Commit b4a41ed2 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6 

* 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  USB: cdc-acm: fix potential null-pointer dereference on disconnect
  USB: cdc-acm: fix potential null-pointer dereference
  USB: cdc-acm: fix memory corruption / panic
  USB: Fix 'bad dma' problem on WDM device disconnect
  usb: wwan: fix compilation without CONFIG_PM_RUNTIME
  USB: uss720 fixup refcount position
  usb: musb: blackfin: fix typo in new bfin_musb_vbus_status func
  usb: musb: blackfin: fix typo in new dev_pm_ops struct
  usb: musb: blackfin: fix typo in platform driver name
  usb: musb: Fix for merge issue
  ehci-hcd: Bug fix: don't set a QH's Halt bit
  USB: Do not pass negative length to snoop_urb()
parents 76d21c56 7e7797e7

drivers/usb/class/cdc-acm.c

+6 −1
Original line number Diff line number Diff line
@@ -297,6 +297,8 @@ static void acm_ctrl_irq(struct urb *urb) 
	if (!ACM_READY(acm))

		goto exit;



	usb_mark_last_busy(acm->dev);



	data = (unsigned char *)(dr + 1);

	switch (dr->bNotificationType) {

	case USB_CDC_NOTIFY_NETWORK_CONNECTION:
@@ -336,7 +338,6 @@ static void acm_ctrl_irq(struct urb *urb) 
		break;

	}

exit:

	usb_mark_last_busy(acm->dev);

	retval = usb_submit_urb(urb, GFP_ATOMIC);

	if (retval)

		dev_err(&urb->dev->dev, "%s - usb_submit_urb failed with "
@@ -533,6 +534,8 @@ static void acm_softint(struct work_struct *work) 
	if (!ACM_READY(acm))

		return;

	tty = tty_port_tty_get(&acm->port);

	if (!tty)

		return;

	tty_wakeup(tty);

	tty_kref_put(tty);

}
@@ -646,8 +649,10 @@ static void acm_port_down(struct acm *acm) 
		usb_kill_urb(acm->ctrlurb);

		for (i = 0; i < ACM_NW; i++)

			usb_kill_urb(acm->wb[i].urb);

		tasklet_disable(&acm->urb_task);

		for (i = 0; i < nr; i++)

			usb_kill_urb(acm->ru[i].urb);

		tasklet_enable(&acm->urb_task);

		acm->control->needs_remote_wakeup = 0;

		usb_autopm_put_interface(acm->control);

	}

drivers/usb/class/cdc-wdm.c

+1 −1
Original line number Diff line number Diff line
@@ -281,7 +281,7 @@ static void cleanup(struct wdm_device *desc) 
			  desc->sbuf,

			  desc->validity->transfer_dma);

	usb_free_coherent(interface_to_usbdev(desc->intf),

			  desc->wMaxCommand,

			  desc->bMaxPacketSize0,

			  desc->inbuf,

			  desc->response->transfer_dma);

	kfree(desc->orq);

drivers/usb/core/devio.c

+1 −1
Original line number Diff line number Diff line
@@ -802,7 +802,7 @@ static int proc_control(struct dev_state *ps, void __user *arg) 
				    tbuf, ctrl.wLength, tmo);

		usb_lock_device(dev);

		snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE,

			tbuf, i);

			  tbuf, max(i, 0));

		if ((i > 0) && ctrl.wLength) {

			if (copy_to_user(ctrl.data, tbuf, i)) {

				free_page((unsigned long)tbuf);

drivers/usb/host/ehci-q.c

+0 −12
Original line number Diff line number Diff line
@@ -315,7 +315,6 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh) 
	int			stopped;

	unsigned		count = 0;

	u8			state;

	const __le32		halt = HALT_BIT(ehci);

	struct ehci_qh_hw	*hw = qh->hw;



	if (unlikely (list_empty (&qh->qtd_list)))
@@ -422,7 +421,6 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh) 
					&& !(qtd->hw_alt_next

						& EHCI_LIST_END(ehci))) {

				stopped = 1;

				goto halt;

			}



		/* stop scanning when we reach qtds the hc is using */
@@ -456,16 +454,6 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh) 
				 */

				ehci_clear_tt_buffer(ehci, qh, urb, token);

			}



			/* force halt for unlinked or blocked qh, so we'll

			 * patch the qh later and so that completions can't

			 * activate it while we "know" it's stopped.

			 */

			if ((halt & hw->hw_token) == 0) {

halt:

				hw->hw_token |= halt;

				wmb ();

			}

		}



		/* unless we already know the urb's status, collect qtd status

drivers/usb/misc/uss720.c

+3 −4
Original line number Diff line number Diff line
@@ -177,12 +177,11 @@ static struct uss720_async_request *submit_async_request(struct parport_uss720_p 
	spin_lock_irqsave(&priv->asynclock, flags);

	list_add_tail(&rq->asynclist, &priv->asynclist);

	spin_unlock_irqrestore(&priv->asynclock, flags);

	ret = usb_submit_urb(rq->urb, mem_flags);

	if (!ret) {

	kref_get(&rq->ref_count);

	ret = usb_submit_urb(rq->urb, mem_flags);

	if (!ret)

		return rq;

	}

	kref_put(&rq->ref_count, destroy_async);

	destroy_async(&rq->ref_count);

	err("submit_async_request submit_urb failed with %d", ret);

	return NULL;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE