Skip to content

Commit c70638a

Browse files
popcornmixpopcornmix
committed
Merge remote-tracking branch 'stable/linux-6.12.y' into rpi-6.12.y
2 parents 31470f8 + a9152eb commit c70638a

File tree

12 files changed

+86
-42
lines changed

12 files changed

+86
-42
lines changed

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# SPDX-License-Identifier: GPL-2.0
22
VERSION = 6
33
PATCHLEVEL = 12
4-
SUBLEVEL = 50
4+
SUBLEVEL = 51
55
EXTRAVERSION =
66
NAME = Baby Opossum Posse
77

‎drivers/media/pci/b2c2/flexcop-pci.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -411,7 +411,7 @@ static void flexcop_pci_remove(struct pci_dev *pdev)
411411
struct flexcop_pci *fc_pci = pci_get_drvdata(pdev);
412412

413413
if (irq_chk_intv > 0)
414-
cancel_delayed_work(&fc_pci->irq_check_work);
414+
cancel_delayed_work_sync(&fc_pci->irq_check_work);
415415

416416
flexcop_pci_dma_exit(fc_pci);
417417
flexcop_device_exit(fc_pci->fc_dev);

‎drivers/media/rc/imon.c‎

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -536,7 +536,9 @@ static int display_open(struct inode *inode, struct file *file)
536536

537537
mutex_lock(&ictx->lock);
538538

539-
if (!ictx->display_supported) {
539+
if (ictx->disconnected) {
540+
retval = -ENODEV;
541+
} else if (!ictx->display_supported) {
540542
pr_err("display not supported by device\n");
541543
retval = -ENODEV;
542544
} else if (ictx->display_isopen) {
@@ -598,6 +600,9 @@ static int send_packet(struct imon_context *ictx)
598600
int retval = 0;
599601
struct usb_ctrlrequest *control_req = NULL;
600602

603+
if (ictx->disconnected)
604+
return -ENODEV;
605+
601606
/* Check if we need to use control or interrupt urb */
602607
if (!ictx->tx_control) {
603608
pipe = usb_sndintpipe(ictx->usbdev_intf0,
@@ -949,12 +954,14 @@ static ssize_t vfd_write(struct file *file, const char __user *buf,
949954
static const unsigned char vfd_packet6[] = {
950955
0x01, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF };
951956

952-
if (ictx->disconnected)
953-
return -ENODEV;
954-
955957
if (mutex_lock_interruptible(&ictx->lock))
956958
return -ERESTARTSYS;
957959

960+
if (ictx->disconnected) {
961+
retval = -ENODEV;
962+
goto exit;
963+
}
964+
958965
if (!ictx->dev_present_intf0) {
959966
pr_err_ratelimited("no iMON device present\n");
960967
retval = -ENODEV;
@@ -1029,11 +1036,13 @@ static ssize_t lcd_write(struct file *file, const char __user *buf,
10291036
int retval = 0;
10301037
struct imon_context *ictx = file->private_data;
10311038

1032-
if (ictx->disconnected)
1033-
return -ENODEV;
1034-
10351039
mutex_lock(&ictx->lock);
10361040

1041+
if (ictx->disconnected) {
1042+
retval = -ENODEV;
1043+
goto exit;
1044+
}
1045+
10371046
if (!ictx->display_supported) {
10381047
pr_err_ratelimited("no iMON display present\n");
10391048
retval = -ENODEV;
@@ -2499,7 +2508,11 @@ static void imon_disconnect(struct usb_interface *interface)
24992508
int ifnum;
25002509

25012510
ictx = usb_get_intfdata(interface);
2511+
2512+
mutex_lock(&ictx->lock);
25022513
ictx->disconnected = true;
2514+
mutex_unlock(&ictx->lock);
2515+
25032516
dev = ictx->dev;
25042517
ifnum = interface->cur_altsetting->desc.bInterfaceNumber;
25052518

‎drivers/media/tuners/xc5000.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1304,7 +1304,7 @@ static void xc5000_release(struct dvb_frontend *fe)
13041304
mutex_lock(&xc5000_list_mutex);
13051305

13061306
if (priv) {
1307-
cancel_delayed_work(&priv->timer_sleep);
1307+
cancel_delayed_work_sync(&priv->timer_sleep);
13081308
hybrid_tuner_release_state(priv);
13091309
}
13101310

‎drivers/media/usb/uvc/uvc_driver.c‎

Lines changed: 46 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,9 @@ struct uvc_entity *uvc_entity_by_id(struct uvc_device *dev, int id)
135135
{
136136
struct uvc_entity *entity;
137137

138+
if (id == UVC_INVALID_ENTITY_ID)
139+
return NULL;
140+
138141
list_for_each_entry(entity, &dev->entities, list) {
139142
if (entity->id == id)
140143
return entity;
@@ -778,14 +781,27 @@ static const u8 uvc_media_transport_input_guid[16] =
778781
UVC_GUID_UVC_MEDIA_TRANSPORT_INPUT;
779782
static const u8 uvc_processing_guid[16] = UVC_GUID_UVC_PROCESSING;
780783

781-
static struct uvc_entity *uvc_alloc_entity(u16 type, u16 id,
782-
unsigned int num_pads, unsigned int extra_size)
784+
static struct uvc_entity *uvc_alloc_new_entity(struct uvc_device *dev, u16 type,
785+
u16 id, unsigned int num_pads,
786+
unsigned int extra_size)
783787
{
784788
struct uvc_entity *entity;
785789
unsigned int num_inputs;
786790
unsigned int size;
787791
unsigned int i;
788792

793+
/* Per UVC 1.1+ spec 3.7.2, the ID should be non-zero. */
794+
if (id == 0) {
795+
dev_err(&dev->intf->dev, "Found Unit with invalid ID 0\n");
796+
id = UVC_INVALID_ENTITY_ID;
797+
}
798+
799+
/* Per UVC 1.1+ spec 3.7.2, the ID is unique. */
800+
if (uvc_entity_by_id(dev, id)) {
801+
dev_err(&dev->intf->dev, "Found multiple Units with ID %u\n", id);
802+
id = UVC_INVALID_ENTITY_ID;
803+
}
804+
789805
extra_size = roundup(extra_size, sizeof(*entity->pads));
790806
if (num_pads)
791807
num_inputs = type & UVC_TERM_OUTPUT ? num_pads : num_pads - 1;
@@ -795,7 +811,7 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u16 id,
795811
+ num_inputs;
796812
entity = kzalloc(size, GFP_KERNEL);
797813
if (entity == NULL)
798-
return NULL;
814+
return ERR_PTR(-ENOMEM);
799815

800816
entity->id = id;
801817
entity->type = type;
@@ -907,10 +923,10 @@ static int uvc_parse_vendor_control(struct uvc_device *dev,
907923
break;
908924
}
909925

910-
unit = uvc_alloc_entity(UVC_VC_EXTENSION_UNIT, buffer[3],
911-
p + 1, 2*n);
912-
if (unit == NULL)
913-
return -ENOMEM;
926+
unit = uvc_alloc_new_entity(dev, UVC_VC_EXTENSION_UNIT,
927+
buffer[3], p + 1, 2 * n);
928+
if (IS_ERR(unit))
929+
return PTR_ERR(unit);
914930

915931
memcpy(unit->guid, &buffer[4], 16);
916932
unit->extension.bNumControls = buffer[20];
@@ -1019,10 +1035,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
10191035
return -EINVAL;
10201036
}
10211037

1022-
term = uvc_alloc_entity(type | UVC_TERM_INPUT, buffer[3],
1023-
1, n + p);
1024-
if (term == NULL)
1025-
return -ENOMEM;
1038+
term = uvc_alloc_new_entity(dev, type | UVC_TERM_INPUT,
1039+
buffer[3], 1, n + p);
1040+
if (IS_ERR(term))
1041+
return PTR_ERR(term);
10261042

10271043
if (UVC_ENTITY_TYPE(term) == UVC_ITT_CAMERA) {
10281044
term->camera.bControlSize = n;
@@ -1078,10 +1094,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
10781094
return 0;
10791095
}
10801096

1081-
term = uvc_alloc_entity(type | UVC_TERM_OUTPUT, buffer[3],
1082-
1, 0);
1083-
if (term == NULL)
1084-
return -ENOMEM;
1097+
term = uvc_alloc_new_entity(dev, type | UVC_TERM_OUTPUT,
1098+
buffer[3], 1, 0);
1099+
if (IS_ERR(term))
1100+
return PTR_ERR(term);
10851101

10861102
memcpy(term->baSourceID, &buffer[7], 1);
10871103

@@ -1100,9 +1116,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
11001116
return -EINVAL;
11011117
}
11021118

1103-
unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, 0);
1104-
if (unit == NULL)
1105-
return -ENOMEM;
1119+
unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3],
1120+
p + 1, 0);
1121+
if (IS_ERR(unit))
1122+
return PTR_ERR(unit);
11061123

11071124
memcpy(unit->baSourceID, &buffer[5], p);
11081125

@@ -1122,9 +1139,9 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
11221139
return -EINVAL;
11231140
}
11241141

1125-
unit = uvc_alloc_entity(buffer[2], buffer[3], 2, n);
1126-
if (unit == NULL)
1127-
return -ENOMEM;
1142+
unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3], 2, n);
1143+
if (IS_ERR(unit))
1144+
return PTR_ERR(unit);
11281145

11291146
memcpy(unit->baSourceID, &buffer[4], 1);
11301147
unit->processing.wMaxMultiplier =
@@ -1151,9 +1168,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
11511168
return -EINVAL;
11521169
}
11531170

1154-
unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, n);
1155-
if (unit == NULL)
1156-
return -ENOMEM;
1171+
unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3],
1172+
p + 1, n);
1173+
if (IS_ERR(unit))
1174+
return PTR_ERR(unit);
11571175

11581176
memcpy(unit->guid, &buffer[4], 16);
11591177
unit->extension.bNumControls = buffer[20];
@@ -1293,9 +1311,10 @@ static int uvc_gpio_parse(struct uvc_device *dev)
12931311
return dev_err_probe(&dev->intf->dev, irq,
12941312
"No IRQ for privacy GPIO\n");
12951313

1296-
unit = uvc_alloc_entity(UVC_EXT_GPIO_UNIT, UVC_EXT_GPIO_UNIT_ID, 0, 1);
1297-
if (!unit)
1298-
return -ENOMEM;
1314+
unit = uvc_alloc_new_entity(dev, UVC_EXT_GPIO_UNIT,
1315+
UVC_EXT_GPIO_UNIT_ID, 0, 1);
1316+
if (IS_ERR(unit))
1317+
return PTR_ERR(unit);
12991318

13001319
unit->gpio.gpio_privacy = gpio_privacy;
13011320
unit->gpio.irq = irq;

‎drivers/media/usb/uvc/uvcvideo.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,8 @@
4141
#define UVC_EXT_GPIO_UNIT 0x7ffe
4242
#define UVC_EXT_GPIO_UNIT_ID 0x100
4343

44+
#define UVC_INVALID_ENTITY_ID 0xffff
45+
4446
/* ------------------------------------------------------------------------
4547
* Driver specific constants.
4648
*/

‎drivers/net/wireless/ath/ath11k/qmi.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2550,7 +2550,7 @@ static int ath11k_qmi_m3_load(struct ath11k_base *ab)
25502550
GFP_KERNEL);
25512551
if (!m3_mem->vaddr) {
25522552
ath11k_err(ab, "failed to allocate memory for M3 with size %zu\n",
2553-
fw->size);
2553+
m3_len);
25542554
ret = -ENOMEM;
25552555
goto out;
25562556
}

‎drivers/target/target_core_configfs.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2776,7 +2776,7 @@ static ssize_t target_lu_gp_members_show(struct config_item *item, char *page)
27762776
config_item_name(&dev->dev_group.cg_item));
27772777
cur_len++; /* Extra byte for NULL terminator */
27782778

2779-
if ((cur_len + len) > PAGE_SIZE) {
2779+
if ((cur_len + len) > PAGE_SIZE || cur_len > LU_GROUP_NAME_BUF) {
27802780
pr_warn("Ran out of lu_gp_show_attr"
27812781
"_members buffer\n");
27822782
break;

‎include/crypto/sha256_base.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ static inline int lib_sha256_base_do_update(struct sha256_state *sctx,
4444
sctx->count += len;
4545

4646
if (unlikely((partial + len) >= SHA256_BLOCK_SIZE)) {
47-
int blocks;
47+
unsigned int blocks;
4848

4949
if (partial) {
5050
int p = SHA256_BLOCK_SIZE - partial;

‎mm/swapfile.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2337,6 +2337,8 @@ static int unuse_mm(struct mm_struct *mm, unsigned int type)
23372337
VMA_ITERATOR(vmi, mm, 0);
23382338

23392339
mmap_read_lock(mm);
2340+
if (check_stable_address_space(mm))
2341+
goto unlock;
23402342
for_each_vma(vmi, vma) {
23412343
if (vma->anon_vma && !is_vm_hugetlb_page(vma)) {
23422344
ret = unuse_vma(vma, type);
@@ -2346,6 +2348,7 @@ static int unuse_mm(struct mm_struct *mm, unsigned int type)
23462348

23472349
cond_resched();
23482350
}
2351+
unlock:
23492352
mmap_read_unlock(mm);
23502353
return ret;
23512354
}

0 commit comments

Comments
 (0)