--- /dev/null
+From 2dce4c2b5f0b43bd25bf9ea6ded06b7f8a54c91f Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes@sipsolutions.net>
+Date: Thu, 2 Jul 2009 15:46:41 +0200
+Subject: cfg80211: fix refcount leak
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+commit 2dce4c2b5f0b43bd25bf9ea6ded06b7f8a54c91f upstream.
+
+The code in cfg80211's cfg80211_bss_update erroneously
+grabs a reference to the BSS, which means that it will
+never be freed.
+
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: John W. Linville <linville@tuxdriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/wireless/scan.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -365,7 +365,6 @@ cfg80211_bss_update(struct cfg80211_regi
+ found = rb_find_bss(dev, res);
+
+ if (found) {
+- kref_get(&found->ref);
+ found->pub.beacon_interval = res->pub.beacon_interval;
+ found->pub.tsf = res->pub.tsf;
+ found->pub.signal = res->pub.signal;
--- /dev/null
+From 1ded3f59f35a2642852b3e2a1c0fa8a97777e9af Mon Sep 17 00:00:00 2001
+From: Stephane Contri <Stephane.Contri@grassvalley.com>
+Date: Thu, 2 Jul 2009 23:26:48 +0000
+Subject: dsa: fix 88e6xxx statistics counter snapshotting
+
+From: Stephane Contri <Stephane.Contri@grassvalley.com>
+
+commit 1ded3f59f35a2642852b3e2a1c0fa8a97777e9af upstream.
+
+The bit that tells us whether a statistics counter snapshot operation
+has completed is located in the GLOBAL register block, not in the
+GLOBAL2 register block, so fix up mv88e6xxx_stats_wait() to poll the
+right register address.
+
+Signed-off-by: Stephane Contri <Stephane.Contri@grassvalley.com>
+Signed-off-by: Lennert Buytenhek <buytenh@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/dsa/mv88e6xxx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/dsa/mv88e6xxx.c
++++ b/net/dsa/mv88e6xxx.c
+@@ -418,7 +418,7 @@ static int mv88e6xxx_stats_wait(struct d
+ int i;
+
+ for (i = 0; i < 10; i++) {
+- ret = REG_READ(REG_GLOBAL2, 0x1d);
++ ret = REG_READ(REG_GLOBAL, 0x1d);
+ if ((ret & 0x8000) == 0)
+ return 0;
+ }
--- /dev/null
+From 7ed9f7e5db58c6e8c2b4b738a75d5dcd8e17aad5 Mon Sep 17 00:00:00 2001
+From: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Date: Thu, 25 Jun 2009 12:31:37 -0700
+Subject: fix RCU-callback-after-kmem_cache_destroy problem in sl[aou]b
+
+From: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+
+commit 7ed9f7e5db58c6e8c2b4b738a75d5dcd8e17aad5 upstream.
+
+Jesper noted that kmem_cache_destroy() invokes synchronize_rcu() rather than
+rcu_barrier() in the SLAB_DESTROY_BY_RCU case, which could result in RCU
+callbacks accessing a kmem_cache after it had been destroyed.
+
+Acked-by: Matt Mackall <mpm@selenic.com>
+Reported-by: Jesper Dangaard Brouer <hawk@comx.dk>
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/slab.c | 2 +-
+ mm/slob.c | 2 ++
+ mm/slub.c | 2 ++
+ 3 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -2592,7 +2592,7 @@ void kmem_cache_destroy(struct kmem_cach
+ }
+
+ if (unlikely(cachep->flags & SLAB_DESTROY_BY_RCU))
+- synchronize_rcu();
++ rcu_barrier();
+
+ __kmem_cache_destroy(cachep);
+ mutex_unlock(&cache_chain_mutex);
+--- a/mm/slob.c
++++ b/mm/slob.c
+@@ -590,6 +590,8 @@ EXPORT_SYMBOL(kmem_cache_create);
+
+ void kmem_cache_destroy(struct kmem_cache *c)
+ {
++ if (c->flags & SLAB_DESTROY_BY_RCU)
++ rcu_barrier();
+ slob_free(c, sizeof(struct kmem_cache));
+ }
+ EXPORT_SYMBOL(kmem_cache_destroy);
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -2490,6 +2490,8 @@ static inline int kmem_cache_close(struc
+ */
+ void kmem_cache_destroy(struct kmem_cache *s)
+ {
++ if (s->flags & SLAB_DESTROY_BY_RCU)
++ rcu_barrier();
+ down_write(&slub_lock);
+ s->refcount--;
+ if (!s->refcount) {
--- /dev/null
+From bceb0f126f25184eaec3f3c8f00c92b0d899e5de Mon Sep 17 00:00:00 2001
+From: Tilman Schmidt <tilman@imap.cc>
+Date: Wed, 1 Jul 2009 11:20:57 +0000
+Subject: gigaset: accept connection establishment messages in any order
+
+From: Tilman Schmidt <tilman@imap.cc>
+
+commit bceb0f126f25184eaec3f3c8f00c92b0d899e5de upstream.
+
+ISDN connection setup failed if the "connection active" and
+"B channel up" messages from the device arrived in a different
+order than expected. Modify the state machine to accept them in
+any order.
+
+Impact: bugfix
+
+Signed-off-by: Tilman Schmidt <tilman@imap.cc>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/isdn/gigaset/ev-layer.c | 44 ++++++++++++++++++----------------------
+ 1 file changed, 20 insertions(+), 24 deletions(-)
+
+--- a/drivers/isdn/gigaset/ev-layer.c
++++ b/drivers/isdn/gigaset/ev-layer.c
+@@ -294,32 +294,33 @@ struct reply_t gigaset_tab_cid_m10x[] =
+ {RSP_OK, 604,604, -1, 605, 5, {ACT_CMD+AT_MSN}},
+ {RSP_OK, 605,605, -1, 606, 5, {ACT_CMD+AT_ISO}},
+ {RSP_NULL, 605,605, -1, 606, 5, {ACT_CMD+AT_ISO}},
+- {RSP_OK, 606,606, -1, 607, 5, {0}, "+VLS=17\r"}, /* set "Endgeraetemodus" */
++ {RSP_OK, 606,606, -1, 607, 5, {0}, "+VLS=17\r"},
+ {RSP_OK, 607,607, -1, 608,-1},
+- //{RSP_ZSAU, 608,608,ZSAU_PROCEEDING, 608, 0, {ACT_ERROR}},//DELETE
+ {RSP_ZSAU, 608,608,ZSAU_PROCEEDING, 609, 5, {ACT_CMD+AT_DIAL}},
+ {RSP_OK, 609,609, -1, 650, 0, {ACT_DIALING}},
+
+- {RSP_ZVLS, 608,608, 17, -1,-1, {ACT_DEBUG}},
+- {RSP_ZCTP, 609,609, -1, -1,-1, {ACT_DEBUG}},
+- {RSP_ZCPN, 609,609, -1, -1,-1, {ACT_DEBUG}},
+ {RSP_ERROR, 601,609, -1, 0, 0, {ACT_ABORTDIAL}},
+ {EV_TIMEOUT, 601,609, -1, 0, 0, {ACT_ABORTDIAL}},
+
+- /* dialing */
+- {RSP_ZCTP, 650,650, -1, -1,-1, {ACT_DEBUG}},
+- {RSP_ZCPN, 650,650, -1, -1,-1, {ACT_DEBUG}},
+- {RSP_ZSAU, 650,650,ZSAU_CALL_DELIVERED, -1,-1, {ACT_DEBUG}}, /* some devices don't send this */
+-
+- /* connection established */
+- {RSP_ZSAU, 650,650,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, //FIXME -> DLE1
+- {RSP_ZSAU, 750,750,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, //FIXME -> DLE1
+-
+- {EV_BC_OPEN, 800,800, -1, 800,-1, {ACT_NOTIFY_BC_UP}}, //FIXME new constate + timeout
++ /* optional dialing responses */
++ {EV_BC_OPEN, 650,650, -1, 651,-1},
++ {RSP_ZVLS, 608,651, 17, -1,-1, {ACT_DEBUG}},
++ {RSP_ZCTP, 609,651, -1, -1,-1, {ACT_DEBUG}},
++ {RSP_ZCPN, 609,651, -1, -1,-1, {ACT_DEBUG}},
++ {RSP_ZSAU, 650,651,ZSAU_CALL_DELIVERED, -1,-1, {ACT_DEBUG}},
++
++ /* connect */
++ {RSP_ZSAU, 650,650,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}},
++ {RSP_ZSAU, 651,651,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT,
++ ACT_NOTIFY_BC_UP}},
++ {RSP_ZSAU, 750,750,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}},
++ {RSP_ZSAU, 751,751,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT,
++ ACT_NOTIFY_BC_UP}},
++ {EV_BC_OPEN, 800,800, -1, 800,-1, {ACT_NOTIFY_BC_UP}},
+
+ /* remote hangup */
+- {RSP_ZSAU, 650,650,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEREJECT}},
+- {RSP_ZSAU, 750,750,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}},
++ {RSP_ZSAU, 650,651,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEREJECT}},
++ {RSP_ZSAU, 750,751,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}},
+ {RSP_ZSAU, 800,800,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}},
+
+ /* hangup */
+@@ -358,7 +359,8 @@ struct reply_t gigaset_tab_cid_m10x[] =
+ {RSP_ZSAU, 700,729,ZSAU_ACTIVE, 0, 0, {ACT_ABORTACCEPT}},
+ {RSP_ZSAU, 700,729,ZSAU_DISCONNECT_IND, 0, 0, {ACT_ABORTACCEPT}},
+
+- {EV_TIMEOUT, 750,750, -1, 0, 0, {ACT_CONNTIMEOUT}},
++ {EV_BC_OPEN, 750,750, -1, 751,-1},
++ {EV_TIMEOUT, 750,751, -1, 0, 0, {ACT_CONNTIMEOUT}},
+
+ /* B channel closed (general case) */
+ {EV_BC_CLOSED, -1, -1, -1, -1,-1, {ACT_NOTIFY_BC_DOWN}}, //FIXME
+@@ -876,12 +878,6 @@ static void bchannel_down(struct bc_stat
+
+ static void bchannel_up(struct bc_state *bcs)
+ {
+- if (!(bcs->chstate & CHS_D_UP)) {
+- dev_notice(bcs->cs->dev, "%s: D channel not up\n", __func__);
+- bcs->chstate |= CHS_D_UP;
+- gigaset_i4l_channel_cmd(bcs, ISDN_STAT_DCONN);
+- }
+-
+ if (bcs->chstate & CHS_B_UP) {
+ dev_notice(bcs->cs->dev, "%s: B channel already up\n",
+ __func__);
--- /dev/null
+From 033a666ccb842ab4134fcd0c861d5ba9f5d6bf3a Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Thu, 2 Jul 2009 14:35:32 +0100
+Subject: NFSD: Don't hold unrefcounted creds over call to nfsd_setuser()
+
+From: David Howells <dhowells@redhat.com>
+
+commit 033a666ccb842ab4134fcd0c861d5ba9f5d6bf3a upstream.
+
+nfsd_open() gets an unrefcounted pointer to the current process's effective
+credentials at the top of the function, then calls nfsd_setuser() via
+fh_verify() - which may replace and destroy the current process's effective
+credentials - and then passes the unrefcounted pointer to dentry_open() - but
+the credentials may have been destroyed by this point.
+
+Instead, the value from current_cred() should be passed directly to
+dentry_open() as one of its arguments, rather than being cached in a variable.
+
+Possibly fh_verify() should return the creds to use.
+
+This is a regression introduced by
+745ca2475a6ac596e3d8d37c2759c0fbe2586227 "CRED: Pass credentials through
+dentry_open()".
+
+Signed-off-by: David Howells <dhowells@redhat.com>
+Tested-and-Verified-By: Steve Dickson <steved@redhat.com>
+Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfsd/vfs.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -677,7 +677,6 @@ __be32
+ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
+ int access, struct file **filp)
+ {
+- const struct cred *cred = current_cred();
+ struct dentry *dentry;
+ struct inode *inode;
+ int flags = O_RDONLY|O_LARGEFILE;
+@@ -732,7 +731,7 @@ nfsd_open(struct svc_rqst *rqstp, struct
+ vfs_dq_init(inode);
+ }
+ *filp = dentry_open(dget(dentry), mntget(fhp->fh_export->ex_path.mnt),
+- flags, cred);
++ flags, current_cred());
+ if (IS_ERR(*filp))
+ host_err = PTR_ERR(*filp);
+ out_nfserr:
--- /dev/null
+From d3a263a8168f78874254ea9da9595cfb0f3e96d7 Mon Sep 17 00:00:00 2001
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+Date: Wed, 24 Jun 2009 19:55:22 +0000
+Subject: SCSI: zalon: fix oops on attach failure
+
+From: James Bottomley <James.Bottomley@HansenPartnership.com>
+
+commit d3a263a8168f78874254ea9da9595cfb0f3e96d7 upstream.
+
+I recently discovered on my zalon that if the attachment fails because
+of a bus misconfiguration (I scrapped my HVD array, so the card is now
+unterminated) then the system oopses. The reason is that if
+ncr_attach() returns NULL (signalling failure) that NULL is passed by
+the goto failed straight into ncr_detach() which oopses.
+
+The fix is just to return -ENODEV in this case.
+
+Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/zalon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/zalon.c
++++ b/drivers/scsi/zalon.c
+@@ -134,7 +134,7 @@ zalon_probe(struct parisc_device *dev)
+
+ host = ncr_attach(&zalon7xx_template, unit, &device);
+ if (!host)
+- goto fail;
++ return -ENODEV;
+
+ if (request_irq(dev->irq, ncr53c8xx_intr, IRQF_SHARED, "zalon", host)) {
+ dev_printk(KERN_ERR, &dev->dev, "irq problem with %d, detaching\n ",
--- /dev/null
+scsi-zalon-fix-oops-on-attach-failure.patch
+nfsd-don-t-hold-unrefcounted-creds-over-call-to-nfsd_setuser.patch
+sound-virtuoso-fix-xonar-d1-dx-silence-after-resume.patch
+sound-usb-audio-add-workaround-for-blue-microphones-devices.patch
+fix-rcu-callback-after-kmem_cache_destroy-problem-in-slb.patch
+dsa-fix-88e6xxx-statistics-counter-snapshotting.patch
+gigaset-accept-connection-establishment-messages-in-any-order.patch
+cfg80211-fix-refcount-leak.patch
+staging-prevent-rtl8187se-from-crashing-dev_ioctl-in-siocgiwname.patch
+usb-handle-zero-length-usbfs-submissions-correctly.patch
+usb-ti_usb_3410_5052-fix-duplicate-device-ids.patch
+usb-fix-uninitialised-variable-in-ti_do_download.patch
+usb-fix-the-clear_tt_buffer-interface.patch
+usb-ehci-use-the-new-clear_tt_buffer-interface.patch
+usb-fix-memleak-in-usbfs.patch
+usb-rndis-gadget-fix-issues-talking-from-pxa.patch
+usb-fix-langid-0-regression.patch
+usb-ehci-report-actual_length-for-iso-transfers.patch
--- /dev/null
+From 8886f33f25083a47d5fa24ad7b57bb708c5c5403 Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Mon, 13 Jul 2009 13:21:58 +0200
+Subject: sound: usb-audio: add workaround for Blue Microphones devices
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 8886f33f25083a47d5fa24ad7b57bb708c5c5403 upstream.
+
+Blue Microphones USB devices have an alternate setting that sends two
+channels of data to the computer. Unfortunately, the descriptors of
+that altsetting have a wrong channel setting, which means that any
+recorded data from such a device has twice the sample rate from what
+would be expected.
+
+This patch adds a workaround to ignore that altsetting. Since these
+devices have only one actual channel, no data is lost.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/usb/usbaudio.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/sound/usb/usbaudio.c
++++ b/sound/usb/usbaudio.c
+@@ -2649,7 +2649,7 @@ static int parse_audio_endpoints(struct
+ struct usb_interface_descriptor *altsd;
+ int i, altno, err, stream;
+ int format;
+- struct audioformat *fp;
++ struct audioformat *fp = NULL;
+ unsigned char *fmt, *csep;
+ int num;
+
+@@ -2722,6 +2722,18 @@ static int parse_audio_endpoints(struct
+ continue;
+ }
+
++ /*
++ * Blue Microphones workaround: The last altsetting is identical
++ * with the previous one, except for a larger packet size, but
++ * is actually a mislabeled two-channel setting; ignore it.
++ */
++ if (fmt[4] == 1 && fmt[5] == 2 && altno == 2 && num == 3 &&
++ fp && fp->altsetting == 1 && fp->channels == 1 &&
++ fp->format == SNDRV_PCM_FORMAT_S16_LE &&
++ le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize) ==
++ fp->maxpacksize * 2)
++ continue;
++
+ csep = snd_usb_find_desc(alts->endpoint[0].extra, alts->endpoint[0].extralen, NULL, USB_DT_CS_ENDPOINT);
+ /* Creamware Noah has this descriptor after the 2nd endpoint */
+ if (!csep && altsd->bNumEndpoints >= 2)
--- /dev/null
+From 826390796d09444b93e1f957582f8970ddfd9b3d Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Thu, 2 Jul 2009 08:31:30 +0200
+Subject: sound: virtuoso: fix Xonar D1/DX silence after resume
+
+From: Clemens Ladisch <clemens@ladisch.de>
+
+commit 826390796d09444b93e1f957582f8970ddfd9b3d upstream.
+
+When resuming, we better take the DACs out of the reset state before
+trying to use them.
+
+Reference: kernel bug #13599
+ http://bugzilla.kernel.org/show_bug.cgi?id=13599
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/oxygen/virtuoso.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/oxygen/virtuoso.c
++++ b/sound/pci/oxygen/virtuoso.c
+@@ -621,6 +621,8 @@ static void xonar_d2_resume(struct oxyge
+
+ static void xonar_d1_resume(struct oxygen *chip)
+ {
++ oxygen_set_bits8(chip, OXYGEN_FUNCTION, OXYGEN_FUNCTION_RESET_CODEC);
++ msleep(1);
+ cs43xx_init(chip);
+ xonar_enable_output(chip);
+ }
--- /dev/null
+From 02c8baecf5d8850dba40b47cdf003ed2e04e66dd Mon Sep 17 00:00:00 2001
+From: Dan Aloni <dan@aloni.org>
+Date: Sat, 20 Jun 2009 16:32:22 +0300
+Subject: Staging: prevent rtl8187se from crashing dev_ioctl() in SIOCGIWNAME
+
+From: Dan Aloni <dan@aloni.org>
+
+commit 02c8baecf5d8850dba40b47cdf003ed2e04e66dd upstream.
+
+I repeatedly get __stack_chk_fail panic()s with this driver before
+applying the attached fix.
+
+ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and
+on certain conditions, the concatenated string will be larger than IFNAMSIZ
+including the terminating zero.
+
+ length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17
+
+This fix uses strl{cpy,cat} in addition to the reduction of the total
+possible length of the output string by a char.
+
+It can be applied to 2.6.30-stable as well.
+
+Signed-off-by: Dan Aloni <dan@aloni.org>
+Cc: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
++++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c
+@@ -461,19 +461,19 @@ int ieee80211_wx_get_name(struct ieee802
+ struct iw_request_info *info,
+ union iwreq_data *wrqu, char *extra)
+ {
+- strcpy(wrqu->name, "802.11");
++ strlcpy(wrqu->name, "802.11", IFNAMSIZ);
+ if(ieee->modulation & IEEE80211_CCK_MODULATION){
+- strcat(wrqu->name, "b");
++ strlcat(wrqu->name, "b", IFNAMSIZ);
+ if(ieee->modulation & IEEE80211_OFDM_MODULATION)
+- strcat(wrqu->name, "/g");
++ strlcat(wrqu->name, "/g", IFNAMSIZ);
+ }else if(ieee->modulation & IEEE80211_OFDM_MODULATION)
+- strcat(wrqu->name, "g");
++ strlcat(wrqu->name, "g", IFNAMSIZ);
+
+ if((ieee->state == IEEE80211_LINKED) ||
+ (ieee->state == IEEE80211_LINKED_SCANNING))
+- strcat(wrqu->name," linked");
++ strlcat(wrqu->name," link", IFNAMSIZ);
+ else if(ieee->state != IEEE80211_NOLINK)
+- strcat(wrqu->name," link..");
++ strlcat(wrqu->name," .....", IFNAMSIZ);
+
+
+ return 0;
--- /dev/null
+From ec6d67e39f5638c792eb7490bf32586ccb9d8005 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 29 Jun 2009 14:34:59 -0400
+Subject: USB: EHCI: report actual_length for iso transfers
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit ec6d67e39f5638c792eb7490bf32586ccb9d8005 upstream.
+
+This patch (as1259b) makes ehci-hcd return the total number of bytes
+transferred in urb->actual_length for Isochronous transfers.
+Until now, the actual_length value was unaccountably left at 0.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Acked-by: David Brownell <dbrownell@users.sourceforge.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/ehci-sched.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/host/ehci-sched.c
++++ b/drivers/usb/host/ehci-sched.c
+@@ -1617,11 +1617,14 @@ itd_complete (
+ desc->status = -EPROTO;
+
+ /* HC need not update length with this error */
+- if (!(t & EHCI_ISOC_BABBLE))
+- desc->actual_length = EHCI_ITD_LENGTH (t);
++ if (!(t & EHCI_ISOC_BABBLE)) {
++ desc->actual_length = EHCI_ITD_LENGTH(t);
++ urb->actual_length += desc->actual_length;
++ }
+ } else if (likely ((t & EHCI_ISOC_ACTIVE) == 0)) {
+ desc->status = 0;
+- desc->actual_length = EHCI_ITD_LENGTH (t);
++ desc->actual_length = EHCI_ITD_LENGTH(t);
++ urb->actual_length += desc->actual_length;
+ } else {
+ /* URB was too late */
+ desc->status = -EXDEV;
+@@ -2012,7 +2015,8 @@ sitd_complete (
+ desc->status = -EPROTO;
+ } else {
+ desc->status = 0;
+- desc->actual_length = desc->length - SITD_LENGTH (t);
++ desc->actual_length = desc->length - SITD_LENGTH(t);
++ urb->actual_length += desc->actual_length;
+ }
+ stream->depth -= stream->interval << 3;
+
--- /dev/null
+From 914b701280a76f96890ad63eb0fa99bf204b961c Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 29 Jun 2009 10:47:30 -0400
+Subject: USB: EHCI: use the new clear_tt_buffer interface
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 914b701280a76f96890ad63eb0fa99bf204b961c upstream.
+
+This patch (as1256) changes ehci-hcd and all the other drivers in the
+EHCI family to make use of the new clear_tt_buffer callbacks. When a
+Clear-TT-Buffer request is in progress for a QH, the QH is not allowed
+to be linked into the async schedule until the request is finished.
+At that time, if there are any URBs queued for the QH, it is linked
+into the async schedule.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/ehci-au1xxx.c | 2
+ drivers/usb/host/ehci-fsl.c | 2
+ drivers/usb/host/ehci-hcd.c | 2
+ drivers/usb/host/ehci-ixp4xx.c | 2
+ drivers/usb/host/ehci-orion.c | 2
+ drivers/usb/host/ehci-pci.c | 2
+ drivers/usb/host/ehci-ppc-of.c | 2
+ drivers/usb/host/ehci-ps3.c | 2
+ drivers/usb/host/ehci-q.c | 91 ++++++++++++++++++++++++++++++-----------
+ drivers/usb/host/ehci.h | 2
+ 10 files changed, 86 insertions(+), 23 deletions(-)
+
+--- a/drivers/usb/host/ehci-au1xxx.c
++++ b/drivers/usb/host/ehci-au1xxx.c
+@@ -112,6 +112,8 @@ static const struct hc_driver ehci_au1xx
+ .bus_resume = ehci_bus_resume,
+ .relinquish_port = ehci_relinquish_port,
+ .port_handed_over = ehci_port_handed_over,
++
++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+ };
+
+ static int ehci_hcd_au1xxx_drv_probe(struct platform_device *pdev)
+--- a/drivers/usb/host/ehci-fsl.c
++++ b/drivers/usb/host/ehci-fsl.c
+@@ -324,6 +324,8 @@ static const struct hc_driver ehci_fsl_h
+ .bus_resume = ehci_bus_resume,
+ .relinquish_port = ehci_relinquish_port,
+ .port_handed_over = ehci_port_handed_over,
++
++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+ };
+
+ static int ehci_fsl_drv_probe(struct platform_device *pdev)
+--- a/drivers/usb/host/ehci.h
++++ b/drivers/usb/host/ehci.h
+@@ -353,7 +353,9 @@ struct ehci_qh {
+ unsigned short period; /* polling interval */
+ unsigned short start; /* where polling starts */
+ #define NO_FRAME ((unsigned short)~0) /* pick new start */
++
+ struct usb_device *dev; /* access to TT */
++ unsigned clearing_tt:1; /* Clear-TT-Buf in progress */
+ } __attribute__ ((aligned (32)));
+
+ /*-------------------------------------------------------------------------*/
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -1003,6 +1003,8 @@ idle_timeout:
+ schedule_timeout_uninterruptible(1);
+ goto rescan;
+ case QH_STATE_IDLE: /* fully unlinked */
++ if (qh->clearing_tt)
++ goto idle_timeout;
+ if (list_empty (&qh->qtd_list)) {
+ qh_put (qh);
+ break;
+--- a/drivers/usb/host/ehci-ixp4xx.c
++++ b/drivers/usb/host/ehci-ixp4xx.c
+@@ -60,6 +60,8 @@ static const struct hc_driver ixp4xx_ehc
+ #endif
+ .relinquish_port = ehci_relinquish_port,
+ .port_handed_over = ehci_port_handed_over,
++
++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+ };
+
+ static int ixp4xx_ehci_probe(struct platform_device *pdev)
+--- a/drivers/usb/host/ehci-orion.c
++++ b/drivers/usb/host/ehci-orion.c
+@@ -164,6 +164,8 @@ static const struct hc_driver ehci_orion
+ .bus_resume = ehci_bus_resume,
+ .relinquish_port = ehci_relinquish_port,
+ .port_handed_over = ehci_port_handed_over,
++
++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+ };
+
+ static void __init
+--- a/drivers/usb/host/ehci-pci.c
++++ b/drivers/usb/host/ehci-pci.c
+@@ -408,6 +408,8 @@ static const struct hc_driver ehci_pci_h
+ .bus_resume = ehci_bus_resume,
+ .relinquish_port = ehci_relinquish_port,
+ .port_handed_over = ehci_port_handed_over,
++
++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+ };
+
+ /*-------------------------------------------------------------------------*/
+--- a/drivers/usb/host/ehci-ppc-of.c
++++ b/drivers/usb/host/ehci-ppc-of.c
+@@ -78,6 +78,8 @@ static const struct hc_driver ehci_ppc_o
+ #endif
+ .relinquish_port = ehci_relinquish_port,
+ .port_handed_over = ehci_port_handed_over,
++
++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+ };
+
+
+--- a/drivers/usb/host/ehci-ps3.c
++++ b/drivers/usb/host/ehci-ps3.c
+@@ -74,6 +74,8 @@ static const struct hc_driver ps3_ehci_h
+ #endif
+ .relinquish_port = ehci_relinquish_port,
+ .port_handed_over = ehci_port_handed_over,
++
++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+ };
+
+ static int ps3_ehci_probe(struct ps3_system_bus_device *dev)
+--- a/drivers/usb/host/ehci-q.c
++++ b/drivers/usb/host/ehci-q.c
+@@ -139,6 +139,55 @@ qh_refresh (struct ehci_hcd *ehci, struc
+
+ /*-------------------------------------------------------------------------*/
+
++static void qh_link_async(struct ehci_hcd *ehci, struct ehci_qh *qh);
++
++static void ehci_clear_tt_buffer_complete(struct usb_hcd *hcd,
++ struct usb_host_endpoint *ep)
++{
++ struct ehci_hcd *ehci = hcd_to_ehci(hcd);
++ struct ehci_qh *qh = ep->hcpriv;
++ unsigned long flags;
++
++ spin_lock_irqsave(&ehci->lock, flags);
++ qh->clearing_tt = 0;
++ if (qh->qh_state == QH_STATE_IDLE && !list_empty(&qh->qtd_list)
++ && HC_IS_RUNNING(hcd->state))
++ qh_link_async(ehci, qh);
++ spin_unlock_irqrestore(&ehci->lock, flags);
++}
++
++static void ehci_clear_tt_buffer(struct ehci_hcd *ehci, struct ehci_qh *qh,
++ struct urb *urb, u32 token)
++{
++
++ /* If an async split transaction gets an error or is unlinked,
++ * the TT buffer may be left in an indeterminate state. We
++ * have to clear the TT buffer.
++ *
++ * Note: this routine is never called for Isochronous transfers.
++ */
++ if (urb->dev->tt && !usb_pipeint(urb->pipe) && !qh->clearing_tt) {
++#ifdef DEBUG
++ struct usb_device *tt = urb->dev->tt->hub;
++ dev_dbg(&tt->dev,
++ "clear tt buffer port %d, a%d ep%d t%08x\n",
++ urb->dev->ttport, urb->dev->devnum,
++ usb_pipeendpoint(urb->pipe), token);
++#endif /* DEBUG */
++ if (!ehci_is_TDI(ehci)
++ || urb->dev->tt->hub !=
++ ehci_to_hcd(ehci)->self.root_hub) {
++ if (usb_hub_clear_tt_buffer(urb) == 0)
++ qh->clearing_tt = 1;
++ } else {
++
++ /* REVISIT ARC-derived cores don't clear the root
++ * hub TT buffer in this way...
++ */
++ }
++ }
++}
++
+ static int qtd_copy_status (
+ struct ehci_hcd *ehci,
+ struct urb *urb,
+@@ -195,28 +244,6 @@ static int qtd_copy_status (
+ usb_pipeendpoint (urb->pipe),
+ usb_pipein (urb->pipe) ? "in" : "out",
+ token, status);
+-
+- /* if async CSPLIT failed, try cleaning out the TT buffer */
+- if (status != -EPIPE
+- && urb->dev->tt
+- && !usb_pipeint(urb->pipe)
+- && ((token & QTD_STS_MMF) != 0
+- || QTD_CERR(token) == 0)
+- && (!ehci_is_TDI(ehci)
+- || urb->dev->tt->hub !=
+- ehci_to_hcd(ehci)->self.root_hub)) {
+-#ifdef DEBUG
+- struct usb_device *tt = urb->dev->tt->hub;
+- dev_dbg (&tt->dev,
+- "clear tt buffer port %d, a%d ep%d t%08x\n",
+- urb->dev->ttport, urb->dev->devnum,
+- usb_pipeendpoint (urb->pipe), token);
+-#endif /* DEBUG */
+- /* REVISIT ARC-derived cores don't clear the root
+- * hub TT buffer in this way...
+- */
+- usb_hub_clear_tt_buffer(urb);
+- }
+ }
+
+ return status;
+@@ -407,9 +434,16 @@ qh_completions (struct ehci_hcd *ehci, s
+ /* qh unlinked; token in overlay may be most current */
+ if (state == QH_STATE_IDLE
+ && cpu_to_hc32(ehci, qtd->qtd_dma)
+- == qh->hw_current)
++ == qh->hw_current) {
+ token = hc32_to_cpu(ehci, qh->hw_token);
+
++ /* An unlink may leave an incomplete
++ * async transaction in the TT buffer.
++ * We have to clear it.
++ */
++ ehci_clear_tt_buffer(ehci, qh, urb, token);
++ }
++
+ /* force halt for unlinked or blocked qh, so we'll
+ * patch the qh later and so that completions can't
+ * activate it while we "know" it's stopped.
+@@ -435,6 +469,13 @@ halt:
+ && (qtd->hw_alt_next
+ & EHCI_LIST_END(ehci)))
+ last_status = -EINPROGRESS;
++
++ /* As part of low/full-speed endpoint-halt processing
++ * we must clear the TT buffer (11.17.5).
++ */
++ if (unlikely(last_status != -EINPROGRESS &&
++ last_status != -EREMOTEIO))
++ ehci_clear_tt_buffer(ehci, qh, urb, token);
+ }
+
+ /* if we're removing something not at the queue head,
+@@ -864,6 +905,10 @@ static void qh_link_async (struct ehci_h
+ __hc32 dma = QH_NEXT(ehci, qh->qh_dma);
+ struct ehci_qh *head;
+
++ /* Don't link a QH if there's a Clear-TT-Buffer pending */
++ if (unlikely(qh->clearing_tt))
++ return;
++
+ /* (re)start the async schedule? */
+ head = ehci->async;
+ timer_action_done (ehci, TIMER_ASYNC_OFF);
--- /dev/null
+From 0cce2eda19923e5e5ccc8b042dec5af87b3ffad0 Mon Sep 17 00:00:00 2001
+From: Daniel Mack <daniel@caiaq.de>
+Date: Fri, 10 Jul 2009 11:04:58 +0200
+Subject: USB: fix LANGID=0 regression
+
+From: Daniel Mack <daniel@caiaq.de>
+
+commit 0cce2eda19923e5e5ccc8b042dec5af87b3ffad0 upstream.
+
+commit b7af0bb ("USB: allow malformed LANGID descriptors") broke support
+for devices without string descriptor support.
+
+Reporting string descriptors is optional to USB devices, and a device
+lets us know it can't deal with strings by responding to the LANGID
+request with a STALL token.
+
+The kernel handled that correctly before b7af0bb came in, but failed
+hard if the LANGID was reported but broken. More than that, if a device
+was not able to provide string descriptors, the LANGID was retrieved
+over and over again at each string read request.
+
+This patch changes the behaviour so that
+
+ a) the LANGID is only queried once
+ b) devices which can't handle string requests are not asked again
+ c) devices with malformed LANGID values have a sane fallback to 0x0409
+
+Signed-off-by: Daniel Mack <daniel@caiaq.de>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/message.c | 63 ++++++++++++++++++++++++++++++++-------------
+ 1 file changed, 45 insertions(+), 18 deletions(-)
+
+--- a/drivers/usb/core/message.c
++++ b/drivers/usb/core/message.c
+@@ -758,6 +758,48 @@ static int usb_string_sub(struct usb_dev
+ return rc;
+ }
+
++static int usb_get_langid(struct usb_device *dev, unsigned char *tbuf)
++{
++ int err;
++
++ if (dev->have_langid)
++ return 0;
++
++ if (dev->string_langid < 0)
++ return -EPIPE;
++
++ err = usb_string_sub(dev, 0, 0, tbuf);
++
++ /* If the string was reported but is malformed, default to english
++ * (0x0409) */
++ if (err == -ENODATA || (err > 0 && err < 4)) {
++ dev->string_langid = 0x0409;
++ dev->have_langid = 1;
++ dev_err(&dev->dev,
++ "string descriptor 0 malformed (err = %d), "
++ "defaulting to 0x%04x\n",
++ err, dev->string_langid);
++ return 0;
++ }
++
++ /* In case of all other errors, we assume the device is not able to
++ * deal with strings at all. Set string_langid to -1 in order to
++ * prevent any string to be retrieved from the device */
++ if (err < 0) {
++ dev_err(&dev->dev, "string descriptor 0 read error: %d\n",
++ err);
++ dev->string_langid = -1;
++ return -EPIPE;
++ }
++
++ /* always use the first langid listed */
++ dev->string_langid = tbuf[2] | (tbuf[3] << 8);
++ dev->have_langid = 1;
++ dev_dbg(&dev->dev, "default language 0x%04x\n",
++ dev->string_langid);
++ return 0;
++}
++
+ /**
+ * usb_string - returns ISO 8859-1 version of a string descriptor
+ * @dev: the device whose string descriptor is being retrieved
+@@ -797,24 +839,9 @@ int usb_string(struct usb_device *dev, i
+ if (!tbuf)
+ return -ENOMEM;
+
+- /* get langid for strings if it's not yet known */
+- if (!dev->have_langid) {
+- err = usb_string_sub(dev, 0, 0, tbuf);
+- if (err < 0) {
+- dev_err(&dev->dev,
+- "string descriptor 0 read error: %d\n",
+- err);
+- } else if (err < 4) {
+- dev_err(&dev->dev, "string descriptor 0 too short\n");
+- } else {
+- dev->string_langid = tbuf[2] | (tbuf[3] << 8);
+- /* always use the first langid listed */
+- dev_dbg(&dev->dev, "default language 0x%04x\n",
+- dev->string_langid);
+- }
+-
+- dev->have_langid = 1;
+- }
++ err = usb_get_langid(dev, tbuf);
++ if (err < 0)
++ goto errout;
+
+ err = usb_string_sub(dev, dev->string_langid, index, tbuf);
+ if (err < 0)
--- /dev/null
+From d794a02111cd3393da69bc7d6dd2b6074bd037cc Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oliver@neukum.org>
+Date: Sun, 28 Jun 2009 23:34:14 +0200
+Subject: USB: fix memleak in usbfs
+
+From: Oliver Neukum <oliver@neukum.org>
+
+commit d794a02111cd3393da69bc7d6dd2b6074bd037cc upstream.
+
+This patch fixes a memory leak in devio.c::processcompl
+
+If writing to user space fails the packet must be discarded, as it
+already has been removed from the queue of completed packets.
+
+Signed-off-by: Oliver Neukum <oliver@neukum.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/devio.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -1230,22 +1230,22 @@ static int processcompl(struct async *as
+ if (as->userbuffer)
+ if (copy_to_user(as->userbuffer, urb->transfer_buffer,
+ urb->transfer_buffer_length))
+- return -EFAULT;
++ goto err_out;
+ if (put_user(as->status, &userurb->status))
+- return -EFAULT;
++ goto err_out;
+ if (put_user(urb->actual_length, &userurb->actual_length))
+- return -EFAULT;
++ goto err_out;
+ if (put_user(urb->error_count, &userurb->error_count))
+- return -EFAULT;
++ goto err_out;
+
+ if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
+ for (i = 0; i < urb->number_of_packets; i++) {
+ if (put_user(urb->iso_frame_desc[i].actual_length,
+ &userurb->iso_frame_desc[i].actual_length))
+- return -EFAULT;
++ goto err_out;
+ if (put_user(urb->iso_frame_desc[i].status,
+ &userurb->iso_frame_desc[i].status))
+- return -EFAULT;
++ goto err_out;
+ }
+ }
+
+@@ -1254,6 +1254,10 @@ static int processcompl(struct async *as
+ if (put_user(addr, (void __user * __user *)arg))
+ return -EFAULT;
+ return 0;
++
++err_out:
++ free_async(as);
++ return -EFAULT;
+ }
+
+ static struct async *reap_as(struct dev_state *ps)
--- /dev/null
+From cb88a1b887bb8908f6e00ce29e893ea52b074940 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 29 Jun 2009 10:43:32 -0400
+Subject: USB: fix the clear_tt_buffer interface
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit cb88a1b887bb8908f6e00ce29e893ea52b074940 upstream.
+
+This patch (as1255) updates the interface for calling
+usb_hub_clear_tt_buffer(). Even the name of the function is changed!
+
+When an async URB (i.e., Control or Bulk) going through a high-speed
+hub to a non-high-speed device is cancelled or fails, the hub's
+Transaction Translator buffer may be left busy still trying to
+complete the transaction. The buffer has to be cleared; that's what
+usb_hub_clear_tt_buffer() does.
+
+It isn't safe to send any more URBs to the same endpoint until the TT
+buffer is fully clear. Therefore the HCD needs to be told when the
+Clear-TT-Buffer request has finished. This patch adds a callback
+method to struct hc_driver for that purpose, and makes the hub driver
+invoke the callback at the proper time.
+
+The patch also changes a couple of names; "hub_tt_kevent" and
+"tt.kevent" now look rather antiquated.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/hcd.h | 4 ++++
+ drivers/usb/core/hub.c | 40 ++++++++++++++++++++++++++--------------
+ drivers/usb/core/hub.h | 6 ++++--
+ drivers/usb/host/ehci-q.c | 2 +-
+ 4 files changed, 35 insertions(+), 17 deletions(-)
+
+--- a/drivers/usb/core/hcd.h
++++ b/drivers/usb/core/hcd.h
+@@ -224,6 +224,10 @@ struct hc_driver {
+ void (*relinquish_port)(struct usb_hcd *, int);
+ /* has a port been handed over to a companion? */
+ int (*port_handed_over)(struct usb_hcd *, int);
++
++ /* CLEAR_TT_BUFFER completion callback */
++ void (*clear_tt_buffer_complete)(struct usb_hcd *,
++ struct usb_host_endpoint *);
+ };
+
+ extern int usb_hcd_link_urb_to_ep(struct usb_hcd *hcd, struct urb *urb);
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -448,10 +448,10 @@ hub_clear_tt_buffer (struct usb_device *
+ * talking to TTs must queue control transfers (not just bulk and iso), so
+ * both can talk to the same hub concurrently.
+ */
+-static void hub_tt_kevent (struct work_struct *work)
++static void hub_tt_work(struct work_struct *work)
+ {
+ struct usb_hub *hub =
+- container_of(work, struct usb_hub, tt.kevent);
++ container_of(work, struct usb_hub, tt.clear_work);
+ unsigned long flags;
+ int limit = 100;
+
+@@ -460,6 +460,7 @@ static void hub_tt_kevent (struct work_s
+ struct list_head *temp;
+ struct usb_tt_clear *clear;
+ struct usb_device *hdev = hub->hdev;
++ const struct hc_driver *drv;
+ int status;
+
+ temp = hub->tt.clear_list.next;
+@@ -469,21 +470,25 @@ static void hub_tt_kevent (struct work_s
+ /* drop lock so HCD can concurrently report other TT errors */
+ spin_unlock_irqrestore (&hub->tt.lock, flags);
+ status = hub_clear_tt_buffer (hdev, clear->devinfo, clear->tt);
+- spin_lock_irqsave (&hub->tt.lock, flags);
+-
+ if (status)
+ dev_err (&hdev->dev,
+ "clear tt %d (%04x) error %d\n",
+ clear->tt, clear->devinfo, status);
++
++ /* Tell the HCD, even if the operation failed */
++ drv = clear->hcd->driver;
++ if (drv->clear_tt_buffer_complete)
++ (drv->clear_tt_buffer_complete)(clear->hcd, clear->ep);
++
+ kfree(clear);
++ spin_lock_irqsave(&hub->tt.lock, flags);
+ }
+ spin_unlock_irqrestore (&hub->tt.lock, flags);
+ }
+
+ /**
+- * usb_hub_tt_clear_buffer - clear control/bulk TT state in high speed hub
+- * @udev: the device whose split transaction failed
+- * @pipe: identifies the endpoint of the failed transaction
++ * usb_hub_clear_tt_buffer - clear control/bulk TT state in high speed hub
++ * @urb: an URB associated with the failed or incomplete split transaction
+ *
+ * High speed HCDs use this to tell the hub driver that some split control or
+ * bulk transaction failed in a way that requires clearing internal state of
+@@ -493,8 +498,10 @@ static void hub_tt_kevent (struct work_s
+ * It may not be possible for that hub to handle additional full (or low)
+ * speed transactions until that state is fully cleared out.
+ */
+-void usb_hub_tt_clear_buffer (struct usb_device *udev, int pipe)
++int usb_hub_clear_tt_buffer(struct urb *urb)
+ {
++ struct usb_device *udev = urb->dev;
++ int pipe = urb->pipe;
+ struct usb_tt *tt = udev->tt;
+ unsigned long flags;
+ struct usb_tt_clear *clear;
+@@ -506,7 +513,7 @@ void usb_hub_tt_clear_buffer (struct usb
+ if ((clear = kmalloc (sizeof *clear, GFP_ATOMIC)) == NULL) {
+ dev_err (&udev->dev, "can't save CLEAR_TT_BUFFER state\n");
+ /* FIXME recover somehow ... RESET_TT? */
+- return;
++ return -ENOMEM;
+ }
+
+ /* info that CLEAR_TT_BUFFER needs */
+@@ -518,14 +525,19 @@ void usb_hub_tt_clear_buffer (struct usb
+ : (USB_ENDPOINT_XFER_BULK << 11);
+ if (usb_pipein (pipe))
+ clear->devinfo |= 1 << 15;
+-
++
++ /* info for completion callback */
++ clear->hcd = bus_to_hcd(udev->bus);
++ clear->ep = urb->ep;
++
+ /* tell keventd to clear state for this TT */
+ spin_lock_irqsave (&tt->lock, flags);
+ list_add_tail (&clear->clear_list, &tt->clear_list);
+- schedule_work (&tt->kevent);
++ schedule_work(&tt->clear_work);
+ spin_unlock_irqrestore (&tt->lock, flags);
++ return 0;
+ }
+-EXPORT_SYMBOL_GPL(usb_hub_tt_clear_buffer);
++EXPORT_SYMBOL_GPL(usb_hub_clear_tt_buffer);
+
+ /* If do_delay is false, return the number of milliseconds the caller
+ * needs to delay.
+@@ -816,7 +828,7 @@ static void hub_quiesce(struct usb_hub *
+ if (hub->has_indicators)
+ cancel_delayed_work_sync(&hub->leds);
+ if (hub->tt.hub)
+- cancel_work_sync(&hub->tt.kevent);
++ cancel_work_sync(&hub->tt.clear_work);
+ }
+
+ /* caller has locked the hub device */
+@@ -933,7 +945,7 @@ static int hub_configure(struct usb_hub
+
+ spin_lock_init (&hub->tt.lock);
+ INIT_LIST_HEAD (&hub->tt.clear_list);
+- INIT_WORK (&hub->tt.kevent, hub_tt_kevent);
++ INIT_WORK(&hub->tt.clear_work, hub_tt_work);
+ switch (hdev->descriptor.bDeviceProtocol) {
+ case 0:
+ break;
+--- a/drivers/usb/core/hub.h
++++ b/drivers/usb/core/hub.h
+@@ -185,16 +185,18 @@ struct usb_tt {
+ /* for control/bulk error recovery (CLEAR_TT_BUFFER) */
+ spinlock_t lock;
+ struct list_head clear_list; /* of usb_tt_clear */
+- struct work_struct kevent;
++ struct work_struct clear_work;
+ };
+
+ struct usb_tt_clear {
+ struct list_head clear_list;
+ unsigned tt;
+ u16 devinfo;
++ struct usb_hcd *hcd;
++ struct usb_host_endpoint *ep;
+ };
+
+-extern void usb_hub_tt_clear_buffer(struct usb_device *dev, int pipe);
++extern int usb_hub_clear_tt_buffer(struct urb *urb);
+ extern void usb_ep0_reinit(struct usb_device *);
+
+ #endif /* __LINUX_HUB_H */
+--- a/drivers/usb/host/ehci-q.c
++++ b/drivers/usb/host/ehci-q.c
+@@ -215,7 +215,7 @@ static int qtd_copy_status (
+ /* REVISIT ARC-derived cores don't clear the root
+ * hub TT buffer in this way...
+ */
+- usb_hub_tt_clear_buffer (urb->dev, urb->pipe);
++ usb_hub_clear_tt_buffer(urb);
+ }
+ }
+
--- /dev/null
+From 87ea8c887905d8b13ae90b537117592ed027632a Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oliver@neukum.org>
+Date: Tue, 30 Jun 2009 09:44:24 +0200
+Subject: USB: fix uninitialised variable in ti_do_download
+
+From: Oliver Neukum <oliver@neukum.org>
+
+commit 87ea8c887905d8b13ae90b537117592ed027632a upstream.
+
+Signed-off-by: Oliver Neukum <oliver@neukum.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ti_usb_3410_5052.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -1659,7 +1659,7 @@ static int ti_do_download(struct usb_dev
+ u8 cs = 0;
+ int done;
+ struct ti_firmware_header *header;
+- int status;
++ int status = 0;
+ int len;
+
+ for (pos = sizeof(struct ti_firmware_header); pos < size; pos++)
--- /dev/null
+From 9180135bc80ab11199d482b6111e23f74d65af4a Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 29 Jun 2009 11:04:54 -0400
+Subject: USB: handle zero-length usbfs submissions correctly
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 9180135bc80ab11199d482b6111e23f74d65af4a upstream.
+
+This patch (as1262) fixes a bug in usbfs: It refuses to accept
+zero-length transfers, and it insists that the buffer pointer be valid
+even if there is no data being transferred.
+
+The patch also consolidates a bunch of repetitive access_ok() checks
+into a single check, which incidentally fixes the lack of such a check
+for Isochronous URBs.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/devio.c | 41 ++++++++++++++++++++---------------------
+ 1 file changed, 20 insertions(+), 21 deletions(-)
+
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -982,7 +982,7 @@ static int proc_do_submiturb(struct dev_
+ USBDEVFS_URB_ZERO_PACKET |
+ USBDEVFS_URB_NO_INTERRUPT))
+ return -EINVAL;
+- if (!uurb->buffer)
++ if (uurb->buffer_length > 0 && !uurb->buffer)
+ return -EINVAL;
+ if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&
+ (uurb->endpoint & ~USB_ENDPOINT_DIR_MASK) == 0)) {
+@@ -1038,11 +1038,6 @@ static int proc_do_submiturb(struct dev_
+ is_in = 0;
+ uurb->endpoint &= ~USB_DIR_IN;
+ }
+- if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
+- uurb->buffer, uurb->buffer_length)) {
+- kfree(dr);
+- return -EFAULT;
+- }
+ snoop(&ps->dev->dev, "control urb: bRequest=%02x "
+ "bRrequestType=%02x wValue=%04x "
+ "wIndex=%04x wLength=%04x\n",
+@@ -1062,9 +1057,6 @@ static int proc_do_submiturb(struct dev_
+ uurb->number_of_packets = 0;
+ if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
+ return -EINVAL;
+- if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
+- uurb->buffer, uurb->buffer_length))
+- return -EFAULT;
+ snoop(&ps->dev->dev, "bulk urb\n");
+ break;
+
+@@ -1106,28 +1098,35 @@ static int proc_do_submiturb(struct dev_
+ return -EINVAL;
+ if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE)
+ return -EINVAL;
+- if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
+- uurb->buffer, uurb->buffer_length))
+- return -EFAULT;
+ snoop(&ps->dev->dev, "interrupt urb\n");
+ break;
+
+ default:
+ return -EINVAL;
+ }
+- as = alloc_async(uurb->number_of_packets);
+- if (!as) {
++ if (uurb->buffer_length > 0 &&
++ !access_ok(is_in ? VERIFY_WRITE : VERIFY_READ,
++ uurb->buffer, uurb->buffer_length)) {
+ kfree(isopkt);
+ kfree(dr);
+- return -ENOMEM;
++ return -EFAULT;
+ }
+- as->urb->transfer_buffer = kmalloc(uurb->buffer_length, GFP_KERNEL);
+- if (!as->urb->transfer_buffer) {
++ as = alloc_async(uurb->number_of_packets);
++ if (!as) {
+ kfree(isopkt);
+ kfree(dr);
+- free_async(as);
+ return -ENOMEM;
+ }
++ if (uurb->buffer_length > 0) {
++ as->urb->transfer_buffer = kmalloc(uurb->buffer_length,
++ GFP_KERNEL);
++ if (!as->urb->transfer_buffer) {
++ kfree(isopkt);
++ kfree(dr);
++ free_async(as);
++ return -ENOMEM;
++ }
++ }
+ as->urb->dev = ps->dev;
+ as->urb->pipe = (uurb->type << 30) |
+ __create_pipe(ps->dev, uurb->endpoint & 0xf) |
+@@ -1169,7 +1168,7 @@ static int proc_do_submiturb(struct dev_
+ kfree(isopkt);
+ as->ps = ps;
+ as->userurb = arg;
+- if (uurb->endpoint & USB_DIR_IN)
++ if (is_in && uurb->buffer_length > 0)
+ as->userbuffer = uurb->buffer;
+ else
+ as->userbuffer = NULL;
+@@ -1179,9 +1178,9 @@ static int proc_do_submiturb(struct dev_
+ as->uid = cred->uid;
+ as->euid = cred->euid;
+ security_task_getsecid(current, &as->secid);
+- if (!is_in) {
++ if (!is_in && uurb->buffer_length > 0) {
+ if (copy_from_user(as->urb->transfer_buffer, uurb->buffer,
+- as->urb->transfer_buffer_length)) {
++ uurb->buffer_length)) {
+ free_async(as);
+ return -EFAULT;
+ }
--- /dev/null
+From 4e19f220d4e84f5728cb7edde36352ab425cfba4 Mon Sep 17 00:00:00 2001
+From: David Brownell <dbrownell@users.sourceforge.net>
+Date: Fri, 19 Jun 2009 03:09:04 -0700
+Subject: USB: RNDIS gadget, fix issues talking from PXA
+
+From: David Brownell <dbrownell@users.sourceforge.net>
+
+commit 4e19f220d4e84f5728cb7edde36352ab425cfba4 upstream.
+
+The reworked Ethernet gadget has an RNDIS interop problem when used
+with the CDC subset driver ... e.g. on PXA 2xx and 3xx hardware,
+which currently has a hard time talking to MS-Windows hosts.
+
+The issue is that Microsoft requires USB_CLASS_COMM. Fix by tweaking
+the CDC subset driver to not switch to USB_CLASS_VENDOR_SPEC if RNDIS
+is used in some other device configuration.
+
+[ UPDATED: some "statements" were comma-terminated; fix that. ]
+
+Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
+Cc: Aric Blumer <aric@sdgsystems.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/gadget/ether.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/gadget/ether.c
++++ b/drivers/usb/gadget/ether.c
+@@ -293,15 +293,16 @@ static int __init eth_bind(struct usb_co
+ /* CDC Subset */
+ eth_config_driver.label = "CDC Subset/SAFE";
+
+- device_desc.idVendor = cpu_to_le16(SIMPLE_VENDOR_NUM),
+- device_desc.idProduct = cpu_to_le16(SIMPLE_PRODUCT_NUM),
+- device_desc.bDeviceClass = USB_CLASS_VENDOR_SPEC;
++ device_desc.idVendor = cpu_to_le16(SIMPLE_VENDOR_NUM);
++ device_desc.idProduct = cpu_to_le16(SIMPLE_PRODUCT_NUM);
++ if (!has_rndis())
++ device_desc.bDeviceClass = USB_CLASS_VENDOR_SPEC;
+ }
+
+ if (has_rndis()) {
+ /* RNDIS plus ECM-or-Subset */
+- device_desc.idVendor = cpu_to_le16(RNDIS_VENDOR_NUM),
+- device_desc.idProduct = cpu_to_le16(RNDIS_PRODUCT_NUM),
++ device_desc.idVendor = cpu_to_le16(RNDIS_VENDOR_NUM);
++ device_desc.idProduct = cpu_to_le16(RNDIS_PRODUCT_NUM);
+ device_desc.bNumConfigurations = 2;
+ }
+
--- /dev/null
+From 3c43f27bf57b0502df2478253699559ee1d43f6d Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@suse.de>
+Date: Fri, 26 Jun 2009 08:05:20 -0700
+Subject: USB: ti_usb_3410_5052: fix duplicate device ids.
+
+From: Greg Kroah-Hartman <gregkh@suse.de>
+
+commit 3c43f27bf57b0502df2478253699559ee1d43f6d upstream.
+
+commit 1a1fab513734b3a4fca1bee8229e5ff7e1cb873c accidentally added the
+device id to both tables in the driver, which causes problems as this is
+only a single port device, not a multiple port device.
+
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ti_usb_3410_5052.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -192,7 +192,6 @@ static struct usb_device_id ti_id_table_
+ { USB_DEVICE(TI_VENDOR_ID, TI_5152_BOOT_PRODUCT_ID) },
+ { USB_DEVICE(TI_VENDOR_ID, TI_5052_EEPROM_PRODUCT_ID) },
+ { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
+- { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
+ };
+
+ static struct usb_device_id ti_id_table_combined[14+2*TI_EXTRA_VID_PID_COUNT+1] = {
projects / thirdparty / kernel / stable-queue.git / commitdiff
