0xa90 create_qp_common+0xc18/0x43c0 mlx5_ib_create_qp+0x379/0x1ca0 create_qp.isra.5+0xc94/0x2260 ib_uverbs_create_qp+0x21b/0x2a0 ib_uverbs_write+0xc2c/0x1010 vfs_write+0x1b0/0x550 SyS_write+0xc7/0x1a0 do_syscall_64+0x1aa/0x740 entry_SYSCALL_64_after_hwframe+0x26/0x9b RIP: 0033:0x433569 RSP: 002b:00007ffc6e62f448 EFLAGS: 00000217 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00000000004002f8 RCX: 0000000000433569 RDX: 0000000000000070 RSI: 00000000200042c0 RDI: 0000000000000003 RBP: 00000000006d5018 R08: 00000000004002f8 R09: 00000000004002f8 R10: 00000000004002f8 R11: 0000000000000217 R12: 0000000000000000 R13: 000000000040c9f0 R14: 000000000040ca80 R15: 0000000000000006
--- drivers/infiniband/hw/mlx5/qp.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/infiniband/hw/mlx5/qp.c +4 -0
@@ -256,7 +256,11 @@ static int set_rq_size(struct mlx5_ib_de }else {if (ucmd) { qp->rq.wqe_cnt = ucmd->rq_wqe_count; +if (ucmd->rq_wqe_shift >BITS_PER_BYTE *sizeof (ucmd->rq_wqe_shift)) +return -EINVAL ; qp->rq.wqe_shift = ucmd->rq_wqe_shift; +if ((1 << qp->rq.wqe_shift) /sizeof (struct mlx5_wqe_data_seg ) < qp->wq_sig) +return -EINVAL ; qp->rq.max_gs = (1 << qp->rq.wqe_shift) /sizeof (struct mlx5_wqe_data_seg ) - qp->wq_sig; qp->rq.max_post = qp->rq.wqe_cnt; }else {
Greg Kroah-Hartman
maintainerPATCH 24/43 NET: usb: qmi_wwan: add support for ublox R410M PID 0x90b2
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: SZ Lin (林上智) <[email protected]>
commit 9306b38e42cb266f98bff6f6f4c1c652aa79ba45 upstream.
This patch adds support for PID 0x90b2 of ublox R410M.
qmicli -d /dev/cdc-wdm0 --dms-get-manufacturer
[/dev/cdc-wdm0] Device manufacturer retrieved:
Manufacturer: 'u-blox'
qmicli -d /dev/cdc-wdm0 --dms-get-model
[/dev/cdc-wdm0] Device model retrieved:
Model: 'SARA-R410M-02B'
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1098,6 +1098,7 @@ static const struct usb_device_id produc {QMI_FIXED_INTF(0x05c6, 0x9080, 8)}, {QMI_FIXED_INTF(0x05c6, 0x9083, 3)}, {QMI_FIXED_INTF(0x05c6, 0x9084, 4)}, + {QMI_FIXED_INTF(0x05c6, 0x90b2, 3)}, /* ublox R410M */ {QMI_FIXED_INTF(0x05c6, 0x920d, 0)}, {QMI_FIXED_INTF(0x05c6, 0x920d, 5)}, {QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)}, /* YUGA CLM920-NC5 */
Greg Kroah-Hartman
maintainerPATCH 25/43 IB/mlx5: Use unlimited rate when static rate is not supported
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danit Goldberg <[email protected]>
commit 4f32ac2e452c2180cd2df581cbadac183e27ecd0 upstream.
Before the change, if the user passed a static rate value different than zero and the FW doesn't support static rate,
it would end up configuring rate of 2.5 GBps.
Fix this by using rate 0; unlimited, in cases where FW doesn't support static rate configuration.
--- drivers/infiniband/hw/mlx5/qp.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/infiniband/hw/mlx5/qp.c +9 -9
@@ -2199,18 +2199,18 @@ enum {static int ib_rate_to_mlx5 (struct mlx5_ib_dev *dev,u8 rate) { -if (rate ==IB_RATE_PORT_CURRENT ) { +if (rate ==IB_RATE_PORT_CURRENT )return 0 ; - }else if (rate <IB_RATE_2_5_GBPS || rate >IB_RATE_300_GBPS ) { + +if (rate <IB_RATE_2_5_GBPS || rate >IB_RATE_300_GBPS )return -EINVAL ; - }else { -while (rate !=IB_RATE_2_5_GBPS && - !(1 << (rate +MLX5_STAT_RATE_OFFSET ) & -MLX5_CAP_GEN (dev->mdev, stat_rate_support))) - --rate; - } -return rate +MLX5_STAT_RATE_OFFSET ; +while (rate !=IB_RATE_PORT_CURRENT && + !(1 << (rate +MLX5_STAT_RATE_OFFSET ) & +MLX5_CAP_GEN (dev->mdev, stat_rate_support))) + --rate; + +return rate ? rate +MLX5_STAT_RATE_OFFSET : rate; } static int modify_raw_packet_eth_prio(struct mlx5_core_dev *dev,
Greg Kroah-Hartman
maintainerPATCH 26/43 IB/hfi1: Fix handling of FECN marked multicast packet
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marciniszyn <[email protected]>
commit f59fb9e05109b836230813e45f71c9ecc2d5dbe6 upstream.
The code for handling a marked UD packet unconditionally returns the dlid in the header of the FECN marked packet. This is not correct for multicast packets where the DLID is in the multicast range.
The subsequent attempt to send the CNP with the multicast lid will cause the chip to halt the ack send context because the source
lid doesn't match the chip programming. The send context will
be halted and flush any other pending packets in the pio ring causing the CNP to not be sent.
A part of investigating the fix, it was determined that the 16B work broke the FECN routine badly with inconsistent use of 16 bit and 32 bits types for lids and pkeys. Since the port's source lid was correctly 32 bits the type mixmatches need to be dealt with at the same time as fixing the CNP header issue.
Fix these issues by:
- Using the ports lid for as the SLID for responding to FECN marked UD packets
- Insure pkey is always 16 bit in this and subordinate routines
- Insure lids are 32 bits in this and subordinate routines
--- drivers/infiniband/hw/hfi1/driver.c | 19 +++++++++++++++---- drivers/infiniband/hw/hfi1/hfi.h | 8 ++++---- drivers/infiniband/hw/hfi1/ud.c | 4 ++-- 3 files changed, 21 insertions(+), 10 deletions(-)
drivers/infiniband/hw/hfi1/driver.c +15 -4
@@ -437,31 +437,43 @@ void hfi1_process_ecn_slowpath(struct rv bool do_cnp) {struct hfi1_ibport *ibp =to_iport (qp->ibqp.device, qp->port_num); +struct hfi1_pportdata *ppd =ppd_from_ibp (ibp);struct ib_other_headers *ohdr = pkt->ohdr;struct ib_grh *grh = pkt->grh;u32 rqpn =0 , bth1; -u16 pkey, rlid, dlid =ib_get_dlid (pkt->hdr); +u16 pkey; +u32 rlid, slid, dlid =0 ;u8 hdr_type, sc, svc_type;bool is_mcast = false; +/* can be called from prescan */ if (pkt->etype ==RHF_RCV_TYPE_BYPASS ) { is_mcast =hfi1_is_16B_mcast (dlid); pkey =hfi1_16B_get_pkey (pkt->hdr); sc =hfi1_16B_get_sc (pkt->hdr); + dlid =hfi1_16B_get_dlid (pkt->hdr); + slid =hfi1_16B_get_slid (pkt->hdr); hdr_type =HFI1_PKT_TYPE_16B ; }else { is_mcast = (dlid >be16_to_cpu (IB_MULTICAST_LID_BASE )) && (dlid !=be16_to_cpu (IB_LID_PERMISSIVE )); pkey =ib_bth_get_pkey (ohdr); sc =hfi1_9B_get_sc5 (pkt->hdr, pkt->rhf); + dlid =ib_get_dlid (pkt->hdr); + slid =ib_get_slid (pkt->hdr); hdr_type =HFI1_PKT_TYPE_9B ; }switch (qp->ibqp.qp_type) { +case IB_QPT_UD : + dlid = ppd->lid; + rlid = slid; + rqpn =ib_get_sqpn (pkt->ohdr); + svc_type =IB_CC_SVCTYPE_UD ; +break ;case IB_QPT_SMI :case IB_QPT_GSI : -case IB_QPT_UD : - rlid =ib_get_slid (pkt->hdr); + rlid = slid; rqpn =ib_get_sqpn (pkt->ohdr); svc_type =IB_CC_SVCTYPE_UD ;break ;
@@ -486,7 +498,6 @@ void hfi1_process_ecn_slowpath(struct rv dlid, rlid, sc, grh);if (!is_mcast && (bth1 &IB_BECN_SMASK )) { -struct hfi1_pportdata *ppd =ppd_from_ibp (ibp);u32 lqpn = bth1 &RVT_QPN_MASK ;u8 sl = ibp->sc_to_sl[sc];
drivers/infiniband/hw/hfi1/hfi.h +4 -4
@@ -1523,13 +1523,13 @@ void set_link_ipg(struct hfi1_pportdatavoid process_becn (struct hfi1_pportdata *ppd,u8 sl,u32 rlid,u32 lqpn,u32 rqpn,u8 svc_type);void return_cnp (struct hfi1_ibport *ibp,struct rvt_qp *qp,u32 remote_qpn, -u32 pkey,u32 slid,u32 dlid,u8 sc5, +u16 pkey,u32 slid,u32 dlid,u8 sc5,const struct ib_grh *old_grh);void return_cnp_16B (struct hfi1_ibport *ibp,struct rvt_qp *qp, -u32 remote_qpn,u32 pkey,u32 slid,u32 dlid, +u32 remote_qpn,u16 pkey,u32 slid,u32 dlid,u8 sc5,const struct ib_grh *old_grh);typedef void (*hfi1_handle_cnp )(struct hfi1_ibport *ibp,struct rvt_qp *qp, -u32 remote_qpn,u32 pkey,u32 slid,u32 dlid, +u32 remote_qpn,u16 pkey,u32 slid,u32 dlid,u8 sc5,const struct ib_grh *old_grh);/* We support only two types - 9B and 16B for now */
@@ -2431,7 +2431,7 @@ static inline void hfi1_make_16b_hdr(str ((slid >>OPA_16B_SLID_SHIFT ) <<OPA_16B_SLID_HIGH_SHIFT ); lrh2 = (lrh2 & ~OPA_16B_DLID_MASK ) | ((dlid >>OPA_16B_DLID_SHIFT ) <<OPA_16B_DLID_HIGH_SHIFT ); - lrh2 = (lrh2 & ~OPA_16B_PKEY_MASK ) | (pkey <<OPA_16B_PKEY_SHIFT ); + lrh2 = (lrh2 & ~OPA_16B_PKEY_MASK ) | ((u32 )pkey <<OPA_16B_PKEY_SHIFT ); lrh2 = (lrh2 & ~OPA_16B_L4_MASK ) | l4; hdr->lrh[0 ] = lrh0;
drivers/infiniband/hw/hfi1/ud.c +2 -2
@@ -630,7 +630,7 @@ int hfi1_lookup_pkey_idx(struct hfi1_ibp }void return_cnp_16B (struct hfi1_ibport *ibp,struct rvt_qp *qp, -u32 remote_qpn,u32 pkey,u32 slid,u32 dlid, +u32 remote_qpn,u16 pkey,u32 slid,u32 dlid,u8 sc5,const struct ib_grh *old_grh) {u64 pbc, pbc_flags =0 ;
@@ -688,7 +688,7 @@ void return_cnp_16B(struct hfi1_ibport * }void return_cnp (struct hfi1_ibport *ibp,struct rvt_qp *qp,u32 remote_qpn, -u32 pkey,u32 slid,u32 dlid,u8 sc5, +u16 pkey,u32 slid,u32 dlid,u8 sc5,const struct ib_grh *old_grh) {u64 pbc, pbc_flags =0 ;
Greg Kroah-Hartman
maintainerPATCH 27/43 IB/hfi1: Fix loss of BECN with AHG
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marciniszyn <[email protected]>
commit 0a0bcb046b2f0c15b89f8c1b08ad3de601a83c66 upstream.
AHG may be armed to use the stored header, which by design is limited to edits in the PSN/A 32 bit word (bth2).
When the code is trying to send a BECN, the use of the stored header will lose the BECN bit.
Fix by avoiding AHG when getting ready to send a BECN. This is accomplished by always claiming the packet is not a middle packet which is an AHG precursor. BECNs are not a normal case and this should not hurt AHG optimizations.
--- drivers/infiniband/hw/hfi1/ruc.c | 50 +++++++++++++++++++++++++++++++-------- 1 file changed, 40 insertions(+), 10 deletions(-)
drivers/infiniband/hw/hfi1/ruc.c +40 -10
@@ -745,6 +745,20 @@ static inline void hfi1_make_ruc_bth(str ohdr->bth[2 ] =cpu_to_be32 (bth2); } +/** +* hfi1_make_ruc_header_16B - build a 16B header +* @qp: the queue pair +* @ohdr: a pointer to the destination header memory +* @bth0: bth0 passed in from the RC/UC builder +* @bth2: bth2 passed in from the RC/UC builder +* @middle: non zero implies indicates ahg "could" be used +* @ps: the current packet state +* +* This routine may disarm ahg under these situations: +* - packet needs a GRH +* - BECN needed +* - migration state not IB_MIG_MIGRATED +*/ static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp, struct ib_other_headers *ohdr, u32 bth0, u32 bth2, int middle,
@@ -789,6 +803,12 @@ static inline void hfi1_make_ruc_header_else middle =0 ; +if (qp->s_flags &RVT_S_ECN ) { + qp->s_flags &= ~RVT_S_ECN ; +/* we recently received a FECN, so return a BECN */ + becn = true; + middle =0 ; + }if (middle)build_ahg (qp, bth2);else
@@ -796,11 +816,6 @@ static inline void hfi1_make_ruc_header_ bth0 |= pkey; bth0 |= extra_bytes <<20 ; -if (qp->s_flags &RVT_S_ECN ) { - qp->s_flags &= ~RVT_S_ECN ; -/* we recently received a FECN, so return a BECN */ - becn =1 ; - }hfi1_make_ruc_bth (qp, ohdr, bth0, bth1, bth2);if (!ppd->lid)
@@ -818,6 +833,20 @@ static inline void hfi1_make_ruc_header_ pkey, becn, 0, l4, priv->s_sc); } +/** +* hfi1_make_ruc_header_9B - build a 9B header +* @qp: the queue pair +* @ohdr: a pointer to the destination header memory +* @bth0: bth0 passed in from the RC/UC builder +* @bth2: bth2 passed in from the RC/UC builder +* @middle: non zero implies indicates ahg "could" be used +* @ps: the current packet state +* +* This routine may disarm ahg under these situations: +* - packet needs a GRH +* - BECN needed +* - migration state not IB_MIG_MIGRATED +*/ static inline void hfi1_make_ruc_header_9B(struct rvt_qp *qp, struct ib_other_headers *ohdr, u32 bth0, u32 bth2, int middle,
@@ -853,6 +882,12 @@ static inline void hfi1_make_ruc_header_else middle =0 ; +if (qp->s_flags &RVT_S_ECN ) { + qp->s_flags &= ~RVT_S_ECN ; +/* we recently received a FECN, so return a BECN */ + bth1 |= (IB_BECN_MASK <<IB_BECN_SHIFT ); + middle =0 ; + }if (middle)build_ahg (qp, bth2);else
@@ -860,11 +895,6 @@ static inline void hfi1_make_ruc_header_ bth0 |= pkey; bth0 |= extra_bytes <<20 ; -if (qp->s_flags &RVT_S_ECN ) { - qp->s_flags &= ~RVT_S_ECN ; -/* we recently received a FECN, so return a BECN */ - bth1 |= (IB_BECN_MASK <<IB_BECN_SHIFT ); - }hfi1_make_ruc_bth (qp, ohdr, bth0, bth1, bth2);if (!ppd->lid)
Greg Kroah-Hartman
maintainerPATCH 28/43 IB/hfi1: Fix NULL pointer dereference when invalid num_vls is used
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Sanchez <[email protected]>
commit 45d924571a5e1329580811f2419da61b07ac3613 upstream.
When an invalid num_vls is used as a module parameter, the code execution follows an exception path where the macro dd_dev_err() expects dd->pcidev->dev not to be NULL in hfi1_init_dd(). This causes a NULL pointer dereference.
Fix hfi1_init_dd() by initializing dd->pcidev and dd->pcidev->dev earlier in the code. If a dd exists, then dd->pcidev and dd->pcidev->dev always exists.
BUG: unable to handle kernel NULL pointer dereference at 00000000000000f0 IP: __dev_printk+0x15/0x90 Workqueue: events work_for_cpu_fn RIP: 0010:__dev_printk+0x15/0x90 Call Trace: dev_err+0x6c/0x90 ? hfi1_init_pportdata+0x38d/0x3f0 [hfi1] hfi1_init_dd+0xdd/0x2530 [hfi1] ? pci_conf1_read+0xb2/0xf0 ? pci_read_config_word.part.9+0x64/0x80 ? pci_conf1_write+0xb0/0xf0 ? pcie_capability_clear_and_set_word+0x57/0x80 init_one+0x141/0x490 [hfi1] local_pci_probe+0x3f/0xa0 work_for_cpu_fn+0x10/0x20 process_one_work+0x152/0x350 worker_thread+0x1cf/0x3e0 kthread+0xf5/0x130 ? max_active_store+0x80/0x80 ? kthread_bind+0x10/0x10 ? do_syscall_64+0x6e/0x1a0 ? SyS_exit_group+0x10/0x10 ret_from_fork+0x35/0x40
--- drivers/infiniband/hw/hfi1/init.c | 2 ++ drivers/infiniband/hw/hfi1/pcie.c | 3 --- 2 files changed, 2 insertions(+), 3 deletions(-)
drivers/infiniband/hw/hfi1/init.c +2 -0
@@ -1234,6 +1234,8 @@ struct hfi1_devdata *hfi1_alloc_devdata(return ERR_PTR (-ENOMEM ); dd->num_pports = nports; dd->pport = (struct hfi1_pportdata *)(dd +1 ); + dd->pcidev = pdev; +pci_set_drvdata (pdev, dd);INIT_LIST_HEAD (&dd->list);idr_preload (GFP_KERNEL );
drivers/infiniband/hw/hfi1/pcie.c +0 -3
@@ -163,9 +163,6 @@ int hfi1_pcie_ddinit(struct hfi1_devdataresource_size_t addr;int ret =0 ; - dd->pcidev = pdev; -pci_set_drvdata (pdev, dd); - addr =pci_resource_start (pdev,0 ); len =pci_resource_len (pdev,0 );
Greg Kroah-Hartman
maintainerPATCH 29/43 iw_cxgb4: Atomically flush per QP HW CQEs
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bharat Potnuri <[email protected]>
commit 2df19e19ae90d94fd8724083f161f368a2797537 upstream.
When a CQ is shared by multiple QPs, c4iw_flush_hw_cq() needs to acquire corresponding QP lock before moving the CQEs into its corresponding SW queue and accessing the SQ contents for completing a WR. Ignore CQEs if corresponding QP is already flushed.
--- drivers/infiniband/hw/cxgb4/cq.c | 11 ++++++++++- drivers/infiniband/hw/cxgb4/iw_cxgb4.h | 2 +- drivers/infiniband/hw/cxgb4/qp.c | 4 ++-- 3 files changed, 13 insertions(+), 4 deletions(-)
drivers/infiniband/hw/cxgb4/cq.c +10 -1
@@ -330,7 +330,7 @@ static void advance_oldest_read(struct t* Deal with out-of-order and/or completions that complete * prior unsignalled WRs. */ -void c4iw_flush_hw_cq (struct c4iw_cq *chp) +void c4iw_flush_hw_cq (struct c4iw_cq *chp,struct c4iw_qp *flush_qhp) {struct t4_cqe *hw_cqe, *swcqe, read_cqe;struct c4iw_qp *qhp;
@@ -354,6 +354,13 @@ void c4iw_flush_hw_cq(struct c4iw_cq *chif (qhp ==NULL ) goto next_cqe; +if (flush_qhp != qhp) { +spin_lock (&qhp->lock); + +if (qhp->wq.flushed ==1 ) + goto next_cqe; + } +if (CQE_OPCODE (hw_cqe) ==FW_RI_TERMINATE ) goto next_cqe;
@@ -405,6 +412,8 @@ void c4iw_flush_hw_cq(struct c4iw_cq *ch next_cqe:t4_hwcq_consume (&chp->cq); ret =t4_next_hw_cqe (&chp->cq, &hw_cqe); +if (qhp && flush_qhp != qhp) +spin_unlock (&qhp->lock); } }
drivers/infiniband/hw/cxgb4/iw_cxgb4.h +1 -1
@@ -993,7 +993,7 @@ void c4iw_pblpool_free(struct c4iw_rdevu32 c4iw_ocqp_pool_alloc (struct c4iw_rdev *rdev,int size);void c4iw_ocqp_pool_free (struct c4iw_rdev *rdev,u32 addr,int size);int c4iw_ofld_send (struct c4iw_rdev *rdev,struct sk_buff *skb); -void c4iw_flush_hw_cq (struct c4iw_cq *chp); +void c4iw_flush_hw_cq (struct c4iw_cq *chp,struct c4iw_qp *flush_qhp);void c4iw_count_rcqes (struct t4_cq *cq,struct t4_wq *wq,int *count);int c4iw_ep_disconnect (struct c4iw_ep *ep,int abrupt,gfp_t gfp);int c4iw_flush_rq (struct t4_wq *wq,struct t4_cq *cq,int count);
drivers/infiniband/hw/cxgb4/qp.c +2 -2
@@ -1349,12 +1349,12 @@ static void __flush_qp(struct c4iw_qp *q qhp->wq.flushed =1 ;t4_set_wq_in_error (&qhp->wq); -c4iw_flush_hw_cq (rchp); +c4iw_flush_hw_cq (rchp, qhp);c4iw_count_rcqes (&rchp->cq, &qhp->wq, &count); rq_flushed =c4iw_flush_rq (&qhp->wq, &rchp->cq, count);if (schp != rchp) -c4iw_flush_hw_cq (schp); +c4iw_flush_hw_cq (schp, qhp); sq_flushed =c4iw_flush_sq (qhp);spin_unlock (&qhp->lock);
Greg Kroah-Hartman
maintainerPATCH 30/43 drm/vmwgfx: Fix a buffer object leak
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellstrom <[email protected]>
commit 13f149d47392782baafd96d54d4e65f3b5ca342f upstream.
A buffer object leak was introduced when fixing a premature buffer object release. Fix this.
--- drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +1 -0
@@ -2612,6 +2612,7 @@ void vmw_kms_helper_resource_finish(struvmw_kms_helper_buffer_finish (res->dev_priv,NULL , ctx->buf, out_fence,NULL ); +vmw_dmabuf_unreference (&ctx->buf);vmw_resource_unreserve (res, false,NULL ,0 );mutex_unlock (&res->dev_priv->cmdbuf_mutex); }
Greg Kroah-Hartman
maintainerPATCH 31/43 drm/bridge: vga-dac: Fix edid memory leak
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Paul <[email protected]>
commit 49ceda9de2da4d1827941d06701f3017c27c1855 upstream.
edid should be freed once it's finished being used.
--- drivers/gpu/drm/bridge/dumb-vga-dac.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/bridge/dumb-vga-dac.c +3 -1
@@ -55,7 +55,9 @@ static int dumb_vga_get_modes(struct drm }drm_mode_connector_update_edid_property (connector, edid); -return drm_add_edid_modes (connector, edid); + ret =drm_add_edid_modes (connector, edid); +kfree (edid); +return ret; fallback:/*
Greg Kroah-Hartman
maintainerPATCH 32/43 test_firmware: fix setting old custom fw path back on exit, second try
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
commit e538409257d0217a9bc715686100a5328db75a15 upstream.
Commit 65c79230576 tried to clear the custom firmware path on exit by writing a single space to the firmware_class.path parameter. This doesn't work because nothing strips this space from the value stored and fw_get_filesystem_firmware() only ignores zero-length paths.
Instead, write a null byte.
--- tools/testing/selftests/firmware/fw_filesystem.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
tools/testing/selftests/firmware/fw_filesystem.sh +4 -2
@@ -46,9 +46,11 @@ test_finish() echo "$OLD_TIMEOUT" >/sys/class/firmware/timeout fi if [ "$OLD_FWPATH" = "" ]; then - OLD_FWPATH=" " + # A zero-length write won't work; write a null byte + printf '\000' >/sys/module/firmware_class/parameters/path + else + echo -n "$OLD_FWPATH" >/sys/module/firmware_class/parameters/path fi - echo -n "$OLD_FWPATH" >/sys/module/firmware_class/parameters/path rm -f "$FW" rmdir "$FWPATH" }
Greg Kroah-Hartman
maintainerPATCH 33/43 errseq: Always report a writeback error once
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox <[email protected]>
commit b4678df184b314a2bd47d2329feca2c2534aa12b upstream.
The errseq_t infrastructure assumes that errors which occurred before the file descriptor was opened are of no interest to the application. This turns out to be a regression for some applications, notably Postgres.
Before errseq_t, a writeback error would be reported exactly once (as long as the inode remained in memory), so Postgres could open a file, call fsync() and find out whether there had been a writeback error on that file from another process.
This patch changes the errseq infrastructure to report errors to all file descriptors which are opened after the error occurred, but before it was reported to any file descriptor. This restores the user-visible behaviour.
--- lib/errseq.c | 25 +++++++++++-------------- 1 file changed, 11 insertions(+), 14 deletions(-)
lib/errseq.c +11 -14
@@ -111,25 +111,22 @@ EXPORT_SYMBOL(errseq_set);* errseq_sample - grab current errseq_t value * @eseq: pointer to errseq_t to be sampled * -* This function allows callers to sample an errseq_t value, marking it as -* "seen" if required. +* This function allows callers to initialise their errseq_t variable. +* If the error has been "seen", new callers will not see an old error. +* If there is an unseen error in @eseq, the caller of this function will +* see it the next time it checks for an error. +* +* Context: Any context. +* Return: The current errseq value. */ errseq_t errseq_sample (errseq_t *eseq) {errseq_t old =READ_ONCE (*eseq); -errseq_t new = old; -/* -* For the common case of no errors ever having been set, we can skip -* marking the SEEN bit. Once an error has been set, the value will -* never go back to zero. -*/ -if (old !=0 ) { - new |=ERRSEQ_SEEN ; -if (old != new) -cmpxchg (eseq, old, new); - } -return new; +/* If nobody has seen this error yet, then we can be the first. */ +if (!(old &ERRSEQ_SEEN )) + old =0 ; +return old; }EXPORT_SYMBOL (errseq_sample);
Greg Kroah-Hartman
maintainerPATCH 34/43 USB: serial: visor: handle potential invalid device configuration
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 4842ed5bfcb9daf6660537d70503c18d38dbdbb8 upstream.
If we get an invalid device configuration from a palm 3 type device, we might incorrectly parse things, and we have the potential to crash in "interesting" ways.
Fix this up by verifying the size of the configuration passed to us by the device, and only if it is correct, will we handle it.
Note that this also fixes an information leak of slab data.
--- drivers/usb/serial/visor.c | 69 ++++++++++++++++++++++----------------------- 1 file changed, 35 insertions(+), 34 deletions(-)
drivers/usb/serial/visor.c +35 -34
@@ -338,47 +338,48 @@ static int palm_os_3_probe(struct usb_se goto exit; } -if (retval ==sizeof (*connection_info)) { - connection_info = (struct visor_connection_info *) - transfer_buffer; - - num_ports =le16_to_cpu (connection_info->num_ports); -for (i =0 ; i < num_ports; ++i) { -switch ( - connection_info->connections[i].port_function_id) { -case VISOR_FUNCTION_GENERIC : - string ="Generic" ; -break ; -case VISOR_FUNCTION_DEBUGGER : - string ="Debugger" ; -break ; -case VISOR_FUNCTION_HOTSYNC : - string ="HotSync" ; -break ; -case VISOR_FUNCTION_CONSOLE : - string ="Console" ; -break ; -case VISOR_FUNCTION_REMOTE_FILE_SYS : - string ="Remote File System" ; -break ; -default : - string ="unknown" ; -break ; - } -dev_info (dev,"%s: port %d, is for %s use\n" , - serial->type->description, - connection_info->connections[i].port, string); - } +if (retval !=sizeof (*connection_info)) { +dev_err (dev,"Invalid connection information received from device\n" ); + retval = -ENODEV ; + goto exit; } -/* -* Handle devices that report invalid stuff here. -*/ + + connection_info = (struct visor_connection_info *)transfer_buffer; + + num_ports =le16_to_cpu (connection_info->num_ports); + +/* Handle devices that report invalid stuff here. */ if (num_ports ==0 || num_ports >2 ) {dev_warn (dev,"%s: No valid connect info available\n" , serial->type->description); num_ports =2 ; } +for (i =0 ; i < num_ports; ++i) { +switch (connection_info->connections[i].port_function_id) { +case VISOR_FUNCTION_GENERIC : + string ="Generic" ; +break ; +case VISOR_FUNCTION_DEBUGGER : + string ="Debugger" ; +break ; +case VISOR_FUNCTION_HOTSYNC : + string ="HotSync" ; +break ; +case VISOR_FUNCTION_CONSOLE : + string ="Console" ; +break ; +case VISOR_FUNCTION_REMOTE_FILE_SYS : + string ="Remote File System" ; +break ; +default : + string ="unknown" ; +break ; + } +dev_info (dev,"%s: port %d, is for %s use\n" , + serial->type->description, + connection_info->connections[i].port, string); + }dev_info (dev,"%s: Number of ports: %d\n" , serial->type->description, num_ports);
Greg Kroah-Hartman
maintainerPATCH 35/43 usb: dwc3: gadget: Fix list_del corruption in dwc3_ep_dequeue
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mayank Rana <[email protected]>
commit 96bd39df29c29d348d65311e5954c0b7d3a2a790 upstream.
dwc3_ep_dequeue() waits for completion of End Transfer command using wait_event_lock_irq(), which will release the dwc3->lock while waiting and reacquire after completion. This allows a potential race condition with ep_disable() which also removes all requests from started_list and pending_list.
The check for NULL r->trb should catch this but currently it exits to the wrong 'out1' label which calls dwc3_gadget_giveback(). Since its list entry was already removed, if CONFIG_DEBUG_LIST is enabled a 'list_del corruption' bug is thrown since its next/prev pointers are already LIST_POISON1/2. If r->trb is NULL it should simply exit to 'out0'.
--- drivers/usb/dwc3/gadget.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/dwc3/gadget.c +1 -1
@@ -1444,7 +1444,7 @@ static int dwc3_gadget_ep_dequeue(struct dwc->lock);if (!r->trb) - goto out1; + goto out0;if (r->num_pending_sgs) {struct dwc3_trb *trb;
Greg Kroah-Hartman
maintainerPATCH 36/43 USB: Accept bulk endpoints with 1024-byte maxpacket
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit fb5ee84ea72c5f1b6cabdd1c9d6e8648995ca7c6 upstream.
Some non-compliant high-speed USB devices have bulk endpoints with a 1024-byte maxpacket size. Although such endpoints don't work with xHCI host controllers, they do work with EHCI controllers. We used to accept these invalid sizes (with a warning), but we no longer do because of an unintentional change introduced by commit aed9d65ac327 ("USB: validate wMaxPacketValue entries in endpoint descriptors").
This patch restores the old behavior, so that people with these peculiar devices can use them without patching their kernels by hand.
--- drivers/usb/core/config.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/core/config.c +3 -1
@@ -191,7 +191,9 @@ static const unsigned short full_speed_mstatic const unsigned short high_speed_maxpacket_maxes[4 ] = { [USB_ENDPOINT_XFER_CONTROL ] =64 , [USB_ENDPOINT_XFER_ISOC ] =1024 , - [USB_ENDPOINT_XFER_BULK ] =512 , + +/* Bulk should be 512, but some devices use 1024: we will warn below */ + [USB_ENDPOINT_XFER_BULK ] =1024 , [USB_ENDPOINT_XFER_INT ] =1024 , };static const unsigned short super_speed_maxpacket_maxes[4 ] = {
Greg Kroah-Hartman
maintainerPATCH 37/43 USB: serial: option: reimplement interface masking
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit c3a65808f04a8426481b63a4fbd9392f009f6330 upstream.
Reimplement interface masking using device flags stored directly in the device-id table. This will make it easier to add and maintain device-id entries by using a more compact and readable notation compared to the current implementation (which manages pairs of masks in separate blacklist structs).
Two convenience macros are used to flag an interface as either reserved or as not supporting modem-control requests:
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
.driver_info = NCTRL(0) | RSVD(3) },For now, we limit the highest maskable interface number to seven, which allows for (up to 16) additional device flags to be added later should need arise.
Note that this will likely need to be backported to stable in order to make future device-id backports more manageable.
--- drivers/usb/serial/option.c | 446 ++++++++++++++------------------------------ 1 file changed, 152 insertions(+), 294 deletions(-)
drivers/usb/serial/option.c +152 -294
@@ -551,151 +551,15 @@ static void option_instat_callback(struc#define WETELECOM_PRODUCT_6802 0x6802#define WETELECOM_PRODUCT_WMD300 0x6803 -struct option_blacklist_info { -/* bitmask of interface numbers blacklisted for send_setup */ -const unsigned long sendsetup; -/* bitmask of interface numbers that are reserved */ -const unsigned long reserved; -}; - -static const struct option_blacklist_info four_g_w14_blacklist = { - .sendsetup =BIT (0 ) |BIT (1 ), -}; - -static const struct option_blacklist_info four_g_w100_blacklist = { - .sendsetup =BIT (1 ) |BIT (2 ), - .reserved =BIT (3 ), -}; - -static const struct option_blacklist_info alcatel_x200_blacklist = { - .sendsetup =BIT (0 ) |BIT (1 ), - .reserved =BIT (4 ), -}; - -static const struct option_blacklist_info zte_0037_blacklist = { - .sendsetup =BIT (0 ) |BIT (1 ), -}; - -static const struct option_blacklist_info zte_k3765_z_blacklist = { - .sendsetup =BIT (0 ) |BIT (1 ) |BIT (2 ), - .reserved =BIT (4 ), -}; - -static const struct option_blacklist_info zte_ad3812_z_blacklist = { - .sendsetup =BIT (0 ) |BIT (1 ) |BIT (2 ), -}; - -static const struct option_blacklist_info zte_mc2718_z_blacklist = { - .sendsetup =BIT (1 ) |BIT (2 ) |BIT (3 ) |BIT (4 ), -}; - -static const struct option_blacklist_info zte_mc2716_z_blacklist = { - .sendsetup =BIT (1 ) |BIT (2 ) |BIT (3 ), -}; - -static const struct option_blacklist_info zte_me3620_mbim_blacklist = { - .reserved =BIT (2 ) |BIT (3 ) |BIT (4 ), -}; - -static const struct option_blacklist_info zte_me3620_xl_blacklist = { - .reserved =BIT (3 ) |BIT (4 ) |BIT (5 ), -}; - -static const struct option_blacklist_info zte_zm8620_x_blacklist = { - .reserved =BIT (3 ) |BIT (4 ) |BIT (5 ), -}; - -static const struct option_blacklist_info huawei_cdc12_blacklist = { - .reserved =BIT (1 ) |BIT (2 ), -}; - -static const struct option_blacklist_info net_intf0_blacklist = { - .reserved =BIT (0 ), -}; - -static const struct option_blacklist_info net_intf1_blacklist = { - .reserved =BIT (1 ), -}; - -static const struct option_blacklist_info net_intf2_blacklist = { - .reserved =BIT (2 ), -}; - -static const struct option_blacklist_info net_intf3_blacklist = { - .reserved =BIT (3 ), -}; - -static const struct option_blacklist_info net_intf4_blacklist = { - .reserved =BIT (4 ), -}; - -static const struct option_blacklist_info net_intf5_blacklist = { - .reserved =BIT (5 ), -}; - -static const struct option_blacklist_info net_intf6_blacklist = { - .reserved =BIT (6 ), -}; - -static const struct option_blacklist_info zte_mf626_blacklist = { - .sendsetup =BIT (0 ) |BIT (1 ), - .reserved =BIT (4 ), -}; - -static const struct option_blacklist_info zte_1255_blacklist = { - .reserved =BIT (3 ) |BIT (4 ), -}; - -static const struct option_blacklist_info simcom_sim7100e_blacklist = { - .reserved =BIT (5 ) |BIT (6 ), -}; - -static const struct option_blacklist_info telit_me910_blacklist = { - .sendsetup =BIT (0 ), - .reserved =BIT (1 ) |BIT (3 ), -}; - -static const struct option_blacklist_info telit_me910_dual_modem_blacklist = { - .sendsetup =BIT (0 ), - .reserved =BIT (3 ), -}; - -static const struct option_blacklist_info telit_le910_blacklist = { - .sendsetup =BIT (0 ), - .reserved =BIT (1 ) |BIT (2 ), -}; - -static const struct option_blacklist_info telit_le920_blacklist = { - .sendsetup =BIT (0 ), - .reserved =BIT (1 ) |BIT (5 ), -}; - -static const struct option_blacklist_info telit_le920a4_blacklist_1 = { - .sendsetup =BIT (0 ), - .reserved =BIT (1 ), -}; - -static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = { - .sendsetup =BIT (2 ), - .reserved =BIT (0 ) |BIT (1 ) |BIT (3 ), -}; -static const struct option_blacklist_info telit_le922_blacklist_usbcfg3 = { - .sendsetup =BIT (0 ), - .reserved =BIT (1 ) |BIT (2 ) |BIT (3 ), -}; +/* Device flags */ -static const struct option_blacklist_info cinterion_rmnet2_blacklist = { - .reserved =BIT (4 ) |BIT (5 ), -}; +/* Interface does not support modem-control requests */ +#define NCTRL (ifnum) ((BIT(ifnum) & 0xff) << 8) -static const struct option_blacklist_info yuga_clm920_nc5_blacklist = { - .reserved =BIT (1 ) |BIT (4 ), -}; +/* Interface is reserved */ +#define RSVD (ifnum) ((BIT(ifnum) & 0xff) << 0) -static const struct option_blacklist_info quectel_ep06_blacklist = { - .reserved =BIT (4 ) |BIT (5 ), -};static const struct usb_device_id option_ids[] = { {USB_DEVICE (OPTION_VENDOR_ID ,OPTION_PRODUCT_COLT ) },
@@ -729,26 +593,26 @@ static const struct usb_device_id option { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GKE) }, { USB_DEVICE(QUANTA_VENDOR_ID, QUANTA_PRODUCT_GLE) }, { USB_DEVICE(QUANTA_VENDOR_ID, 0xea42), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c05, USB_CLASS_COMM, 0x02, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c1f, USB_CLASS_COMM, 0x02, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1c23, USB_CLASS_COMM, 0x02, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t) &net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E173S6, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t) &net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_E1750, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t) &net_intf2_blacklist }, + .driver_info = RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1441, USB_CLASS_COMM, 0x02, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x1442, USB_CLASS_COMM, 0x02, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4505, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist }, + .driver_info = RSVD(1) | RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3765, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist }, + .driver_info = RSVD(1) | RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0x14ac, 0xff, 0xff, 0xff), /* Huawei E1820 */ - .driver_info = (kernel_ulong_t) &net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist }, + .driver_info = RSVD(1) | RSVD(2) }, { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0xff, 0xff) }, { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x01) }, { USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, 0xff, 0x01, 0x02) },
@@ -1193,67 +1057,67 @@ static const struct usb_device_id option { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) }, { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */ { USB_DEVICE_AND_INTERFACE_INFO(QUALCOMM_VENDOR_ID, 0x6001, 0xff, 0xff, 0xff), /* 4G LTE usb-modem U901 */ - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 *//* Quectel products using Qualcomm vendor ID */ { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)}, { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) },/* Yuga products use Qualcomm vendor ID */ { USB_DEVICE(QUALCOMM_VENDOR_ID, YUGA_PRODUCT_CLM920_NC5), - .driver_info = (kernel_ulong_t)&yuga_clm920_nc5_blacklist }, + .driver_info = RSVD(1) | RSVD(4) },/* Quectel products using Quectel vendor ID */ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06), - .driver_info = (kernel_ulong_t)&quectel_ep06_blacklist }, + .driver_info = RSVD(4) | RSVD(5) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003), - .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, + .driver_info = RSVD(0) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6004) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6005) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_628A) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHE_628S), - .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, + .driver_info = RSVD(0) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_301), - .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, + .driver_info = RSVD(0) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628), - .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, + .driver_info = RSVD(0) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628S) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_680) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_685A) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720S), - .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, + .driver_info = RSVD(0) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7002), - .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, + .driver_info = RSVD(0) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629K), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7004), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7005) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_629), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629S), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720I), - .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, + .driver_info = RSVD(0) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7212), - .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, + .driver_info = RSVD(0) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7213), - .driver_info = (kernel_ulong_t)&net_intf0_blacklist }, + .driver_info = RSVD(0) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7251), - .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7252), - .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7253), - .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864G) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_DUAL) },
@@ -1261,38 +1125,38 @@ static const struct usb_device_id option { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0), - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, + .driver_info = RSVD(0) | RSVD(1) | NCTRL(2) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG1), - .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG2), - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3), - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff), - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, + .driver_info = RSVD(0) | RSVD(1) | NCTRL(2) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), - .driver_info = (kernel_ulong_t)&telit_me910_blacklist }, + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), - .driver_info = (kernel_ulong_t)&telit_me910_dual_modem_blacklist }, + .driver_info = NCTRL(0) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), - .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), - .driver_info = (kernel_ulong_t)&telit_le920_blacklist }, + .driver_info = NCTRL(0) | RSVD(1) | RSVD(5) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1207) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1208), - .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 }, + .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1211), - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1212), - .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 }, + .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214), - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0003, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0004, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0005, 0xff, 0xff, 0xff) },
@@ -1308,58 +1172,58 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0010, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0011, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0012, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0013, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0016, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0017, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0018, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0019, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0020, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0021, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0022, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0023, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0024, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0025, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0028, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0029, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0030, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF626, 0xff, - 0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_mf626_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF626, 0xff, 0xff, 0xff), + .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0032, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0033, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0034, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0037, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&zte_0037_blacklist }, + .driver_info = NCTRL(0) | NCTRL(1) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0038, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0039, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0040, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0042, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0043, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0044, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0048, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0049, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0050, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0051, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0052, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0054, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0055, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0056, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0057, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0058, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0061, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0062, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0063, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0064, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0065, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0066, 0xff, 0xff, 0xff) },
@@ -1384,26 +1248,26 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0096, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0097, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0104, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0105, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0106, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0108, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0113, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0117, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0118, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0121, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0122, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0123, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0124, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0125, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + .driver_info = RSVD(6) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0126, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0128, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0135, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0136, 0xff, 0xff, 0xff) },
@@ -1419,50 +1283,50 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0155, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0156, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0159, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0164, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0165, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0167, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0189, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0191, 0xff, 0xff, 0xff), /* ZTE EuFi890 */ - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0196, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0197, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0199, 0xff, 0xff, 0xff), /* ZTE MF820S */ - .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0200, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0201, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0254, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0257, 0xff, 0xff, 0xff), /* ZTE MF821 */ - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0265, 0xff, 0xff, 0xff), /* ONDA MT8205 */ - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0284, 0xff, 0xff, 0xff), /* ZTE MF880 */ - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0317, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0326, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0330, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0395, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0412, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G */ - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0414, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0417, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1018, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1021, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + .driver_info = RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) },
@@ -1579,23 +1443,23 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1170, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1244, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1245, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1246, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1247, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1248, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1249, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1250, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1251, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1252, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1253, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1254, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1255, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&zte_1255_blacklist }, + .driver_info = RSVD(3) | RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1256, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1257, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1258, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1259, 0xff, 0xff, 0xff) },
@@ -1610,7 +1474,7 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1268, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1269, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1270, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1271, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1272, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1273, 0xff, 0xff, 0xff) },
@@ -1646,17 +1510,17 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1303, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1333, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1401, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + .driver_info = RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1402, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + .driver_info = RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1424, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + .driver_info = RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1425, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + .driver_info = RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff), /* ZTE MF91 */ - .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + .driver_info = RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G v2 */ - .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + .driver_info = RSVD(2) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
@@ -1674,8 +1538,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1596, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1598, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1600, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, - 0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, 0xff, 0xff), + .driver_info = NCTRL(0) | NCTRL(1) | NCTRL(2) | RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, /* ZTE CDMA products */
@@ -1686,20 +1550,20 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0094, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, + .driver_info = RSVD(1) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0168, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0170, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0176, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff42, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff43, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff44, 0xff, 0xff, 0xff) },
@@ -1851,19 +1715,19 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710T, 0xff, 0xff, 0xff) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2718, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&zte_mc2718_z_blacklist }, + .driver_info = NCTRL(1) | NCTRL(2) | NCTRL(3) | NCTRL(4) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AD3812, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist }, + .driver_info = NCTRL(0) | NCTRL(1) | NCTRL(2) }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff), - .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist }, + .driver_info = NCTRL(1) | NCTRL(2) | NCTRL(3) }, { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_L), - .driver_info = (kernel_ulong_t)&zte_me3620_xl_blacklist }, + .driver_info = RSVD(3) | RSVD(4) | RSVD(5) }, { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_MBIM), - .driver_info = (kernel_ulong_t)&zte_me3620_mbim_blacklist }, + .driver_info = RSVD(2) | RSVD(3) | RSVD(4) }, { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ME3620_X), - .driver_info = (kernel_ulong_t)&zte_me3620_xl_blacklist }, + .driver_info = RSVD(3) | RSVD(4) | RSVD(5) }, { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_ZM8620_X), - .driver_info = (kernel_ulong_t)&zte_zm8620_x_blacklist }, + .driver_info = RSVD(3) | RSVD(4) | RSVD(5) }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) }, { USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
@@ -1883,37 +1747,34 @@ static const struct usb_device_id option { USB_DEVICE(ALINK_VENDOR_ID, ALINK_PRODUCT_PH300) }, { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) }, { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E), - .driver_info = (kernel_ulong_t)&simcom_sim7100e_blacklist }, + .driver_info = RSVD(5) | RSVD(6) }, { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200), - .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist - }, + .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) }, { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D), - .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + .driver_info = RSVD(6) }, { USB_DEVICE(ALCATEL_VENDOR_ID, 0x0052), - .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + .driver_info = RSVD(6) }, { USB_DEVICE(ALCATEL_VENDOR_ID, 0x00b6), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE(ALCATEL_VENDOR_ID, 0x00b7), - .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + .driver_info = RSVD(5) }, { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L100V), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L800MA), - .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + .driver_info = RSVD(2) }, { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) }, { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) }, { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14), - .driver_info = (kernel_ulong_t)&four_g_w14_blacklist - }, + .driver_info = NCTRL(0) | NCTRL(1) }, { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W100), - .driver_info = (kernel_ulong_t)&four_g_w100_blacklist - }, + .driver_info = NCTRL(1) | NCTRL(2) | RSVD(3) }, {USB_DEVICE(LONGCHEER_VENDOR_ID, FUJISOFT_PRODUCT_FS040U), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist}, + .driver_info = RSVD(3)}, { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) }, { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, 0x9801, 0xff), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + .driver_info = RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, 0x9803, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
@@ -1939,14 +1800,14 @@ static const struct usb_device_id option { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_E) }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EU3_P) }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX, 0xff) }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_2RMNET, 0xff), - .driver_info = (kernel_ulong_t)&cinterion_rmnet2_blacklist }, + .driver_info = RSVD(4) | RSVD(5) }, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_AUDIO, 0xff), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_2RMNET, 0xff) }, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_AUDIO, 0xff) }, { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
@@ -1956,20 +1817,20 @@ static const struct usb_device_id option { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */ { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD140), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD155), - .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + .driver_info = RSVD(6) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200), - .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + .driver_info = RSVD(6) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD160), - .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, + .driver_info = RSVD(6) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */ { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/ { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
@@ -2046,9 +1907,9 @@ static const struct usb_device_id option { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) }, { USB_DEVICE_AND_INTERFACE_INFO(TPLINK_VENDOR_ID, TPLINK_PRODUCT_LTE, 0xff, 0x00, 0x00) }, /* TP-Link LTE Module */ { USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(TPLINK_VENDOR_ID, 0x9000), /* TP-Link MA260 */ - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(CHANGHONG_VENDOR_ID, CHANGHONG_PRODUCT_CH690) }, { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d01, 0xff) }, /* D-Link DWM-156 (variant) */ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d02, 0xff) },
@@ -2056,9 +1917,9 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) }, /* D-Link DWM-158 */ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d0e, 0xff) }, /* D-Link DWM-157 C1 */ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */ - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */ - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
@@ -2118,7 +1979,7 @@ static int option_probe(struct usb_seriastruct usb_interface_descriptor *iface_desc = &serial->interface->cur_altsetting->desc;struct usb_device_descriptor *dev_desc = &serial->dev->descriptor; -const struct option_blacklist_info *blacklist; +unsigned long device_flags = id->driver_info;/* Never bind to the CD-Rom emulation interface */ if (iface_desc->bInterfaceClass ==0x08 )
@@ -2129,9 +1990,7 @@ static int option_probe(struct usb_seria* the same class/subclass/protocol as the serial interfaces. Look at * the Windows driver .INF files for reserved interface numbers. */ - blacklist = (void *)id->driver_info; -if (blacklist &&test_bit (iface_desc->bInterfaceNumber, - &blacklist->reserved)) +if (device_flags &RSVD (iface_desc->bInterfaceNumber))return -ENODEV ;/* * Don't bind network interface on Samsung GT-B3730, it is handled by
@@ -2142,8 +2001,8 @@ static int option_probe(struct usb_seria iface_desc->bInterfaceClass != USB_CLASS_CDC_DATA) return -ENODEV; -/* Store the blacklist info so we can use it during attach. */ -usb_set_serial_data (serial, (void *)blacklist); +/* Store the device flags so we can use them during attach. */ +usb_set_serial_data (serial, (void *)device_flags);return 0 ; }
@@ -2151,22 +2010,21 @@ static int option_probe(struct usb_seriastatic int option_attach (struct usb_serial *serial) {struct usb_interface_descriptor *iface_desc; -const struct option_blacklist_info *blacklist;struct usb_wwan_intf_private *data; +unsigned long device_flags; data =kzalloc (sizeof (struct usb_wwan_intf_private ),GFP_KERNEL );if (!data)return -ENOMEM ; -/* Retrieve blacklist info stored at probe. */ - blacklist =usb_get_serial_data (serial); +/* Retrieve device flags stored at probe. */ + device_flags = (unsigned long )usb_get_serial_data (serial); iface_desc = &serial->interface->cur_altsetting->desc; -if (!blacklist || !test_bit (iface_desc->bInterfaceNumber, - &blacklist->sendsetup)) { +if (!(device_flags &NCTRL (iface_desc->bInterfaceNumber))) data->use_send_setup =1 ; - } +spin_lock_init (&data->susp_lock);usb_set_serial_data (serial, data);
Greg Kroah-Hartman
maintainerPATCH 38/43 USB: serial: option: adding support for ublox R410M
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: SZ Lin (林上智) <[email protected]>
commit 4205cb01f6e9ef2ae6daa7be4e8ac1edeb4c9d64 upstream.
This patch adds support for ublox R410M PID 0x90b2 USB modem to option driver, this module supports LTE Cat M1 / NB1.
Interface layout:
0: QCDM/DIAG
1: ADB
2: AT
3: RMNET
--- drivers/usb/serial/option.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/serial/option.c +5 -0
@@ -236,6 +236,8 @@ static void option_instat_callback(struc/* These Quectel products use Qualcomm's vendor ID */ #define QUECTEL_PRODUCT_UC20 0x9003#define QUECTEL_PRODUCT_UC15 0x9090 +/* These u-blox products use Qualcomm's vendor ID */ +#define UBLOX_PRODUCT_R410M 0x90b2/* These Yuga products use Qualcomm's vendor ID */ #define YUGA_PRODUCT_CLM920_NC5 0x9625
@@ -1068,6 +1070,9 @@ static const struct usb_device_id option/* Yuga products use Qualcomm vendor ID */ { USB_DEVICE(QUALCOMM_VENDOR_ID, YUGA_PRODUCT_CLM920_NC5), .driver_info = RSVD(1) | RSVD(4) }, + /* u-blox products using Qualcomm vendor ID */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R410M), + .driver_info = RSVD(1) | RSVD(3) }, /* Quectel products using Quectel vendor ID */ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21), .driver_info = RSVD(4) },
Greg Kroah-Hartman
maintainerPATCH 39/43 usb: musb: host: fix potential NULL pointer dereference
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bin Liu <[email protected]>
commit 2b63f1329df2cd814c1f8353fae4853ace6521d1 upstream.
musb_start_urb() doesn't check the pass-in parameter if it is NULL. But in musb_bulk_nak_timeout() the parameter passed to musb_start_urb() is returned from first_qh(), which could be NULL.
So wrap the musb_start_urb() call here with a if condition check to avoid the potential NULL pointer dereference.
--- drivers/usb/musb/musb_host.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/musb/musb_host.c +3 -1
@@ -1023,7 +1023,9 @@ static void musb_bulk_nak_timeout(struct/* set tx_reinit and schedule the next qh */ ep->tx_reinit =1 ; } -musb_start_urb (musb, is_in, next_qh); + +if (next_qh) +musb_start_urb (musb, is_in, next_qh); } }
Greg Kroah-Hartman
maintainerPATCH 40/43 usb: musb: trace: fix NULL pointer dereference in musb_g_tx()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bin Liu <[email protected]>
commit 9aea9b6cc78d2b99b23d84fb2e0bc6e464c6569e upstream.
The usb_request pointer could be NULL in musb_g_tx(), where the tracepoint call would trigger the NULL pointer dereference failure when parsing the members of the usb_request pointer.
Move the tracepoint call to where the usb_request pointer is already checked to solve the issue.
--- drivers/usb/musb/musb_gadget.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/musb/musb_gadget.c +2 -1
@@ -442,7 +442,6 @@ void musb_g_tx(struct musb *musb, u8 epn req =next_request (musb_ep); request = &req->request; -trace_musb_req_tx (req); csr =musb_readw (epio,MUSB_TXCSR );musb_dbg (musb,"<== %s, txcsr %04x" , musb_ep->end_point.name, csr);
@@ -481,6 +480,8 @@ void musb_g_tx(struct musb *musb, u8 epnu8 is_dma =0 ;bool short_packet = false; +trace_musb_req_tx (req); +if (dma && (csr &MUSB_TXCSR_DMAENAB )) { is_dma =1 ; csr |=MUSB_TXCSR_P_WZC_BITS ;
Greg Kroah-Hartman
maintainerPATCH 41/43 platform/x86: asus-wireless: Fix NULL pointer dereference
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: João Paulo Rechi Vita <[email protected]>
commit 9f0a93de9139c2b0a59299cd36b61564522458f8 upstream.
When the module is removed the led workqueue is destroyed in the remove callback, before the led device is unregistered from the led subsystem.
This leads to a NULL pointer derefence when the led device is unregistered automatically later as part of the module removal cleanup. Bellow is the backtrace showing the problem.
BUG: unable to handle kernel NULL pointer dereference at (null) IP: __queue_work+0x8c/0x410 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI Modules linked in: ccm edac_mce_amd kvm_amd kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 joydev crypto_simd asus_nb_wmi glue_helper uvcvideo snd_hda_codec_conexant snd_hda_codec_generic snd_hda_codec_hdmi snd_hda_intel asus_wmi snd_hda_codec cryptd snd_hda_core sparse_keymap videobuf2_vmalloc arc4 videobuf2_memops snd_hwdep input_leds videobuf2_v4l2 ath9k psmouse videobuf2_core videodev ath9k_common snd_pcm ath9k_hw media fam15h_power ath k10temp snd_timer mac80211 i2c_piix4 r8169 mii mac_hid cfg80211 asus_wireless(-) snd soundcore wmi shpchp 8250_dw ip_tables x_tables amdkfd amd_iommu_v2 amdgpu radeon chash i2c_algo_bit drm_kms_helper syscopyarea serio_raw sysfillrect sysimgblt fb_sys_fops ahci ttm libahci drm video CPU: 3 PID: 2177 Comm: rmmod Not tainted 4.15.0-5-generic #6+dev94.b4287e5bem1-Endless Hardware name: ASUSTeK COMPUTER INC. X555DG/X555DG, BIOS 5.011 05/05/2015 RIP: 0010:__queue_work+0x8c/0x410 RSP: 0018:ffffbe8cc249fcd8 EFLAGS: 00010086 RAX: ffff992ac6810800 RBX: 0000000000000000 RCX: 0000000000000008 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff992ac6400e18 RBP: ffffbe8cc249fd18 R08: ffff992ac6400db0 R09: 0000000000000000 R10: 0000000000000040 R11: ffff992ac6400dd8 R12: 0000000000002000 R13: ffff992abd762e00 R14: ffff992abd763e38 R15: 000000000001ebe0 FS: 00007f318203e700(0000) GS:ffff992aced80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000001c720e000 CR4: 00000000001406e0 Call Trace: queue_work_on+0x38/0x40 led_state_set+0x2c/0x40 [asus_wireless] led_set_brightness_nopm+0x14/0x40 led_set_brightness+0x37/0x60 led_trigger_set+0xfc/0x1d0 led_classdev_unregister+0x32/0xd0 devm_led_classdev_release+0x11/0x20 release_nodes+0x109/0x1f0 devres_release_all+0x3c/0x50 device_release_driver_internal+0x16d/0x220 driver_detach+0x3f/0x80 bus_remove_driver+0x55/0xd0 driver_unregister+0x2c/0x40 acpi_bus_unregister_driver+0x15/0x20 asus_wireless_driver_exit+0x10/0xb7c [asus_wireless] SyS_delete_module+0x1da/0x2b0 entry_SYSCALL_64_fastpath+0x24/0x87 RIP: 0033:0x7f3181b65fd7 RSP: 002b:00007ffe74bcbe18 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3181b65fd7 RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000555ea2559258 RBP: 0000555ea25591f0 R08: 00007ffe74bcad91 R09: 000000000000000a R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000003 R13: 00007ffe74bcae00 R14: 0000000000000000 R15: 0000555ea25591f0 Code: 01 00 00 02 0f 85 7d 01 00 00 48 63 45 d4 48 c7 c6 00 f4 fa 87 49 8b 9d 08 01 00 00 48 03 1c c6 4c 89 f7 e8 87 fb ff ff 48 85 c0 <48> 8b 3b 0f 84 c5 01 00 00 48 39 f8 0f 84 bc 01 00 00 48 89 c7 RIP: __queue_work+0x8c/0x410 RSP: ffffbe8cc249fcd8 CR2: 0000000000000000 ---[ end trace 7aa4f4a232e9c39c ]---
Unregistering the led device on the remove callback before destroying the workqueue avoids this problem.
https://bugzilla.kernel.org/show_bug.cgi?id=196097
--- drivers/platform/x86/asus-wireless.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/platform/x86/asus-wireless.c +3 -1
@@ -178,8 +178,10 @@ static int asus_wireless_remove(struct a {struct asus_wireless_data *data =acpi_driver_data (adev); -if (data->wq) +if (data->wq) { +devm_led_classdev_unregister (&adev->dev, &data->led);destroy_workqueue (data->wq); + }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 42/43 irqchip/qcom: Fix check for spurious interrupts
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Agustin Vega-Frias <[email protected]>
commit 1bc2463cee92ef0e2034c813d5e511adeb58b5fd upstream.
When the interrupts for a combiner span multiple registers it must be checked if any interrupts have been asserted on each register before checking for spurious interrupts.
Checking each register seperately leads to false positive warnings.
[ tglx: Massaged changelog ]
--- drivers/irqchip/qcom-irq-combiner.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/irqchip/qcom-irq-combiner.c +2 -2
@@ -1,4 +1,4 @@ -/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved. +/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and
@@ -68,7 +68,7 @@ static void combiner_handle_irq(struct i bit =readl_relaxed (combiner->regs[reg].addr); status = bit & combiner->regs[reg].enabled; -if (!status) +if (bit && !status) pr_warn_ratelimited("Unexpected IRQ on CPU%d: (%08x %08lx %p)\n", smp_processor_id(), bit, combiner->regs[reg].enabled,
Greg Kroah-Hartman
maintainerPATCH 43/43 tracing: Fix bad use of igrab in trace_uprobe.c
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Song Liu <[email protected]>
commit 0c92c7a3c5d416f47b32c5f20a611dfeca5d5f2e upstream.
As Miklos reported and suggested:
This pattern repeats two times in trace_uprobe.c and in kernel/events/core.c as well:
ret = kern_path(filename, LOOKUP_FOLLOW, &path);
if (ret)
goto fail_address_parse;
inode = igrab(d_inode(path.dentry));
path_put(&path); And it's wrong. You can only hold a reference to the inode if you have an active ref to the superblock as well (which is normally through path.mnt) or holding s_umount.
This way unmounting the containing filesystem while the tracepoint is active will give you the "VFS: Busy inodes after unmount..." message and a crash when the inode is finally put.
Solution: store path instead of inode.
This patch fixes two instances in trace_uprobe.c. struct path is added to struct trace_uprobe to keep the inode and containing mount point referenced.
--- kernel/trace/trace_uprobe.c | 24 ++++++++++-------------- 1 file changed, 10 insertions(+), 14 deletions(-)
kernel/trace/trace_uprobe.c +10 -14
@@ -55,6 +55,7 @@ struct trace_uprobe {struct list_head list;struct trace_uprobe_filter filter;struct uprobe_consumer consumer; +struct path path;struct inode *inode;char *filename;unsigned long offset;
@@ -287,7 +288,7 @@ static void free_trace_uprobe(struct trafor (i =0 ; i < tu->tp.nr_args; i++)traceprobe_free_probe_arg (&tu->tp.args[i]); -iput (tu->inode); +path_put (&tu->path);kfree (tu->tp.call.class->system);kfree (tu->tp.call.name);kfree (tu->filename);
@@ -361,7 +362,6 @@ end:static int create_trace_uprobe (int argc,char **argv) {struct trace_uprobe *tu; -struct inode *inode;char *arg, *event, *group, *filename;char buf[MAX_EVENT_NAME_LEN ];struct path path;
@@ -369,7 +369,6 @@ static int create_trace_uprobe(int argc,bool is_delete, is_return;int i, ret; - inode =NULL ; ret =0 ; is_delete = false; is_return = false;
@@ -435,21 +434,16 @@ static int create_trace_uprobe(int argc, }/* Find the last occurrence, in case the path contains ':' too. */ arg =strrchr (argv[1 ],':' ); -if (!arg) { - ret = -EINVAL ; - goto fail_address_parse; - } +if (!arg) +return -EINVAL ; *arg++ ='\0' ; filename = argv[1 ]; ret =kern_path (filename,LOOKUP_FOLLOW , &path);if (ret) - goto fail_address_parse; - - inode =igrab (d_inode (path.dentry)); -path_put (&path); +return ret; -if (!inode || !S_ISREG (inode->i_mode)) { +if (!d_is_reg (path.dentry)) { ret = -EINVAL ; goto fail_address_parse; }
@@ -488,7 +482,7 @@ static int create_trace_uprobe(int argc, goto fail_address_parse; } tu->offset = offset; - tu->inode = inode; + tu->path = path; tu->filename =kstrdup (filename,GFP_KERNEL );if (!tu->filename) {
@@ -556,7 +550,7 @@ error:return ret; fail_address_parse: -iput (inode); +path_put (&path);pr_info ("Failed to parse address or file.\n" );
@@ -935,6 +929,7 @@ probe_event_enable(struct trace_uprobe * goto err_flags; tu->consumer.filter = filter; + tu->inode =d_real_inode (tu->path.dentry); ret =uprobe_register (tu->inode, tu->offset, &tu->consumer);if (ret) goto err_buffer;
@@ -980,6 +975,7 @@ probe_event_disable(struct trace_uprobeWARN_ON (!uprobe_filter_is_empty (&tu->filter));uprobe_unregister (tu->inode, tu->offset, &tu->consumer); + tu->inode =NULL ; tu->tp.flags &= file ? ~TP_FLAG_TRACE : ~TP_FLAG_PROFILE ;uprobe_buffer_disable ();
stable-rc/linux-4.14.y boot: 114 boots: 2 failed, 104 passed with 5 offline, 3 conflicts (v4.14.39-44-gc5a9c8283a69)
stable-rc/linux-4.14.y boot: 114 boots: 2 failed, 104 passed with 5 offline, 3 conflicts (v4.14.39-44-gc5a9c8283a69)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.14.y/kernel/v4.14.39-44-gc5a9c8283a69/
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.14.y/kernel/v4.14.39-44-gc5a9c8283a69/
Tree: stable-rc
Branch: linux-4.14.y
Git Describe: v4.14.39-44-gc5a9c8283a69
Git Commit: c5a9c8283a6928d22ddc589157213f4f331fca76
Git URL: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 56 unique boards, 23 SoC families, 15 builds out of 185
Boot Regressions Detected:
arm:
multi_v7_defconfig:
am335x-boneblack:
lab-collabora: new failure (last pass: v4.14.39-4-g5ce1e4d96025)
tegra_defconfig:
tegra124-jetson-tk1:
lab-mhart: new failure (last pass: v4.14.39-4-g5ce1e4d96025)arm64:
defconfig:
apq8016-sbc:
lab-mhart: new failure (last pass: v4.14.39-4-g5ce1e4d96025)
meson-gxl-s905x-khadas-vim:
lab-baylibre: failing since 12 days (last pass: v4.14.26-140-g2a1700a4929f - first fail: v4.14.36-184-g3cd53e436ee2)x86:
x86_64_defconfig:
x86-atom330:
lab-mhart: new failure (last pass: v4.14.39-4-g5ce1e4d96025)Boot Failures Detected:
arm64:
defconfig
apq8016-sbc: 1 failed labx86:
x86_64_defconfig
x86-atom330: 1 failed labOffline Platforms:
arm:
multi_v7_defconfig:
qcom-apq8064-cm-qs600: 1 offline lab
qcom-apq8064-ifc6410: 1 offline lab
qcom_defconfig:
qcom-apq8064-cm-qs600: 1 offline lab
qcom-apq8064-ifc6410: 1 offline labarm64:
defconfig:
apq8016-sbc: 1 offline labConflicting Boot Failures Detected: (These likely are not failures as other labs are reporting PASS. Needs review.)
arm:
tegra_defconfig:
tegra124-jetson-tk1:
lab-collabora: PASS
lab-mhart: FAIL
lab-baylibre-seattle: PASS
multi_v7_defconfig:
am335x-boneblack:
lab-collabora: FAIL
lab-baylibre-seattle: PASSarm64:
defconfig:
meson-gxl-s905x-khadas-vim:
lab-baylibre-seattle: PASS
lab-baylibre: FAIL---
For more info write to <[email protected]>
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.40 release. There are 43 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 10 07:39:32 UTC 2018. Anything received after that time might be too late.
Build results:
total: 146 pass: 146 fail: 0 Qemu test results: total: 141 pass: 141 fail: 0
Details are available at http://kerneltests.org/builders/.
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.40 release. There are 43 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 10 07:39:32 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.40-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm and x86_64.
Summary
------------------------------------------------------------------------
kernel: 4.9.99-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.9.y
git commit: 6e28bacfe4aa523ece3838a9d50e7612d41be723
git describe: v4.9.98-33-g6e28bacfe4aa
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.9-oe/build/v4.9.98-33-g6e28bacfe4aa
No regressions (compared to build v4.9.98-8-g5918d4b6b7ff)
Boards, architectures and test suites:
-------------------------------------
dragonboard-410c
* boot - pass: 20
* kselftest - skip: 32, pass: 34
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 6, pass: 57
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - skip: 1, pass: 21
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - pass: 14
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 135, pass: 1015
* ltp-timers-tests - pass: 13
hi6220-hikey - arm64
* boot - pass: 20
* kselftest - skip: 29, pass: 36
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 6, pass: 57
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - skip: 1, pass: 21
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 4, pass: 10
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 136, pass: 1014
* ltp-timers-tests - pass: 13
juno-r2 - arm64
* boot - pass: 20
* kselftest - skip: 29, pass: 37
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 6, pass: 57
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - pass: 22
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 4, pass: 10
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 135, pass: 1015
* ltp-timers-tests - pass: 13
qemu_arm
* boot - fail: 12, pass: 8
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 18, pass: 63
* ltp-fcntl-locktests-tests - pass: 2
* ltp-hugetlb-tests - skip: 1, pass: 21
* ltp-ipc-tests - pass: 9
* ltp-pty-tests - pass: 4
* ltp-syscalls-tests - skip: 92, fail: 3, pass: 1055
qemu_arm64
* boot - pass: 20
* kselftest - skip: 33, pass: 35
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 6, pass: 57
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - pass: 22
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 6, pass: 8
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 157, fail: 2, pass: 991
* ltp-timers-tests - pass: 13
qemu_x86_64
* boot - pass: 22
* kselftest - skip: 33, pass: 47
* kselftest-vsyscall-mode-native - skip: 33, pass: 47
* kselftest-vsyscall-mode-none - skip: 33, pass: 47
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 6, pass: 57
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - pass: 22
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 1, pass: 13
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 152, pass: 998
* ltp-timers-tests - pass: 13
x15 - arm
* boot - pass: 20
* kselftest - skip: 29, pass: 36
* libhugetlbfs - skip: 1, pass: 87
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 18, pass: 63
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 5, pass: 58
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - skip: 2, pass: 20
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 1, pass: 13
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 75, pass: 1075
* ltp-timers-tests - pass: 13
x86_64
* boot - pass: 22
* kselftest - skip: 30, pass: 50
* kselftest-vsyscall-mode-native - skip: 30, fail: 1, pass: 49
* kselftest-vsyscall-mode-none - skip: 30, pass: 50
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 5, pass: 58
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 1
* ltp-hugetlb-tests - pass: 22
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 5, pass: 9
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 116, pass: 1034
* ltp-timers-tests - pass: 13
Signature · 2 lines
Linaro QA (BETA) https://qa-reports.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.40 release. There are 43 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 10 07:39:32 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.40-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm and x86_64.
Summary
------------------------------------------------------------------------
kernel: 4.14.40-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.14.y
git commit: c5a9c8283a6928d22ddc589157213f4f331fca76
git describe: v4.14.39-44-gc5a9c8283a69
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.14-oe/build/v4.14.39-44-gc5a9c8283a69
No regressions (compared to build v4.14.39-4-g5ce1e4d96025)
------------------------------------------------------------------------
Boards, architectures and test suites:
-------------------------------------
dragonboard-410c
* boot - fail: 4, pass: 20
* kselftest - skip: 27, pass: 41
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 6, pass: 57
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - skip: 1, pass: 21
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - pass: 14
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 134, pass: 1016
* ltp-timers-tests - pass: 13
hi6220-hikey - arm64
* boot - pass: 20
* kselftest - skip: 24, pass: 44
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 6, pass: 57
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - skip: 1, pass: 21
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 4, pass: 10
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 135, pass: 1015
* ltp-timers-tests - pass: 13
juno-r2 - arm64
* boot - pass: 20
* kselftest - skip: 25, pass: 43
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 6, pass: 57
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - pass: 22
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 4, pass: 10
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 134, pass: 1016
* ltp-timers-tests - pass: 13
qemu_arm
* boot - fail: 7, pass: 13
* ltp-cap_bounds-tests - pass: 2
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 5, pass: 58
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - skip: 1, pass: 21
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 7, pass: 7
* ltp-securebits-tests - pass: 4
qemu_arm64
* boot - pass: 20
* kselftest - skip: 29, pass: 41
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - pass: 22
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 6, pass: 8
* ltp-securebits-tests - pass: 4
* ltp-timers-tests - pass: 13
qemu_x86_64
* boot - pass: 20
* kselftest - skip: 30, pass: 50
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 6, pass: 57
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - pass: 22
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 1, pass: 13
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 153, pass: 997
* ltp-timers-tests - pass: 13
x15 - arm
* boot - pass: 20
* kselftest - skip: 26, fail: 2, pass: 37
* libhugetlbfs - skip: 1, pass: 87
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 18, pass: 63
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 5, pass: 58
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - skip: 2, pass: 20
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 1, pass: 13
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 75, pass: 1075
* ltp-timers-tests - pass: 13
x86_64
* boot - pass: 22
* kselftest - skip: 22, pass: 54
* kselftest-vsyscall-mode-native - skip: 25, fail: 1, pass: 53
* kselftest-vsyscall-mode-none - skip: 25, pass: 54
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 5, pass: 58
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - pass: 22
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 5, pass: 9
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 116, pass: 1034
* ltp-timers-tests - pass: 13
Signature · 3 lines
Linaro QA (BETA) https://qa-reports.linaro.org _______________________
Quoted 15 lines · Naresh Kamboju
Quoted 14 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.40 release. There are 43 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 10 07:39:32 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.40-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.
Quoted 3 lines
Quoted 3 lines
thanks,
greg k-h
Please ignore 4.9 results summary in this thread.
- Naresh
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.40 release. There are 43 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 10 07:39:32 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.40-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Merged, compiled, and installed onto my Raspberry Pi 3.
No issues during initial usage or in dmesg.
Thanks!
Nathan
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.40 release. There are 43 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 10 07:39:32 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.40-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Greg Kroah-Hartman
maintainerQuoted 15 lines · Nathan Chancellor
Quoted 14 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.40 release. There are 43 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu May 10 07:39:32 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.40-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.
Quoted 8 lines
Quoted 4 lines
thanks,
greg k-h
Merged, compiled, and installed onto my Raspberry Pi 3.
No issues during initial usage or in dmesg.
Thanks for testing and letting me know.
greg k-h