From db972160d67a18b471edfbdb4c0831aa93d58873 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 27 Jul 2009 16:19:43 -0700 Subject: [PATCH] start .30 queue up --- queue-2.6.30/cfg80211-fix-refcount-leak.patch | 31 +++ ...6xxx-statistics-counter-snapshotting.patch | 34 +++ ...er-kmem_cache_destroy-problem-in-slb.patch | 58 ++++ ...-establishment-messages-in-any-order.patch | 100 +++++++ ...nted-creds-over-call-to-nfsd_setuser.patch | 52 ++++ ...csi-zalon-fix-oops-on-attach-failure.patch | 35 +++ queue-2.6.30/series | 18 ++ ...karound-for-blue-microphones-devices.patch | 56 ++++ ...fix-xonar-d1-dx-silence-after-resume.patch | 34 +++ ...om-crashing-dev_ioctl-in-siocgiwname.patch | 59 ++++ ...port-actual_length-for-iso-transfers.patch | 51 ++++ ...se-the-new-clear_tt_buffer-interface.patch | 262 ++++++++++++++++++ .../usb-fix-langid-0-regression.patch | 114 ++++++++ queue-2.6.30/usb-fix-memleak-in-usbfs.patch | 63 +++++ ...sb-fix-the-clear_tt_buffer-interface.patch | 200 +++++++++++++ ...itialised-variable-in-ti_do_download.patch | 28 ++ ...o-length-usbfs-submissions-correctly.patch | 123 ++++++++ ...s-gadget-fix-issues-talking-from-pxa.patch | 51 ++++ ...b_3410_5052-fix-duplicate-device-ids.patch | 29 ++ 19 files changed, 1398 insertions(+) create mode 100644 queue-2.6.30/cfg80211-fix-refcount-leak.patch create mode 100644 queue-2.6.30/dsa-fix-88e6xxx-statistics-counter-snapshotting.patch create mode 100644 queue-2.6.30/fix-rcu-callback-after-kmem_cache_destroy-problem-in-slb.patch create mode 100644 queue-2.6.30/gigaset-accept-connection-establishment-messages-in-any-order.patch create mode 100644 queue-2.6.30/nfsd-don-t-hold-unrefcounted-creds-over-call-to-nfsd_setuser.patch create mode 100644 queue-2.6.30/scsi-zalon-fix-oops-on-attach-failure.patch create mode 100644 queue-2.6.30/series create mode 100644 queue-2.6.30/sound-usb-audio-add-workaround-for-blue-microphones-devices.patch create mode 100644 queue-2.6.30/sound-virtuoso-fix-xonar-d1-dx-silence-after-resume.patch create mode 100644 queue-2.6.30/staging-prevent-rtl8187se-from-crashing-dev_ioctl-in-siocgiwname.patch create mode 100644 queue-2.6.30/usb-ehci-report-actual_length-for-iso-transfers.patch create mode 100644 queue-2.6.30/usb-ehci-use-the-new-clear_tt_buffer-interface.patch create mode 100644 queue-2.6.30/usb-fix-langid-0-regression.patch create mode 100644 queue-2.6.30/usb-fix-memleak-in-usbfs.patch create mode 100644 queue-2.6.30/usb-fix-the-clear_tt_buffer-interface.patch create mode 100644 queue-2.6.30/usb-fix-uninitialised-variable-in-ti_do_download.patch create mode 100644 queue-2.6.30/usb-handle-zero-length-usbfs-submissions-correctly.patch create mode 100644 queue-2.6.30/usb-rndis-gadget-fix-issues-talking-from-pxa.patch create mode 100644 queue-2.6.30/usb-ti_usb_3410_5052-fix-duplicate-device-ids.patch diff --git a/queue-2.6.30/cfg80211-fix-refcount-leak.patch b/queue-2.6.30/cfg80211-fix-refcount-leak.patch new file mode 100644 index 00000000000..65f8c47f9af --- /dev/null +++ b/queue-2.6.30/cfg80211-fix-refcount-leak.patch @@ -0,0 +1,31 @@ +From 2dce4c2b5f0b43bd25bf9ea6ded06b7f8a54c91f Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Thu, 2 Jul 2009 15:46:41 +0200 +Subject: cfg80211: fix refcount leak + +From: Johannes Berg + +commit 2dce4c2b5f0b43bd25bf9ea6ded06b7f8a54c91f upstream. + +The code in cfg80211's cfg80211_bss_update erroneously +grabs a reference to the BSS, which means that it will +never be freed. + +Signed-off-by: Johannes Berg +Signed-off-by: John W. Linville +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/scan.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -365,7 +365,6 @@ cfg80211_bss_update(struct cfg80211_regi + found = rb_find_bss(dev, res); + + if (found) { +- kref_get(&found->ref); + found->pub.beacon_interval = res->pub.beacon_interval; + found->pub.tsf = res->pub.tsf; + found->pub.signal = res->pub.signal; diff --git a/queue-2.6.30/dsa-fix-88e6xxx-statistics-counter-snapshotting.patch b/queue-2.6.30/dsa-fix-88e6xxx-statistics-counter-snapshotting.patch new file mode 100644 index 00000000000..99d607bce3c --- /dev/null +++ b/queue-2.6.30/dsa-fix-88e6xxx-statistics-counter-snapshotting.patch @@ -0,0 +1,34 @@ +From 1ded3f59f35a2642852b3e2a1c0fa8a97777e9af Mon Sep 17 00:00:00 2001 +From: Stephane Contri +Date: Thu, 2 Jul 2009 23:26:48 +0000 +Subject: dsa: fix 88e6xxx statistics counter snapshotting + +From: Stephane Contri + +commit 1ded3f59f35a2642852b3e2a1c0fa8a97777e9af upstream. + +The bit that tells us whether a statistics counter snapshot operation +has completed is located in the GLOBAL register block, not in the +GLOBAL2 register block, so fix up mv88e6xxx_stats_wait() to poll the +right register address. + +Signed-off-by: Stephane Contri +Signed-off-by: Lennert Buytenhek +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/dsa/mv88e6xxx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/dsa/mv88e6xxx.c ++++ b/net/dsa/mv88e6xxx.c +@@ -418,7 +418,7 @@ static int mv88e6xxx_stats_wait(struct d + int i; + + for (i = 0; i < 10; i++) { +- ret = REG_READ(REG_GLOBAL2, 0x1d); ++ ret = REG_READ(REG_GLOBAL, 0x1d); + if ((ret & 0x8000) == 0) + return 0; + } diff --git a/queue-2.6.30/fix-rcu-callback-after-kmem_cache_destroy-problem-in-slb.patch b/queue-2.6.30/fix-rcu-callback-after-kmem_cache_destroy-problem-in-slb.patch new file mode 100644 index 00000000000..44b49051904 --- /dev/null +++ b/queue-2.6.30/fix-rcu-callback-after-kmem_cache_destroy-problem-in-slb.patch @@ -0,0 +1,58 @@ +From 7ed9f7e5db58c6e8c2b4b738a75d5dcd8e17aad5 Mon Sep 17 00:00:00 2001 +From: Paul E. McKenney +Date: Thu, 25 Jun 2009 12:31:37 -0700 +Subject: fix RCU-callback-after-kmem_cache_destroy problem in sl[aou]b + +From: Paul E. McKenney + +commit 7ed9f7e5db58c6e8c2b4b738a75d5dcd8e17aad5 upstream. + +Jesper noted that kmem_cache_destroy() invokes synchronize_rcu() rather than +rcu_barrier() in the SLAB_DESTROY_BY_RCU case, which could result in RCU +callbacks accessing a kmem_cache after it had been destroyed. + +Acked-by: Matt Mackall +Reported-by: Jesper Dangaard Brouer +Signed-off-by: Paul E. McKenney +Signed-off-by: Pekka Enberg +Signed-off-by: Greg Kroah-Hartman + +--- + mm/slab.c | 2 +- + mm/slob.c | 2 ++ + mm/slub.c | 2 ++ + 3 files changed, 5 insertions(+), 1 deletion(-) + +--- a/mm/slab.c ++++ b/mm/slab.c +@@ -2592,7 +2592,7 @@ void kmem_cache_destroy(struct kmem_cach + } + + if (unlikely(cachep->flags & SLAB_DESTROY_BY_RCU)) +- synchronize_rcu(); ++ rcu_barrier(); + + __kmem_cache_destroy(cachep); + mutex_unlock(&cache_chain_mutex); +--- a/mm/slob.c ++++ b/mm/slob.c +@@ -590,6 +590,8 @@ EXPORT_SYMBOL(kmem_cache_create); + + void kmem_cache_destroy(struct kmem_cache *c) + { ++ if (c->flags & SLAB_DESTROY_BY_RCU) ++ rcu_barrier(); + slob_free(c, sizeof(struct kmem_cache)); + } + EXPORT_SYMBOL(kmem_cache_destroy); +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -2490,6 +2490,8 @@ static inline int kmem_cache_close(struc + */ + void kmem_cache_destroy(struct kmem_cache *s) + { ++ if (s->flags & SLAB_DESTROY_BY_RCU) ++ rcu_barrier(); + down_write(&slub_lock); + s->refcount--; + if (!s->refcount) { diff --git a/queue-2.6.30/gigaset-accept-connection-establishment-messages-in-any-order.patch b/queue-2.6.30/gigaset-accept-connection-establishment-messages-in-any-order.patch new file mode 100644 index 00000000000..3557107d9cc --- /dev/null +++ b/queue-2.6.30/gigaset-accept-connection-establishment-messages-in-any-order.patch @@ -0,0 +1,100 @@ +From bceb0f126f25184eaec3f3c8f00c92b0d899e5de Mon Sep 17 00:00:00 2001 +From: Tilman Schmidt +Date: Wed, 1 Jul 2009 11:20:57 +0000 +Subject: gigaset: accept connection establishment messages in any order + +From: Tilman Schmidt + +commit bceb0f126f25184eaec3f3c8f00c92b0d899e5de upstream. + +ISDN connection setup failed if the "connection active" and +"B channel up" messages from the device arrived in a different +order than expected. Modify the state machine to accept them in +any order. + +Impact: bugfix + +Signed-off-by: Tilman Schmidt +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/isdn/gigaset/ev-layer.c | 44 ++++++++++++++++++---------------------- + 1 file changed, 20 insertions(+), 24 deletions(-) + +--- a/drivers/isdn/gigaset/ev-layer.c ++++ b/drivers/isdn/gigaset/ev-layer.c +@@ -294,32 +294,33 @@ struct reply_t gigaset_tab_cid_m10x[] = + {RSP_OK, 604,604, -1, 605, 5, {ACT_CMD+AT_MSN}}, + {RSP_OK, 605,605, -1, 606, 5, {ACT_CMD+AT_ISO}}, + {RSP_NULL, 605,605, -1, 606, 5, {ACT_CMD+AT_ISO}}, +- {RSP_OK, 606,606, -1, 607, 5, {0}, "+VLS=17\r"}, /* set "Endgeraetemodus" */ ++ {RSP_OK, 606,606, -1, 607, 5, {0}, "+VLS=17\r"}, + {RSP_OK, 607,607, -1, 608,-1}, +- //{RSP_ZSAU, 608,608,ZSAU_PROCEEDING, 608, 0, {ACT_ERROR}},//DELETE + {RSP_ZSAU, 608,608,ZSAU_PROCEEDING, 609, 5, {ACT_CMD+AT_DIAL}}, + {RSP_OK, 609,609, -1, 650, 0, {ACT_DIALING}}, + +- {RSP_ZVLS, 608,608, 17, -1,-1, {ACT_DEBUG}}, +- {RSP_ZCTP, 609,609, -1, -1,-1, {ACT_DEBUG}}, +- {RSP_ZCPN, 609,609, -1, -1,-1, {ACT_DEBUG}}, + {RSP_ERROR, 601,609, -1, 0, 0, {ACT_ABORTDIAL}}, + {EV_TIMEOUT, 601,609, -1, 0, 0, {ACT_ABORTDIAL}}, + +- /* dialing */ +- {RSP_ZCTP, 650,650, -1, -1,-1, {ACT_DEBUG}}, +- {RSP_ZCPN, 650,650, -1, -1,-1, {ACT_DEBUG}}, +- {RSP_ZSAU, 650,650,ZSAU_CALL_DELIVERED, -1,-1, {ACT_DEBUG}}, /* some devices don't send this */ +- +- /* connection established */ +- {RSP_ZSAU, 650,650,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, //FIXME -> DLE1 +- {RSP_ZSAU, 750,750,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, //FIXME -> DLE1 +- +- {EV_BC_OPEN, 800,800, -1, 800,-1, {ACT_NOTIFY_BC_UP}}, //FIXME new constate + timeout ++ /* optional dialing responses */ ++ {EV_BC_OPEN, 650,650, -1, 651,-1}, ++ {RSP_ZVLS, 608,651, 17, -1,-1, {ACT_DEBUG}}, ++ {RSP_ZCTP, 609,651, -1, -1,-1, {ACT_DEBUG}}, ++ {RSP_ZCPN, 609,651, -1, -1,-1, {ACT_DEBUG}}, ++ {RSP_ZSAU, 650,651,ZSAU_CALL_DELIVERED, -1,-1, {ACT_DEBUG}}, ++ ++ /* connect */ ++ {RSP_ZSAU, 650,650,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, ++ {RSP_ZSAU, 651,651,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT, ++ ACT_NOTIFY_BC_UP}}, ++ {RSP_ZSAU, 750,750,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT}}, ++ {RSP_ZSAU, 751,751,ZSAU_ACTIVE, 800,-1, {ACT_CONNECT, ++ ACT_NOTIFY_BC_UP}}, ++ {EV_BC_OPEN, 800,800, -1, 800,-1, {ACT_NOTIFY_BC_UP}}, + + /* remote hangup */ +- {RSP_ZSAU, 650,650,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEREJECT}}, +- {RSP_ZSAU, 750,750,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}}, ++ {RSP_ZSAU, 650,651,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEREJECT}}, ++ {RSP_ZSAU, 750,751,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}}, + {RSP_ZSAU, 800,800,ZSAU_DISCONNECT_IND, 0, 0, {ACT_REMOTEHUP}}, + + /* hangup */ +@@ -358,7 +359,8 @@ struct reply_t gigaset_tab_cid_m10x[] = + {RSP_ZSAU, 700,729,ZSAU_ACTIVE, 0, 0, {ACT_ABORTACCEPT}}, + {RSP_ZSAU, 700,729,ZSAU_DISCONNECT_IND, 0, 0, {ACT_ABORTACCEPT}}, + +- {EV_TIMEOUT, 750,750, -1, 0, 0, {ACT_CONNTIMEOUT}}, ++ {EV_BC_OPEN, 750,750, -1, 751,-1}, ++ {EV_TIMEOUT, 750,751, -1, 0, 0, {ACT_CONNTIMEOUT}}, + + /* B channel closed (general case) */ + {EV_BC_CLOSED, -1, -1, -1, -1,-1, {ACT_NOTIFY_BC_DOWN}}, //FIXME +@@ -876,12 +878,6 @@ static void bchannel_down(struct bc_stat + + static void bchannel_up(struct bc_state *bcs) + { +- if (!(bcs->chstate & CHS_D_UP)) { +- dev_notice(bcs->cs->dev, "%s: D channel not up\n", __func__); +- bcs->chstate |= CHS_D_UP; +- gigaset_i4l_channel_cmd(bcs, ISDN_STAT_DCONN); +- } +- + if (bcs->chstate & CHS_B_UP) { + dev_notice(bcs->cs->dev, "%s: B channel already up\n", + __func__); diff --git a/queue-2.6.30/nfsd-don-t-hold-unrefcounted-creds-over-call-to-nfsd_setuser.patch b/queue-2.6.30/nfsd-don-t-hold-unrefcounted-creds-over-call-to-nfsd_setuser.patch new file mode 100644 index 00000000000..d0ce7b70fc0 --- /dev/null +++ b/queue-2.6.30/nfsd-don-t-hold-unrefcounted-creds-over-call-to-nfsd_setuser.patch @@ -0,0 +1,52 @@ +From 033a666ccb842ab4134fcd0c861d5ba9f5d6bf3a Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Thu, 2 Jul 2009 14:35:32 +0100 +Subject: NFSD: Don't hold unrefcounted creds over call to nfsd_setuser() + +From: David Howells + +commit 033a666ccb842ab4134fcd0c861d5ba9f5d6bf3a upstream. + +nfsd_open() gets an unrefcounted pointer to the current process's effective +credentials at the top of the function, then calls nfsd_setuser() via +fh_verify() - which may replace and destroy the current process's effective +credentials - and then passes the unrefcounted pointer to dentry_open() - but +the credentials may have been destroyed by this point. + +Instead, the value from current_cred() should be passed directly to +dentry_open() as one of its arguments, rather than being cached in a variable. + +Possibly fh_verify() should return the creds to use. + +This is a regression introduced by +745ca2475a6ac596e3d8d37c2759c0fbe2586227 "CRED: Pass credentials through +dentry_open()". + +Signed-off-by: David Howells +Tested-and-Verified-By: Steve Dickson +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/vfs.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -677,7 +677,6 @@ __be32 + nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, + int access, struct file **filp) + { +- const struct cred *cred = current_cred(); + struct dentry *dentry; + struct inode *inode; + int flags = O_RDONLY|O_LARGEFILE; +@@ -732,7 +731,7 @@ nfsd_open(struct svc_rqst *rqstp, struct + vfs_dq_init(inode); + } + *filp = dentry_open(dget(dentry), mntget(fhp->fh_export->ex_path.mnt), +- flags, cred); ++ flags, current_cred()); + if (IS_ERR(*filp)) + host_err = PTR_ERR(*filp); + out_nfserr: diff --git a/queue-2.6.30/scsi-zalon-fix-oops-on-attach-failure.patch b/queue-2.6.30/scsi-zalon-fix-oops-on-attach-failure.patch new file mode 100644 index 00000000000..bc2be897cbd --- /dev/null +++ b/queue-2.6.30/scsi-zalon-fix-oops-on-attach-failure.patch @@ -0,0 +1,35 @@ +From d3a263a8168f78874254ea9da9595cfb0f3e96d7 Mon Sep 17 00:00:00 2001 +From: James Bottomley +Date: Wed, 24 Jun 2009 19:55:22 +0000 +Subject: SCSI: zalon: fix oops on attach failure + +From: James Bottomley + +commit d3a263a8168f78874254ea9da9595cfb0f3e96d7 upstream. + +I recently discovered on my zalon that if the attachment fails because +of a bus misconfiguration (I scrapped my HVD array, so the card is now +unterminated) then the system oopses. The reason is that if +ncr_attach() returns NULL (signalling failure) that NULL is passed by +the goto failed straight into ncr_detach() which oopses. + +The fix is just to return -ENODEV in this case. + +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/zalon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/zalon.c ++++ b/drivers/scsi/zalon.c +@@ -134,7 +134,7 @@ zalon_probe(struct parisc_device *dev) + + host = ncr_attach(&zalon7xx_template, unit, &device); + if (!host) +- goto fail; ++ return -ENODEV; + + if (request_irq(dev->irq, ncr53c8xx_intr, IRQF_SHARED, "zalon", host)) { + dev_printk(KERN_ERR, &dev->dev, "irq problem with %d, detaching\n ", diff --git a/queue-2.6.30/series b/queue-2.6.30/series new file mode 100644 index 00000000000..36fbaf895bb --- /dev/null +++ b/queue-2.6.30/series @@ -0,0 +1,18 @@ +scsi-zalon-fix-oops-on-attach-failure.patch +nfsd-don-t-hold-unrefcounted-creds-over-call-to-nfsd_setuser.patch +sound-virtuoso-fix-xonar-d1-dx-silence-after-resume.patch +sound-usb-audio-add-workaround-for-blue-microphones-devices.patch +fix-rcu-callback-after-kmem_cache_destroy-problem-in-slb.patch +dsa-fix-88e6xxx-statistics-counter-snapshotting.patch +gigaset-accept-connection-establishment-messages-in-any-order.patch +cfg80211-fix-refcount-leak.patch +staging-prevent-rtl8187se-from-crashing-dev_ioctl-in-siocgiwname.patch +usb-handle-zero-length-usbfs-submissions-correctly.patch +usb-ti_usb_3410_5052-fix-duplicate-device-ids.patch +usb-fix-uninitialised-variable-in-ti_do_download.patch +usb-fix-the-clear_tt_buffer-interface.patch +usb-ehci-use-the-new-clear_tt_buffer-interface.patch +usb-fix-memleak-in-usbfs.patch +usb-rndis-gadget-fix-issues-talking-from-pxa.patch +usb-fix-langid-0-regression.patch +usb-ehci-report-actual_length-for-iso-transfers.patch diff --git a/queue-2.6.30/sound-usb-audio-add-workaround-for-blue-microphones-devices.patch b/queue-2.6.30/sound-usb-audio-add-workaround-for-blue-microphones-devices.patch new file mode 100644 index 00000000000..a46fb9cb38c --- /dev/null +++ b/queue-2.6.30/sound-usb-audio-add-workaround-for-blue-microphones-devices.patch @@ -0,0 +1,56 @@ +From 8886f33f25083a47d5fa24ad7b57bb708c5c5403 Mon Sep 17 00:00:00 2001 +From: Clemens Ladisch +Date: Mon, 13 Jul 2009 13:21:58 +0200 +Subject: sound: usb-audio: add workaround for Blue Microphones devices + +From: Clemens Ladisch + +commit 8886f33f25083a47d5fa24ad7b57bb708c5c5403 upstream. + +Blue Microphones USB devices have an alternate setting that sends two +channels of data to the computer. Unfortunately, the descriptors of +that altsetting have a wrong channel setting, which means that any +recorded data from such a device has twice the sample rate from what +would be expected. + +This patch adds a workaround to ignore that altsetting. Since these +devices have only one actual channel, no data is lost. + +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/usbaudio.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +--- a/sound/usb/usbaudio.c ++++ b/sound/usb/usbaudio.c +@@ -2649,7 +2649,7 @@ static int parse_audio_endpoints(struct + struct usb_interface_descriptor *altsd; + int i, altno, err, stream; + int format; +- struct audioformat *fp; ++ struct audioformat *fp = NULL; + unsigned char *fmt, *csep; + int num; + +@@ -2722,6 +2722,18 @@ static int parse_audio_endpoints(struct + continue; + } + ++ /* ++ * Blue Microphones workaround: The last altsetting is identical ++ * with the previous one, except for a larger packet size, but ++ * is actually a mislabeled two-channel setting; ignore it. ++ */ ++ if (fmt[4] == 1 && fmt[5] == 2 && altno == 2 && num == 3 && ++ fp && fp->altsetting == 1 && fp->channels == 1 && ++ fp->format == SNDRV_PCM_FORMAT_S16_LE && ++ le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize) == ++ fp->maxpacksize * 2) ++ continue; ++ + csep = snd_usb_find_desc(alts->endpoint[0].extra, alts->endpoint[0].extralen, NULL, USB_DT_CS_ENDPOINT); + /* Creamware Noah has this descriptor after the 2nd endpoint */ + if (!csep && altsd->bNumEndpoints >= 2) diff --git a/queue-2.6.30/sound-virtuoso-fix-xonar-d1-dx-silence-after-resume.patch b/queue-2.6.30/sound-virtuoso-fix-xonar-d1-dx-silence-after-resume.patch new file mode 100644 index 00000000000..5f4d4c9beaa --- /dev/null +++ b/queue-2.6.30/sound-virtuoso-fix-xonar-d1-dx-silence-after-resume.patch @@ -0,0 +1,34 @@ +From 826390796d09444b93e1f957582f8970ddfd9b3d Mon Sep 17 00:00:00 2001 +From: Clemens Ladisch +Date: Thu, 2 Jul 2009 08:31:30 +0200 +Subject: sound: virtuoso: fix Xonar D1/DX silence after resume + +From: Clemens Ladisch + +commit 826390796d09444b93e1f957582f8970ddfd9b3d upstream. + +When resuming, we better take the DACs out of the reset state before +trying to use them. + +Reference: kernel bug #13599 + http://bugzilla.kernel.org/show_bug.cgi?id=13599 + +Signed-off-by: Clemens Ladisch +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/oxygen/virtuoso.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/oxygen/virtuoso.c ++++ b/sound/pci/oxygen/virtuoso.c +@@ -621,6 +621,8 @@ static void xonar_d2_resume(struct oxyge + + static void xonar_d1_resume(struct oxygen *chip) + { ++ oxygen_set_bits8(chip, OXYGEN_FUNCTION, OXYGEN_FUNCTION_RESET_CODEC); ++ msleep(1); + cs43xx_init(chip); + xonar_enable_output(chip); + } diff --git a/queue-2.6.30/staging-prevent-rtl8187se-from-crashing-dev_ioctl-in-siocgiwname.patch b/queue-2.6.30/staging-prevent-rtl8187se-from-crashing-dev_ioctl-in-siocgiwname.patch new file mode 100644 index 00000000000..d7c1724bf70 --- /dev/null +++ b/queue-2.6.30/staging-prevent-rtl8187se-from-crashing-dev_ioctl-in-siocgiwname.patch @@ -0,0 +1,59 @@ +From 02c8baecf5d8850dba40b47cdf003ed2e04e66dd Mon Sep 17 00:00:00 2001 +From: Dan Aloni +Date: Sat, 20 Jun 2009 16:32:22 +0300 +Subject: Staging: prevent rtl8187se from crashing dev_ioctl() in SIOCGIWNAME + +From: Dan Aloni + +commit 02c8baecf5d8850dba40b47cdf003ed2e04e66dd upstream. + +I repeatedly get __stack_chk_fail panic()s with this driver before +applying the attached fix. + +ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and +on certain conditions, the concatenated string will be larger than IFNAMSIZ +including the terminating zero. + + length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17 + +This fix uses strl{cpy,cat} in addition to the reduction of the total +possible length of the output string by a char. + +It can be applied to 2.6.30-stable as well. + +Signed-off-by: Dan Aloni +Cc: Bartlomiej Zolnierkiewicz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c ++++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_softmac_wx.c +@@ -461,19 +461,19 @@ int ieee80211_wx_get_name(struct ieee802 + struct iw_request_info *info, + union iwreq_data *wrqu, char *extra) + { +- strcpy(wrqu->name, "802.11"); ++ strlcpy(wrqu->name, "802.11", IFNAMSIZ); + if(ieee->modulation & IEEE80211_CCK_MODULATION){ +- strcat(wrqu->name, "b"); ++ strlcat(wrqu->name, "b", IFNAMSIZ); + if(ieee->modulation & IEEE80211_OFDM_MODULATION) +- strcat(wrqu->name, "/g"); ++ strlcat(wrqu->name, "/g", IFNAMSIZ); + }else if(ieee->modulation & IEEE80211_OFDM_MODULATION) +- strcat(wrqu->name, "g"); ++ strlcat(wrqu->name, "g", IFNAMSIZ); + + if((ieee->state == IEEE80211_LINKED) || + (ieee->state == IEEE80211_LINKED_SCANNING)) +- strcat(wrqu->name," linked"); ++ strlcat(wrqu->name," link", IFNAMSIZ); + else if(ieee->state != IEEE80211_NOLINK) +- strcat(wrqu->name," link.."); ++ strlcat(wrqu->name," .....", IFNAMSIZ); + + + return 0; diff --git a/queue-2.6.30/usb-ehci-report-actual_length-for-iso-transfers.patch b/queue-2.6.30/usb-ehci-report-actual_length-for-iso-transfers.patch new file mode 100644 index 00000000000..625921e5f1b --- /dev/null +++ b/queue-2.6.30/usb-ehci-report-actual_length-for-iso-transfers.patch @@ -0,0 +1,51 @@ +From ec6d67e39f5638c792eb7490bf32586ccb9d8005 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 29 Jun 2009 14:34:59 -0400 +Subject: USB: EHCI: report actual_length for iso transfers + +From: Alan Stern + +commit ec6d67e39f5638c792eb7490bf32586ccb9d8005 upstream. + +This patch (as1259b) makes ehci-hcd return the total number of bytes +transferred in urb->actual_length for Isochronous transfers. +Until now, the actual_length value was unaccountably left at 0. + +Signed-off-by: Alan Stern +Acked-by: David Brownell +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-sched.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/usb/host/ehci-sched.c ++++ b/drivers/usb/host/ehci-sched.c +@@ -1617,11 +1617,14 @@ itd_complete ( + desc->status = -EPROTO; + + /* HC need not update length with this error */ +- if (!(t & EHCI_ISOC_BABBLE)) +- desc->actual_length = EHCI_ITD_LENGTH (t); ++ if (!(t & EHCI_ISOC_BABBLE)) { ++ desc->actual_length = EHCI_ITD_LENGTH(t); ++ urb->actual_length += desc->actual_length; ++ } + } else if (likely ((t & EHCI_ISOC_ACTIVE) == 0)) { + desc->status = 0; +- desc->actual_length = EHCI_ITD_LENGTH (t); ++ desc->actual_length = EHCI_ITD_LENGTH(t); ++ urb->actual_length += desc->actual_length; + } else { + /* URB was too late */ + desc->status = -EXDEV; +@@ -2012,7 +2015,8 @@ sitd_complete ( + desc->status = -EPROTO; + } else { + desc->status = 0; +- desc->actual_length = desc->length - SITD_LENGTH (t); ++ desc->actual_length = desc->length - SITD_LENGTH(t); ++ urb->actual_length += desc->actual_length; + } + stream->depth -= stream->interval << 3; + diff --git a/queue-2.6.30/usb-ehci-use-the-new-clear_tt_buffer-interface.patch b/queue-2.6.30/usb-ehci-use-the-new-clear_tt_buffer-interface.patch new file mode 100644 index 00000000000..f640d6eafb7 --- /dev/null +++ b/queue-2.6.30/usb-ehci-use-the-new-clear_tt_buffer-interface.patch @@ -0,0 +1,262 @@ +From 914b701280a76f96890ad63eb0fa99bf204b961c Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 29 Jun 2009 10:47:30 -0400 +Subject: USB: EHCI: use the new clear_tt_buffer interface + +From: Alan Stern + +commit 914b701280a76f96890ad63eb0fa99bf204b961c upstream. + +This patch (as1256) changes ehci-hcd and all the other drivers in the +EHCI family to make use of the new clear_tt_buffer callbacks. When a +Clear-TT-Buffer request is in progress for a QH, the QH is not allowed +to be linked into the async schedule until the request is finished. +At that time, if there are any URBs queued for the QH, it is linked +into the async schedule. + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ehci-au1xxx.c | 2 + drivers/usb/host/ehci-fsl.c | 2 + drivers/usb/host/ehci-hcd.c | 2 + drivers/usb/host/ehci-ixp4xx.c | 2 + drivers/usb/host/ehci-orion.c | 2 + drivers/usb/host/ehci-pci.c | 2 + drivers/usb/host/ehci-ppc-of.c | 2 + drivers/usb/host/ehci-ps3.c | 2 + drivers/usb/host/ehci-q.c | 91 ++++++++++++++++++++++++++++++----------- + drivers/usb/host/ehci.h | 2 + 10 files changed, 86 insertions(+), 23 deletions(-) + +--- a/drivers/usb/host/ehci-au1xxx.c ++++ b/drivers/usb/host/ehci-au1xxx.c +@@ -112,6 +112,8 @@ static const struct hc_driver ehci_au1xx + .bus_resume = ehci_bus_resume, + .relinquish_port = ehci_relinquish_port, + .port_handed_over = ehci_port_handed_over, ++ ++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete, + }; + + static int ehci_hcd_au1xxx_drv_probe(struct platform_device *pdev) +--- a/drivers/usb/host/ehci-fsl.c ++++ b/drivers/usb/host/ehci-fsl.c +@@ -324,6 +324,8 @@ static const struct hc_driver ehci_fsl_h + .bus_resume = ehci_bus_resume, + .relinquish_port = ehci_relinquish_port, + .port_handed_over = ehci_port_handed_over, ++ ++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete, + }; + + static int ehci_fsl_drv_probe(struct platform_device *pdev) +--- a/drivers/usb/host/ehci.h ++++ b/drivers/usb/host/ehci.h +@@ -353,7 +353,9 @@ struct ehci_qh { + unsigned short period; /* polling interval */ + unsigned short start; /* where polling starts */ + #define NO_FRAME ((unsigned short)~0) /* pick new start */ ++ + struct usb_device *dev; /* access to TT */ ++ unsigned clearing_tt:1; /* Clear-TT-Buf in progress */ + } __attribute__ ((aligned (32))); + + /*-------------------------------------------------------------------------*/ +--- a/drivers/usb/host/ehci-hcd.c ++++ b/drivers/usb/host/ehci-hcd.c +@@ -1003,6 +1003,8 @@ idle_timeout: + schedule_timeout_uninterruptible(1); + goto rescan; + case QH_STATE_IDLE: /* fully unlinked */ ++ if (qh->clearing_tt) ++ goto idle_timeout; + if (list_empty (&qh->qtd_list)) { + qh_put (qh); + break; +--- a/drivers/usb/host/ehci-ixp4xx.c ++++ b/drivers/usb/host/ehci-ixp4xx.c +@@ -60,6 +60,8 @@ static const struct hc_driver ixp4xx_ehc + #endif + .relinquish_port = ehci_relinquish_port, + .port_handed_over = ehci_port_handed_over, ++ ++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete, + }; + + static int ixp4xx_ehci_probe(struct platform_device *pdev) +--- a/drivers/usb/host/ehci-orion.c ++++ b/drivers/usb/host/ehci-orion.c +@@ -164,6 +164,8 @@ static const struct hc_driver ehci_orion + .bus_resume = ehci_bus_resume, + .relinquish_port = ehci_relinquish_port, + .port_handed_over = ehci_port_handed_over, ++ ++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete, + }; + + static void __init +--- a/drivers/usb/host/ehci-pci.c ++++ b/drivers/usb/host/ehci-pci.c +@@ -408,6 +408,8 @@ static const struct hc_driver ehci_pci_h + .bus_resume = ehci_bus_resume, + .relinquish_port = ehci_relinquish_port, + .port_handed_over = ehci_port_handed_over, ++ ++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete, + }; + + /*-------------------------------------------------------------------------*/ +--- a/drivers/usb/host/ehci-ppc-of.c ++++ b/drivers/usb/host/ehci-ppc-of.c +@@ -78,6 +78,8 @@ static const struct hc_driver ehci_ppc_o + #endif + .relinquish_port = ehci_relinquish_port, + .port_handed_over = ehci_port_handed_over, ++ ++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete, + }; + + +--- a/drivers/usb/host/ehci-ps3.c ++++ b/drivers/usb/host/ehci-ps3.c +@@ -74,6 +74,8 @@ static const struct hc_driver ps3_ehci_h + #endif + .relinquish_port = ehci_relinquish_port, + .port_handed_over = ehci_port_handed_over, ++ ++ .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete, + }; + + static int ps3_ehci_probe(struct ps3_system_bus_device *dev) +--- a/drivers/usb/host/ehci-q.c ++++ b/drivers/usb/host/ehci-q.c +@@ -139,6 +139,55 @@ qh_refresh (struct ehci_hcd *ehci, struc + + /*-------------------------------------------------------------------------*/ + ++static void qh_link_async(struct ehci_hcd *ehci, struct ehci_qh *qh); ++ ++static void ehci_clear_tt_buffer_complete(struct usb_hcd *hcd, ++ struct usb_host_endpoint *ep) ++{ ++ struct ehci_hcd *ehci = hcd_to_ehci(hcd); ++ struct ehci_qh *qh = ep->hcpriv; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&ehci->lock, flags); ++ qh->clearing_tt = 0; ++ if (qh->qh_state == QH_STATE_IDLE && !list_empty(&qh->qtd_list) ++ && HC_IS_RUNNING(hcd->state)) ++ qh_link_async(ehci, qh); ++ spin_unlock_irqrestore(&ehci->lock, flags); ++} ++ ++static void ehci_clear_tt_buffer(struct ehci_hcd *ehci, struct ehci_qh *qh, ++ struct urb *urb, u32 token) ++{ ++ ++ /* If an async split transaction gets an error or is unlinked, ++ * the TT buffer may be left in an indeterminate state. We ++ * have to clear the TT buffer. ++ * ++ * Note: this routine is never called for Isochronous transfers. ++ */ ++ if (urb->dev->tt && !usb_pipeint(urb->pipe) && !qh->clearing_tt) { ++#ifdef DEBUG ++ struct usb_device *tt = urb->dev->tt->hub; ++ dev_dbg(&tt->dev, ++ "clear tt buffer port %d, a%d ep%d t%08x\n", ++ urb->dev->ttport, urb->dev->devnum, ++ usb_pipeendpoint(urb->pipe), token); ++#endif /* DEBUG */ ++ if (!ehci_is_TDI(ehci) ++ || urb->dev->tt->hub != ++ ehci_to_hcd(ehci)->self.root_hub) { ++ if (usb_hub_clear_tt_buffer(urb) == 0) ++ qh->clearing_tt = 1; ++ } else { ++ ++ /* REVISIT ARC-derived cores don't clear the root ++ * hub TT buffer in this way... ++ */ ++ } ++ } ++} ++ + static int qtd_copy_status ( + struct ehci_hcd *ehci, + struct urb *urb, +@@ -195,28 +244,6 @@ static int qtd_copy_status ( + usb_pipeendpoint (urb->pipe), + usb_pipein (urb->pipe) ? "in" : "out", + token, status); +- +- /* if async CSPLIT failed, try cleaning out the TT buffer */ +- if (status != -EPIPE +- && urb->dev->tt +- && !usb_pipeint(urb->pipe) +- && ((token & QTD_STS_MMF) != 0 +- || QTD_CERR(token) == 0) +- && (!ehci_is_TDI(ehci) +- || urb->dev->tt->hub != +- ehci_to_hcd(ehci)->self.root_hub)) { +-#ifdef DEBUG +- struct usb_device *tt = urb->dev->tt->hub; +- dev_dbg (&tt->dev, +- "clear tt buffer port %d, a%d ep%d t%08x\n", +- urb->dev->ttport, urb->dev->devnum, +- usb_pipeendpoint (urb->pipe), token); +-#endif /* DEBUG */ +- /* REVISIT ARC-derived cores don't clear the root +- * hub TT buffer in this way... +- */ +- usb_hub_clear_tt_buffer(urb); +- } + } + + return status; +@@ -407,9 +434,16 @@ qh_completions (struct ehci_hcd *ehci, s + /* qh unlinked; token in overlay may be most current */ + if (state == QH_STATE_IDLE + && cpu_to_hc32(ehci, qtd->qtd_dma) +- == qh->hw_current) ++ == qh->hw_current) { + token = hc32_to_cpu(ehci, qh->hw_token); + ++ /* An unlink may leave an incomplete ++ * async transaction in the TT buffer. ++ * We have to clear it. ++ */ ++ ehci_clear_tt_buffer(ehci, qh, urb, token); ++ } ++ + /* force halt for unlinked or blocked qh, so we'll + * patch the qh later and so that completions can't + * activate it while we "know" it's stopped. +@@ -435,6 +469,13 @@ halt: + && (qtd->hw_alt_next + & EHCI_LIST_END(ehci))) + last_status = -EINPROGRESS; ++ ++ /* As part of low/full-speed endpoint-halt processing ++ * we must clear the TT buffer (11.17.5). ++ */ ++ if (unlikely(last_status != -EINPROGRESS && ++ last_status != -EREMOTEIO)) ++ ehci_clear_tt_buffer(ehci, qh, urb, token); + } + + /* if we're removing something not at the queue head, +@@ -864,6 +905,10 @@ static void qh_link_async (struct ehci_h + __hc32 dma = QH_NEXT(ehci, qh->qh_dma); + struct ehci_qh *head; + ++ /* Don't link a QH if there's a Clear-TT-Buffer pending */ ++ if (unlikely(qh->clearing_tt)) ++ return; ++ + /* (re)start the async schedule? */ + head = ehci->async; + timer_action_done (ehci, TIMER_ASYNC_OFF); diff --git a/queue-2.6.30/usb-fix-langid-0-regression.patch b/queue-2.6.30/usb-fix-langid-0-regression.patch new file mode 100644 index 00000000000..72a34f9bef4 --- /dev/null +++ b/queue-2.6.30/usb-fix-langid-0-regression.patch @@ -0,0 +1,114 @@ +From 0cce2eda19923e5e5ccc8b042dec5af87b3ffad0 Mon Sep 17 00:00:00 2001 +From: Daniel Mack +Date: Fri, 10 Jul 2009 11:04:58 +0200 +Subject: USB: fix LANGID=0 regression + +From: Daniel Mack + +commit 0cce2eda19923e5e5ccc8b042dec5af87b3ffad0 upstream. + +commit b7af0bb ("USB: allow malformed LANGID descriptors") broke support +for devices without string descriptor support. + +Reporting string descriptors is optional to USB devices, and a device +lets us know it can't deal with strings by responding to the LANGID +request with a STALL token. + +The kernel handled that correctly before b7af0bb came in, but failed +hard if the LANGID was reported but broken. More than that, if a device +was not able to provide string descriptors, the LANGID was retrieved +over and over again at each string read request. + +This patch changes the behaviour so that + + a) the LANGID is only queried once + b) devices which can't handle string requests are not asked again + c) devices with malformed LANGID values have a sane fallback to 0x0409 + +Signed-off-by: Daniel Mack +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/message.c | 63 ++++++++++++++++++++++++++++++++------------- + 1 file changed, 45 insertions(+), 18 deletions(-) + +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -758,6 +758,48 @@ static int usb_string_sub(struct usb_dev + return rc; + } + ++static int usb_get_langid(struct usb_device *dev, unsigned char *tbuf) ++{ ++ int err; ++ ++ if (dev->have_langid) ++ return 0; ++ ++ if (dev->string_langid < 0) ++ return -EPIPE; ++ ++ err = usb_string_sub(dev, 0, 0, tbuf); ++ ++ /* If the string was reported but is malformed, default to english ++ * (0x0409) */ ++ if (err == -ENODATA || (err > 0 && err < 4)) { ++ dev->string_langid = 0x0409; ++ dev->have_langid = 1; ++ dev_err(&dev->dev, ++ "string descriptor 0 malformed (err = %d), " ++ "defaulting to 0x%04x\n", ++ err, dev->string_langid); ++ return 0; ++ } ++ ++ /* In case of all other errors, we assume the device is not able to ++ * deal with strings at all. Set string_langid to -1 in order to ++ * prevent any string to be retrieved from the device */ ++ if (err < 0) { ++ dev_err(&dev->dev, "string descriptor 0 read error: %d\n", ++ err); ++ dev->string_langid = -1; ++ return -EPIPE; ++ } ++ ++ /* always use the first langid listed */ ++ dev->string_langid = tbuf[2] | (tbuf[3] << 8); ++ dev->have_langid = 1; ++ dev_dbg(&dev->dev, "default language 0x%04x\n", ++ dev->string_langid); ++ return 0; ++} ++ + /** + * usb_string - returns ISO 8859-1 version of a string descriptor + * @dev: the device whose string descriptor is being retrieved +@@ -797,24 +839,9 @@ int usb_string(struct usb_device *dev, i + if (!tbuf) + return -ENOMEM; + +- /* get langid for strings if it's not yet known */ +- if (!dev->have_langid) { +- err = usb_string_sub(dev, 0, 0, tbuf); +- if (err < 0) { +- dev_err(&dev->dev, +- "string descriptor 0 read error: %d\n", +- err); +- } else if (err < 4) { +- dev_err(&dev->dev, "string descriptor 0 too short\n"); +- } else { +- dev->string_langid = tbuf[2] | (tbuf[3] << 8); +- /* always use the first langid listed */ +- dev_dbg(&dev->dev, "default language 0x%04x\n", +- dev->string_langid); +- } +- +- dev->have_langid = 1; +- } ++ err = usb_get_langid(dev, tbuf); ++ if (err < 0) ++ goto errout; + + err = usb_string_sub(dev, dev->string_langid, index, tbuf); + if (err < 0) diff --git a/queue-2.6.30/usb-fix-memleak-in-usbfs.patch b/queue-2.6.30/usb-fix-memleak-in-usbfs.patch new file mode 100644 index 00000000000..45880f792ac --- /dev/null +++ b/queue-2.6.30/usb-fix-memleak-in-usbfs.patch @@ -0,0 +1,63 @@ +From d794a02111cd3393da69bc7d6dd2b6074bd037cc Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Sun, 28 Jun 2009 23:34:14 +0200 +Subject: USB: fix memleak in usbfs + +From: Oliver Neukum + +commit d794a02111cd3393da69bc7d6dd2b6074bd037cc upstream. + +This patch fixes a memory leak in devio.c::processcompl + +If writing to user space fails the packet must be discarded, as it +already has been removed from the queue of completed packets. + +Signed-off-by: Oliver Neukum +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1230,22 +1230,22 @@ static int processcompl(struct async *as + if (as->userbuffer) + if (copy_to_user(as->userbuffer, urb->transfer_buffer, + urb->transfer_buffer_length)) +- return -EFAULT; ++ goto err_out; + if (put_user(as->status, &userurb->status)) +- return -EFAULT; ++ goto err_out; + if (put_user(urb->actual_length, &userurb->actual_length)) +- return -EFAULT; ++ goto err_out; + if (put_user(urb->error_count, &userurb->error_count)) +- return -EFAULT; ++ goto err_out; + + if (usb_endpoint_xfer_isoc(&urb->ep->desc)) { + for (i = 0; i < urb->number_of_packets; i++) { + if (put_user(urb->iso_frame_desc[i].actual_length, + &userurb->iso_frame_desc[i].actual_length)) +- return -EFAULT; ++ goto err_out; + if (put_user(urb->iso_frame_desc[i].status, + &userurb->iso_frame_desc[i].status)) +- return -EFAULT; ++ goto err_out; + } + } + +@@ -1254,6 +1254,10 @@ static int processcompl(struct async *as + if (put_user(addr, (void __user * __user *)arg)) + return -EFAULT; + return 0; ++ ++err_out: ++ free_async(as); ++ return -EFAULT; + } + + static struct async *reap_as(struct dev_state *ps) diff --git a/queue-2.6.30/usb-fix-the-clear_tt_buffer-interface.patch b/queue-2.6.30/usb-fix-the-clear_tt_buffer-interface.patch new file mode 100644 index 00000000000..6eb4ff9e145 --- /dev/null +++ b/queue-2.6.30/usb-fix-the-clear_tt_buffer-interface.patch @@ -0,0 +1,200 @@ +From cb88a1b887bb8908f6e00ce29e893ea52b074940 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 29 Jun 2009 10:43:32 -0400 +Subject: USB: fix the clear_tt_buffer interface + +From: Alan Stern + +commit cb88a1b887bb8908f6e00ce29e893ea52b074940 upstream. + +This patch (as1255) updates the interface for calling +usb_hub_clear_tt_buffer(). Even the name of the function is changed! + +When an async URB (i.e., Control or Bulk) going through a high-speed +hub to a non-high-speed device is cancelled or fails, the hub's +Transaction Translator buffer may be left busy still trying to +complete the transaction. The buffer has to be cleared; that's what +usb_hub_clear_tt_buffer() does. + +It isn't safe to send any more URBs to the same endpoint until the TT +buffer is fully clear. Therefore the HCD needs to be told when the +Clear-TT-Buffer request has finished. This patch adds a callback +method to struct hc_driver for that purpose, and makes the hub driver +invoke the callback at the proper time. + +The patch also changes a couple of names; "hub_tt_kevent" and +"tt.kevent" now look rather antiquated. + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hcd.h | 4 ++++ + drivers/usb/core/hub.c | 40 ++++++++++++++++++++++++++-------------- + drivers/usb/core/hub.h | 6 ++++-- + drivers/usb/host/ehci-q.c | 2 +- + 4 files changed, 35 insertions(+), 17 deletions(-) + +--- a/drivers/usb/core/hcd.h ++++ b/drivers/usb/core/hcd.h +@@ -224,6 +224,10 @@ struct hc_driver { + void (*relinquish_port)(struct usb_hcd *, int); + /* has a port been handed over to a companion? */ + int (*port_handed_over)(struct usb_hcd *, int); ++ ++ /* CLEAR_TT_BUFFER completion callback */ ++ void (*clear_tt_buffer_complete)(struct usb_hcd *, ++ struct usb_host_endpoint *); + }; + + extern int usb_hcd_link_urb_to_ep(struct usb_hcd *hcd, struct urb *urb); +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -448,10 +448,10 @@ hub_clear_tt_buffer (struct usb_device * + * talking to TTs must queue control transfers (not just bulk and iso), so + * both can talk to the same hub concurrently. + */ +-static void hub_tt_kevent (struct work_struct *work) ++static void hub_tt_work(struct work_struct *work) + { + struct usb_hub *hub = +- container_of(work, struct usb_hub, tt.kevent); ++ container_of(work, struct usb_hub, tt.clear_work); + unsigned long flags; + int limit = 100; + +@@ -460,6 +460,7 @@ static void hub_tt_kevent (struct work_s + struct list_head *temp; + struct usb_tt_clear *clear; + struct usb_device *hdev = hub->hdev; ++ const struct hc_driver *drv; + int status; + + temp = hub->tt.clear_list.next; +@@ -469,21 +470,25 @@ static void hub_tt_kevent (struct work_s + /* drop lock so HCD can concurrently report other TT errors */ + spin_unlock_irqrestore (&hub->tt.lock, flags); + status = hub_clear_tt_buffer (hdev, clear->devinfo, clear->tt); +- spin_lock_irqsave (&hub->tt.lock, flags); +- + if (status) + dev_err (&hdev->dev, + "clear tt %d (%04x) error %d\n", + clear->tt, clear->devinfo, status); ++ ++ /* Tell the HCD, even if the operation failed */ ++ drv = clear->hcd->driver; ++ if (drv->clear_tt_buffer_complete) ++ (drv->clear_tt_buffer_complete)(clear->hcd, clear->ep); ++ + kfree(clear); ++ spin_lock_irqsave(&hub->tt.lock, flags); + } + spin_unlock_irqrestore (&hub->tt.lock, flags); + } + + /** +- * usb_hub_tt_clear_buffer - clear control/bulk TT state in high speed hub +- * @udev: the device whose split transaction failed +- * @pipe: identifies the endpoint of the failed transaction ++ * usb_hub_clear_tt_buffer - clear control/bulk TT state in high speed hub ++ * @urb: an URB associated with the failed or incomplete split transaction + * + * High speed HCDs use this to tell the hub driver that some split control or + * bulk transaction failed in a way that requires clearing internal state of +@@ -493,8 +498,10 @@ static void hub_tt_kevent (struct work_s + * It may not be possible for that hub to handle additional full (or low) + * speed transactions until that state is fully cleared out. + */ +-void usb_hub_tt_clear_buffer (struct usb_device *udev, int pipe) ++int usb_hub_clear_tt_buffer(struct urb *urb) + { ++ struct usb_device *udev = urb->dev; ++ int pipe = urb->pipe; + struct usb_tt *tt = udev->tt; + unsigned long flags; + struct usb_tt_clear *clear; +@@ -506,7 +513,7 @@ void usb_hub_tt_clear_buffer (struct usb + if ((clear = kmalloc (sizeof *clear, GFP_ATOMIC)) == NULL) { + dev_err (&udev->dev, "can't save CLEAR_TT_BUFFER state\n"); + /* FIXME recover somehow ... RESET_TT? */ +- return; ++ return -ENOMEM; + } + + /* info that CLEAR_TT_BUFFER needs */ +@@ -518,14 +525,19 @@ void usb_hub_tt_clear_buffer (struct usb + : (USB_ENDPOINT_XFER_BULK << 11); + if (usb_pipein (pipe)) + clear->devinfo |= 1 << 15; +- ++ ++ /* info for completion callback */ ++ clear->hcd = bus_to_hcd(udev->bus); ++ clear->ep = urb->ep; ++ + /* tell keventd to clear state for this TT */ + spin_lock_irqsave (&tt->lock, flags); + list_add_tail (&clear->clear_list, &tt->clear_list); +- schedule_work (&tt->kevent); ++ schedule_work(&tt->clear_work); + spin_unlock_irqrestore (&tt->lock, flags); ++ return 0; + } +-EXPORT_SYMBOL_GPL(usb_hub_tt_clear_buffer); ++EXPORT_SYMBOL_GPL(usb_hub_clear_tt_buffer); + + /* If do_delay is false, return the number of milliseconds the caller + * needs to delay. +@@ -816,7 +828,7 @@ static void hub_quiesce(struct usb_hub * + if (hub->has_indicators) + cancel_delayed_work_sync(&hub->leds); + if (hub->tt.hub) +- cancel_work_sync(&hub->tt.kevent); ++ cancel_work_sync(&hub->tt.clear_work); + } + + /* caller has locked the hub device */ +@@ -933,7 +945,7 @@ static int hub_configure(struct usb_hub + + spin_lock_init (&hub->tt.lock); + INIT_LIST_HEAD (&hub->tt.clear_list); +- INIT_WORK (&hub->tt.kevent, hub_tt_kevent); ++ INIT_WORK(&hub->tt.clear_work, hub_tt_work); + switch (hdev->descriptor.bDeviceProtocol) { + case 0: + break; +--- a/drivers/usb/core/hub.h ++++ b/drivers/usb/core/hub.h +@@ -185,16 +185,18 @@ struct usb_tt { + /* for control/bulk error recovery (CLEAR_TT_BUFFER) */ + spinlock_t lock; + struct list_head clear_list; /* of usb_tt_clear */ +- struct work_struct kevent; ++ struct work_struct clear_work; + }; + + struct usb_tt_clear { + struct list_head clear_list; + unsigned tt; + u16 devinfo; ++ struct usb_hcd *hcd; ++ struct usb_host_endpoint *ep; + }; + +-extern void usb_hub_tt_clear_buffer(struct usb_device *dev, int pipe); ++extern int usb_hub_clear_tt_buffer(struct urb *urb); + extern void usb_ep0_reinit(struct usb_device *); + + #endif /* __LINUX_HUB_H */ +--- a/drivers/usb/host/ehci-q.c ++++ b/drivers/usb/host/ehci-q.c +@@ -215,7 +215,7 @@ static int qtd_copy_status ( + /* REVISIT ARC-derived cores don't clear the root + * hub TT buffer in this way... + */ +- usb_hub_tt_clear_buffer (urb->dev, urb->pipe); ++ usb_hub_clear_tt_buffer(urb); + } + } + diff --git a/queue-2.6.30/usb-fix-uninitialised-variable-in-ti_do_download.patch b/queue-2.6.30/usb-fix-uninitialised-variable-in-ti_do_download.patch new file mode 100644 index 00000000000..6dbed34da2c --- /dev/null +++ b/queue-2.6.30/usb-fix-uninitialised-variable-in-ti_do_download.patch @@ -0,0 +1,28 @@ +From 87ea8c887905d8b13ae90b537117592ed027632a Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Tue, 30 Jun 2009 09:44:24 +0200 +Subject: USB: fix uninitialised variable in ti_do_download + +From: Oliver Neukum + +commit 87ea8c887905d8b13ae90b537117592ed027632a upstream. + +Signed-off-by: Oliver Neukum +Cc: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ti_usb_3410_5052.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/ti_usb_3410_5052.c ++++ b/drivers/usb/serial/ti_usb_3410_5052.c +@@ -1659,7 +1659,7 @@ static int ti_do_download(struct usb_dev + u8 cs = 0; + int done; + struct ti_firmware_header *header; +- int status; ++ int status = 0; + int len; + + for (pos = sizeof(struct ti_firmware_header); pos < size; pos++) diff --git a/queue-2.6.30/usb-handle-zero-length-usbfs-submissions-correctly.patch b/queue-2.6.30/usb-handle-zero-length-usbfs-submissions-correctly.patch new file mode 100644 index 00000000000..30dbcba1ede --- /dev/null +++ b/queue-2.6.30/usb-handle-zero-length-usbfs-submissions-correctly.patch @@ -0,0 +1,123 @@ +From 9180135bc80ab11199d482b6111e23f74d65af4a Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 29 Jun 2009 11:04:54 -0400 +Subject: USB: handle zero-length usbfs submissions correctly + +From: Alan Stern + +commit 9180135bc80ab11199d482b6111e23f74d65af4a upstream. + +This patch (as1262) fixes a bug in usbfs: It refuses to accept +zero-length transfers, and it insists that the buffer pointer be valid +even if there is no data being transferred. + +The patch also consolidates a bunch of repetitive access_ok() checks +into a single check, which incidentally fixes the lack of such a check +for Isochronous URBs. + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 41 ++++++++++++++++++++--------------------- + 1 file changed, 20 insertions(+), 21 deletions(-) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -982,7 +982,7 @@ static int proc_do_submiturb(struct dev_ + USBDEVFS_URB_ZERO_PACKET | + USBDEVFS_URB_NO_INTERRUPT)) + return -EINVAL; +- if (!uurb->buffer) ++ if (uurb->buffer_length > 0 && !uurb->buffer) + return -EINVAL; + if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL && + (uurb->endpoint & ~USB_ENDPOINT_DIR_MASK) == 0)) { +@@ -1038,11 +1038,6 @@ static int proc_do_submiturb(struct dev_ + is_in = 0; + uurb->endpoint &= ~USB_DIR_IN; + } +- if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ, +- uurb->buffer, uurb->buffer_length)) { +- kfree(dr); +- return -EFAULT; +- } + snoop(&ps->dev->dev, "control urb: bRequest=%02x " + "bRrequestType=%02x wValue=%04x " + "wIndex=%04x wLength=%04x\n", +@@ -1062,9 +1057,6 @@ static int proc_do_submiturb(struct dev_ + uurb->number_of_packets = 0; + if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE) + return -EINVAL; +- if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ, +- uurb->buffer, uurb->buffer_length)) +- return -EFAULT; + snoop(&ps->dev->dev, "bulk urb\n"); + break; + +@@ -1106,28 +1098,35 @@ static int proc_do_submiturb(struct dev_ + return -EINVAL; + if (uurb->buffer_length > MAX_USBFS_BUFFER_SIZE) + return -EINVAL; +- if (!access_ok(is_in ? VERIFY_WRITE : VERIFY_READ, +- uurb->buffer, uurb->buffer_length)) +- return -EFAULT; + snoop(&ps->dev->dev, "interrupt urb\n"); + break; + + default: + return -EINVAL; + } +- as = alloc_async(uurb->number_of_packets); +- if (!as) { ++ if (uurb->buffer_length > 0 && ++ !access_ok(is_in ? VERIFY_WRITE : VERIFY_READ, ++ uurb->buffer, uurb->buffer_length)) { + kfree(isopkt); + kfree(dr); +- return -ENOMEM; ++ return -EFAULT; + } +- as->urb->transfer_buffer = kmalloc(uurb->buffer_length, GFP_KERNEL); +- if (!as->urb->transfer_buffer) { ++ as = alloc_async(uurb->number_of_packets); ++ if (!as) { + kfree(isopkt); + kfree(dr); +- free_async(as); + return -ENOMEM; + } ++ if (uurb->buffer_length > 0) { ++ as->urb->transfer_buffer = kmalloc(uurb->buffer_length, ++ GFP_KERNEL); ++ if (!as->urb->transfer_buffer) { ++ kfree(isopkt); ++ kfree(dr); ++ free_async(as); ++ return -ENOMEM; ++ } ++ } + as->urb->dev = ps->dev; + as->urb->pipe = (uurb->type << 30) | + __create_pipe(ps->dev, uurb->endpoint & 0xf) | +@@ -1169,7 +1168,7 @@ static int proc_do_submiturb(struct dev_ + kfree(isopkt); + as->ps = ps; + as->userurb = arg; +- if (uurb->endpoint & USB_DIR_IN) ++ if (is_in && uurb->buffer_length > 0) + as->userbuffer = uurb->buffer; + else + as->userbuffer = NULL; +@@ -1179,9 +1178,9 @@ static int proc_do_submiturb(struct dev_ + as->uid = cred->uid; + as->euid = cred->euid; + security_task_getsecid(current, &as->secid); +- if (!is_in) { ++ if (!is_in && uurb->buffer_length > 0) { + if (copy_from_user(as->urb->transfer_buffer, uurb->buffer, +- as->urb->transfer_buffer_length)) { ++ uurb->buffer_length)) { + free_async(as); + return -EFAULT; + } diff --git a/queue-2.6.30/usb-rndis-gadget-fix-issues-talking-from-pxa.patch b/queue-2.6.30/usb-rndis-gadget-fix-issues-talking-from-pxa.patch new file mode 100644 index 00000000000..3ceb41e8ec8 --- /dev/null +++ b/queue-2.6.30/usb-rndis-gadget-fix-issues-talking-from-pxa.patch @@ -0,0 +1,51 @@ +From 4e19f220d4e84f5728cb7edde36352ab425cfba4 Mon Sep 17 00:00:00 2001 +From: David Brownell +Date: Fri, 19 Jun 2009 03:09:04 -0700 +Subject: USB: RNDIS gadget, fix issues talking from PXA + +From: David Brownell + +commit 4e19f220d4e84f5728cb7edde36352ab425cfba4 upstream. + +The reworked Ethernet gadget has an RNDIS interop problem when used +with the CDC subset driver ... e.g. on PXA 2xx and 3xx hardware, +which currently has a hard time talking to MS-Windows hosts. + +The issue is that Microsoft requires USB_CLASS_COMM. Fix by tweaking +the CDC subset driver to not switch to USB_CLASS_VENDOR_SPEC if RNDIS +is used in some other device configuration. + +[ UPDATED: some "statements" were comma-terminated; fix that. ] + +Signed-off-by: David Brownell +Cc: Aric Blumer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/ether.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/usb/gadget/ether.c ++++ b/drivers/usb/gadget/ether.c +@@ -293,15 +293,16 @@ static int __init eth_bind(struct usb_co + /* CDC Subset */ + eth_config_driver.label = "CDC Subset/SAFE"; + +- device_desc.idVendor = cpu_to_le16(SIMPLE_VENDOR_NUM), +- device_desc.idProduct = cpu_to_le16(SIMPLE_PRODUCT_NUM), +- device_desc.bDeviceClass = USB_CLASS_VENDOR_SPEC; ++ device_desc.idVendor = cpu_to_le16(SIMPLE_VENDOR_NUM); ++ device_desc.idProduct = cpu_to_le16(SIMPLE_PRODUCT_NUM); ++ if (!has_rndis()) ++ device_desc.bDeviceClass = USB_CLASS_VENDOR_SPEC; + } + + if (has_rndis()) { + /* RNDIS plus ECM-or-Subset */ +- device_desc.idVendor = cpu_to_le16(RNDIS_VENDOR_NUM), +- device_desc.idProduct = cpu_to_le16(RNDIS_PRODUCT_NUM), ++ device_desc.idVendor = cpu_to_le16(RNDIS_VENDOR_NUM); ++ device_desc.idProduct = cpu_to_le16(RNDIS_PRODUCT_NUM); + device_desc.bNumConfigurations = 2; + } + diff --git a/queue-2.6.30/usb-ti_usb_3410_5052-fix-duplicate-device-ids.patch b/queue-2.6.30/usb-ti_usb_3410_5052-fix-duplicate-device-ids.patch new file mode 100644 index 00000000000..8a1dd643279 --- /dev/null +++ b/queue-2.6.30/usb-ti_usb_3410_5052-fix-duplicate-device-ids.patch @@ -0,0 +1,29 @@ +From 3c43f27bf57b0502df2478253699559ee1d43f6d Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Fri, 26 Jun 2009 08:05:20 -0700 +Subject: USB: ti_usb_3410_5052: fix duplicate device ids. + +From: Greg Kroah-Hartman + +commit 3c43f27bf57b0502df2478253699559ee1d43f6d upstream. + +commit 1a1fab513734b3a4fca1bee8229e5ff7e1cb873c accidentally added the +device id to both tables in the driver, which causes problems as this is +only a single port device, not a multiple port device. + +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ti_usb_3410_5052.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/usb/serial/ti_usb_3410_5052.c ++++ b/drivers/usb/serial/ti_usb_3410_5052.c +@@ -192,7 +192,6 @@ static struct usb_device_id ti_id_table_ + { USB_DEVICE(TI_VENDOR_ID, TI_5152_BOOT_PRODUCT_ID) }, + { USB_DEVICE(TI_VENDOR_ID, TI_5052_EEPROM_PRODUCT_ID) }, + { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) }, +- { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) }, + }; + + static struct usb_device_id ti_id_table_combined[14+2*TI_EXTRA_VID_PID_COUNT+1] = { -- 2.47.2