From: Greg Kroah-Hartman Date: Fri, 26 Oct 2012 22:22:46 +0000 (-0700) Subject: 3.6-stable patches X-Git-Tag: v3.0.49~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8ec421f11567f39023bf1b1098e4552c4ec94d08;p=thirdparty%2Fkernel%2Fstable-queue.git 3.6-stable patches added patches: drivers-hv-cleanup-error-handling-in-vmbus_open.patch ehci-add-yet-another-lucid-nohandoff-pci-quirk.patch ehci-fix-lucid-nohandoff-pci-quirk-to-be-more-generic-with-bios-versions.patch extcon-unregister-compat-class-at-module-unload-to-fix-oops.patch extcon-unregister-compat-link-on-cleanup.patch staging-android-binder-allow-using-highmem-for-binder-buffers.patch staging-android-binder-fix-memory-leak-on-thread-process-exit.patch staging-comedi-amplc_dio200-fix-possible-null-deref-during-detach.patch staging-comedi-amplc_pc236-fix-invalid-register-access-during-detach.patch staging-comedi-amplc_pc236-fix-possible-null-deref-during-detach.patch staging-comedi-amplc_pc263-fix-possible-null-deref-during-detach.patch staging-comedi-das08-fix-possible-null-deref-during-detach.patch staging-comedi-ni_daq_700-fix-dio-subdevice-regression.patch staging-comedi-ni_labpc-fix-possible-null-deref-during-detach.patch staging-zram-fix-handling-of-incompressible-pages.patch usb-hub-send-clear_tt_buffer_complete-events-when-canceling-tt-clear-work.patch usb-storage-add-unusual_devs-entry-for-casio-ex-n1-digital-camera.patch --- diff --git a/queue-3.6/drivers-hv-cleanup-error-handling-in-vmbus_open.patch b/queue-3.6/drivers-hv-cleanup-error-handling-in-vmbus_open.patch new file mode 100644 index 00000000000..2dd389cd04b --- /dev/null +++ b/queue-3.6/drivers-hv-cleanup-error-handling-in-vmbus_open.patch @@ -0,0 +1,105 @@ +From 1392550240aaa72ce3a094a38bd23525cd67ce60 Mon Sep 17 00:00:00 2001 +From: "K. Y. Srinivasan" +Date: Fri, 12 Oct 2012 13:22:42 -0700 +Subject: Drivers: hv: Cleanup error handling in vmbus_open() + +From: "K. Y. Srinivasan" + +commit 1392550240aaa72ce3a094a38bd23525cd67ce60 upstream. + +Fix a memory leak in the error handling path in the function vmbus_open(). + +Signed-off-by: K. Y. Srinivasan +Reviewed-by: Haiyang Zhang +Reported-by: Jason Wang +Acked-by: Jason Wang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hv/channel.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +--- a/drivers/hv/channel.c ++++ b/drivers/hv/channel.c +@@ -146,14 +146,14 @@ int vmbus_open(struct vmbus_channel *new + + if (ret != 0) { + err = ret; +- goto errorout; ++ goto error0; + } + + ret = hv_ringbuffer_init( + &newchannel->inbound, in, recv_ringbuffer_size); + if (ret != 0) { + err = ret; +- goto errorout; ++ goto error0; + } + + +@@ -168,7 +168,7 @@ int vmbus_open(struct vmbus_channel *new + + if (ret != 0) { + err = ret; +- goto errorout; ++ goto error0; + } + + /* Create and init the channel open message */ +@@ -177,7 +177,7 @@ int vmbus_open(struct vmbus_channel *new + GFP_KERNEL); + if (!open_info) { + err = -ENOMEM; +- goto errorout; ++ goto error0; + } + + init_completion(&open_info->waitevent); +@@ -193,7 +193,7 @@ int vmbus_open(struct vmbus_channel *new + + if (userdatalen > MAX_USER_DEFINED_BYTES) { + err = -EINVAL; +- goto errorout; ++ goto error0; + } + + if (userdatalen) +@@ -208,19 +208,18 @@ int vmbus_open(struct vmbus_channel *new + sizeof(struct vmbus_channel_open_channel)); + + if (ret != 0) +- goto cleanup; ++ goto error1; + + t = wait_for_completion_timeout(&open_info->waitevent, 5*HZ); + if (t == 0) { + err = -ETIMEDOUT; +- goto errorout; ++ goto error1; + } + + + if (open_info->response.open_result.status) + err = open_info->response.open_result.status; + +-cleanup: + spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags); + list_del(&open_info->msglistentry); + spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); +@@ -228,9 +227,12 @@ cleanup: + kfree(open_info); + return err; + +-errorout: +- hv_ringbuffer_cleanup(&newchannel->outbound); +- hv_ringbuffer_cleanup(&newchannel->inbound); ++error1: ++ spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags); ++ list_del(&open_info->msglistentry); ++ spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); ++ ++error0: + free_pages((unsigned long)out, + get_order(send_ringbuffer_size + recv_ringbuffer_size)); + kfree(open_info); diff --git a/queue-3.6/ehci-add-yet-another-lucid-nohandoff-pci-quirk.patch b/queue-3.6/ehci-add-yet-another-lucid-nohandoff-pci-quirk.patch new file mode 100644 index 00000000000..bb595bbe2e1 --- /dev/null +++ b/queue-3.6/ehci-add-yet-another-lucid-nohandoff-pci-quirk.patch @@ -0,0 +1,34 @@ +From 8daf8b6086f9d575200cd0aa3797e26137255609 Mon Sep 17 00:00:00 2001 +From: Anisse Astier +Date: Tue, 9 Oct 2012 12:22:37 +0200 +Subject: ehci: Add yet-another Lucid nohandoff pci quirk + +From: Anisse Astier + +commit 8daf8b6086f9d575200cd0aa3797e26137255609 upstream. + +Board name changed on another shipping Lucid tablet. + +Signed-off-by: Anisse Astier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/pci-quirks.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -548,6 +548,13 @@ static const struct dmi_system_id __devi + DMI_MATCH(DMI_BIOS_VERSION, "Lucid-"), + }, + }, ++ { ++ /* Pegatron Lucid (Ordissimo) */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "Ordissimo"), ++ DMI_MATCH(DMI_BIOS_VERSION, "Lucid-"), ++ }, ++ }, + { } + }; + diff --git a/queue-3.6/ehci-fix-lucid-nohandoff-pci-quirk-to-be-more-generic-with-bios-versions.patch b/queue-3.6/ehci-fix-lucid-nohandoff-pci-quirk-to-be-more-generic-with-bios-versions.patch new file mode 100644 index 00000000000..20d968b99b7 --- /dev/null +++ b/queue-3.6/ehci-fix-lucid-nohandoff-pci-quirk-to-be-more-generic-with-bios-versions.patch @@ -0,0 +1,30 @@ +From c323dc023b9501e5d09582ec7efd1d40a9001d99 Mon Sep 17 00:00:00 2001 +From: Anisse Astier +Date: Tue, 9 Oct 2012 12:22:36 +0200 +Subject: ehci: fix Lucid nohandoff pci quirk to be more generic with BIOS versions + +From: Anisse Astier + +commit c323dc023b9501e5d09582ec7efd1d40a9001d99 upstream. + +BIOS vendors keep changing the BIOS versions. Only match the beginning +of the string to match all Lucid tablets with board name M11JB. + +Signed-off-by: Anisse Astier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/pci-quirks.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -545,7 +545,7 @@ static const struct dmi_system_id __devi + /* Pegatron Lucid (Ordissimo AIRIS) */ + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "M11JB"), +- DMI_MATCH(DMI_BIOS_VERSION, "Lucid-GE-133"), ++ DMI_MATCH(DMI_BIOS_VERSION, "Lucid-"), + }, + }, + { } diff --git a/queue-3.6/extcon-unregister-compat-class-at-module-unload-to-fix-oops.patch b/queue-3.6/extcon-unregister-compat-class-at-module-unload-to-fix-oops.patch new file mode 100644 index 00000000000..2ccd1924595 --- /dev/null +++ b/queue-3.6/extcon-unregister-compat-class-at-module-unload-to-fix-oops.patch @@ -0,0 +1,159 @@ +From 0dc77b6dabec8fd298392018cc0de5214af2dc43 Mon Sep 17 00:00:00 2001 +From: Peter Huewe +Date: Mon, 24 Sep 2012 15:32:31 +0900 +Subject: extcon: Unregister compat class at module unload to fix oops + +From: Peter Huewe + +commit 0dc77b6dabec8fd298392018cc0de5214af2dc43 upstream. + +If you compile extcon with CONFIG_ANDROID and then load and unload the +module you get a simple oops as the driver does not unregister its +compat class and thus cannot register it again. + +Full trace: + +root@(none):~# modprobe extcon_class +root@(none):~# rmmod extcon_class +root@(none):~# modprobe extcon_class +------------[ cut here ]------------ +WARNING: at fs/sysfs/dir.c:536 sysfs_add_one+0xde/0x100() +sysfs: cannot create duplicate filename '/class/switch' +Modules linked in: extcon_class(+) [last unloaded: extcon_class] +Call Trace: +9f451a00: [<602a58bc>] printk+0x0/0xa8 +9f451a18: [<60039b43>] warn_slowpath_common+0x93/0xd0 +9f451a28: [<6012c6de>] sysfs_add_one+0xde/0x100 +9f451a50: [<601d3d90>] strcat+0x0/0x40 +9f451a68: [<60039cdc>] warn_slowpath_fmt+0x9c/0xa0 +9f451a90: [<6002fe32>] unblock_signals+0x0/0x84 +9f451ab0: [<60039c40>] warn_slowpath_fmt+0x0/0xa0 +9f451ac0: [<6002fe32>] unblock_signals+0x0/0x84 +9f451ae8: [<6012bd97>] sysfs_pathname.isra.10+0x57/0x70 +9f451b00: [<601d3d90>] strcat+0x0/0x40 +9f451b18: [<6012bd97>] sysfs_pathname.isra.10+0x57/0x70 +9f451b48: [<6012c6de>] sysfs_add_one+0xde/0x100 +9f451b78: [<6012c96f>] create_dir+0x8f/0x100 +9f451bc0: [] extcon_class_init+0x0/0x12 [extcon_class] +9f451bd8: [<6012cda6>] sysfs_create_dir+0xa6/0x1c0 +9f451be8: [<601d89f1>] kvasprintf+0x81/0xa0 +9f451bf8: [<601cf0f0>] kobject_get+0x0/0x50 +9f451c18: [<601cf396>] kobject_add_internal+0x96/0x280 +9f451c60: [] extcon_class_init+0x0/0x12 [extcon_class] +9f451c78: [<601cfb93>] kobject_add+0xd3/0x140 +9f451cc0: [<601cfac0>] kobject_add+0x0/0x140 +9f451cd0: [<6002fe32>] unblock_signals+0x0/0x84 +9f451cf8: [<6002fffc>] set_signals+0x29/0x3f +9f451d28: [<600c1de1>] kmem_cache_alloc+0xe1/0x100 +9f451d78: [<601cffa0>] kobject_create_and_add+0x50/0xa0 +9f451da8: [<601fbe76>] class_compat_register+0x56/0x80 +9f451dc8: [] create_extcon_class+0x88/0xd0 [extcon_class] +9f451de8: [] extcon_class_init+0x10/0x12 [extcon_class] +9f451df8: [<600189a8>] do_one_initcall+0x48/0x1f0 +9f451e20: [<60061920>] blocking_notifier_call_chain+0x0/0x20 +9f451e30: [<60061920>] blocking_notifier_call_chain+0x0/0x20 +9f451e58: [<6007e3c3>] sys_init_module+0xa3/0x280 +9f451e88: [<6001e2ad>] handle_syscall+0x8d/0x90 +9f451ea8: [<60033370>] userspace+0x405/0x531 +9f451ee8: [<6001e380>] copy_chunk_to_user+0x0/0x40 +9f451ef8: [<6001e5cd>] do_op_one_page+0x14d/0x220 +9f451fd8: [<6001a355>] fork_handler+0x95/0xa0 + +---[ end trace dd512cc03fe1c367 ]--- +------------[ cut here ]------------ +WARNING: at lib/kobject.c:196 kobject_add_internal+0x26e/0x280() +kobject_add_internal failed for switch with -EEXIST, don't try to +register things with the same name in the same directory. +Modules linked in: extcon_class(+) [last unloaded: extcon_class] +Call Trace: +9f451ad0: [<602a58bc>] printk+0x0/0xa8 +9f451ae8: [<60039b43>] warn_slowpath_common+0x93/0xd0 +9f451af8: [<601cf56e>] kobject_add_internal+0x26e/0x280 +9f451b18: [<601cf140>] kobject_put+0x0/0x70 +9f451b20: [] extcon_class_init+0x0/0x12 [extcon_class] +9f451b38: [<60039cdc>] warn_slowpath_fmt+0x9c/0xa0 +9f451b88: [<60039c40>] warn_slowpath_fmt+0x0/0xa0 +9f451bc0: [] extcon_class_init+0x0/0x12 [extcon_class] +9f451bd8: [<6012cda6>] sysfs_create_dir+0xa6/0x1c0 +9f451be8: [<601d89f1>] kvasprintf+0x81/0xa0 +9f451bf8: [<601cf0f0>] kobject_get+0x0/0x50 +9f451c18: [<601cf56e>] kobject_add_internal+0x26e/0x280 +9f451c60: [] extcon_class_init+0x0/0x12 [extcon_class] +9f451c78: [<601cfb93>] kobject_add+0xd3/0x140 +9f451cc0: [<601cfac0>] kobject_add+0x0/0x140 +9f451cd0: [<6002fe32>] unblock_signals+0x0/0x84 +9f451cf8: [<6002fffc>] set_signals+0x29/0x3f +9f451d28: [<600c1de1>] kmem_cache_alloc+0xe1/0x100 +9f451d78: [<601cffa0>] kobject_create_and_add+0x50/0xa0 +9f451da8: [<601fbe76>] class_compat_register+0x56/0x80 +9f451dc8: [] create_extcon_class+0x88/0xd0 [extcon_class] +9f451de8: [] extcon_class_init+0x10/0x12 [extcon_class] +9f451df8: [<600189a8>] do_one_initcall+0x48/0x1f0 +9f451e20: [<60061920>] blocking_notifier_call_chain+0x0/0x20 +9f451e30: [<60061920>] blocking_notifier_call_chain+0x0/0x20 +9f451e58: [<6007e3c3>] sys_init_module+0xa3/0x280 +9f451e88: [<6001e2ad>] handle_syscall+0x8d/0x90 +9f451ea8: [<60033370>] userspace+0x405/0x531 +9f451ee8: [<6001e380>] copy_chunk_to_user+0x0/0x40 +9f451ef8: [<6001e5cd>] do_op_one_page+0x14d/0x220 +9f451fd8: [<6001a355>] fork_handler+0x95/0xa0 + +---[ end trace dd512cc03fe1c368 ]--- +kobject_create_and_add: kobject_add error: -17 +------------[ cut here ]------------ +WARNING: at drivers/extcon/extcon_class.c:545 +create_extcon_class+0xbc/0xd0 [extcon_class]() +cannot allocate +Modules linked in: extcon_class(+) [last unloaded: extcon_class] +Call Trace: +9f451c80: [<602a58bc>] printk+0x0/0xa8 +9f451c98: [<60039b43>] warn_slowpath_common+0x93/0xd0 +9f451ca0: [<6002fe32>] unblock_signals+0x0/0x84 +9f451ca8: [] create_extcon_class+0xbc/0xd0 [extcon_class] +9f451cd0: [] extcon_class_init+0x0/0x12 [extcon_class] +9f451ce8: [<60039cdc>] warn_slowpath_fmt+0x9c/0xa0 +9f451d20: [<6002fe32>] unblock_signals+0x0/0x84 +9f451d28: [<60039c40>] warn_slowpath_fmt+0x0/0xa0 +9f451d48: [<6002fffc>] set_signals+0x29/0x3f +9f451d58: [<601cf172>] kobject_put+0x32/0x70 +9f451d78: [<600c22c3>] kfree+0xb3/0x100 +9f451da8: [<601fbe9a>] class_compat_register+0x7a/0x80 +9f451dc8: [] create_extcon_class+0xbc/0xd0 [extcon_class] +9f451de8: [] extcon_class_init+0x10/0x12 [extcon_class] +9f451df8: [<600189a8>] do_one_initcall+0x48/0x1f0 +9f451e20: [<60061920>] blocking_notifier_call_chain+0x0/0x20 +9f451e30: [<60061920>] blocking_notifier_call_chain+0x0/0x20 +9f451e58: [<6007e3c3>] sys_init_module+0xa3/0x280 +9f451e88: [<6001e2ad>] handle_syscall+0x8d/0x90 +9f451ea8: [<60033370>] userspace+0x405/0x531 +9f451ee8: [<6001e380>] copy_chunk_to_user+0x0/0x40 +9f451ef8: [<6001e5cd>] do_op_one_page+0x14d/0x220 +9f451fd8: [<6001a355>] fork_handler+0x95/0xa0 + +---[ end trace dd512cc03fe1c369 ]--- +FATAL: Error inserting extcon_class +(/lib/modules/3.6.0-rc6-00178-g811315f/kernel/drivers/extcon/extcon_class.ko): +Cannot allocate memory + +This patch fixes this. + +Signed-off-by: Peter Huewe +Signed-off-by: Chanwoo Choi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/extcon/extcon_class.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/extcon/extcon_class.c ++++ b/drivers/extcon/extcon_class.c +@@ -821,6 +821,9 @@ module_init(extcon_class_init); + + static void __exit extcon_class_exit(void) + { ++#if defined(CONFIG_ANDROID) ++ class_compat_unregister(switch_class); ++#endif + class_destroy(extcon_class); + } + module_exit(extcon_class_exit); diff --git a/queue-3.6/extcon-unregister-compat-link-on-cleanup.patch b/queue-3.6/extcon-unregister-compat-link-on-cleanup.patch new file mode 100644 index 00000000000..0c1833016dd --- /dev/null +++ b/queue-3.6/extcon-unregister-compat-link-on-cleanup.patch @@ -0,0 +1,32 @@ +From 824a1bc045cef278aec15bef35d8d0b59ce77856 Mon Sep 17 00:00:00 2001 +From: Peter Huewe +Date: Mon, 24 Sep 2012 15:36:24 +0900 +Subject: extcon: unregister compat link on cleanup + +From: Peter Huewe + +commit 824a1bc045cef278aec15bef35d8d0b59ce77856 upstream. + +Since extcon registers this compat link at device registration +(extcon_dev_register), we should probably remove them at deregistration/cleanup. + +Signed-off-by: Peter Huewe +Signed-off-by: Chanwoo Choi + +--- + drivers/extcon/extcon_class.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/extcon/extcon_class.c ++++ b/drivers/extcon/extcon_class.c +@@ -575,6 +575,10 @@ static void extcon_cleanup(struct extcon + kfree(edev->cables); + } + ++#if defined(CONFIG_ANDROID) ++ if (switch_class) ++ class_compat_remove_link(switch_class, edev->dev, NULL); ++#endif + device_unregister(edev->dev); + put_device(edev->dev); + } diff --git a/queue-3.6/series b/queue-3.6/series index da7defcd7ac..2dff7a94b56 100644 --- a/queue-3.6/series +++ b/queue-3.6/series @@ -22,3 +22,20 @@ xhci-fix-potential-null-ptr-deref-in-command-cancellation.patch xhci-fix-integer-overflow.patch xhci-endianness-xhci_calculate_intel_u2_timeout.patch sysfs-sysfs_pathname-sysfs_add_one-use-strlcat-instead-of-strcat.patch +staging-android-binder-fix-memory-leak-on-thread-process-exit.patch +staging-android-binder-allow-using-highmem-for-binder-buffers.patch +staging-zram-fix-handling-of-incompressible-pages.patch +staging-comedi-das08-fix-possible-null-deref-during-detach.patch +staging-comedi-ni_daq_700-fix-dio-subdevice-regression.patch +staging-comedi-ni_labpc-fix-possible-null-deref-during-detach.patch +staging-comedi-amplc_dio200-fix-possible-null-deref-during-detach.patch +staging-comedi-amplc_pc263-fix-possible-null-deref-during-detach.patch +staging-comedi-amplc_pc236-fix-invalid-register-access-during-detach.patch +staging-comedi-amplc_pc236-fix-possible-null-deref-during-detach.patch +extcon-unregister-compat-class-at-module-unload-to-fix-oops.patch +extcon-unregister-compat-link-on-cleanup.patch +drivers-hv-cleanup-error-handling-in-vmbus_open.patch +ehci-fix-lucid-nohandoff-pci-quirk-to-be-more-generic-with-bios-versions.patch +ehci-add-yet-another-lucid-nohandoff-pci-quirk.patch +usb-storage-add-unusual_devs-entry-for-casio-ex-n1-digital-camera.patch +usb-hub-send-clear_tt_buffer_complete-events-when-canceling-tt-clear-work.patch diff --git a/queue-3.6/staging-android-binder-allow-using-highmem-for-binder-buffers.patch b/queue-3.6/staging-android-binder-allow-using-highmem-for-binder-buffers.patch new file mode 100644 index 00000000000..09f781f5feb --- /dev/null +++ b/queue-3.6/staging-android-binder-allow-using-highmem-for-binder-buffers.patch @@ -0,0 +1,32 @@ +From 585650dcec88e704a19bb226a34b6a7166111623 Mon Sep 17 00:00:00 2001 +From: Arve Hjønnevåg +Date: Tue, 16 Oct 2012 15:29:55 -0700 +Subject: Staging: android: binder: Allow using highmem for binder buffers + +From: Arve Hjønnevåg + +commit 585650dcec88e704a19bb226a34b6a7166111623 upstream. + +The default kernel mapping for the pages allocated for the binder +buffers is never used. Set the __GFP_HIGHMEM flag when allocating +these pages so we don't needlessly use low memory pages that may +be required elsewhere. + +Signed-off-by: Arve Hjønnevåg +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/android/binder.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/android/binder.c ++++ b/drivers/staging/android/binder.c +@@ -655,7 +655,7 @@ static int binder_update_page_range(stru + page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; + + BUG_ON(*page); +- *page = alloc_page(GFP_KERNEL | __GFP_ZERO); ++ *page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO); + if (*page == NULL) { + pr_err("binder: %d: binder_alloc_buf failed " + "for page at %p\n", proc->pid, page_addr); diff --git a/queue-3.6/staging-android-binder-fix-memory-leak-on-thread-process-exit.patch b/queue-3.6/staging-android-binder-fix-memory-leak-on-thread-process-exit.patch new file mode 100644 index 00000000000..0ec0908057b --- /dev/null +++ b/queue-3.6/staging-android-binder-fix-memory-leak-on-thread-process-exit.patch @@ -0,0 +1,78 @@ +From 675d66b0ed5fd170d6a44cf8dbb3fa56a5347bdb Mon Sep 17 00:00:00 2001 +From: Arve Hjønnevåg +Date: Tue, 16 Oct 2012 15:29:54 -0700 +Subject: Staging: android: binder: Fix memory leak on thread/process exit + +From: Arve Hjønnevåg + +commit 675d66b0ed5fd170d6a44cf8dbb3fa56a5347bdb upstream. + +If a thread or process exited while a reply, one-way transaction or +death notification was pending, the struct holding the pending work +was leaked. + +Signed-off-by: Arve Hjønnevåg +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/android/binder.c | 28 +++++++++++++++++++++++++++- + 1 file changed, 27 insertions(+), 1 deletion(-) + +--- a/drivers/staging/android/binder.c ++++ b/drivers/staging/android/binder.c +@@ -2507,14 +2507,38 @@ static void binder_release_work(struct l + struct binder_transaction *t; + + t = container_of(w, struct binder_transaction, work); +- if (t->buffer->target_node && !(t->flags & TF_ONE_WAY)) ++ if (t->buffer->target_node && ++ !(t->flags & TF_ONE_WAY)) { + binder_send_failed_reply(t, BR_DEAD_REPLY); ++ } else { ++ binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, ++ "binder: undelivered transaction %d\n", ++ t->debug_id); ++ t->buffer->transaction = NULL; ++ kfree(t); ++ binder_stats_deleted(BINDER_STAT_TRANSACTION); ++ } + } break; + case BINDER_WORK_TRANSACTION_COMPLETE: { ++ binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, ++ "binder: undelivered TRANSACTION_COMPLETE\n"); + kfree(w); + binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); + } break; ++ case BINDER_WORK_DEAD_BINDER_AND_CLEAR: ++ case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { ++ struct binder_ref_death *death; ++ ++ death = container_of(w, struct binder_ref_death, work); ++ binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, ++ "binder: undelivered death notification, %p\n", ++ death->cookie); ++ kfree(death); ++ binder_stats_deleted(BINDER_STAT_DEATH); ++ } break; + default: ++ pr_err("binder: unexpected work type, %d, not freed\n", ++ w->type); + break; + } + } +@@ -2984,6 +3008,7 @@ static void binder_deferred_release(stru + nodes++; + rb_erase(&node->rb_node, &proc->nodes); + list_del_init(&node->work.entry); ++ binder_release_work(&node->async_todo); + if (hlist_empty(&node->refs)) { + kfree(node); + binder_stats_deleted(BINDER_STAT_NODE); +@@ -3022,6 +3047,7 @@ static void binder_deferred_release(stru + binder_delete_ref(ref); + } + binder_release_work(&proc->todo); ++ binder_release_work(&proc->delivered_death); + buffers = 0; + + while ((n = rb_first(&proc->allocated_buffers))) { diff --git a/queue-3.6/staging-comedi-amplc_dio200-fix-possible-null-deref-during-detach.patch b/queue-3.6/staging-comedi-amplc_dio200-fix-possible-null-deref-during-detach.patch new file mode 100644 index 00000000000..a905c385ee7 --- /dev/null +++ b/queue-3.6/staging-comedi-amplc_dio200-fix-possible-null-deref-during-detach.patch @@ -0,0 +1,41 @@ +From dfb2540e91e1f63765bc3ff497ad0b714d774261 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Wed, 3 Oct 2012 16:25:16 +0100 +Subject: staging: comedi: amplc_dio200: fix possible NULL deref during detach + +From: Ian Abbott + +commit dfb2540e91e1f63765bc3ff497ad0b714d774261 upstream. + +`dio200_detach()` is called by the comedi core to clean up if either +`dio200_attach()` or `dio200_attach_pci()` return an error. It assigns +`thisboard` to the return value of `comedi_board(dev)` and assumes it is +non-null. In the case of a previous call to `dio200_attach()` it won't +be `NULL` because the comedi core will have pointed it to one of the +elements of `dio200_boards[]`, but in the case of a previous call to +`dio200_attach_pci()` it could be `NULL`, leading to a null pointer +dereference. + +Check that `thisboard` is valid at the top of `dio200_detach()` and +return early if it is `NULL`. This is okay because the only other thing +that could have been allocated is `dev->private` and that is freed by +the comedi core, not by this function. + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/amplc_dio200.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/staging/comedi/drivers/amplc_dio200.c ++++ b/drivers/staging/comedi/drivers/amplc_dio200.c +@@ -1429,6 +1429,8 @@ static void dio200_detach(struct comedi_ + const struct dio200_layout_struct *layout; + unsigned n; + ++ if (!thisboard) ++ return; + if (dev->irq) + free_irq(dev->irq, dev); + if (dev->subdevices) { diff --git a/queue-3.6/staging-comedi-amplc_pc236-fix-invalid-register-access-during-detach.patch b/queue-3.6/staging-comedi-amplc_pc236-fix-invalid-register-access-during-detach.patch new file mode 100644 index 00000000000..5c9a05ffcfe --- /dev/null +++ b/queue-3.6/staging-comedi-amplc_pc236-fix-invalid-register-access-during-detach.patch @@ -0,0 +1,43 @@ +From aaeb61a97b7159ebe30b18a422d04eeabfa8790b Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Wed, 3 Oct 2012 16:25:17 +0100 +Subject: staging: comedi: amplc_pc236: fix invalid register access during detach + +From: Ian Abbott + +commit aaeb61a97b7159ebe30b18a422d04eeabfa8790b upstream. + +`pc236_detach()` is called by the comedi core if it attempted to attach +a device and failed. `pc236_detach()` calls `pc236_intr_disable()` if +the comedi device private data pointer (`devpriv`) is non-null. This +test is insufficient as `pc236_intr_disable()` accesses hardware +registers and the attach routine may have failed before it has saved +their I/O base addresses. + +Fix it by checking `dev->iobase` is non-zero before calling +`pc236_intr_disable()` as that means the I/O base addresses have been +saved and the hardware registers can be accessed. It also implies the +comedi device private data pointer is valid, so there is no need to +check it. + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/amplc_pc236.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/staging/comedi/drivers/amplc_pc236.c ++++ b/drivers/staging/comedi/drivers/amplc_pc236.c +@@ -577,10 +577,9 @@ static int __devinit pc236_attach_pci(st + + static void pc236_detach(struct comedi_device *dev) + { +- struct pc236_private *devpriv = dev->private; + struct pci_dev *pcidev = comedi_to_pci_dev(dev); + +- if (devpriv) ++ if (dev->iobase) + pc236_intr_disable(dev); + if (dev->irq) + free_irq(dev->irq, dev); diff --git a/queue-3.6/staging-comedi-amplc_pc236-fix-possible-null-deref-during-detach.patch b/queue-3.6/staging-comedi-amplc_pc236-fix-possible-null-deref-during-detach.patch new file mode 100644 index 00000000000..2894910c4e7 --- /dev/null +++ b/queue-3.6/staging-comedi-amplc_pc236-fix-possible-null-deref-during-detach.patch @@ -0,0 +1,42 @@ +From 2db012bd40b889d8e5483d3daa07af04c4c109d8 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Wed, 3 Oct 2012 16:25:18 +0100 +Subject: staging: comedi: amplc_pc236: fix possible NULL deref during detach + +From: Ian Abbott + +commit 2db012bd40b889d8e5483d3daa07af04c4c109d8 upstream. + +`pc236_detach()` is called by the comedi core to clean up if either +`pc236_attach()` or `pc236_attach_pci()` returns an error. It sets +`thisboard` to the return value of `comedi_board(dev)` and assumes it is +non-null. This is a valid assumption if `pc236_attach()` fails, but not +if `pc236_attach_pci()` fails, leading to a possible NULL pointer +dereference. + +Check `thisboard` at the top of `pc236_detach()` and return early if it +is `NULL`. This is okay because the only other thing that could have +been allocated is `dev->private` and that is freed by the comedi core, +not by this function. + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/amplc_pc236.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/staging/comedi/drivers/amplc_pc236.c ++++ b/drivers/staging/comedi/drivers/amplc_pc236.c +@@ -577,8 +577,11 @@ static int __devinit pc236_attach_pci(st + + static void pc236_detach(struct comedi_device *dev) + { ++ const struct pc236_board *thisboard = comedi_board(dev); + struct pci_dev *pcidev = comedi_to_pci_dev(dev); + ++ if (!thisboard) ++ return; + if (dev->iobase) + pc236_intr_disable(dev); + if (dev->irq) diff --git a/queue-3.6/staging-comedi-amplc_pc263-fix-possible-null-deref-during-detach.patch b/queue-3.6/staging-comedi-amplc_pc263-fix-possible-null-deref-during-detach.patch new file mode 100644 index 00000000000..0c72a5df342 --- /dev/null +++ b/queue-3.6/staging-comedi-amplc_pc263-fix-possible-null-deref-during-detach.patch @@ -0,0 +1,41 @@ +From 1d1171ffda585c1cab7bd7cf4bd8f8fd5923fb4a Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Wed, 3 Oct 2012 16:25:19 +0100 +Subject: staging: comedi: amplc_pc263: fix possible NULL deref during detach + +From: Ian Abbott + +commit 1d1171ffda585c1cab7bd7cf4bd8f8fd5923fb4a upstream. + +`pc263_detach()` is called by the comedi core to clean up if either +`pc263_attach()` or `pc263_attach_pci()` returns an error. It sets +`thisboard` to the return value of `comedi_board(dev)` and assumes it is +non-null. This is a valid assumption if `pc263_attach()` fails, but not +if `pc263_attach_pci()` fails, leading to a possible NULL pointer +dereference. + +Check `thisboard` at the top of `pc263_detach()` and return early if it +is `NULL`. This is okay because no other resources need cleaning up in +this case. + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/amplc_pc263.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/staging/comedi/drivers/amplc_pc263.c ++++ b/drivers/staging/comedi/drivers/amplc_pc263.c +@@ -310,8 +310,11 @@ static int __devinit pc263_attach_pci(st + + static void pc263_detach(struct comedi_device *dev) + { ++ const struct pc263_board *thisboard = comedi_board(dev); + struct pci_dev *pcidev = comedi_to_pci_dev(dev); + ++ if (!thisboard) ++ return; + if (pcidev) { + if (dev->iobase) + comedi_pci_disable(pcidev); diff --git a/queue-3.6/staging-comedi-das08-fix-possible-null-deref-during-detach.patch b/queue-3.6/staging-comedi-das08-fix-possible-null-deref-during-detach.patch new file mode 100644 index 00000000000..dee20a365f6 --- /dev/null +++ b/queue-3.6/staging-comedi-das08-fix-possible-null-deref-during-detach.patch @@ -0,0 +1,39 @@ +From ee280d134f2e05e0172369a53fbe202dbfc527fa Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Wed, 3 Oct 2012 16:25:20 +0100 +Subject: staging: comedi: das08: fix possible NULL deref during detach + +From: Ian Abbott + +commit ee280d134f2e05e0172369a53fbe202dbfc527fa upstream. + +`das08_detach()` is called by the comedi core to clean up if either +`das08_attach()` or `das08_attach_pci()` returns an error. It sets +`thisboard` to the return value of `comedi_board(dev)` and assumes it is +non-null. This is a valid assumption if `das08_attach()` fails, but not +if `das08_attach_pci()` fails, leading to a possible NULL pointer +dereference. + +Check `thisboard` at the top of `das08_detach()` and return early if it +is `NULL`. This is okay because the only other thing that could have +been allocated is `dev->private` and that is freed by the comedi core, +not by this function. + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/das08.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/staging/comedi/drivers/das08.c ++++ b/drivers/staging/comedi/drivers/das08.c +@@ -1028,6 +1028,8 @@ static void __maybe_unused das08_detach( + const struct das08_board_struct *thisboard = comedi_board(dev); + struct das08_private_struct *devpriv = dev->private; + ++ if (!thisboard) ++ return; + das08_common_detach(dev); + if (IS_ENABLED(CONFIG_COMEDI_DAS08_ISA) && + (thisboard->bustype == isa || thisboard->bustype == pc104)) { diff --git a/queue-3.6/staging-comedi-ni_daq_700-fix-dio-subdevice-regression.patch b/queue-3.6/staging-comedi-ni_daq_700-fix-dio-subdevice-regression.patch new file mode 100644 index 00000000000..fc5736f1a82 --- /dev/null +++ b/queue-3.6/staging-comedi-ni_daq_700-fix-dio-subdevice-regression.patch @@ -0,0 +1,41 @@ +From 6681e63399926651cc29bcb9d92229b6f1cf1daa Mon Sep 17 00:00:00 2001 +From: Fred Brooks +Date: Tue, 2 Oct 2012 11:10:26 +0100 +Subject: staging: comedi: ni_daq_700: fix dio subdevice regression + +From: Fred Brooks + +commit 6681e63399926651cc29bcb9d92229b6f1cf1daa upstream. + +Here is a small patch to fix a problem caused by a previous patch that +removed the callback function. The callback remove patch: +http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=1de02225358988e8fd48d1dc3fd12336bbae258a + +I finally booted my dev machine on the latest kernel (running Debian +here so it's still on 3.2 normally) to test the ni_daq_700 driver with +my test program and noticed this bug. + +Shift the DIO_R read result to bits 8..15 Digital direction +configuration: channels 0-7 output, 8-15 input (8225 device emu as port +A output, port B input, port C N/A). + +Signed-off-by: Fred Brooks +Signed-off-by: Ian Abbott +Reviewed-by: H Hartley Sweeten +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/ni_daq_700.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/comedi/drivers/ni_daq_700.c ++++ b/drivers/staging/comedi/drivers/ni_daq_700.c +@@ -71,7 +71,7 @@ static int subdev_700_insn(struct comedi + } + + data[1] = s->state & 0xff; +- data[1] |= inb(dev->iobase + DIO_R); ++ data[1] |= inb(dev->iobase + DIO_R) << 8; + + return insn->n; + } diff --git a/queue-3.6/staging-comedi-ni_labpc-fix-possible-null-deref-during-detach.patch b/queue-3.6/staging-comedi-ni_labpc-fix-possible-null-deref-during-detach.patch new file mode 100644 index 00000000000..c320277d671 --- /dev/null +++ b/queue-3.6/staging-comedi-ni_labpc-fix-possible-null-deref-during-detach.patch @@ -0,0 +1,40 @@ +From 922b67c1ac53014d80649a961a2fde700cd065d8 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Wed, 3 Oct 2012 16:25:21 +0100 +Subject: staging: comedi: ni_labpc: fix possible NULL deref during detach + +From: Ian Abbott + +commit 922b67c1ac53014d80649a961a2fde700cd065d8 upstream. + +`labpc_common_detach()` is called by the comedi core to clean up if +either `labpc_attach()` (including the one in the "ni_labpc_cs" module) +or `labpc_attach_pci()` returns an error. It assumes the `thisboard` +macro (expanding to `((struct labpc_board_struct *)dev->board_ptr)`) is +non-null. This is a valid assumption if `labpc_attach()` fails, but not +if `labpc_attach_pci()` fails, leading to a possible NULL pointer +dereference. + +Check `thisboard` at the top of `labpc_common_detach()` and return early +if it is `NULL`. This is okay because the only other thing that could +have been allocated is `dev->private` and that is freed by the comedi +core, not by this function. + +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/drivers/ni_labpc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/staging/comedi/drivers/ni_labpc.c ++++ b/drivers/staging/comedi/drivers/ni_labpc.c +@@ -809,6 +809,8 @@ static int labpc_find_device(struct come + + void labpc_common_detach(struct comedi_device *dev) + { ++ if (!thisboard) ++ return; + if (dev->subdevices) + subdev_8255_cleanup(dev, dev->subdevices + 2); + #ifdef CONFIG_ISA_DMA_API diff --git a/queue-3.6/staging-zram-fix-handling-of-incompressible-pages.patch b/queue-3.6/staging-zram-fix-handling-of-incompressible-pages.patch new file mode 100644 index 00000000000..b2b77af9260 --- /dev/null +++ b/queue-3.6/staging-zram-fix-handling-of-incompressible-pages.patch @@ -0,0 +1,70 @@ +From c8f2f0db1d0294aaf37e8a85bea9bbc4aaf5c0fe Mon Sep 17 00:00:00 2001 +From: Nitin Gupta +Date: Wed, 10 Oct 2012 17:42:18 -0700 +Subject: staging: zram: Fix handling of incompressible pages + +From: Nitin Gupta + +commit c8f2f0db1d0294aaf37e8a85bea9bbc4aaf5c0fe upstream. + +Change 130f315a (staging: zram: remove special handle of uncompressed page) +introduced a bug in the handling of incompressible pages which resulted in +memory allocation failure for such pages. + +When a page expands on compression, say from 4K to 4K+30, we were trying to +do zsmalloc(pool, 4K+30). However, the maximum size which zsmalloc can +allocate is PAGE_SIZE (for obvious reasons), so such allocation requests +always return failure (0). + +For a page that has compressed size larger than the original size (this may +happen with already compressed or random data), there is no point storing +the compressed version as that would take more space and would also require +time for decompression when needed again. So, the fix is to store any page, +whose compressed size exceeds a threshold (max_zpage_size), as-it-is i.e. +without compression. Memory required for storing this uncompressed page can +then be requested from zsmalloc which supports PAGE_SIZE sized allocations. + +Lastly, the fix checks that we do not attempt to "decompress" the page which +we stored in the uncompressed form -- we just memcpy() out such pages. + +Signed-off-by: Nitin Gupta +Reported-by: viechweg@gmail.com +Reported-by: paerley@gmail.com +Reported-by: wu.tommy@gmail.com +Acked-by: Minchan Kim +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/zram/zram_drv.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/staging/zram/zram_drv.c ++++ b/drivers/staging/zram/zram_drv.c +@@ -223,8 +223,13 @@ static int zram_bvec_read(struct zram *z + cmem = zs_map_object(zram->mem_pool, zram->table[index].handle, + ZS_MM_RO); + +- ret = lzo1x_decompress_safe(cmem, zram->table[index].size, ++ if (zram->table[index].size == PAGE_SIZE) { ++ memcpy(uncmem, cmem, PAGE_SIZE); ++ ret = LZO_E_OK; ++ } else { ++ ret = lzo1x_decompress_safe(cmem, zram->table[index].size, + uncmem, &clen); ++ } + + if (is_partial_io(bvec)) { + memcpy(user_mem + bvec->bv_offset, uncmem + offset, +@@ -342,8 +347,11 @@ static int zram_bvec_write(struct zram * + goto out; + } + +- if (unlikely(clen > max_zpage_size)) ++ if (unlikely(clen > max_zpage_size)) { + zram_stat_inc(&zram->stats.bad_compress); ++ src = uncmem; ++ clen = PAGE_SIZE; ++ } + + handle = zs_malloc(zram->mem_pool, clen); + if (!handle) { diff --git a/queue-3.6/usb-hub-send-clear_tt_buffer_complete-events-when-canceling-tt-clear-work.patch b/queue-3.6/usb-hub-send-clear_tt_buffer_complete-events-when-canceling-tt-clear-work.patch new file mode 100644 index 00000000000..9bed070cdfe --- /dev/null +++ b/queue-3.6/usb-hub-send-clear_tt_buffer_complete-events-when-canceling-tt-clear-work.patch @@ -0,0 +1,144 @@ +From 3b6054da68f9b0d5ed6a7ed0f42a79e61904352c Mon Sep 17 00:00:00 2001 +From: Octavian Purdila +Date: Mon, 1 Oct 2012 22:21:12 +0300 +Subject: usb hub: send clear_tt_buffer_complete events when canceling TT clear work + +From: Octavian Purdila + +commit 3b6054da68f9b0d5ed6a7ed0f42a79e61904352c upstream. + +There is a race condition in the USB hub code with regard to handling +TT clear requests that can get the HCD driver in a deadlock. Usually +when an TT clear request is scheduled it will be executed immediately: + +<7>[ 6.077583] usb 2-1.3: unlink qh1-0e01/f4d4db00 start 0 [1/2 us] +<3>[ 6.078041] usb 2-1: clear tt buffer port 3, a3 ep2 t04048d82 +<7>[ 6.078299] hub_tt_work:731 +<7>[ 9.309089] usb 2-1.5: link qh1-0e01/f4d506c0 start 0 [1/2 us] +<7>[ 9.324526] ehci_hcd 0000:00:1d.0: reused qh f4d4db00 schedule +<7>[ 9.324539] usb 2-1.3: link qh1-0e01/f4d4db00 start 0 [1/2 us] +<7>[ 9.341530] usb 1-1.1: link qh4-0e01/f397aec0 start 2 [1/2 us] +<7>[ 10.116159] usb 2-1.3: unlink qh1-0e01/f4d4db00 start 0 [1/2 us] +<3>[ 10.116459] usb 2-1: clear tt buffer port 3, a3 ep2 t04048d82 +<7>[ 10.116537] hub_tt_work:731 + +However, if a suspend operation is triggered before hub_tt_work is +scheduled, hub_quiesce will cancel the work without notifying the HCD +driver: + +<3>[ 35.033941] usb 2-1: clear tt buffer port 3, a3 ep2 t04048d80 +<5>[ 35.034022] sd 0:0:0:0: [sda] Stopping disk +<7>[ 35.034039] hub 2-1:1.0: hub_suspend +<7>[ 35.034067] usb 2-1: unlink qh256-0001/f3b1ab00 start 1 [1/0 us] +<7>[ 35.035085] hub 1-0:1.0: hub_suspend +<7>[ 35.035102] usb usb1: bus suspend, wakeup 0 +<7>[ 35.035106] ehci_hcd 0000:00:1a.0: suspend root hub +<7>[ 35.035298] hub 2-0:1.0: hub_suspend +<7>[ 35.035313] usb usb2: bus suspend, wakeup 0 +<7>[ 35.035315] ehci_hcd 0000:00:1d.0: suspend root hub +<6>[ 35.250017] PM: suspend of devices complete after 216.979 msecs +<6>[ 35.250822] PM: late suspend of devices complete after 0.799 msecs +<7>[ 35.252343] ehci_hcd 0000:00:1d.0: wakeup: 1 +<7>[ 35.262923] ehci_hcd 0000:00:1d.0: --> PCI D3hot +<7>[ 35.263302] ehci_hcd 0000:00:1a.0: wakeup: 1 +<7>[ 35.273912] ehci_hcd 0000:00:1a.0: --> PCI D3hot +<6>[ 35.274254] PM: noirq suspend of devices complete after 23.442 msecs +<6>[ 35.274975] ACPI: Preparing to enter system sleep state S3 +<6>[ 35.292666] PM: Saving platform NVS memory +<7>[ 35.295030] Disabling non-boot CPUs ... +<6>[ 35.297351] CPU 1 is now offline +<6>[ 35.300345] CPU 2 is now offline +<6>[ 35.303929] CPU 3 is now offline +<7>[ 35.303931] lockdep: fixing up alternatives. +<6>[ 35.304825] Extended CMOS year: 2000 + +When the device will resume the EHCI driver will get stuck in +ehci_endpoint_disable waiting for the tt_clearing flag to reset: + +<0>[ 47.610967] usb 2-1.3: **** DPM device timeout **** +<7>[ 47.610972] f2f11c60 00000092 f2f11c0c c10624a5 00000003 f4c6e880 c1c8a4c0 c1c8a4c0 +<7>[ 47.610983] 15c55698 0000000b f56b34c0 f2a45b70 f4c6e880 00000082 f2a4602c f2f11c30 +<7>[ 47.610993] c10787f8 f4cac000 f2a45b70 00000000 f4cac010 f2f11c58 00000046 00000001 +<7>[ 47.611004] Call Trace: +<7>[ 47.611006] [] ? sched_clock_cpu+0xf5/0x160 +<7>[ 47.611019] [] ? lock_release_holdtime.part.22+0x88/0xf0 +<7>[ 47.611026] [] ? lock_timer_base.isra.35+0x26/0x50 +<7>[ 47.611034] [] ? schedule_timeout+0x133/0x290 +<7>[ 47.611044] [] schedule+0x1e/0x50 +<7>[ 47.611051] [] schedule_timeout+0x138/0x290 +<7>[ 47.611057] [] ? sched_clock_cpu+0xf5/0x160 +<7>[ 47.611063] [] ? usleep_range+0x40/0x40 +<7>[ 47.611070] [] schedule_timeout_uninterruptible+0x15/0x20 +<7>[ 47.611077] [] ehci_endpoint_disable+0x64/0x160 +<7>[ 47.611084] [] ? usb_hcd_flush_endpoint+0x10e/0x1d0 +<7>[ 47.611092] [] ? sysfs_add_file+0x13/0x20 +<7>[ 47.611100] [] usb_hcd_disable_endpoint+0x29/0x40 +<7>[ 47.611107] [] usb_disable_endpoint+0x5c/0x80 +<7>[ 47.611111] [] usb_disable_interface+0x37/0x50 +<7>[ 47.611116] [] usb_reset_and_verify_device+0x4b0/0x640 +<7>[ 47.611122] [] ? hub_port_status+0xb5/0x100 +<7>[ 47.611129] [] usb_port_resume+0xd5/0x220 +<7>[ 47.611136] [] generic_resume+0xf/0x30 +<7>[ 47.611142] [] usb_resume+0x133/0x180 +<7>[ 47.611147] [] ? usb_dev_thaw+0x10/0x10 +<7>[ 47.611152] [] usb_dev_resume+0xd/0x10 +<7>[ 47.611157] [] dpm_run_callback+0x40/0xb0 +<7>[ 47.611164] [] ? pm_runtime_enable+0x43/0x70 +<7>[ 47.611171] [] device_resume+0x1a6/0x2c0 +<7>[ 47.611177] [] ? dpm_show_time+0xe0/0xe0 +<7>[ 47.611183] [] async_resume+0x19/0x40 +<7>[ 47.611189] [] async_run_entry_fn+0x64/0x160 +<7>[ 47.611196] [] ? process_one_work+0x104/0x480 +<7>[ 47.611203] [] ? process_one_work+0x10c/0x480 +<7>[ 47.611209] [] process_one_work+0x180/0x480 +<7>[ 47.611215] [] ? process_one_work+0x104/0x480 +<7>[ 47.611220] [] ? async_schedule+0x10/0x10 +<7>[ 47.611226] [] worker_thread+0x11c/0x2f0 +<7>[ 47.611233] [] ? manage_workers.isra.27+0x1f0/0x1f0 +<7>[ 47.611239] [] kthread+0x78/0x80 +<7>[ 47.611244] [] ? timer_cpu_notify+0xd6/0x20d +<7>[ 47.611253] [] ? __init_kthread_worker+0x60/0x60 +<7>[ 47.611258] [] kernel_thread_helper+0x6/0xd +<7>[ 47.611283] ------------[ cut here ]------------ + +This patch changes hub_quiesce behavior to flush the TT clear work +instead of canceling it, to make sure that no TT clear request remains +uncompleted before suspend. + +Signed-off-by: Octavian Purdila +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -730,13 +730,16 @@ static void hub_tt_work(struct work_stru + int limit = 100; + + spin_lock_irqsave (&hub->tt.lock, flags); +- while (--limit && !list_empty (&hub->tt.clear_list)) { ++ while (!list_empty(&hub->tt.clear_list)) { + struct list_head *next; + struct usb_tt_clear *clear; + struct usb_device *hdev = hub->hdev; + const struct hc_driver *drv; + int status; + ++ if (!hub->quiescing && --limit < 0) ++ break; ++ + next = hub->tt.clear_list.next; + clear = list_entry (next, struct usb_tt_clear, clear_list); + list_del (&clear->clear_list); +@@ -1201,7 +1204,7 @@ static void hub_quiesce(struct usb_hub * + if (hub->has_indicators) + cancel_delayed_work_sync(&hub->leds); + if (hub->tt.hub) +- cancel_work_sync(&hub->tt.clear_work); ++ flush_work_sync(&hub->tt.clear_work); + } + + /* caller has locked the hub device */ diff --git a/queue-3.6/usb-storage-add-unusual_devs-entry-for-casio-ex-n1-digital-camera.patch b/queue-3.6/usb-storage-add-unusual_devs-entry-for-casio-ex-n1-digital-camera.patch new file mode 100644 index 00000000000..7e597fe674c --- /dev/null +++ b/queue-3.6/usb-storage-add-unusual_devs-entry-for-casio-ex-n1-digital-camera.patch @@ -0,0 +1,39 @@ +From d7870af7e2e3a91b462075ec1ca669b482215187 Mon Sep 17 00:00:00 2001 +From: Michael Shigorin +Date: Mon, 22 Oct 2012 12:18:56 +0300 +Subject: usb-storage: add unusual_devs entry for Casio EX-N1 digital camera + +From: Michael Shigorin + +commit d7870af7e2e3a91b462075ec1ca669b482215187 upstream. + +This commit sets removable subclass for Casio EX-N1 digital camera. + +The patch has been tested within an ALT Linux kernel: +http://git.altlinux.org/people/led/packages/?p=kernel-image-3.0.git;a=commitdiff;h=c0fd891836e89fe0c93a4d536a59216d90e4e3e7 + +See also https://bugzilla.kernel.org/show_bug.cgi?id=49221 + +Signed-off-by: Oleksandr Chumachenko +Signed-off-by: Michael Shigorin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_devs.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -1004,6 +1004,12 @@ UNUSUAL_DEV( 0x07cf, 0x1001, 0x1000, 0x9 + USB_SC_8070, USB_PR_CB, NULL, + US_FL_NEED_OVERRIDE | US_FL_FIX_INQUIRY ), + ++/* Submitted by Oleksandr Chumachenko */ ++UNUSUAL_DEV( 0x07cf, 0x1167, 0x0100, 0x0100, ++ "Casio", ++ "EX-N1 DigitalCamera", ++ USB_SC_8070, USB_PR_DEVICE, NULL, 0), ++ + /* Submitted by Hartmut Wahl */ + UNUSUAL_DEV( 0x0839, 0x000a, 0x0001, 0x0001, + "Samsung",