Commit b4a41ed2 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6

* 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  USB: cdc-acm: fix potential null-pointer dereference on disconnect
  USB: cdc-acm: fix potential null-pointer dereference
  USB: cdc-acm: fix memory corruption / panic
  USB: Fix 'bad dma' problem on WDM device disconnect
  usb: wwan: fix compilation without CONFIG_PM_RUNTIME
  USB: uss720 fixup refcount position
  usb: musb: blackfin: fix typo in new bfin_musb_vbus_status func
  usb: musb: blackfin: fix typo in new dev_pm_ops struct
  usb: musb: blackfin: fix typo in platform driver name
  usb: musb: Fix for merge issue
  ehci-hcd: Bug fix: don't set a QH's Halt bit
  USB: Do not pass negative length to snoop_urb()
parents 76d21c56 7e7797e7
...@@ -297,6 +297,8 @@ static void acm_ctrl_irq(struct urb *urb) ...@@ -297,6 +297,8 @@ static void acm_ctrl_irq(struct urb *urb)
if (!ACM_READY(acm)) if (!ACM_READY(acm))
goto exit; goto exit;
usb_mark_last_busy(acm->dev);
data = (unsigned char *)(dr + 1); data = (unsigned char *)(dr + 1);
switch (dr->bNotificationType) { switch (dr->bNotificationType) {
case USB_CDC_NOTIFY_NETWORK_CONNECTION: case USB_CDC_NOTIFY_NETWORK_CONNECTION:
...@@ -336,7 +338,6 @@ static void acm_ctrl_irq(struct urb *urb) ...@@ -336,7 +338,6 @@ static void acm_ctrl_irq(struct urb *urb)
break; break;
} }
exit: exit:
usb_mark_last_busy(acm->dev);
retval = usb_submit_urb(urb, GFP_ATOMIC); retval = usb_submit_urb(urb, GFP_ATOMIC);
if (retval) if (retval)
dev_err(&urb->dev->dev, "%s - usb_submit_urb failed with " dev_err(&urb->dev->dev, "%s - usb_submit_urb failed with "
...@@ -533,6 +534,8 @@ static void acm_softint(struct work_struct *work) ...@@ -533,6 +534,8 @@ static void acm_softint(struct work_struct *work)
if (!ACM_READY(acm)) if (!ACM_READY(acm))
return; return;
tty = tty_port_tty_get(&acm->port); tty = tty_port_tty_get(&acm->port);
if (!tty)
return;
tty_wakeup(tty); tty_wakeup(tty);
tty_kref_put(tty); tty_kref_put(tty);
} }
...@@ -646,8 +649,10 @@ static void acm_port_down(struct acm *acm) ...@@ -646,8 +649,10 @@ static void acm_port_down(struct acm *acm)
usb_kill_urb(acm->ctrlurb); usb_kill_urb(acm->ctrlurb);
for (i = 0; i < ACM_NW; i++) for (i = 0; i < ACM_NW; i++)
usb_kill_urb(acm->wb[i].urb); usb_kill_urb(acm->wb[i].urb);
tasklet_disable(&acm->urb_task);
for (i = 0; i < nr; i++) for (i = 0; i < nr; i++)
usb_kill_urb(acm->ru[i].urb); usb_kill_urb(acm->ru[i].urb);
tasklet_enable(&acm->urb_task);
acm->control->needs_remote_wakeup = 0; acm->control->needs_remote_wakeup = 0;
usb_autopm_put_interface(acm->control); usb_autopm_put_interface(acm->control);
} }
......
...@@ -281,7 +281,7 @@ static void cleanup(struct wdm_device *desc) ...@@ -281,7 +281,7 @@ static void cleanup(struct wdm_device *desc)
desc->sbuf, desc->sbuf,
desc->validity->transfer_dma); desc->validity->transfer_dma);
usb_free_coherent(interface_to_usbdev(desc->intf), usb_free_coherent(interface_to_usbdev(desc->intf),
desc->wMaxCommand, desc->bMaxPacketSize0,
desc->inbuf, desc->inbuf,
desc->response->transfer_dma); desc->response->transfer_dma);
kfree(desc->orq); kfree(desc->orq);
......
...@@ -802,7 +802,7 @@ static int proc_control(struct dev_state *ps, void __user *arg) ...@@ -802,7 +802,7 @@ static int proc_control(struct dev_state *ps, void __user *arg)
tbuf, ctrl.wLength, tmo); tbuf, ctrl.wLength, tmo);
usb_lock_device(dev); usb_lock_device(dev);
snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE, snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE,
tbuf, i); tbuf, max(i, 0));
if ((i > 0) && ctrl.wLength) { if ((i > 0) && ctrl.wLength) {
if (copy_to_user(ctrl.data, tbuf, i)) { if (copy_to_user(ctrl.data, tbuf, i)) {
free_page((unsigned long)tbuf); free_page((unsigned long)tbuf);
......
...@@ -315,7 +315,6 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh) ...@@ -315,7 +315,6 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
int stopped; int stopped;
unsigned count = 0; unsigned count = 0;
u8 state; u8 state;
const __le32 halt = HALT_BIT(ehci);
struct ehci_qh_hw *hw = qh->hw; struct ehci_qh_hw *hw = qh->hw;
if (unlikely (list_empty (&qh->qtd_list))) if (unlikely (list_empty (&qh->qtd_list)))
...@@ -422,7 +421,6 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh) ...@@ -422,7 +421,6 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
&& !(qtd->hw_alt_next && !(qtd->hw_alt_next
& EHCI_LIST_END(ehci))) { & EHCI_LIST_END(ehci))) {
stopped = 1; stopped = 1;
goto halt;
} }
/* stop scanning when we reach qtds the hc is using */ /* stop scanning when we reach qtds the hc is using */
...@@ -456,16 +454,6 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh) ...@@ -456,16 +454,6 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
*/ */
ehci_clear_tt_buffer(ehci, qh, urb, token); ehci_clear_tt_buffer(ehci, qh, urb, token);
} }
/* force halt for unlinked or blocked qh, so we'll
* patch the qh later and so that completions can't
* activate it while we "know" it's stopped.
*/
if ((halt & hw->hw_token) == 0) {
halt:
hw->hw_token |= halt;
wmb ();
}
} }
/* unless we already know the urb's status, collect qtd status /* unless we already know the urb's status, collect qtd status
......
...@@ -177,12 +177,11 @@ static struct uss720_async_request *submit_async_request(struct parport_uss720_p ...@@ -177,12 +177,11 @@ static struct uss720_async_request *submit_async_request(struct parport_uss720_p
spin_lock_irqsave(&priv->asynclock, flags); spin_lock_irqsave(&priv->asynclock, flags);
list_add_tail(&rq->asynclist, &priv->asynclist); list_add_tail(&rq->asynclist, &priv->asynclist);
spin_unlock_irqrestore(&priv->asynclock, flags); spin_unlock_irqrestore(&priv->asynclock, flags);
kref_get(&rq->ref_count);
ret = usb_submit_urb(rq->urb, mem_flags); ret = usb_submit_urb(rq->urb, mem_flags);
if (!ret) { if (!ret)
kref_get(&rq->ref_count);
return rq; return rq;
} destroy_async(&rq->ref_count);
kref_put(&rq->ref_count, destroy_async);
err("submit_async_request submit_urb failed with %d", ret); err("submit_async_request submit_urb failed with %d", ret);
return NULL; return NULL;
} }
......
...@@ -322,7 +322,7 @@ static void bfin_musb_try_idle(struct musb *musb, unsigned long timeout) ...@@ -322,7 +322,7 @@ static void bfin_musb_try_idle(struct musb *musb, unsigned long timeout)
mod_timer(&musb_conn_timer, jiffies + TIMER_DELAY); mod_timer(&musb_conn_timer, jiffies + TIMER_DELAY);
} }
static int bfin_musb_get_vbus_status(struct musb *musb) static int bfin_musb_vbus_status(struct musb *musb)
{ {
return 0; return 0;
} }
...@@ -540,7 +540,7 @@ static struct dev_pm_ops bfin_pm_ops = { ...@@ -540,7 +540,7 @@ static struct dev_pm_ops bfin_pm_ops = {
.resume = bfin_resume, .resume = bfin_resume,
}; };
#define DEV_PM_OPS &bfin_pm_op, #define DEV_PM_OPS &bfin_pm_ops
#else #else
#define DEV_PM_OPS NULL #define DEV_PM_OPS NULL
#endif #endif
...@@ -548,7 +548,7 @@ static struct dev_pm_ops bfin_pm_ops = { ...@@ -548,7 +548,7 @@ static struct dev_pm_ops bfin_pm_ops = {
static struct platform_driver bfin_driver = { static struct platform_driver bfin_driver = {
.remove = __exit_p(bfin_remove), .remove = __exit_p(bfin_remove),
.driver = { .driver = {
.name = "musb-bfin", .name = "musb-blackfin",
.pm = DEV_PM_OPS, .pm = DEV_PM_OPS,
}, },
}; };
......
...@@ -1880,12 +1880,12 @@ int usb_gadget_probe_driver(struct usb_gadget_driver *driver, ...@@ -1880,12 +1880,12 @@ int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
if (retval < 0) { if (retval < 0) {
DBG(1, "add_hcd failed, %d\n", retval); DBG(1, "add_hcd failed, %d\n", retval);
goto err2; goto err2;
if ((musb->xceiv->last_event == USB_EVENT_ID)
&& musb->xceiv->set_vbus)
otg_set_vbus(musb->xceiv, 1);
} }
if ((musb->xceiv->last_event == USB_EVENT_ID)
&& musb->xceiv->set_vbus)
otg_set_vbus(musb->xceiv, 1);
hcd->self.uses_pio_for_control = 1; hcd->self.uses_pio_for_control = 1;
if (musb->xceiv->last_event == USB_EVENT_NONE) if (musb->xceiv->last_event == USB_EVENT_NONE)
......
...@@ -698,8 +698,7 @@ static void play_delayed(struct usb_serial_port *port) ...@@ -698,8 +698,7 @@ static void play_delayed(struct usb_serial_port *port)
/* we have to throw away the rest */ /* we have to throw away the rest */
do { do {
unbusy_queued_urb(urb, portdata); unbusy_queued_urb(urb, portdata);
//extremely dirty usb_autopm_put_interface_no_suspend(port->serial->interface);
atomic_dec(&port->serial->interface->dev.power.usage_count);
} while ((urb = usb_get_from_anchor(&portdata->delayed))); } while ((urb = usb_get_from_anchor(&portdata->delayed)));
break; break;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment