usb-io_ti-fix-port-data-memory-leak.patch
usb-io_ti-fix-sysfs-attribute-creation.patch
usb-cyberjack-fix-port-data-memory-leak.patch
+usb-musb-am35xx-drop-spurious-unplugging-a-device.patch
+usb-host-xhci-new-system-added-for-compliance-mode-patch-on-sn65lvpe502cp.patch
+usb-iuu_phoenix-fix-port-data-memory-leak.patch
--- /dev/null
+From 470809741a28c3092279f4e1f3f432e534d46068 Mon Sep 17 00:00:00 2001
+From: "Alexis R. Cortes" <alexis.cortes@ti.com>
+Date: Wed, 17 Oct 2012 14:09:12 -0500
+Subject: usb: host: xhci: New system added for Compliance Mode Patch on SN65LVPE502CP
+
+From: "Alexis R. Cortes" <alexis.cortes@ti.com>
+
+commit 470809741a28c3092279f4e1f3f432e534d46068 upstream.
+
+This minor change adds a new system to which the "Fix Compliance Mode
+on SN65LVPE502CP Hardware" patch has to be applied also.
+
+System added:
+Vendor: Hewlett-Packard. System Model: Z1
+
+Signed-off-by: Alexis R. Cortes <alexis.cortes@ti.com>
+Acked-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -479,7 +479,8 @@ static bool compliance_mode_recovery_tim
+
+ if (strstr(dmi_product_name, "Z420") ||
+ strstr(dmi_product_name, "Z620") ||
+- strstr(dmi_product_name, "Z820"))
++ strstr(dmi_product_name, "Z820") ||
++ strstr(dmi_product_name, "Z1"))
+ return true;
+
+ return false;
--- /dev/null
+From 53636555b9190f88320d9d46cf142f8797895456 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Wed, 17 Oct 2012 13:34:59 +0200
+Subject: USB: iuu_phoenix: fix port-data memory leak
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 53636555b9190f88320d9d46cf142f8797895456 upstream.
+
+Fix port-data memory leak by replacing attach and release with
+port_probe and port_remove.
+
+Since commit 0998d0631001288 (device-core: Ensure drvdata = NULL when no
+driver is bound) the port private data is no longer freed at release as
+it is no longer accessible.
+
+Compile-only tested.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+--- a/drivers/usb/serial/iuu_phoenix.c
++++ b/drivers/usb/serial/iuu_phoenix.c
+@@ -72,63 +72,45 @@ struct iuu_private {
+ u32 clk;
+ };
+
+-
+-static void iuu_free_buf(struct iuu_private *priv)
+-{
+- kfree(priv->buf);
+- kfree(priv->writebuf);
+-}
+-
+-static int iuu_alloc_buf(struct usb_serial *serial, struct iuu_private *priv)
+-{
+- priv->buf = kzalloc(256, GFP_KERNEL);
+- priv->writebuf = kzalloc(256, GFP_KERNEL);
+- if (!priv->buf || !priv->writebuf) {
+- iuu_free_buf(priv);
+- dev_dbg(&serial->dev->dev, "%s problem allocation buffer\n", __func__);
+- return -ENOMEM;
+- }
+- dev_dbg(&serial->dev->dev, "%s - Privates buffers allocation success\n", __func__);
+- return 0;
+-}
+-
+-static int iuu_startup(struct usb_serial *serial)
++static int iuu_port_probe(struct usb_serial_port *port)
+ {
+ struct iuu_private *priv;
+
+ priv = kzalloc(sizeof(struct iuu_private), GFP_KERNEL);
+- dev_dbg(&serial->dev->dev, "%s- priv allocation success\n", __func__);
+ if (!priv)
+ return -ENOMEM;
+- if (iuu_alloc_buf(serial, priv)) {
++
++ priv->buf = kzalloc(256, GFP_KERNEL);
++ if (!priv->buf) {
+ kfree(priv);
+ return -ENOMEM;
+ }
++
++ priv->writebuf = kzalloc(256, GFP_KERNEL);
++ if (!priv->writebuf) {
++ kfree(priv->buf);
++ kfree(priv);
++ return -ENOMEM;
++ }
++
+ priv->vcc = vcc_default;
+ spin_lock_init(&priv->lock);
+ init_waitqueue_head(&priv->delta_msr_wait);
+- usb_set_serial_port_data(serial->port[0], priv);
++
++ usb_set_serial_port_data(port, priv);
++
+ return 0;
+ }
+
+-/* Release function */
+-static void iuu_release(struct usb_serial *serial)
++static int iuu_port_remove(struct usb_serial_port *port)
+ {
+- struct usb_serial_port *port = serial->port[0];
+ struct iuu_private *priv = usb_get_serial_port_data(port);
+- if (!port)
+- return;
+-
+- if (priv) {
+- iuu_free_buf(priv);
+- dev_dbg(&port->dev, "%s - I will free all\n", __func__);
+- usb_set_serial_port_data(port, NULL);
+
+- dev_dbg(&port->dev, "%s - priv is not anymore in port structure\n", __func__);
+- kfree(priv);
++ kfree(priv->writebuf);
++ kfree(priv->buf);
++ kfree(priv);
+
+- dev_dbg(&port->dev, "%s priv is now kfree\n", __func__);
+- }
++ return 0;
+ }
+
+ static int iuu_tiocmset(struct tty_struct *tty,
+@@ -1225,8 +1207,8 @@ static struct usb_serial_driver iuu_device = {
+ .tiocmset = iuu_tiocmset,
+ .set_termios = iuu_set_termios,
+ .init_termios = iuu_init_termios,
+- .attach = iuu_startup,
+- .release = iuu_release,
++ .port_probe = iuu_port_probe,
++ .port_remove = iuu_port_remove,
+ };
+
+ static struct usb_serial_driver * const serial_drivers[] = {
--- /dev/null
+From 6ff1f3d3bd7c69c62ca5773b1b684bce42eff06a Mon Sep 17 00:00:00 2001
+From: Stefano Babic <sbabic@denx.de>
+Date: Mon, 15 Oct 2012 11:20:22 +0200
+Subject: usb: musb: am35xx: drop spurious unplugging a device
+
+From: Stefano Babic <sbabic@denx.de>
+
+commit 6ff1f3d3bd7c69c62ca5773b1b684bce42eff06a upstream.
+
+On AM3517, tx and rx interrupt are detected together with
+the disconnect event. This generates a kernel panic in musb_interrupt,
+because rx / tx are handled after disconnect.
+This issue was seen on a Technexion's TAM3517 SOM. Unplugging a device,
+tx / rx interrupts together with disconnect are detected. This brings
+to kernel panic like this:
+
+[ 68.526153] Unable to handle kernel NULL pointer dereference at virtual address 00000011
+[ 68.534698] pgd = c0004000
+[ 68.537536] [00000011] *pgd=00000000
+[ 68.541351] Internal error: Oops: 17 [#1] ARM
+[ 68.545928] Modules linked in:
+[ 68.549163] CPU: 0 Not tainted (3.6.0-rc5-00020-g9e05905 #178)
+[ 68.555694] PC is at rxstate+0x8/0xdc
+[ 68.559539] LR is at musb_interrupt+0x98/0x858
+[ 68.564239] pc : [<c035cd88>] lr : [<c035af1c>] psr: 40000193
+[ 68.564239] sp : ce83fb40 ip : d0906410 fp : 00000000
+[ 68.576293] r10: 00000000 r9 : cf3b0e40 r8 : 00000002
+[ 68.581817] r7 : 00000019 r6 : 00000001 r5 : 00000001 r4 : 000000d4
+[ 68.588684] r3 : 00000000 r2 : 00000000 r1 : ffffffcc r0 : cf23c108
+[ 68.595550] Flags: nZcv IRQs off FIQs on Mode SVC_32 ISA ARM Segment ke
+
+Note: this behavior is not seen with a USB hub, while it is
+easy to reproduce connecting a USB-pen directly to the USB-A of
+the board.
+
+Drop tx / rx interrupts if disconnect is detected.
+
+Signed-off-by: Stefano Babic <sbabic@denx.de>
+CC: Felipe Balbi <balbi@ti.com>
+Tested-by: Dmitry Lifshitz <lifshitz@compulab.co.il>
+Tested-by: Igor Grinberg <grinberg@compulab.co.il>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/am35x.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/musb/am35x.c
++++ b/drivers/usb/musb/am35x.c
+@@ -312,6 +312,12 @@ static irqreturn_t am35x_musb_interrupt(
+ ret = IRQ_HANDLED;
+ }
+
++ /* Drop spurious RX and TX if device is disconnected */
++ if (musb->int_usb & MUSB_INTR_DISCONNECT) {
++ musb->int_tx = 0;
++ musb->int_rx = 0;
++ }
++
+ if (musb->int_tx || musb->int_rx || musb->int_usb)
+ ret |= musb_interrupt(musb);
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
