3.2-stable patches

added patches:
	usb-dwc3-fix-bogus-test-in-dwc3_gadget_start_isoc.patch
	usb-dwc3-use-proper-function-for-setting-endpoint-name.patch

diff --git a/queue-3.2/series b/queue-3.2/series
index 9b172d8c2d7cb10901bf5d9f3c4c7c06b9d9816f..77777da6fac29ba7c553b652ae5cff003f982692 100644 (file)
--- a/queue-3.2/series
+++ b/queue-3.2/series
@@ -13,3 +13,5 @@ powerpc-usb-fix-bug-of-kernel-hang-when-initializing-usb.patch
 staging-r8712u-add-missing-initialization-and-remove-configuration-parameter-config_r8712_ap.patch
 staging-r8712u-fix-regression-introduced-by-commit-a5ee652.patch
 staging-r8712u-fix-regression-in-signal-level-after-commit-c6dc001.patch
+usb-dwc3-fix-bogus-test-in-dwc3_gadget_start_isoc.patch
+usb-dwc3-use-proper-function-for-setting-endpoint-name.patch

diff --git a/queue-3.2/usb-dwc3-fix-bogus-test-in-dwc3_gadget_start_isoc.patch b/queue-3.2/usb-dwc3-fix-bogus-test-in-dwc3_gadget_start_isoc.patch
new file mode 100644 (file)
index 0000000..0c9e3b8
--- /dev/null
+++ b/queue-3.2/usb-dwc3-fix-bogus-test-in-dwc3_gadget_start_isoc.patch
@@ -0,0 +1,52 @@
+From 9bafa56c7cee5c6fa68de5924220abb220c7e229 Mon Sep 17 00:00:00 2001
+From: Paul Zimmerman <Paul.Zimmerman@synopsys.com>
+Date: Fri, 17 Feb 2012 14:10:16 -0800
+Subject: usb: dwc3: fix bogus test in dwc3_gadget_start_isoc
+
+From: Paul Zimmerman <Paul.Zimmerman@synopsys.com>
+
+commit 9bafa56c7cee5c6fa68de5924220abb220c7e229 upstream.
+
+Zero is a valid value for a microframe number. So remove the bogus
+test for non-zero in dwc3_gadget_start_isoc().
+
+Signed-off-by: Paul Zimmerman <paulz@synopsys.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c |   16 +++++-----------
+ 1 file changed, 5 insertions(+), 11 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1405,7 +1405,7 @@ static void dwc3_endpoint_transfer_compl
+ static void dwc3_gadget_start_isoc(struct dwc3 *dwc,
+               struct dwc3_ep *dep, const struct dwc3_event_depevt *event)
+ {
+-      u32 uf;
++      u32 uf, mask;
+ 
+       if (list_empty(&dep->request_list)) {
+               dev_vdbg(dwc->dev, "ISOC ep %s run out for requests.\n",
+@@ -1413,16 +1413,10 @@ static void dwc3_gadget_start_isoc(struc
+               return;
+       }
+ 
+-      if (event->parameters) {
+-              u32 mask;
+-
+-              mask = ~(dep->interval - 1);
+-              uf = event->parameters & mask;
+-              /* 4 micro frames in the future */
+-              uf += dep->interval * 4;
+-      } else {
+-              uf = 0;
+-      }
++      mask = ~(dep->interval - 1);
++      uf = event->parameters & mask;
++      /* 4 micro frames in the future */
++      uf += dep->interval * 4;
+ 
+       __dwc3_gadget_kick_transfer(dep, uf, 1);
+ }

diff --git a/queue-3.2/usb-dwc3-use-proper-function-for-setting-endpoint-name.patch b/queue-3.2/usb-dwc3-use-proper-function-for-setting-endpoint-name.patch
new file mode 100644 (file)
index 0000000..199a22e
--- /dev/null
+++ b/queue-3.2/usb-dwc3-use-proper-function-for-setting-endpoint-name.patch
@@ -0,0 +1,43 @@
+From 27a78d6a283d6782438f72306746afe4bf44c215 Mon Sep 17 00:00:00 2001
+From: Anton Tikhomirov <av.tikhomirov@samsung.com>
+Date: Thu, 23 Feb 2012 15:38:46 +0900
+Subject: usb: dwc3: use proper function for setting endpoint name
+
+From: Anton Tikhomirov <av.tikhomirov@samsung.com>
+
+commit 27a78d6a283d6782438f72306746afe4bf44c215 upstream.
+
+It's wrong to use the size of array as an argument for strncat.
+Memory corruption is possible. strlcat is exactly what we need here.
+
+Signed-off-by: Anton Tikhomirov <av.tikhomirov@samsung.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -449,16 +449,16 @@ static int dwc3_gadget_ep_enable(struct
+ 
+       switch (usb_endpoint_type(desc)) {
+       case USB_ENDPOINT_XFER_CONTROL:
+-              strncat(dep->name, "-control", sizeof(dep->name));
++              strlcat(dep->name, "-control", sizeof(dep->name));
+               break;
+       case USB_ENDPOINT_XFER_ISOC:
+-              strncat(dep->name, "-isoc", sizeof(dep->name));
++              strlcat(dep->name, "-isoc", sizeof(dep->name));
+               break;
+       case USB_ENDPOINT_XFER_BULK:
+-              strncat(dep->name, "-bulk", sizeof(dep->name));
++              strlcat(dep->name, "-bulk", sizeof(dep->name));
+               break;
+       case USB_ENDPOINT_XFER_INT:
+-              strncat(dep->name, "-int", sizeof(dep->name));
++              strlcat(dep->name, "-int", sizeof(dep->name));
+               break;
+       default:
+               dev_err(dwc->dev, "invalid endpoint transfer type\n");