Commit 48cf398f authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'char-misc-6.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc 

Pull char / misc driver fixes from Greg KH:
 "Here are some small char/misc and other driver fixes for 6.9-rc5.
  Included in here are the following:

   - binder driver fix for reported problem

   - speakup crash fix

   - mei driver fixes for reported problems

   - comdei driver fix

   - interconnect driver fixes

   - rtsx driver fix

   - peci.h kernel doc fix

  All of these have been in linux-next for over a week with no reported
  problems"

* tag 'char-misc-6.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  peci: linux/peci.h: fix Excess kernel-doc description warning
  binder: check offset alignment in binder_get_object()
  comedi: vmk80xx: fix incomplete endpoint checking
  mei: vsc: Unregister interrupt handler for system suspend
  Revert "mei: vsc: Call wake_up() in the threaded IRQ handler"
  misc: rtsx: Fix rts5264 driver status incorrect when card removed
  mei: me: disable RPL-S on SPS and IGN firmwares
  speakup: Avoid crash on very long word
  interconnect: Don't access req_list while it's being manipulated
  interconnect: qcom: x1e80100: Remove inexistent ACV_PERF BCM
parents 4e90ba75 ebaed6d4

drivers/accessibility/speakup/main.c

+1 −1
Original line number Diff line number Diff line
@@ -574,7 +574,7 @@ static u_long get_word(struct vc_data *vc) 
	}

	attr_ch = get_char(vc, (u_short *)tmp_pos, &spk_attr);

	buf[cnt++] = attr_ch;

	while (tmpx < vc->vc_cols - 1) {

	while (tmpx < vc->vc_cols - 1 && cnt < sizeof(buf) - 1) {

		tmp_pos += 2;

		tmpx++;

		ch = get_char(vc, (u_short *)tmp_pos, &temp);

drivers/android/binder.c

+3 −1
Original line number Diff line number Diff line
@@ -1708,8 +1708,10 @@ static size_t binder_get_object(struct binder_proc *proc, 
	size_t object_size = 0;



	read_size = min_t(size_t, sizeof(*object), buffer->data_size - offset);

	if (offset > buffer->data_size || read_size < sizeof(*hdr))

	if (offset > buffer->data_size || read_size < sizeof(*hdr) ||

	    !IS_ALIGNED(offset, sizeof(u32)))

		return 0;



	if (u) {

		if (copy_from_user(object, u + offset, read_size))

			return 0;

drivers/comedi/drivers/vmk80xx.c

+12 −23
Original line number Diff line number Diff line
@@ -641,33 +641,22 @@ static int vmk80xx_find_usb_endpoints(struct comedi_device *dev) 
	struct vmk80xx_private *devpriv = dev->private;

	struct usb_interface *intf = comedi_to_usb_interface(dev);

	struct usb_host_interface *iface_desc = intf->cur_altsetting;

	struct usb_endpoint_descriptor *ep_desc;

	int i;



	if (iface_desc->desc.bNumEndpoints != 2)

		return -ENODEV;



	for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) {

		ep_desc = &iface_desc->endpoint[i].desc;



		if (usb_endpoint_is_int_in(ep_desc) ||

		    usb_endpoint_is_bulk_in(ep_desc)) {

			if (!devpriv->ep_rx)

				devpriv->ep_rx = ep_desc;

			continue;

		}

	struct usb_endpoint_descriptor *ep_rx_desc, *ep_tx_desc;

	int ret;



		if (usb_endpoint_is_int_out(ep_desc) ||

		    usb_endpoint_is_bulk_out(ep_desc)) {

			if (!devpriv->ep_tx)

				devpriv->ep_tx = ep_desc;

			continue;

		}

	}

	if (devpriv->model == VMK8061_MODEL)

		ret = usb_find_common_endpoints(iface_desc, &ep_rx_desc,

						&ep_tx_desc, NULL, NULL);

	else

		ret = usb_find_common_endpoints(iface_desc, NULL, NULL,

						&ep_rx_desc, &ep_tx_desc);



	if (!devpriv->ep_rx || !devpriv->ep_tx)

	if (ret)

		return -ENODEV;



	devpriv->ep_rx = ep_rx_desc;

	devpriv->ep_tx = ep_tx_desc;



	if (!usb_endpoint_maxp(devpriv->ep_rx) || !usb_endpoint_maxp(devpriv->ep_tx))

		return -EINVAL;

drivers/interconnect/core.c

+8 −0
Original line number Diff line number Diff line
@@ -176,6 +176,8 @@ static struct icc_path *path_init(struct device *dev, struct icc_node *dst, 


	path->num_nodes = num_nodes;



	mutex_lock(&icc_bw_lock);



	for (i = num_nodes - 1; i >= 0; i--) {

		node->provider->users++;

		hlist_add_head(&path->reqs[i].req_node, &node->req_list);
@@ -186,6 +188,8 @@ static struct icc_path *path_init(struct device *dev, struct icc_node *dst, 
		node = node->reverse;

	}



	mutex_unlock(&icc_bw_lock);



	return path;

}
@@ -792,12 +796,16 @@ void icc_put(struct icc_path *path) 
		pr_err("%s: error (%d)\n", __func__, ret);



	mutex_lock(&icc_lock);

	mutex_lock(&icc_bw_lock);



	for (i = 0; i < path->num_nodes; i++) {

		node = path->reqs[i].node;

		hlist_del(&path->reqs[i].req_node);

		if (!WARN_ON(!node->provider->users))

			node->provider->users--;

	}



	mutex_unlock(&icc_bw_lock);

	mutex_unlock(&icc_lock);



	kfree_const(path->name);

drivers/interconnect/qcom/x1e80100.c

+0 −26
Original line number Diff line number Diff line
@@ -116,15 +116,6 @@ static struct qcom_icc_node xm_sdc2 = { 
	.links = { X1E80100_SLAVE_A2NOC_SNOC },

};



static struct qcom_icc_node ddr_perf_mode_master = {

	.name = "ddr_perf_mode_master",

	.id = X1E80100_MASTER_DDR_PERF_MODE,

	.channels = 1,

	.buswidth = 4,

	.num_links = 1,

	.links = { X1E80100_SLAVE_DDR_PERF_MODE },

};



static struct qcom_icc_node qup0_core_master = {

	.name = "qup0_core_master",

	.id = X1E80100_MASTER_QUP_CORE_0,
@@ -688,14 +679,6 @@ static struct qcom_icc_node qns_a2noc_snoc = { 
	.links = { X1E80100_MASTER_A2NOC_SNOC },

};



static struct qcom_icc_node ddr_perf_mode_slave = {

	.name = "ddr_perf_mode_slave",

	.id = X1E80100_SLAVE_DDR_PERF_MODE,

	.channels = 1,

	.buswidth = 4,

	.num_links = 0,

};



static struct qcom_icc_node qup0_core_slave = {

	.name = "qup0_core_slave",

	.id = X1E80100_SLAVE_QUP_CORE_0,
@@ -1377,12 +1360,6 @@ static struct qcom_icc_bcm bcm_acv = { 
	.nodes = { &ebi },

};



static struct qcom_icc_bcm bcm_acv_perf = {

	.name = "ACV_PERF",

	.num_nodes = 1,

	.nodes = { &ddr_perf_mode_slave },

};



static struct qcom_icc_bcm bcm_ce0 = {

	.name = "CE0",

	.num_nodes = 1,
@@ -1583,18 +1560,15 @@ static const struct qcom_icc_desc x1e80100_aggre2_noc = { 
};



static struct qcom_icc_bcm * const clk_virt_bcms[] = {

	&bcm_acv_perf,

	&bcm_qup0,

	&bcm_qup1,

	&bcm_qup2,

};



static struct qcom_icc_node * const clk_virt_nodes[] = {

	[MASTER_DDR_PERF_MODE] = &ddr_perf_mode_master,

	[MASTER_QUP_CORE_0] = &qup0_core_master,

	[MASTER_QUP_CORE_1] = &qup1_core_master,

	[MASTER_QUP_CORE_2] = &qup2_core_master,

	[SLAVE_DDR_PERF_MODE] = &ddr_perf_mode_slave,

	[SLAVE_QUP_CORE_0] = &qup0_core_slave,

	[SLAVE_QUP_CORE_1] = &qup1_core_slave,

	[SLAVE_QUP_CORE_2] = &qup2_core_slave,