Merge branch 'android-4.4-p' of https://android.googlesource.com/kernel/common into lineage-18.1-caf-msm8998

# By Pavel Skripkin (6) and others
# Via Greg Kroah-Hartman
* android-4.4-p:
  Linux 4.4.278
  sis900: Fix missing pci_disable_device() in probe and remove
  tulip: windbond-840: Fix missing pci_disable_device() in probe and remove
  net: llc: fix skb_over_panic
  mlx4: Fix missing error code in mlx4_load_one()
  tipc: fix sleeping in tipc accept routine
  netfilter: nft_nat: allow to specify layer 4 protocol NAT only
  cfg80211: Fix possible memory leak in function cfg80211_bss_update
  x86/asm: Ensure asm/proto.h can be included stand-alone
  NIU: fix incorrect error return, missed in previous revert
  can: esd_usb2: fix memory leak
  can: ems_usb: fix memory leak
  can: usb_8dev: fix memory leak
  ocfs2: issue zeroout to EOF blocks
  ocfs2: fix zero out valid data
  ARM: ensure the signal page contains defined contents
  lib/string.c: add multibyte memset functions
  ARM: dts: versatile: Fix up interrupt controller node names
  hfs: add lock nesting notation to hfs_find_init
  hfs: fix high memory mapping in hfs_bnode_read
  hfs: add missing clean-up in hfs_fill_super
  sctp: move 198 addresses from unusable to private scope
  net/802/garp: fix memleak in garp_request_join()
  net/802/mrp: fix memleak in mrp_request_join()
  workqueue: fix UAF in pwq_unbound_release_workfn()
  af_unix: fix garbage collect vs MSG_PEEK
  net: split out functions related to registering inflight socket files
  Linux 4.4.277
  btrfs: compression: don't try to compress if we don't have enough pages
  iio: accel: bma180: Fix BMA25x bandwidth register values
  iio: accel: bma180: Use explicit member assignment
  net: bcmgenet: ensure EXT_ENERGY_DET_MASK is clear
  media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()
  tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop.
  USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
  USB: serial: cp210x: fix comments for GE CS1000
  USB: serial: option: add support for u-blox LARA-R6 family
  usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop()
  usb: max-3421: Prevent corruption of freed memory
  USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS
  usb: hub: Disable USB 3 device initiated lpm if exit latency is too high
  KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow
  xhci: Fix lost USB 2 remote wake
  ALSA: sb: Fix potential ABBA deadlock in CSP driver
  s390/ftrace: fix ftrace_update_ftrace_func implementation
  proc: Avoid mixing integer types in mem_rw()
  Revert "USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem"
  scsi: target: Fix protect handling in WRITE SAME(32)
  scsi: iscsi: Fix iface sysfs attr detection
  netrom: Decrease sock refcount when sock timers expire
  net: decnet: Fix sleeping inside in af_decnet
  net: fix uninit-value in caif_seqpkt_sendmsg
  s390/bpf: Perform r1 range checking before accessing jit->seen_reg[r1]
  perf probe-file: Delete namelist in del_events() on the error path
  perf test bpf: Free obj_buf
  igb: Check if num of q_vectors is smaller than max before array access
  iavf: Fix an error handling path in 'iavf_probe()'
  ipv6: tcp: drop silly ICMPv6 packet too big messages
  tcp: annotate data races around tp->mtu_info
  net: validate lwtstate->data before returning from skb_tunnel_info()
  net: ti: fix UAF in tlan_remove_one
  net: moxa: fix UAF in moxart_mac_probe
  net: bcmgenet: Ensure all TX/RX queues DMAs are disabled
  net: ipv6: fix return value of ip6_skb_dst_mtu
  x86/fpu: Make init_fpstate correct with optimized XSAVE
  Revert "memory: fsl_ifc: fix leak of IO mapping on probe failure"
  sched/fair: Fix CFS bandwidth hrtimer expiry type
  scsi: aic7xxx: Fix unintentional sign extension issue on left shift of u8
  kbuild: mkcompile_h: consider timestamp if KBUILD_BUILD_TIMESTAMP is set
  thermal/core: Correct function name thermal_zone_device_unregister()
  ARM: imx: pm-imx5: Fix references to imx5_cpu_suspend_info
  ARM: dts: imx6: phyFLEX: Fix UART hardware flow control
  ARM: dts: BCM63xx: Fix NAND nodes names
  ARM: brcmstb: dts: fix NAND nodes names

Change-Id: Id59b93b8704270f45923f262facbadde4c486a15

1 files changed, 13 insertions, 2 deletions

diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
index 50d9b945089e..11d045699344 100644
--- a/drivers/net/can/usb/usb_8dev.c
+++ b/drivers/net/can/usb/usb_8dev.c
@@ -148,7 +148,8 @@ struct usb_8dev_priv {
 	u8 *cmd_msg_buffer;
 
 	struct mutex usb_8dev_cmd_lock;
-
+	void *rxbuf[MAX_RX_URBS];
+	dma_addr_t rxbuf_dma[MAX_RX_URBS];
 };
 
 /* tx frame */
@@ -746,6 +747,7 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
 	for (i = 0; i < MAX_RX_URBS; i++) {
 		struct urb *urb = NULL;
 		u8 *buf;
+		dma_addr_t buf_dma;
 
 		/* create a URB, and a buffer for it */
 		urb = usb_alloc_urb(0, GFP_KERNEL);
@@ -756,7 +758,7 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
 		}
 
 		buf = usb_alloc_coherent(priv->udev, RX_BUFFER_SIZE, GFP_KERNEL,
-					 &urb->transfer_dma);
+					 &buf_dma);
 		if (!buf) {
 			netdev_err(netdev, "No memory left for USB buffer\n");
 			usb_free_urb(urb);
@@ -764,6 +766,8 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
 			break;
 		}
 
+		urb->transfer_dma = buf_dma;
+
 		usb_fill_bulk_urb(urb, priv->udev,
 				  usb_rcvbulkpipe(priv->udev,
 						  USB_8DEV_ENDP_DATA_RX),
@@ -781,6 +785,9 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
 			break;
 		}
 
+		priv->rxbuf[i] = buf;
+		priv->rxbuf_dma[i] = buf_dma;
+
 		/* Drop reference, USB core will take care of freeing it */
 		usb_free_urb(urb);
 	}
@@ -850,6 +857,10 @@ static void unlink_all_urbs(struct usb_8dev_priv *priv)
 
 	usb_kill_anchored_urbs(&priv->rx_submitted);
 
+	for (i = 0; i < MAX_RX_URBS; ++i)
+		usb_free_coherent(priv->udev, RX_BUFFER_SIZE,
+				  priv->rxbuf[i], priv->rxbuf_dma[i]);
+
 	usb_kill_anchored_urbs(&priv->tx_submitted);
 	atomic_set(&priv->active_tx_urbs, 0);