From: Greg Kroah-Hartman Date: Wed, 24 Oct 2012 17:07:36 +0000 (-0700) Subject: 3.6-stable patches X-Git-Tag: v3.0.49~45 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0c952f44c56bc9256913b4bd4c9045716ebde4f5;p=thirdparty%2Fkernel%2Fstable-queue.git 3.6-stable patches added patches: usb-host-xhci-new-system-added-for-compliance-mode-patch-on-sn65lvpe502cp.patch usb-iuu_phoenix-fix-port-data-memory-leak.patch usb-musb-am35xx-drop-spurious-unplugging-a-device.patch --- diff --git a/queue-3.6/series b/queue-3.6/series index d24a53fdae2..a51169541bf 100644 --- a/queue-3.6/series +++ b/queue-3.6/series @@ -22,3 +22,6 @@ usb-acm-fix-the-computation-of-the-number-of-data-bits.patch usb-io_ti-fix-port-data-memory-leak.patch usb-io_ti-fix-sysfs-attribute-creation.patch usb-cyberjack-fix-port-data-memory-leak.patch +usb-musb-am35xx-drop-spurious-unplugging-a-device.patch +usb-host-xhci-new-system-added-for-compliance-mode-patch-on-sn65lvpe502cp.patch +usb-iuu_phoenix-fix-port-data-memory-leak.patch diff --git a/queue-3.6/usb-host-xhci-new-system-added-for-compliance-mode-patch-on-sn65lvpe502cp.patch b/queue-3.6/usb-host-xhci-new-system-added-for-compliance-mode-patch-on-sn65lvpe502cp.patch new file mode 100644 index 00000000000..4478b9e5635 --- /dev/null +++ b/queue-3.6/usb-host-xhci-new-system-added-for-compliance-mode-patch-on-sn65lvpe502cp.patch @@ -0,0 +1,35 @@ +From 470809741a28c3092279f4e1f3f432e534d46068 Mon Sep 17 00:00:00 2001 +From: "Alexis R. Cortes" +Date: Wed, 17 Oct 2012 14:09:12 -0500 +Subject: usb: host: xhci: New system added for Compliance Mode Patch on SN65LVPE502CP + +From: "Alexis R. Cortes" + +commit 470809741a28c3092279f4e1f3f432e534d46068 upstream. + +This minor change adds a new system to which the "Fix Compliance Mode +on SN65LVPE502CP Hardware" patch has to be applied also. + +System added: +Vendor: Hewlett-Packard. System Model: Z1 + +Signed-off-by: Alexis R. Cortes +Acked-by: Sarah Sharp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -479,7 +479,8 @@ static bool compliance_mode_recovery_tim + + if (strstr(dmi_product_name, "Z420") || + strstr(dmi_product_name, "Z620") || +- strstr(dmi_product_name, "Z820")) ++ strstr(dmi_product_name, "Z820") || ++ strstr(dmi_product_name, "Z1")) + return true; + + return false; diff --git a/queue-3.6/usb-iuu_phoenix-fix-port-data-memory-leak.patch b/queue-3.6/usb-iuu_phoenix-fix-port-data-memory-leak.patch new file mode 100644 index 00000000000..c47d322baca --- /dev/null +++ b/queue-3.6/usb-iuu_phoenix-fix-port-data-memory-leak.patch @@ -0,0 +1,118 @@ +From 53636555b9190f88320d9d46cf142f8797895456 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 17 Oct 2012 13:34:59 +0200 +Subject: USB: iuu_phoenix: fix port-data memory leak + +From: Johan Hovold + +commit 53636555b9190f88320d9d46cf142f8797895456 upstream. + +Fix port-data memory leak by replacing attach and release with +port_probe and port_remove. + +Since commit 0998d0631001288 (device-core: Ensure drvdata = NULL when no +driver is bound) the port private data is no longer freed at release as +it is no longer accessible. + +Compile-only tested. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- a/drivers/usb/serial/iuu_phoenix.c ++++ b/drivers/usb/serial/iuu_phoenix.c +@@ -72,63 +72,45 @@ struct iuu_private { + u32 clk; + }; + +- +-static void iuu_free_buf(struct iuu_private *priv) +-{ +- kfree(priv->buf); +- kfree(priv->writebuf); +-} +- +-static int iuu_alloc_buf(struct usb_serial *serial, struct iuu_private *priv) +-{ +- priv->buf = kzalloc(256, GFP_KERNEL); +- priv->writebuf = kzalloc(256, GFP_KERNEL); +- if (!priv->buf || !priv->writebuf) { +- iuu_free_buf(priv); +- dev_dbg(&serial->dev->dev, "%s problem allocation buffer\n", __func__); +- return -ENOMEM; +- } +- dev_dbg(&serial->dev->dev, "%s - Privates buffers allocation success\n", __func__); +- return 0; +-} +- +-static int iuu_startup(struct usb_serial *serial) ++static int iuu_port_probe(struct usb_serial_port *port) + { + struct iuu_private *priv; + + priv = kzalloc(sizeof(struct iuu_private), GFP_KERNEL); +- dev_dbg(&serial->dev->dev, "%s- priv allocation success\n", __func__); + if (!priv) + return -ENOMEM; +- if (iuu_alloc_buf(serial, priv)) { ++ ++ priv->buf = kzalloc(256, GFP_KERNEL); ++ if (!priv->buf) { + kfree(priv); + return -ENOMEM; + } ++ ++ priv->writebuf = kzalloc(256, GFP_KERNEL); ++ if (!priv->writebuf) { ++ kfree(priv->buf); ++ kfree(priv); ++ return -ENOMEM; ++ } ++ + priv->vcc = vcc_default; + spin_lock_init(&priv->lock); + init_waitqueue_head(&priv->delta_msr_wait); +- usb_set_serial_port_data(serial->port[0], priv); ++ ++ usb_set_serial_port_data(port, priv); ++ + return 0; + } + +-/* Release function */ +-static void iuu_release(struct usb_serial *serial) ++static int iuu_port_remove(struct usb_serial_port *port) + { +- struct usb_serial_port *port = serial->port[0]; + struct iuu_private *priv = usb_get_serial_port_data(port); +- if (!port) +- return; +- +- if (priv) { +- iuu_free_buf(priv); +- dev_dbg(&port->dev, "%s - I will free all\n", __func__); +- usb_set_serial_port_data(port, NULL); + +- dev_dbg(&port->dev, "%s - priv is not anymore in port structure\n", __func__); +- kfree(priv); ++ kfree(priv->writebuf); ++ kfree(priv->buf); ++ kfree(priv); + +- dev_dbg(&port->dev, "%s priv is now kfree\n", __func__); +- } ++ return 0; + } + + static int iuu_tiocmset(struct tty_struct *tty, +@@ -1225,8 +1207,8 @@ static struct usb_serial_driver iuu_device = { + .tiocmset = iuu_tiocmset, + .set_termios = iuu_set_termios, + .init_termios = iuu_init_termios, +- .attach = iuu_startup, +- .release = iuu_release, ++ .port_probe = iuu_port_probe, ++ .port_remove = iuu_port_remove, + }; + + static struct usb_serial_driver * const serial_drivers[] = { diff --git a/queue-3.6/usb-musb-am35xx-drop-spurious-unplugging-a-device.patch b/queue-3.6/usb-musb-am35xx-drop-spurious-unplugging-a-device.patch new file mode 100644 index 00000000000..cc4d7e12cca --- /dev/null +++ b/queue-3.6/usb-musb-am35xx-drop-spurious-unplugging-a-device.patch @@ -0,0 +1,63 @@ +From 6ff1f3d3bd7c69c62ca5773b1b684bce42eff06a Mon Sep 17 00:00:00 2001 +From: Stefano Babic +Date: Mon, 15 Oct 2012 11:20:22 +0200 +Subject: usb: musb: am35xx: drop spurious unplugging a device + +From: Stefano Babic + +commit 6ff1f3d3bd7c69c62ca5773b1b684bce42eff06a upstream. + +On AM3517, tx and rx interrupt are detected together with +the disconnect event. This generates a kernel panic in musb_interrupt, +because rx / tx are handled after disconnect. +This issue was seen on a Technexion's TAM3517 SOM. Unplugging a device, +tx / rx interrupts together with disconnect are detected. This brings +to kernel panic like this: + +[ 68.526153] Unable to handle kernel NULL pointer dereference at virtual address 00000011 +[ 68.534698] pgd = c0004000 +[ 68.537536] [00000011] *pgd=00000000 +[ 68.541351] Internal error: Oops: 17 [#1] ARM +[ 68.545928] Modules linked in: +[ 68.549163] CPU: 0 Not tainted (3.6.0-rc5-00020-g9e05905 #178) +[ 68.555694] PC is at rxstate+0x8/0xdc +[ 68.559539] LR is at musb_interrupt+0x98/0x858 +[ 68.564239] pc : [] lr : [] psr: 40000193 +[ 68.564239] sp : ce83fb40 ip : d0906410 fp : 00000000 +[ 68.576293] r10: 00000000 r9 : cf3b0e40 r8 : 00000002 +[ 68.581817] r7 : 00000019 r6 : 00000001 r5 : 00000001 r4 : 000000d4 +[ 68.588684] r3 : 00000000 r2 : 00000000 r1 : ffffffcc r0 : cf23c108 +[ 68.595550] Flags: nZcv IRQs off FIQs on Mode SVC_32 ISA ARM Segment ke + +Note: this behavior is not seen with a USB hub, while it is +easy to reproduce connecting a USB-pen directly to the USB-A of +the board. + +Drop tx / rx interrupts if disconnect is detected. + +Signed-off-by: Stefano Babic +CC: Felipe Balbi +Tested-by: Dmitry Lifshitz +Tested-by: Igor Grinberg +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/am35x.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/musb/am35x.c ++++ b/drivers/usb/musb/am35x.c +@@ -312,6 +312,12 @@ static irqreturn_t am35x_musb_interrupt( + ret = IRQ_HANDLED; + } + ++ /* Drop spurious RX and TX if device is disconnected */ ++ if (musb->int_usb & MUSB_INTR_DISCONNECT) { ++ musb->int_tx = 0; ++ musb->int_rx = 0; ++ } ++ + if (musb->int_tx || musb->int_rx || musb->int_usb) + ret |= musb_interrupt(musb); +