--- /dev/null
+From 96696a9df935d15fd2e89603454c20a692ec232a Mon Sep 17 00:00:00 2001
+From: Thomas Hebb <tommyhebb@gmail.com>
+Date: Thu, 2 Jul 2015 01:04:18 -0400
+Subject: phy: berlin-usb: fix divider for BG2CD
+
+From: Thomas Hebb <tommyhebb@gmail.com>
+
+commit 96696a9df935d15fd2e89603454c20a692ec232a upstream.
+
+The marvell,berlin2cd-usb-phy compatible incorrectly sets the PLL
+divider to BG2's value instead of BG2CD/BG2Q's. Change it to the right
+value.
+
+Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/phy/phy-berlin-usb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/phy/phy-berlin-usb.c
++++ b/drivers/phy/phy-berlin-usb.c
+@@ -106,8 +106,8 @@
+ static const u32 phy_berlin_pll_dividers[] = {
+ /* Berlin 2 */
+ CLK_REF_DIV(0xc) | FEEDBACK_CLK_DIV(0x54),
+- /* Berlin 2CD */
+- CLK_REF_DIV(0x6) | FEEDBACK_CLK_DIV(0x55),
++ /* Berlin 2CD/Q */
++ CLK_REF_DIV(0xc) | FEEDBACK_CLK_DIV(0x54),
+ };
+
+ struct phy_berlin_usb_priv {
--- /dev/null
+From 4724e27114c4a7eceeee07db227a17fcab6f165c Mon Sep 17 00:00:00 2001
+From: NeilBrown <neil@brown.name>
+Date: Thu, 16 Apr 2015 18:03:04 +1000
+Subject: phy: twl4030-usb: remove incorrect pm_runtime_get_sync() in probe function.
+
+From: NeilBrown <neil@brown.name>
+
+commit 4724e27114c4a7eceeee07db227a17fcab6f165c upstream.
+
+The USB phy should initialize with power-off, and will be powered on
+by the USB system when a cable connection is detected.
+
+Having this pm_runtime_get_sync() during probe causes the phy to
+*always* be powered on.
+Removing it returns to sensible power management.
+
+Fixes: 96be39ab34b77c6f6f5cd6ae03aac6c6449ee5c4
+Signed-off-by: NeilBrown <neil@brown.name>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/phy/phy-twl4030-usb.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/phy/phy-twl4030-usb.c
++++ b/drivers/phy/phy-twl4030-usb.c
+@@ -711,7 +711,6 @@ static int twl4030_usb_probe(struct plat
+ pm_runtime_use_autosuspend(&pdev->dev);
+ pm_runtime_set_autosuspend_delay(&pdev->dev, 2000);
+ pm_runtime_enable(&pdev->dev);
+- pm_runtime_get_sync(&pdev->dev);
+
+ /* Our job is to use irqs and status from the power module
+ * to keep the transceiver disabled when nothing's connected.
libata-add-ata_horkage_max_sec_1024-to-revert-back-to-previous-max_sectors-limit.patch
libata-do-not-blacklist-m510dc.patch
libata-force-disable-trim-for-supersspeed-s238.patch
+usb-dwc3-gadget-return-error-if-command-sent-to-dgcmd-register-fails.patch
+usb-dwc3-gadget-return-error-if-command-sent-to-depcmd-register-fails.patch
+usb-dwc3-gadget-don-t-clear-ep_busy-too-early.patch
+usb-dwc3-reset-the-transfer-resource-index-on-set_interface.patch
+usb-core-fix-usb-3.0-devices-lost-in-notattached-state-after-a-hub-port-reset.patch
+usb-devio-fix-a-condition-in-async_completed.patch
+phy-twl4030-usb-remove-incorrect-pm_runtime_get_sync-in-probe-function.patch
+usb-phy-mxs-suspend-to-ram-causes-null-pointer-dereference.patch
+phy-berlin-usb-fix-divider-for-bg2cd.patch
+usb-gadget-composite-fix-null-pointer-dereference.patch
+usb-gadget-f_fs-do-not-set-cancel-function-on-synchronous-read-write.patch
+usb-gadget-mv_udc_core-fix-phy_regs-i-o-memory-leak.patch
+usb-f_mass_storage-limit-number-of-reported-luns.patch
+usb-musb-host-rely-on-port_mode-to-call-musb_start.patch
+usb-cp210x-add-id-for-aruba-networks-controllers.patch
+usb-option-add-2020-4000-id.patch
+usb-serial-destroy-serial_minors-idr-on-module-exit.patch
+usb-ohci-fix-race-between-ed-unlink-and-urb-submission.patch
+usb-core-lpm-set-lpm_capable-for-root-hub-device.patch
+usb-xhci-bugfix-for-null-pointer-deference-in-xhci_endpoint_init-function.patch
--- /dev/null
+From fb6d1f7df5d25299fd7b3e84b72b8851d3634764 Mon Sep 17 00:00:00 2001
+From: Robert Schlabbach <Robert.Schlabbach@gmx.net>
+Date: Tue, 26 May 2015 00:27:30 +0200
+Subject: usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset
+
+From: Robert Schlabbach <Robert.Schlabbach@gmx.net>
+
+commit fb6d1f7df5d25299fd7b3e84b72b8851d3634764 upstream.
+
+Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset.
+
+Dissolve the function hub_port_finish_reset() completely and divide the
+actions to be taken into those which need to be done after each reset
+attempt and those which need to be done after the full procedure is
+complete, and place them in the appropriate places in hub_port_reset().
+Also, remove an unneeded forward declaration of hub_port_reset().
+
+Verbose Problem Description:
+
+USB 3.0 devices may be "lost for good" during a hub port reset.
+This makes Linux unable to boot from USB 3.0 devices in certain
+constellations of host controllers and devices, because the USB device is
+lost during initialization, preventing the rootfs from being mounted.
+
+The underlying problem is that in the affected constellations, during the
+processing inside hub_port_reset(), the hub link state goes from 0 to
+SS.inactive after the initial reset, and back to 0 again only after the
+following "warm" reset.
+
+However, hub_port_finish_reset() is called after each reset attempt and
+sets the state the connected USB device based on the "preliminary" status
+of the hot reset to USB_STATE_NOTATTACHED due to SS.inactive, yet when
+the following warm reset is complete and hub_port_finish_reset() is
+called again, its call to set the device to USB_STATE_DEFAULT is blocked
+by usb_set_device_state() which does not allow taking USB devices out of
+USB_STATE_NOTATTACHED state.
+
+Thanks to Alan Stern for guiding me to the proper solution and how to
+submit it.
+
+Link: http://lkml.kernel.org/r/trinity-25981484-72a9-4d46-bf17-9c1cf9301a31-1432073240136%20()%203capp-gmx-bs27
+Signed-off-by: Robert Schlabbach <robert_s@gmx.net>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hub.c | 82 +++++++++++++++++++------------------------------
+ 1 file changed, 33 insertions(+), 49 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2616,9 +2616,6 @@ static bool use_new_scheme(struct usb_de
+ return USE_NEW_SCHEME(retry);
+ }
+
+-static int hub_port_reset(struct usb_hub *hub, int port1,
+- struct usb_device *udev, unsigned int delay, bool warm);
+-
+ /* Is a USB 3.0 port in the Inactive or Compliance Mode state?
+ * Port worm reset is required to recover
+ */
+@@ -2706,44 +2703,6 @@ static int hub_port_wait_reset(struct us
+ return 0;
+ }
+
+-static void hub_port_finish_reset(struct usb_hub *hub, int port1,
+- struct usb_device *udev, int *status)
+-{
+- switch (*status) {
+- case 0:
+- /* TRSTRCY = 10 ms; plus some extra */
+- msleep(10 + 40);
+- if (udev) {
+- struct usb_hcd *hcd = bus_to_hcd(udev->bus);
+-
+- update_devnum(udev, 0);
+- /* The xHC may think the device is already reset,
+- * so ignore the status.
+- */
+- if (hcd->driver->reset_device)
+- hcd->driver->reset_device(hcd, udev);
+- }
+- /* FALL THROUGH */
+- case -ENOTCONN:
+- case -ENODEV:
+- usb_clear_port_feature(hub->hdev,
+- port1, USB_PORT_FEAT_C_RESET);
+- if (hub_is_superspeed(hub->hdev)) {
+- usb_clear_port_feature(hub->hdev, port1,
+- USB_PORT_FEAT_C_BH_PORT_RESET);
+- usb_clear_port_feature(hub->hdev, port1,
+- USB_PORT_FEAT_C_PORT_LINK_STATE);
+- usb_clear_port_feature(hub->hdev, port1,
+- USB_PORT_FEAT_C_CONNECTION);
+- }
+- if (udev)
+- usb_set_device_state(udev, *status
+- ? USB_STATE_NOTATTACHED
+- : USB_STATE_DEFAULT);
+- break;
+- }
+-}
+-
+ /* Handle port reset and port warm(BH) reset (for USB3 protocol ports) */
+ static int hub_port_reset(struct usb_hub *hub, int port1,
+ struct usb_device *udev, unsigned int delay, bool warm)
+@@ -2767,13 +2726,10 @@ static int hub_port_reset(struct usb_hub
+ * If the caller hasn't explicitly requested a warm reset,
+ * double check and see if one is needed.
+ */
+- status = hub_port_status(hub, port1,
+- &portstatus, &portchange);
+- if (status < 0)
+- goto done;
+-
+- if (hub_port_warm_reset_required(hub, port1, portstatus))
+- warm = true;
++ if (hub_port_status(hub, port1, &portstatus, &portchange) == 0)
++ if (hub_port_warm_reset_required(hub, port1,
++ portstatus))
++ warm = true;
+ }
+ clear_bit(port1, hub->warm_reset_bits);
+
+@@ -2799,11 +2755,19 @@ static int hub_port_reset(struct usb_hub
+
+ /* Check for disconnect or reset */
+ if (status == 0 || status == -ENOTCONN || status == -ENODEV) {
+- hub_port_finish_reset(hub, port1, udev, &status);
++ usb_clear_port_feature(hub->hdev, port1,
++ USB_PORT_FEAT_C_RESET);
+
+ if (!hub_is_superspeed(hub->hdev))
+ goto done;
+
++ usb_clear_port_feature(hub->hdev, port1,
++ USB_PORT_FEAT_C_BH_PORT_RESET);
++ usb_clear_port_feature(hub->hdev, port1,
++ USB_PORT_FEAT_C_PORT_LINK_STATE);
++ usb_clear_port_feature(hub->hdev, port1,
++ USB_PORT_FEAT_C_CONNECTION);
++
+ /*
+ * If a USB 3.0 device migrates from reset to an error
+ * state, re-issue the warm reset.
+@@ -2836,6 +2800,26 @@ static int hub_port_reset(struct usb_hub
+ dev_err(&port_dev->dev, "Cannot enable. Maybe the USB cable is bad?\n");
+
+ done:
++ if (status == 0) {
++ /* TRSTRCY = 10 ms; plus some extra */
++ msleep(10 + 40);
++ if (udev) {
++ struct usb_hcd *hcd = bus_to_hcd(udev->bus);
++
++ update_devnum(udev, 0);
++ /* The xHC may think the device is already reset,
++ * so ignore the status.
++ */
++ if (hcd->driver->reset_device)
++ hcd->driver->reset_device(hcd, udev);
++
++ usb_set_device_state(udev, USB_STATE_DEFAULT);
++ }
++ } else {
++ if (udev)
++ usb_set_device_state(udev, USB_STATE_NOTATTACHED);
++ }
++
+ if (!hub_is_superspeed(hub->hdev))
+ up_read(&ehci_cf_port_reset_rwsem);
+
--- /dev/null
+From 2d2a316765d956bc5cb6bb367b2ec52ca59ab8e9 Mon Sep 17 00:00:00 2001
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Tue, 16 Jun 2015 09:08:26 +0800
+Subject: usb: core: lpm: set lpm_capable for root hub device
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+commit 2d2a316765d956bc5cb6bb367b2ec52ca59ab8e9 upstream.
+
+Commit 25cd2882e2fc ("usb/xhci: Change how we indicate a host supports
+Link PM.") removed the code to set lpm_capable for USB 3.0 super-speed
+root hub. The intention of that change was to avoid touching usb core
+internal field, a.k.a. lpm_capable, and let usb core to set it by
+checking U1 and U2 exit latency values in the descriptor.
+
+Usb core checks and sets lpm_capable in hub_port_init(). Unfortunately,
+root hub is a special usb device as it has no parent. Hub_port_init()
+will never be called for a root hub device. That means lpm_capable will
+by no means be set for the root hub. As the result, lpm isn't functional
+at all in Linux kernel.
+
+This patch add the code to check and set lpm_capable when registering a
+root hub device. It could be back-ported to kernels as old as v3.15,
+that contains the Commit 25cd2882e2fc ("usb/xhci: Change how we indicate
+a host supports Link PM.").
+
+Reported-by: Kevin Strasser <kevin.strasser@linux.intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hcd.c | 7 +++++--
+ drivers/usb/core/hub.c | 2 +-
+ drivers/usb/core/usb.h | 1 +
+ 3 files changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1022,9 +1022,12 @@ static int register_root_hub(struct usb_
+ dev_name(&usb_dev->dev), retval);
+ return (retval < 0) ? retval : -EMSGSIZE;
+ }
+- if (usb_dev->speed == USB_SPEED_SUPER) {
++
++ if (le16_to_cpu(usb_dev->descriptor.bcdUSB) >= 0x0201) {
+ retval = usb_get_bos_descriptor(usb_dev);
+- if (retval < 0) {
++ if (!retval) {
++ usb_dev->lpm_capable = usb_device_supports_lpm(usb_dev);
++ } else if (usb_dev->speed == USB_SPEED_SUPER) {
+ mutex_unlock(&usb_bus_list_lock);
+ dev_dbg(parent_dev, "can't read %s bos descriptor %d\n",
+ dev_name(&usb_dev->dev), retval);
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -122,7 +122,7 @@ struct usb_hub *usb_hub_to_struct_hub(st
+ return usb_get_intfdata(hdev->actconfig->interface[0]);
+ }
+
+-static int usb_device_supports_lpm(struct usb_device *udev)
++int usb_device_supports_lpm(struct usb_device *udev)
+ {
+ /* USB 2.1 (and greater) devices indicate LPM support through
+ * their USB 2.0 Extended Capabilities BOS descriptor.
+--- a/drivers/usb/core/usb.h
++++ b/drivers/usb/core/usb.h
+@@ -65,6 +65,7 @@ extern int usb_hub_init(void);
+ extern void usb_hub_cleanup(void);
+ extern int usb_major_init(void);
+ extern void usb_major_cleanup(void);
++extern int usb_device_supports_lpm(struct usb_device *udev);
+
+ #ifdef CONFIG_PM
+
--- /dev/null
+From f98a7aa81eeeadcad25665c3501c236d531d4382 Mon Sep 17 00:00:00 2001
+From: Peter Sanford <peter@sanford.io>
+Date: Thu, 25 Jun 2015 17:40:05 -0700
+Subject: USB: cp210x: add ID for Aruba Networks controllers
+
+From: Peter Sanford <peter@sanford.io>
+
+commit f98a7aa81eeeadcad25665c3501c236d531d4382 upstream.
+
+Add the USB serial console device ID for Aruba Networks 7xxx series
+controllers which have a USB port for their serial console.
+
+Signed-off-by: Peter Sanford <peter@sanford.io>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/cp210x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -187,6 +187,7 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */
+ { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */
+ { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */
++ { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */
+ { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
+ { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
+ { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
--- /dev/null
+From 83ed07c5db71bc02bd646d6eb60b48908235cdf9 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 18 May 2015 15:29:51 +0300
+Subject: USB: devio: fix a condition in async_completed()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 83ed07c5db71bc02bd646d6eb60b48908235cdf9 upstream.
+
+Static checkers complain that the current condition is never true. It
+seems pretty likely that it's a typo and "URB" was intended instead of
+"USB".
+
+Fixes: 3d97ff63f899 ('usbdevfs: Use scatter-gather lists for large bulk transfers')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/devio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -513,7 +513,7 @@ static void async_completed(struct urb *
+ snoop(&urb->dev->dev, "urb complete\n");
+ snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length,
+ as->status, COMPLETE, NULL, 0);
+- if ((urb->transfer_flags & URB_DIR_MASK) == USB_DIR_IN)
++ if ((urb->transfer_flags & URB_DIR_MASK) == URB_DIR_IN)
+ snoop_urb_data(urb, urb->actual_length);
+
+ if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
--- /dev/null
+From e18b7975c885bc3a938b9a76daf32957ea0235fa Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <balbi@ti.com>
+Date: Fri, 29 May 2015 10:06:38 -0500
+Subject: usb: dwc3: gadget: don't clear EP_BUSY too early
+
+From: Felipe Balbi <balbi@ti.com>
+
+commit e18b7975c885bc3a938b9a76daf32957ea0235fa upstream.
+
+In case of non-Isochronous transfers, we don't
+want to clear DWC3_EP_BUSY flag until XferComplete
+event. That's because XferInProgress was only enabled
+so we can recycle TRBs and usb_requests quicker, but
+there are still other pending requests being transferred.
+
+In order to make sure we don't allow for another StartTransfer
+command while the HW is still processing other transfers,
+we must keep DWC3_EP_BUSY flag set and this what this patch
+does.
+
+Fixes: f3af36511e60 (usb: dwc3: gadget: always enable IOC on
+ bulk/interrupt transfers)
+Reported-by: sundeep subbaraya <sundeep.lkml@gmail.com>
+Tested-by: sundeep subbaraya <sundeep.lkml@gmail.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1906,12 +1906,16 @@ static void dwc3_endpoint_transfer_compl
+ {
+ unsigned status = 0;
+ int clean_busy;
++ u32 is_xfer_complete;
++
++ is_xfer_complete = (event->endpoint_event == DWC3_DEPEVT_XFERCOMPLETE);
+
+ if (event->status & DEPEVT_STATUS_BUSERR)
+ status = -ECONNRESET;
+
+ clean_busy = dwc3_cleanup_done_reqs(dwc, dep, event, status);
+- if (clean_busy)
++ if (clean_busy && (is_xfer_complete ||
++ usb_endpoint_xfer_isoc(dep->endpoint.desc)))
+ dep->flags &= ~DWC3_EP_BUSY;
+
+ /*
--- /dev/null
+From 76e838c9f7765f9a6205b4d558d75a66104bc60d Mon Sep 17 00:00:00 2001
+From: Subbaraya Sundeep Bhatta <subbaraya.sundeep.bhatta@xilinx.com>
+Date: Thu, 21 May 2015 15:46:48 +0530
+Subject: usb: dwc3: gadget: return error if command sent to DEPCMD register fails
+
+From: Subbaraya Sundeep Bhatta <subbaraya.sundeep.bhatta@xilinx.com>
+
+commit 76e838c9f7765f9a6205b4d558d75a66104bc60d upstream.
+
+We need to return error to caller if command is not sent to
+controller succesfully.
+
+Signed-off-by: Subbaraya Sundeep Bhatta <sbhatta@xilinx.com>
+Fixes: 72246da40f37 (usb: Introduce DesignWare USB3 DRD Driver)
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -330,6 +330,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3
+ dwc3_trace(trace_dwc3_gadget,
+ "Command Complete --> %d",
+ DWC3_DEPCMD_STATUS(reg));
++ if (DWC3_DEPCMD_STATUS(reg))
++ return -EINVAL;
+ return 0;
+ }
+
--- /dev/null
+From 891b1dc022955d36cf4c0f42d383226a930db7ed Mon Sep 17 00:00:00 2001
+From: Subbaraya Sundeep Bhatta <subbaraya.sundeep.bhatta@xilinx.com>
+Date: Thu, 21 May 2015 15:46:47 +0530
+Subject: usb: dwc3: gadget: return error if command sent to DGCMD register fails
+
+From: Subbaraya Sundeep Bhatta <subbaraya.sundeep.bhatta@xilinx.com>
+
+commit 891b1dc022955d36cf4c0f42d383226a930db7ed upstream.
+
+We need to return error to caller if command is not sent to
+controller succesfully.
+
+Signed-off-by: Subbaraya Sundeep Bhatta <sbhatta@xilinx.com>
+Fixes: b09bb64239c8 (usb: dwc3: gadget: implement Global Command support)
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -291,6 +291,8 @@ int dwc3_send_gadget_generic_command(str
+ dwc3_trace(trace_dwc3_gadget,
+ "Command Complete --> %d",
+ DWC3_DGCMD_STATUS(reg));
++ if (DWC3_DGCMD_STATUS(reg))
++ return -EINVAL;
+ return 0;
+ }
+
--- /dev/null
+From aebda618718157a69c0dc0adb978d69bc2b8723c Mon Sep 17 00:00:00 2001
+From: John Youn <John.Youn@synopsys.com>
+Date: Mon, 17 Sep 2001 00:00:00 -0700
+Subject: usb: dwc3: Reset the transfer resource index on SET_INTERFACE
+
+From: John Youn <John.Youn@synopsys.com>
+
+commit aebda618718157a69c0dc0adb978d69bc2b8723c upstream.
+
+This fixes an issue introduced in commit b23c843992b6 (usb: dwc3:
+gadget: fix DEPSTARTCFG for non-EP0 EPs) that made sure we would
+only use DEPSTARTCFG once per SetConfig.
+
+The trick is that we should use one DEPSTARTCFG per SetConfig *OR*
+SetInterface. SetInterface was completely missed from the original
+patch.
+
+This problem became aparent after commit 76e838c9f776 (usb: dwc3:
+gadget: return error if command sent to DEPCMD register fails)
+added checking of the return status of device endpoint commands.
+
+'Set Endpoint Transfer Resource' command was caught failing
+occasionally. This is because the Transfer Resource
+Index was not getting reset during a SET_INTERFACE request.
+
+Finally, to fix the issue, was we have to do is make sure that
+our start_config_issued flag gets reset whenever we receive a
+SetInterface request.
+
+To verify the problem (and its fix), all we have to do is run
+test 9 from testusb with 'testusb -t 9 -s 2048 -a -c 5000'.
+
+Tested-by: Huang Rui <ray.huang@amd.com>
+Tested-by: Subbaraya Sundeep Bhatta <subbaraya.sundeep.bhatta@xilinx.com>
+Fixes: b23c843992b6 (usb: dwc3: gadget: fix DEPSTARTCFG for non-EP0 EPs)
+Signed-off-by: John Youn <johnyoun@synopsys.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/ep0.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -727,6 +727,10 @@ static int dwc3_ep0_std_request(struct d
+ dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_ISOCH_DELAY");
+ ret = dwc3_ep0_set_isoch_delay(dwc, ctrl);
+ break;
++ case USB_REQ_SET_INTERFACE:
++ dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_INTERFACE");
++ dwc->start_config_issued = false;
++ /* Fall through */
+ default:
+ dwc3_trace(trace_dwc3_ep0, "Forwarding to gadget driver");
+ ret = dwc3_ep0_delegate_req(dwc, ctrl);
--- /dev/null
+From 8515bac01a983d277148e4fcc5f235bf603de577 Mon Sep 17 00:00:00 2001
+From: Michal Nazarewicz <mina86@mina86.com>
+Date: Fri, 19 Jun 2015 23:56:34 +0200
+Subject: usb: f_mass_storage: limit number of reported LUNs
+
+From: Michal Nazarewicz <mina86@mina86.com>
+
+commit 8515bac01a983d277148e4fcc5f235bf603de577 upstream.
+
+Mass storage function created via configfs always reports eight LUNs
+to the hosts even if only one LUN has been configured. Adjust the
+number when the USB function is allocated based on LUNs that user
+has created.
+
+Tested-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_mass_storage.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/gadget/function/f_mass_storage.c
++++ b/drivers/usb/gadget/function/f_mass_storage.c
+@@ -2786,7 +2786,7 @@ int fsg_common_set_nluns(struct fsg_comm
+ return -EINVAL;
+ }
+
+- curlun = kcalloc(nluns, sizeof(*curlun), GFP_KERNEL);
++ curlun = kcalloc(FSG_MAX_LUNS, sizeof(*curlun), GFP_KERNEL);
+ if (unlikely(!curlun))
+ return -ENOMEM;
+
+@@ -2796,8 +2796,6 @@ int fsg_common_set_nluns(struct fsg_comm
+ common->luns = curlun;
+ common->nluns = nluns;
+
+- pr_info("Number of LUNs=%d\n", common->nluns);
+-
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(fsg_common_set_nluns);
+@@ -3563,14 +3561,26 @@ static struct usb_function *fsg_alloc(st
+ struct fsg_opts *opts = fsg_opts_from_func_inst(fi);
+ struct fsg_common *common = opts->common;
+ struct fsg_dev *fsg;
++ unsigned nluns, i;
+
+ fsg = kzalloc(sizeof(*fsg), GFP_KERNEL);
+ if (unlikely(!fsg))
+ return ERR_PTR(-ENOMEM);
+
+ mutex_lock(&opts->lock);
++ if (!opts->refcnt) {
++ for (nluns = i = 0; i < FSG_MAX_LUNS; ++i)
++ if (common->luns[i])
++ nluns = i + 1;
++ if (!nluns)
++ pr_warn("No LUNS defined, continuing anyway\n");
++ else
++ common->nluns = nluns;
++ pr_info("Number of LUNs=%u\n", common->nluns);
++ }
+ opts->refcnt++;
+ mutex_unlock(&opts->lock);
++
+ fsg->function.name = FSG_DRIVER_DESC;
+ fsg->function.bind = fsg_bind;
+ fsg->function.unbind = fsg_unbind;
--- /dev/null
+From b4c21f0bdd2c0cd5d5be1bb56f0a28dae5041eed Mon Sep 17 00:00:00 2001
+From: Kishon Vijay Abraham I <kishon@ti.com>
+Date: Thu, 11 Jun 2015 22:12:11 +0530
+Subject: usb: gadget: composite: Fix NULL pointer dereference
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+commit b4c21f0bdd2c0cd5d5be1bb56f0a28dae5041eed upstream.
+
+commit f563d230903210acc ("usb: gadget: composite: add req_match method
+to usb_function") accesses cdev->config even before set config
+is invoked causing a NULL pointer dereferencing error while running
+Lecroy Mass Storage Compliance test.
+
+Fix it here by accessing cdev->config only if it is non NULL.
+
+Fixes: commit f563d230903210acc ("usb: gadget: composite: add req_match
+method to usb_function").
+
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/composite.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -1758,10 +1758,13 @@ unknown:
+ * take such requests too, if that's ever needed: to work
+ * in config 0, etc.
+ */
+- list_for_each_entry(f, &cdev->config->functions, list)
+- if (f->req_match && f->req_match(f, ctrl))
+- goto try_fun_setup;
+- f = NULL;
++ if (cdev->config) {
++ list_for_each_entry(f, &cdev->config->functions, list)
++ if (f->req_match && f->req_match(f, ctrl))
++ goto try_fun_setup;
++ f = NULL;
++ }
++
+ switch (ctrl->bRequestType & USB_RECIP_MASK) {
+ case USB_RECIP_INTERFACE:
+ if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
--- /dev/null
+From 4088acf1e845aba35f30fb91dee10649edbd0e84 Mon Sep 17 00:00:00 2001
+From: Rui Miguel Silva <rui.silva@linaro.org>
+Date: Mon, 18 May 2015 16:02:07 +0100
+Subject: usb: gadget: f_fs: do not set cancel function on synchronous {read,write}
+
+From: Rui Miguel Silva <rui.silva@linaro.org>
+
+commit 4088acf1e845aba35f30fb91dee10649edbd0e84 upstream.
+
+do not try to set cancel function in synchronous operations in
+ffs_epfile_{read,write}_iter.
+
+Acked-by: Al Viro <viro@ZenIV.linux.org.uk>
+Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_fs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -924,7 +924,8 @@ static ssize_t ffs_epfile_write_iter(str
+
+ kiocb->private = p;
+
+- kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
++ if (p->aio)
++ kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
+
+ res = ffs_epfile_io(kiocb->ki_filp, p);
+ if (res == -EIOCBQUEUED)
+@@ -968,7 +969,8 @@ static ssize_t ffs_epfile_read_iter(stru
+
+ kiocb->private = p;
+
+- kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
++ if (p->aio)
++ kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
+
+ res = ffs_epfile_io(kiocb->ki_filp, p);
+ if (res == -EIOCBQUEUED)
--- /dev/null
+From 53e20f2eb161fbe9eea28b54dccc870cec94eca2 Mon Sep 17 00:00:00 2001
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Date: Sun, 19 Jul 2015 23:13:28 +0700
+Subject: usb: gadget: mv_udc_core: fix phy_regs I/O memory leak
+
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+
+commit 53e20f2eb161fbe9eea28b54dccc870cec94eca2 upstream.
+
+There was an omission in transition to devm_xxx resource handling.
+iounmap(udc->phy_regs) were removed, but ioremap() was left
+without devm_.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Fixes: 3517c31a8ece6 ("usb: gadget: mv_udc: use devm_xxx for probe")
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/mv_udc_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/udc/mv_udc_core.c
++++ b/drivers/usb/gadget/udc/mv_udc_core.c
+@@ -2167,7 +2167,7 @@ static int mv_udc_probe(struct platform_
+ return -ENODEV;
+ }
+
+- udc->phy_regs = ioremap(r->start, resource_size(r));
++ udc->phy_regs = devm_ioremap(&pdev->dev, r->start, resource_size(r));
+ if (udc->phy_regs == NULL) {
+ dev_err(&pdev->dev, "failed to map phy I/O memory\n");
+ return -EBUSY;
--- /dev/null
+From be9d39881fc4fa39a64b6eed6bab5d9ee5125344 Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <balbi@ti.com>
+Date: Tue, 2 Jun 2015 13:03:36 -0500
+Subject: usb: musb: host: rely on port_mode to call musb_start()
+
+From: Felipe Balbi <balbi@ti.com>
+
+commit be9d39881fc4fa39a64b6eed6bab5d9ee5125344 upstream.
+
+Currently, we're calling musb_start() twice for DRD ports
+in some situations. This has been observed to cause enumeration
+issues after suspend/resume cycles with AM335x.
+
+In order to fix the problem, we just have to fix the check
+on musb_has_gadget() so that it only returns true if
+current mode is Host and ignore the fact that we have or
+not a gadget driver loaded.
+
+Fixes: ae44df2e21b5 (usb: musb: call musb_start() only once in OTG mode)
+Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Tested-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_virthub.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/usb/musb/musb_virthub.c
++++ b/drivers/usb/musb/musb_virthub.c
+@@ -273,9 +273,7 @@ static int musb_has_gadget(struct musb *
+ #ifdef CONFIG_USB_MUSB_HOST
+ return 1;
+ #else
+- if (musb->port_mode == MUSB_PORT_MODE_HOST)
+- return 1;
+- return musb->g.dev.driver != NULL;
++ return musb->port_mode == MUSB_PORT_MODE_HOST;
+ #endif
+ }
+
--- /dev/null
+From 7d8021c967648accd1b78e5e1ddaad655cd2c61f Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 30 Jun 2015 11:25:54 -0400
+Subject: USB: OHCI: Fix race between ED unlink and URB submission
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 7d8021c967648accd1b78e5e1ddaad655cd2c61f upstream.
+
+This patch fixes a bug introduced by commit 977dcfdc6031 ("USB: OHCI:
+don't lose track of EDs when a controller dies"). The commit changed
+ed_state from ED_UNLINK to ED_IDLE too early, before finish_urb() had
+been called. The user-visible consequence is that the driver
+occasionally crashes or locks up when an URB is submitted while
+another URB for the same endpoint is being unlinked.
+
+This patch moves the ED state change later, to the right place. The
+drawback is that now we may unnecessarily execute some instructions
+multiple times when a controller dies. Since controllers dying is an
+exceptional occurrence, a little wasted time won't matter.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Heiko Przybyl <lil_tux@web.de>
+Tested-by: Heiko Przybyl <lil_tux@web.de>
+Fixes: 977dcfdc60311e7aa571cabf6f39c36dde13339e
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ohci-q.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/drivers/usb/host/ohci-q.c
++++ b/drivers/usb/host/ohci-q.c
+@@ -980,10 +980,6 @@ rescan_all:
+ int completed, modified;
+ __hc32 *prev;
+
+- /* Is this ED already invisible to the hardware? */
+- if (ed->state == ED_IDLE)
+- goto ed_idle;
+-
+ /* only take off EDs that the HC isn't using, accounting for
+ * frame counter wraps and EDs with partially retired TDs
+ */
+@@ -1011,12 +1007,10 @@ skip_ed:
+ }
+
+ /* ED's now officially unlinked, hc doesn't see */
+- ed->state = ED_IDLE;
+ ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_H);
+ ed->hwNextED = 0;
+ wmb();
+ ed->hwINFO &= ~cpu_to_hc32(ohci, ED_SKIP | ED_DEQUEUE);
+-ed_idle:
+
+ /* reentrancy: if we drop the schedule lock, someone might
+ * have modified this list. normally it's just prepending
+@@ -1087,6 +1081,7 @@ rescan_this:
+ if (list_empty(&ed->td_list)) {
+ *last = ed->ed_next;
+ ed->ed_next = NULL;
++ ed->state = ED_IDLE;
+ list_del(&ed->in_use_list);
+ } else if (ohci->rh_state == OHCI_RH_RUNNING) {
+ *last = ed->ed_next;
--- /dev/null
+From f6d7fb37f92622479ef6da604f27561f5045ba1e Mon Sep 17 00:00:00 2001
+From: Claudio Cappelli <claudio.cappelli.linux@gmail.com>
+Date: Wed, 10 Jun 2015 20:38:30 +0200
+Subject: USB: option: add 2020:4000 ID
+
+From: Claudio Cappelli <claudio.cappelli.linux@gmail.com>
+
+commit f6d7fb37f92622479ef6da604f27561f5045ba1e upstream.
+
+Add device Olivetti Olicard 300 (Network Connect: MT6225) - IDs 2020:4000.
+
+T: Bus=01 Lev=02 Prnt=04 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=2020 ProdID=4000 Rev=03.00
+S: Manufacturer=Network Connect
+S: Product=MT6225
+C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=02 Prot=01 Driver=option
+I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 6 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
+
+Signed-off-by: Claudio Cappelli <claudio.cappelli.linux@gmail.com>
+Suggested-by: Lars Melin <larsm17@gmail.com>
+[johan: amend commit message with devices info ]
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1765,6 +1765,7 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
+ { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
+ { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
+ { } /* Terminating entry */
--- /dev/null
+From 543aa4867d4a2dff5fc11e1b688197ee3bad7f89 Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Mon, 15 Jun 2015 04:37:00 +0000
+Subject: usb: phy: mxs: suspend to RAM causes NULL pointer dereference
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+commit 543aa4867d4a2dff5fc11e1b688197ee3bad7f89 upstream.
+
+Triggering suspend to RAM via sysfs on a i.MX28 causes a NULL pointer
+dereference. This patch avoids the oops in mxs_phy_get_vbus_status()
+by aborting since there is no syscon available.
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Fixes: efdbd3a5d6e ("usb: phy: mxs: do not set PWD.RXPWD1PT1 for low speed connection")
+Acked-by: Peter Chen <peter.chen@freescale.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/phy/phy-mxs-usb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/phy/phy-mxs-usb.c
++++ b/drivers/usb/phy/phy-mxs-usb.c
+@@ -217,6 +217,9 @@ static bool mxs_phy_get_vbus_status(stru
+ {
+ unsigned int vbus_value;
+
++ if (!mxs_phy->regmap_anatop)
++ return false;
++
+ if (mxs_phy->port_id == 0)
+ regmap_read(mxs_phy->regmap_anatop,
+ ANADIG_USB1_VBUS_DET_STAT,
--- /dev/null
+From d23f47d4927fd2f61b3a754d83c7bcec215b5cfe Mon Sep 17 00:00:00 2001
+From: Johannes Thumshirn <jthumshirn@suse.de>
+Date: Wed, 8 Jul 2015 17:26:37 +0200
+Subject: USB: serial: Destroy serial_minors IDR on module exit
+
+From: Johannes Thumshirn <jthumshirn@suse.de>
+
+commit d23f47d4927fd2f61b3a754d83c7bcec215b5cfe upstream.
+
+Destroy serial_minors IDR on module exit, reclaiming the allocated memory.
+
+This was detected by the following semantic patch (written by Luis
+Rodriguez <mcgrof@suse.com>)
+
+<SmPL>
+@ defines_module_init @
+declarer name module_init, module_exit;
+declarer name DEFINE_IDR;
+identifier init;
+@@
+
+module_init(init);
+
+@ defines_module_exit @
+identifier exit;
+@@
+
+module_exit(exit);
+
+@ declares_idr depends on defines_module_init && defines_module_exit @
+identifier idr;
+@@
+
+DEFINE_IDR(idr);
+
+@ on_exit_calls_destroy depends on declares_idr && defines_module_exit @
+identifier declares_idr.idr, defines_module_exit.exit;
+@@
+
+exit(void)
+{
+ ...
+ idr_destroy(&idr);
+ ...
+}
+
+@ missing_module_idr_destroy depends on declares_idr && defines_module_exit && !on_exit_calls_destroy @
+identifier declares_idr.idr, defines_module_exit.exit;
+@@
+
+exit(void)
+{
+ ...
+ +idr_destroy(&idr);
+}
+</SmPL>
+
+Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/usb-serial.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -1306,6 +1306,7 @@ static void __exit usb_serial_exit(void)
+ tty_unregister_driver(usb_serial_tty_driver);
+ put_tty_driver(usb_serial_tty_driver);
+ bus_unregister(&usb_serial_bus_type);
++ idr_destroy(&serial_minors);
+ }
+
+
--- /dev/null
+From 3496810663922617d4b706ef2780c279252ddd6a Mon Sep 17 00:00:00 2001
+From: AMAN DEEP <aman.deep@samsung.com>
+Date: Tue, 21 Jul 2015 17:20:27 +0300
+Subject: usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function
+
+From: AMAN DEEP <aman.deep@samsung.com>
+
+commit 3496810663922617d4b706ef2780c279252ddd6a upstream.
+
+virt_dev->num_cached_rings counts on freed ring and is not updated
+correctly. In xhci_free_or_cache_endpoint_ring() function, the free ring
+is added into cache and then num_rings_cache is incremented as below:
+ virt_dev->ring_cache[rings_cached] =
+ virt_dev->eps[ep_index].ring;
+ virt_dev->num_rings_cached++;
+here, free ring pointer is added to a current index and then
+index is incremented.
+So current index always points to empty location in the ring cache.
+For getting available free ring, current index should be decremented
+first and then corresponding ring buffer value should be taken from ring
+cache.
+
+But In function xhci_endpoint_init(), the num_rings_cached index is
+accessed before decrement.
+ virt_dev->eps[ep_index].new_ring =
+ virt_dev->ring_cache[virt_dev->num_rings_cached];
+ virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
+ virt_dev->num_rings_cached--;
+This is bug in manipulating the index of ring cache.
+And it should be as below:
+ virt_dev->num_rings_cached--;
+ virt_dev->eps[ep_index].new_ring =
+ virt_dev->ring_cache[virt_dev->num_rings_cached];
+ virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
+
+Signed-off-by: Aman Deep <aman.deep@samsung.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci-mem.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1427,10 +1427,10 @@ int xhci_endpoint_init(struct xhci_hcd *
+ /* Attempt to use the ring cache */
+ if (virt_dev->num_rings_cached == 0)
+ return -ENOMEM;
++ virt_dev->num_rings_cached--;
+ virt_dev->eps[ep_index].new_ring =
+ virt_dev->ring_cache[virt_dev->num_rings_cached];
+ virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
+- virt_dev->num_rings_cached--;
+ xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring,
+ 1, type);
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
