1. 18 Apr, 2012 5 commits
    • Julia Lawall's avatar
      drivers/usb/misc/usbtest.c: add kfrees · f4a728d0
      Julia Lawall authored
      Free the two previously allocated buffers before exiting the function in an
      error case.
      Signed-off-by: default avatarJulia Lawall <Julia.Lawall@lip6.fr>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      f4a728d0
    • Anatolij Gustschin's avatar
      USB: ehci-fsl: Fix kernel crash on mpc5121e · f941f692
      Anatolij Gustschin authored
      Since commit 28c56ea1
      (powerpc/usb: fix bug of kernel hang when initializing usb)
      the kernel crashes on mpc5121e. mpc5121e doesn't have system interface
      registers, accessing this register address space cause the machine check
      exception and a kernel crash:
      ...
      [    1.294596] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
      [    1.316491] fsl-ehci fsl-ehci.0: Freescale On-Chip EHCI Host Controller
      [    1.337334] fsl-ehci fsl-ehci.0: new USB bus registered, assigned bus number 1
      [    1.358548] Machine check in kernel mode.
      [    1.375917] Caused by (from SRR1=49030): Transfer error ack signal
      [    1.395505] Oops: Machine check, sig: 7 [#1]
      [    1.413113] MPC5121 ADS
      [    1.428718] Modules linked in:
      [    1.444841] NIP: c026efc4 LR: c0278b50 CTR: 00000000
      [    1.463342] REGS: df837ba0 TRAP: 0200   Not tainted  (3.3.0-08839-gb5174fa3)
      [    1.484083] MSR: 00049030 <EE,ME,IR,DR>  CR: 42042022  XER: 20000000
      [    1.504099] TASK = df834000[1] 'swapper' THREAD: df836000
      [    1.509667] GPR00: 1c000000 df837c50 df834000 df9d74e0 00000003 00000010 00000000 00000000
      [    1.531650] GPR08: 00000020 00000000 c037cdd8 e1088000 22042028 1001a69c 00000000 00000000
      [    1.553762] GPR16: 1ffbce70 00000000 1fef5b28 1fef3e08 00000000 00000000 1ffcbc7c c045b264
      [    1.575824] GPR24: 0000008b 00000002 c04a7dd0 e1088000 df33c960 df9d74e0 00000000 df9d7400
      [    1.612295] NIP [c026efc4] ehci_fsl_setup_phy+0x110/0x124
      [    1.632454] LR [c0278b50] ehci_fsl_setup+0x29c/0x304
      [    1.652065] Call Trace:
      [    1.668923] [df837c50] [c0278a40] ehci_fsl_setup+0x18c/0x304 (unreliable)
      [    1.690332] [df837c70] [c025cba4] usb_add_hcd+0x1f0/0x66c
      [    1.710377] [df837cb0] [c0277ab8] ehci_fsl_drv_probe+0x180/0x308
      [    1.731322] [df837ce0] [c01fc7a8] platform_drv_probe+0x20/0x30
      [    1.752202] [df837cf0] [c01fb0ac] driver_probe_device+0x8c/0x214
      [    1.773491] [df837d10] [c01f956c] bus_for_each_drv+0x6c/0xa8
      [    1.794279] [df837d40] [c01fafdc] device_attach+0xb4/0xd8
      [    1.814574] [df837d60] [c01fa44c] bus_probe_device+0xa4/0xb4
      [    1.835343] [df837d80] [c01f87a8] device_add+0x52c/0x5dc
      [    1.855462] [df837dd0] [c01fcd58] platform_device_add+0x124/0x1d0
      [    1.876558] [df837df0] [c036dcec] fsl_usb2_device_register+0xa0/0xd4
      [    1.897512] [df837e10] [c036df28] fsl_usb2_mph_dr_of_probe+0x208/0x264
      [    1.918253] [df837e90] [c01fc7a8] platform_drv_probe+0x20/0x30
      [    1.938300] [df837ea0] [c01fb0ac] driver_probe_device+0x8c/0x214
      [    1.958511] [df837ec0] [c01fb2f0] __driver_attach+0xbc/0xc0
      [    1.978088] [df837ee0] [c01f9608] bus_for_each_dev+0x60/0x9c
      [    1.997589] [df837f10] [c01fab88] driver_attach+0x24/0x34
      [    2.016757] [df837f20] [c01fa744] bus_add_driver+0x1ac/0x274
      [    2.036339] [df837f50] [c01fb898] driver_register+0x88/0x150
      [    2.056052] [df837f70] [c01fcabc] platform_driver_register+0x68/0x78
      [    2.076650] [df837f80] [c0446500] fsl_usb2_mph_dr_driver_init+0x18/0x28
      [    2.097734] [df837f90] [c0003988] do_one_initcall+0x148/0x1b0
      [    2.117934] [df837fc0] [c042d89c] kernel_init+0xfc/0x190
      [    2.137667] [df837ff0] [c000d2c4] kernel_thread+0x4c/0x68
      [    2.157240] Instruction dump:
      [    2.174119] 90050004 4e800020 2f840003 419e0014 2f840004 409eff64 6400c000 4bffff5c
      [    2.196000] 64001000 7c0004ac 812b0500 0c090000 <4c00012c> 61290200 7c0004ac 912b0500
      [    2.218100] ---[ end trace 21659aedb84ad816 ]---
      [    2.237089]
      [    3.232940] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000007
      [    3.232954]
      [    3.271575] Rebooting in 1 seconds..
      
      Check pdata->have_sysif_regs flag before accessing system interface
      registers.
      Signed-off-by: default avatarAnatolij Gustschin <agust@denx.de>
      Cc: Shengzhou Liu <Shengzhou.Liu@freescale.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      f941f692
    • Oliver Neukum's avatar
      uwb: fix error handling · 5bd7b419
      Oliver Neukum authored
      Fatal errors such as a device disconnect must not trigger
      error handling. The error returns must be checked.
      Signed-off-by: default avatarOliver Neukum <oneukum@suse.de>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      5bd7b419
    • Oliver Neukum's avatar
      uwb: fix use of del_timer_sync() in interrupt · 9426cd05
      Oliver Neukum authored
      del_timer_sync() cannot be used in interrupt.
      Replace it with del_timer() and a flag
      Signed-off-by: default avatarOliver Neukum <oneukum@suse.de>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      9426cd05
    • Alan Stern's avatar
      EHCI: always clear the STS_FLR status bit · 2fbe2bf1
      Alan Stern authored
      This patch (as1544) fixes a problem affecting some EHCI controllers.
      They can generate interrupts whenever the STS_FLR status bit is turned
      on, even though that bit is masked out in the Interrupt Enable
      register.
      
      Since the driver doesn't use STS_FLR anyway, the patch changes the
      interrupt routine to clear that bit whenever it is set, rather than
      leaving it alone.
      Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Reported-and-tested-by: default avatarTomoya MORINAGA <tomoya.rohm@gmail.com>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      2fbe2bf1
  2. 17 Apr, 2012 5 commits
    • Alan Stern's avatar
      EHCI: fix criterion for resuming the root hub · dc75ce9d
      Alan Stern authored
      This patch (as1542) changes the criterion ehci-hcd uses to tell when
      it needs to resume the controller's root hub.  A resume is needed when
      a port status change is detected, obviously, but only if the root hub
      is currently suspended.
      
      Right now the driver tests whether the root hub is running, and that
      is not the correct test.  In particular, if the controller has died
      then the root hub should not be restarted.  In addition, some buggy
      hardware occasionally requires the root hub to be running and
      sending out SOF packets even while it is nominally supposed to be
      suspended.
      
      In the end, the test needs to be changed.  Rather than checking whether
      the root hub is currently running, the driver will now check whether
      the root hub is currently suspended.  This will yield the correct
      behavior in all cases.
      Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      CC: Peter Chen <B29397@freescale.com>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      dc75ce9d
    • Bjørn Mork's avatar
      USB: sierra: avoid QMI/wwan interface on MC77xx · 749541d1
      Bjørn Mork authored
      These devices have a number of non serial interfaces as well.  Use
      the existing "Direct IP" blacklist to prevent binding to interfaces
      which are handled by other drivers.
      
      We also extend the "Direct IP" blacklist with with interfaces only
      seen in "QMI" mode, assuming that these devices use the same
      interface numbers for serial interfaces both in "Direct IP" and in
      "QMI" mode.
      Signed-off-by: default avatarBjørn Mork <bjorn@mork.no>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      749541d1
    • Xi Wang's avatar
      usb: usbtest: avoid integer overflow in alloc_sglist() · 8bde9a62
      Xi Wang authored
      A large `nents' from userspace could overflow the allocation size,
      leading to memory corruption.
      
      | alloc_sglist()
      | usbtest_ioctl()
      
      Use kmalloc_array() to avoid the overflow.
      Signed-off-by: default avatarXi Wang <xi.wang@gmail.com>
      Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      8bde9a62
    • Xi Wang's avatar
      usb: usbtest: avoid integer overflow in test_ctrl_queue() · e65cdfae
      Xi Wang authored
      Avoid overflowing context.count = param->sglen * param->iterations,
      where both `sglen' and `iterations' are from userspace.
      
      | test_ctrl_queue()
      | usbtest_ioctl()
      
      Keep -EOPNOTSUPP for error code.
      Signed-off-by: default avatarXi Wang <xi.wang@gmail.com>
      Acked-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      e65cdfae
    • Alan Stern's avatar
      USB: fix deadlock in bConfigurationValue attribute method · 8963c487
      Alan Stern authored
      This patch (as154) fixes a self-deadlock that occurs when userspace
      writes to the bConfigurationValue sysfs attribute for a hub with
      children.  The task tries to lock the bandwidth_mutex at a time when
      it already owns the lock:
      
      	The attribute's method calls usb_set_configuration(),
      	which calls usb_disable_device() with the bandwidth_mutex
      	held.
      
      	usb_disable_device() unregisters the existing interfaces,
      	which causes the hub driver to be unbound.
      
      	The hub_disconnect() routine calls hub_quiesce(), which
      	calls usb_disconnect() for each of the hub's children.
      
      	usb_disconnect() attempts to acquire the bandwidth_mutex
      	around a call to usb_disable_device().
      
      The solution is to make usb_disable_device() acquire the mutex for
      itself instead of requiring the caller to hold it.  Then the mutex can
      cover only the bandwidth deallocation operation and not the region
      where the interfaces are unregistered.
      
      This has the potential to change system behavior slightly when a
      config change races with another config or altsetting change.  Some of
      the bandwidth released from the old config might get claimed by the
      other config or altsetting, make it impossible to restore the old
      config in case of a failure.  But since we don't try to recover from
      config-change failures anyway, this doesn't matter.
      
      [This should be marked for stable kernels that contain the commit
      fccf4e86 "USB: Free bandwidth when
      usb_disable_device is called."
      That commit was marked for stable kernels as old as 2.6.32.]
      Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Signed-off-by: default avatarSarah Sharp <sarah.a.sharp@linux.intel.com>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      8963c487
  3. 16 Apr, 2012 4 commits
    • Greg Kroah-Hartman's avatar
      Merge tag 'fixes-for-v3.4-rc3' of... · edffaa03
      Greg Kroah-Hartman authored
      Merge tag 'fixes-for-v3.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus
      
      usb: fixes for v3.4-rc cycle
      
      Here are the fixes I have queued for v3.4-rc cycle so far.
      
      It includes fixes on many of the gadget drivers and a few
      of the UDC controller drivers.
      
      For musb we have a fix for a kernel oops when unloading
      omap2430.ko glue layer, proper error checking for pm_runtime_*,
      fix for the ULPI transfer block, and a bug fix in musb_cleanup_urb
      routine.
      
      For s3c-hsotg we have mostly FIFO-related fixes (proper TX FIFO
      allocation, TX FIFO corruption fix in DMA mode) but also a couple
      of minor fixes (fixing maximum packet size for ep0 and fix for
      big transfers with DMA).
      
      For the dwc3 driver we have a memory leak fix, a very important
      fix for USB30CV with SetFeature tests and the hability to handle
      ep0 requests bigger than wMaxPacketSize.
      
      On top of that there's a bunch of gadget driver minor fixes adding
      proper section annotations, and fixing up the sysfs interface for
      doing device-initiated connect/disconnect and so on.
      
      All patches have been pending on the mailing list for quite a while
      and look good for your for-linus branch.
      edffaa03
    • Linus Torvalds's avatar
      Linux 3.4-rc3 · e816b57a
      Linus Torvalds authored
      e816b57a
    • Linus Torvalds's avatar
      Merge branch 'fixes' of git://git.linaro.org/people/rmk/linux-arm · 9a8e5d41
      Linus Torvalds authored
      Pull ARM fixes from Russell King:
       "Nothing too disasterous, the biggest thing being the removal of the
        regulator support for vcore in the AMBA driver; only one SoC was using
        this and it got broken during the last merge window, which then
        started causing problems for other people.  Mutual agreement was
        reached for it to be removed."
      
      * 'fixes' of git://git.linaro.org/people/rmk/linux-arm:
        ARM: 7386/1: jump_label: fixup for rename to static_key
        ARM: 7384/1: ThumbEE: Disable userspace TEEHBR access for !CONFIG_ARM_THUMBEE
        ARM: 7382/1: mm: truncate memory banks to fit in 4GB space for classic MMU
        ARM: 7359/2: smp_twd: Only wait for reprogramming on active cpus
        ARM: 7383/1: nommu: populate vectors page from paging_init
        ARM: 7381/1: nommu: fix typo in mm/Kconfig
        ARM: 7380/1: DT: do not add a zero-sized memory property
        ARM: 7379/1: DT: fix atags_to_fdt() second call site
        ARM: 7366/3: amba: Remove AMBA level regulator support
        ARM: 7377/1: vic: re-read status register before dispatching each IRQ handler
        ARM: 7368/1: fault.c: correct how the tsk->[maj|min]_flt gets incremented
      9a8e5d41
    • Linus Torvalds's avatar
      x86-32: fix up strncpy_from_user() sign error · 12e993b8
      Linus Torvalds authored
      The 'max' range needs to be unsigned, since the size of the user address
      space is bigger than 2GB.
      
      We know that 'count' is positive in 'long' (that is checked in the
      caller), so we will truncate 'max' down to something that fits in a
      signed long, but before we actually do that, that comparison needs to be
      done in unsigned.
      
      Bug introduced in commit 92ae03f2 ("x86: merge 32/64-bit versions of
      'strncpy_from_user()' and speed it up").  On x86-64 you can't trigger
      this, since the user address space is much smaller than 63 bits, and on
      x86-32 it works in practice, since you would seldom hit the strncpy
      limits anyway.
      
      I had actually tested the corner-cases, I had only tested them on
      x86-64.  Besides, I had only worried about the case of a pointer *close*
      to the end of the address space, rather than really far away from it ;)
      
      This also changes the "we hit the user-specified maximum" to return
      'res', for the trivial reason that gcc seems to generate better code
      that way.  'res' and 'count' are the same in that case, so it really
      doesn't matter which one we return.
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      12e993b8
  4. 15 Apr, 2012 12 commits
  5. 14 Apr, 2012 13 commits
  6. 13 Apr, 2012 1 commit