--- /dev/null
+From f5738e2ef88070ef1372e6e718124d88e9abe4ac Mon Sep 17 00:00:00 2001
+From: Ursula Braun <ursula.braun@de.ibm.com>
+Date: Tue, 13 May 2014 14:38:02 +0200
+Subject: af_iucv: wrong mapping of sent and confirmed skbs
+
+From: Ursula Braun <ursula.braun@de.ibm.com>
+
+commit f5738e2ef88070ef1372e6e718124d88e9abe4ac upstream.
+
+When sending data through IUCV a MESSAGE COMPLETE interrupt
+signals that sent data memory can be freed or reused again.
+With commit f9c41a62bba3f3f7ef3541b2a025e3371bcbba97
+"af_iucv: fix recvmsg by replacing skb_pull() function" the
+MESSAGE COMPLETE callback iucv_callback_txdone() identifies
+the wrong skb as being confirmed, which leads to data corruption.
+This patch fixes the skb mapping logic in iucv_callback_txdone().
+
+Signed-off-by: Ursula Braun <ursula.braun@de.ibm.com>
+Signed-off-by: Frank Blaschka <frank.blaschka@de.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/iucv/af_iucv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/iucv/af_iucv.c
++++ b/net/iucv/af_iucv.c
+@@ -1829,7 +1829,7 @@ static void iucv_callback_txdone(struct
+ spin_lock_irqsave(&list->lock, flags);
+
+ while (list_skb != (struct sk_buff *)list) {
+- if (msg->tag != IUCV_SKB_CB(list_skb)->tag) {
++ if (msg->tag == IUCV_SKB_CB(list_skb)->tag) {
+ this = list_skb;
+ break;
+ }
--- /dev/null
+From 8bab797c6e5724a43b7666ad70860712365cdb71 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 9 May 2014 14:59:16 +0300
+Subject: applicom: dereferencing NULL on error path
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 8bab797c6e5724a43b7666ad70860712365cdb71 upstream.
+
+This is a static checker fix. The "dev" variable is always NULL after
+the while statement so we would be dereferencing a NULL pointer here.
+
+Fixes: 819a3eba4233 ('[PATCH] applicom: fix error handling')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/applicom.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/char/applicom.c
++++ b/drivers/char/applicom.c
+@@ -345,7 +345,6 @@ out:
+ free_irq(apbs[i].irq, &dummy);
+ iounmap(apbs[i].RamIO);
+ }
+- pci_disable_device(dev);
+ return ret;
+ }
+
--- /dev/null
+From 77c2f02edbeda9409a7cf3fd66233015820c213a Mon Sep 17 00:00:00 2001
+From: Paul Bolle <pebolle@tiscali.nl>
+Date: Fri, 16 May 2014 12:00:57 +0200
+Subject: ARM: OMAP: replace checks for CONFIG_USB_GADGET_OMAP
+
+From: Paul Bolle <pebolle@tiscali.nl>
+
+commit 77c2f02edbeda9409a7cf3fd66233015820c213a upstream.
+
+Commit 193ab2a60700 ("usb: gadget: allow multiple gadgets to be built")
+apparently required that checks for CONFIG_USB_GADGET_OMAP would be
+replaced with checks for CONFIG_USB_OMAP. Do so now for the remaining
+checks for CONFIG_USB_GADGET_OMAP, even though these checks have
+basically been broken since v3.1.
+
+And, since we're touching this code, use the IS_ENABLED() macro, so
+things will now (hopefully) also work if USB_OMAP is modular.
+
+Fixes: 193ab2a60700 ("usb: gadget: allow multiple gadgets to be built")
+Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-omap1/board-h2.c | 2 +-
+ arch/arm/mach-omap1/board-h3.c | 2 +-
+ arch/arm/mach-omap1/board-innovator.c | 2 +-
+ arch/arm/mach-omap1/board-osk.c | 2 +-
+ drivers/usb/phy/phy-isp1301-omap.c | 2 +-
+ 5 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/mach-omap1/board-h2.c
++++ b/arch/arm/mach-omap1/board-h2.c
+@@ -379,7 +379,7 @@ static struct omap_usb_config h2_usb_con
+ /* usb1 has a Mini-AB port and external isp1301 transceiver */
+ .otg = 2,
+
+-#ifdef CONFIG_USB_GADGET_OMAP
++#if IS_ENABLED(CONFIG_USB_OMAP)
+ .hmc_mode = 19, /* 0:host(off) 1:dev|otg 2:disabled */
+ /* .hmc_mode = 21,*/ /* 0:host(off) 1:dev(loopback) 2:host(loopback) */
+ #elif defined(CONFIG_USB_OHCI_HCD) || defined(CONFIG_USB_OHCI_HCD_MODULE)
+--- a/arch/arm/mach-omap1/board-h3.c
++++ b/arch/arm/mach-omap1/board-h3.c
+@@ -366,7 +366,7 @@ static struct omap_usb_config h3_usb_con
+ /* usb1 has a Mini-AB port and external isp1301 transceiver */
+ .otg = 2,
+
+-#ifdef CONFIG_USB_GADGET_OMAP
++#if IS_ENABLED(CONFIG_USB_OMAP)
+ .hmc_mode = 19, /* 0:host(off) 1:dev|otg 2:disabled */
+ #elif defined(CONFIG_USB_OHCI_HCD) || defined(CONFIG_USB_OHCI_HCD_MODULE)
+ /* NONSTANDARD CABLE NEEDED (B-to-Mini-B) */
+--- a/arch/arm/mach-omap1/board-innovator.c
++++ b/arch/arm/mach-omap1/board-innovator.c
+@@ -312,7 +312,7 @@ static struct omap_usb_config h2_usb_con
+ /* usb1 has a Mini-AB port and external isp1301 transceiver */
+ .otg = 2,
+
+-#ifdef CONFIG_USB_GADGET_OMAP
++#if IS_ENABLED(CONFIG_USB_OMAP)
+ .hmc_mode = 19, /* 0:host(off) 1:dev|otg 2:disabled */
+ /* .hmc_mode = 21,*/ /* 0:host(off) 1:dev(loopback) 2:host(loopback) */
+ #elif defined(CONFIG_USB_OHCI_HCD) || defined(CONFIG_USB_OHCI_HCD_MODULE)
+--- a/arch/arm/mach-omap1/board-osk.c
++++ b/arch/arm/mach-omap1/board-osk.c
+@@ -280,7 +280,7 @@ static struct omap_usb_config osk_usb_co
+ * be used, with a NONSTANDARD gender-bending cable/dongle, as
+ * a peripheral.
+ */
+-#ifdef CONFIG_USB_GADGET_OMAP
++#if IS_ENABLED(CONFIG_USB_OMAP)
+ .register_dev = 1,
+ .hmc_mode = 0,
+ #else
+--- a/drivers/usb/phy/phy-isp1301-omap.c
++++ b/drivers/usb/phy/phy-isp1301-omap.c
+@@ -1299,7 +1299,7 @@ isp1301_set_host(struct usb_otg *otg, st
+ return isp1301_otg_enable(isp);
+ return 0;
+
+-#elif !defined(CONFIG_USB_GADGET_OMAP)
++#elif !IS_ENABLED(CONFIG_USB_OMAP)
+ // FIXME update its refcount
+ otg->host = host;
+
--- /dev/null
+From 0b5a958cf4df3a5cd578b861471e62138f55c85e Mon Sep 17 00:00:00 2001
+From: Stephane Grosjean <s.grosjean@peak-system.com>
+Date: Tue, 20 May 2014 11:38:56 +0200
+Subject: can: peak_pci: prevent use after free at netdev removal
+
+From: Stephane Grosjean <s.grosjean@peak-system.com>
+
+commit 0b5a958cf4df3a5cd578b861471e62138f55c85e upstream.
+
+As remarked by Christopher R. Baker in his post at
+
+http://marc.info/?l=linux-can&m=139707295706465&w=2
+
+there's a possibility for an use after free condition at device removal.
+
+This simplified patch introduces an additional variable to prevent the issue.
+Thanks for catching this.
+
+Reported-by: Christopher R. Baker <cbaker@rec.ri.cmu.edu>
+Signed-off-by: Stephane Grosjean <s.grosjean@peak-system.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/sja1000/peak_pci.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/can/sja1000/peak_pci.c
++++ b/drivers/net/can/sja1000/peak_pci.c
+@@ -551,7 +551,7 @@ static int peak_pci_probe(struct pci_dev
+ {
+ struct sja1000_priv *priv;
+ struct peak_pci_chan *chan;
+- struct net_device *dev;
++ struct net_device *dev, *prev_dev;
+ void __iomem *cfg_base, *reg_base;
+ u16 sub_sys_id, icr;
+ int i, err, channels;
+@@ -687,11 +687,13 @@ failure_remove_channels:
+ writew(0x0, cfg_base + PITA_ICR + 2);
+
+ chan = NULL;
+- for (dev = pci_get_drvdata(pdev); dev; dev = chan->prev_dev) {
+- unregister_sja1000dev(dev);
+- free_sja1000dev(dev);
++ for (dev = pci_get_drvdata(pdev); dev; dev = prev_dev) {
+ priv = netdev_priv(dev);
+ chan = priv->priv;
++ prev_dev = chan->prev_dev;
++
++ unregister_sja1000dev(dev);
++ free_sja1000dev(dev);
+ }
+
+ /* free any PCIeC resources too */
+@@ -725,10 +727,12 @@ static void peak_pci_remove(struct pci_d
+
+ /* Loop over all registered devices */
+ while (1) {
++ struct net_device *prev_dev = chan->prev_dev;
++
+ dev_info(&pdev->dev, "removing device %s\n", dev->name);
+ unregister_sja1000dev(dev);
+ free_sja1000dev(dev);
+- dev = chan->prev_dev;
++ dev = prev_dev;
+
+ if (!dev) {
+ /* do that only for first channel */
--- /dev/null
+From dfee4111febf3d9ef3a640b2cd6205c75f4e7e3d Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Date: Wed, 9 Apr 2014 15:20:14 +0200
+Subject: extcon: max8997: Fix NULL pointer exception on missing pdata
+
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+
+commit dfee4111febf3d9ef3a640b2cd6205c75f4e7e3d upstream.
+
+Fix NULL pointer exception when platform data is not supplied. The
+driver dereferenced pdata pointer where it could be NULL.
+
+Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Fixes: 810d601f07c
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/extcon/extcon-max8997.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/extcon/extcon-max8997.c
++++ b/drivers/extcon/extcon-max8997.c
+@@ -712,7 +712,7 @@ static int max8997_muic_probe(struct pla
+ goto err_irq;
+ }
+
+- if (pdata->muic_pdata) {
++ if (pdata && pdata->muic_pdata) {
+ struct max8997_muic_platform_data *muic_pdata
+ = pdata->muic_pdata;
+
--- /dev/null
+From 6954cc1f238199e971ec905c5cc87120806ac981 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Thu, 8 May 2014 10:09:23 +0200
+Subject: net: cpsw: fix null dereference at probe
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 6954cc1f238199e971ec905c5cc87120806ac981 upstream.
+
+Fix null-pointer dereference at probe when the mdio platform device is
+missing (e.g. when it has been disabled in DT).
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/ti/cpsw.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -1547,6 +1547,10 @@ static int cpsw_probe_dt(struct cpsw_pla
+ mdio_node = of_find_node_by_phandle(be32_to_cpup(parp));
+ phyid = be32_to_cpup(parp+1);
+ mdio = of_find_device_by_node(mdio_node);
++ if (!mdio) {
++ pr_err("Missing mdio platform device\n");
++ return -EINVAL;
++ }
+ snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
+ PHY_ID_FMT, mdio->name, phyid);
+
--- /dev/null
+From d3921a03a89acb1b9ca599590c0131c89f8737d8 Mon Sep 17 00:00:00 2001
+From: Paul Bolle <pebolle@tiscali.nl>
+Date: Mon, 26 May 2014 21:47:11 +0200
+Subject: staging: tidspbridge: check for CONFIG_SND_OMAP_SOC_MCBSP
+
+From: Paul Bolle <pebolle@tiscali.nl>
+
+commit d3921a03a89acb1b9ca599590c0131c89f8737d8 upstream.
+
+Commit d0f47ff17f29 ("ASoC: OMAP: Build config cleanup for McBSP")
+removed the Kconfig symbol OMAP_MCBSP. It left two checks for
+CONFIG_OMAP_MCBSP untouched.
+
+Convert these to checks for CONFIG_SND_OMAP_SOC_MCBSP. That must be
+correct, since that re-enables calls to functions that are all found in
+sound/soc/omap/mcbsp.c. And that file is built only if
+CONFIG_SND_OMAP_SOC_MCBSP is defined.
+
+Fixes: d0f47ff17f29 ("ASoC: OMAP: Build config cleanup for McBSP")
+Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/tidspbridge/core/dsp-clock.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/tidspbridge/core/dsp-clock.c
++++ b/drivers/staging/tidspbridge/core/dsp-clock.c
+@@ -226,7 +226,7 @@ int dsp_clk_enable(enum dsp_clk_id clk_i
+ case GPT_CLK:
+ status = omap_dm_timer_start(timer[clk_id - 1]);
+ break;
+-#ifdef CONFIG_OMAP_MCBSP
++#ifdef CONFIG_SND_OMAP_SOC_MCBSP
+ case MCBSP_CLK:
+ omap_mcbsp_request(MCBSP_ID(clk_id));
+ omap2_mcbsp_set_clks_src(MCBSP_ID(clk_id), MCBSP_CLKS_PAD_SRC);
+@@ -302,7 +302,7 @@ int dsp_clk_disable(enum dsp_clk_id clk_
+ case GPT_CLK:
+ status = omap_dm_timer_stop(timer[clk_id - 1]);
+ break;
+-#ifdef CONFIG_OMAP_MCBSP
++#ifdef CONFIG_SND_OMAP_SOC_MCBSP
+ case MCBSP_CLK:
+ omap2_mcbsp_set_clks_src(MCBSP_ID(clk_id), MCBSP_CLKS_PRCM_SRC);
+ omap_mcbsp_free(MCBSP_ID(clk_id));
--- /dev/null
+From 687ef9817df7ed960d14575b9033dde3d04631fe Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <balbi@ti.com>
+Date: Wed, 16 Apr 2014 10:30:33 -0500
+Subject: usb: dwc3: gadget: clear stall when disabling endpoint
+
+From: Felipe Balbi <balbi@ti.com>
+
+commit 687ef9817df7ed960d14575b9033dde3d04631fe upstream.
+
+so it seems like DWC3 IP doesn't clear stalls
+automatically when we disable an endpoint, because
+of that, we _must_ make sure stalls are cleared
+before clearing the proper bit in DALEPENA register.
+
+Reported-by: Johannes Stezenbach <js@sig21.net>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc3/gadget.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -604,6 +604,10 @@ static int __dwc3_gadget_ep_disable(stru
+
+ dwc3_remove_requests(dwc, dep);
+
++ /* make sure HW endpoint isn't stalled */
++ if (dep->flags & DWC3_EP_STALL)
++ __dwc3_gadget_ep_set_halt(dep, 0);
++
+ reg = dwc3_readl(dwc->regs, DWC3_DALEPENA);
+ reg &= ~DWC3_DALEPENA_EP(dep->number);
+ dwc3_writel(dwc->regs, DWC3_DALEPENA, reg);
--- /dev/null
+From b0a50e92bda3c4aeb8017d4e6c6e92146ebd5c9b Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 3 Jun 2014 11:00:27 -0400
+Subject: USB: EHCI: avoid BIOS handover on the HASEE E200
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit b0a50e92bda3c4aeb8017d4e6c6e92146ebd5c9b upstream.
+
+Leandro Liptak reports that his HASEE E200 computer hangs when we ask
+the BIOS to hand over control of the EHCI host controller. This
+definitely sounds like a bug in the BIOS, but at the moment there is
+no way to fix it.
+
+This patch works around the problem by avoiding the handoff whenever
+the motherboard and BIOS version match those of Leandro's computer.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Leandro Liptak <leandroliptak@gmail.com>
+Tested-by: Leandro Liptak <leandroliptak@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/pci-quirks.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -555,6 +555,14 @@ static const struct dmi_system_id ehci_d
+ DMI_MATCH(DMI_BIOS_VERSION, "Lucid-"),
+ },
+ },
++ {
++ /* HASEE E200 */
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "HASEE"),
++ DMI_MATCH(DMI_BOARD_NAME, "E210"),
++ DMI_MATCH(DMI_BIOS_VERSION, "6.00"),
++ },
++ },
+ { }
+ };
+
+@@ -564,9 +572,14 @@ static void ehci_bios_handoff(struct pci
+ {
+ int try_handoff = 1, tried_handoff = 0;
+
+- /* The Pegatron Lucid tablet sporadically waits for 98 seconds trying
+- * the handoff on its unused controller. Skip it. */
+- if (pdev->vendor == 0x8086 && pdev->device == 0x283a) {
++ /*
++ * The Pegatron Lucid tablet sporadically waits for 98 seconds trying
++ * the handoff on its unused controller. Skip it.
++ *
++ * The HASEE E200 hangs when the semaphore is set (bugzilla #77021).
++ */
++ if (pdev->vendor == 0x8086 && (pdev->device == 0x283a ||
++ pdev->device == 0x27cc)) {
+ if (dmi_check_system(ehci_dmi_nohandoff_table))
+ try_handoff = 0;
+ }
--- /dev/null
+From d30f2065d6da377cc76771aca5a9850cfca8723b Mon Sep 17 00:00:00 2001
+From: Paul Bolle <pebolle@tiscali.nl>
+Date: Mon, 26 May 2014 23:37:09 +0200
+Subject: usb: gadget: rename CONFIG_USB_GADGET_PXA25X
+
+From: Paul Bolle <pebolle@tiscali.nl>
+
+commit d30f2065d6da377cc76771aca5a9850cfca8723b upstream.
+
+Commit 193ab2a60700 ("usb: gadget: allow multiple gadgets to be built")
+basically renamed the Kconfig symbol USB_GADGET_PXA25X to USB_PXA25X. It
+did not rename the related macros in use at that time. Commit
+c0a39151a405 ("ARM: pxa: fix inconsistent CONFIG_USB_PXA27X") did so for
+all but one macro. Rename that last macro too now.
+
+Fixes: 193ab2a60700 ("usb: gadget: allow multiple gadgets to be built")
+Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/inode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/inode.c
++++ b/drivers/usb/gadget/inode.c
+@@ -1509,7 +1509,7 @@ gadgetfs_setup (struct usb_gadget *gadge
+ }
+ break;
+
+-#ifndef CONFIG_USB_GADGET_PXA25X
++#ifndef CONFIG_USB_PXA25X
+ /* PXA automagically handles this request too */
+ case USB_REQ_GET_CONFIGURATION:
+ if (ctrl->bRequestType != 0x80)
--- /dev/null
+From 32b36eeae6a859670d2939a7d6136cb5e9ed64f8 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 3 Jun 2014 11:11:34 -0400
+Subject: USB: usbtest: add a timeout for scatter-gather tests
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 32b36eeae6a859670d2939a7d6136cb5e9ed64f8 upstream.
+
+In usbtest, tests 5 - 8 use the scatter-gather library in usbcore
+without any sort of timeout. If there's a problem in the gadget or
+host controller being tested, the test can hang.
+
+This patch adds a 10-second timeout to the tests, so that they will
+fail gracefully with an ETIMEDOUT error instead of hanging.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Huang Rui <ray.huang@amd.com>
+Tested-by: Huang Rui <ray.huang@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/misc/usbtest.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/misc/usbtest.c
++++ b/drivers/usb/misc/usbtest.c
+@@ -7,7 +7,7 @@
+ #include <linux/moduleparam.h>
+ #include <linux/scatterlist.h>
+ #include <linux/mutex.h>
+-
++#include <linux/timer.h>
+ #include <linux/usb.h>
+
+
+@@ -476,6 +476,14 @@ alloc_sglist(int nents, int max, int var
+ return sg;
+ }
+
++static void sg_timeout(unsigned long _req)
++{
++ struct usb_sg_request *req = (struct usb_sg_request *) _req;
++
++ req->status = -ETIMEDOUT;
++ usb_sg_cancel(req);
++}
++
+ static int perform_sglist(
+ struct usbtest_dev *tdev,
+ unsigned iterations,
+@@ -487,6 +495,9 @@ static int perform_sglist(
+ {
+ struct usb_device *udev = testdev_to_usbdev(tdev);
+ int retval = 0;
++ struct timer_list sg_timer;
++
++ setup_timer_on_stack(&sg_timer, sg_timeout, (unsigned long) req);
+
+ while (retval == 0 && iterations-- > 0) {
+ retval = usb_sg_init(req, udev, pipe,
+@@ -497,7 +508,10 @@ static int perform_sglist(
+
+ if (retval)
+ break;
++ mod_timer(&sg_timer, jiffies +
++ msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
+ usb_sg_wait(req);
++ del_timer_sync(&sg_timer);
+ retval = req->status;
+
+ /* FIXME check resulting data pattern */
--- /dev/null
+From e4d58f5dcb7d7be45df8def31881ebfae99c75da Mon Sep 17 00:00:00 2001
+From: Huang Rui <ray.huang@amd.com>
+Date: Mon, 26 May 2014 10:55:36 +0800
+Subject: usb: usbtest: fix unlink write error with pattern 1
+
+From: Huang Rui <ray.huang@amd.com>
+
+commit e4d58f5dcb7d7be45df8def31881ebfae99c75da upstream.
+
+TEST 12 and TEST 24 unlinks the URB write request for N times. When
+host and gadget both initialize pattern 1 (mod 63) data series to
+transfer, the gadget side will complain the wrong data which is not
+expected. Because in host side, usbtest doesn't fill the data buffer
+as mod 63 and this patch fixed it.
+
+[20285.488974] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready
+[20285.489181] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Not Active
+[20285.489423] dwc3 dwc3.0.auto: ep1out-bulk: req ffff8800aa6cb480 dma aeb50800 length 512 last
+[20285.489727] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Start Transfer' params 00000000 a9eaf000 00000000
+[20285.490055] dwc3 dwc3.0.auto: Command Complete --> 0
+[20285.490281] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready
+[20285.490492] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Active
+[20285.490713] dwc3 dwc3.0.auto: ep1out-bulk: endpoint busy
+[20285.490909] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Complete
+[20285.491117] dwc3 dwc3.0.auto: request ffff8800aa6cb480 from ep1out-bulk completed 512/512 ===> 0
+[20285.491431] zero gadget: bad OUT byte, buf[1] = 0
+[20285.491605] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Set Stall' params 00000000 00000000 00000000
+[20285.491915] dwc3 dwc3.0.auto: Command Complete --> 0
+[20285.492099] dwc3 dwc3.0.auto: queing request ffff8800aa6cb480 to ep1out-bulk length 512
+[20285.492387] dwc3 dwc3.0.auto: ep1out-bulk: Transfer Not Ready
+[20285.492595] dwc3 dwc3.0.auto: ep1out-bulk: reason Transfer Not Active
+[20285.492830] dwc3 dwc3.0.auto: ep1out-bulk: req ffff8800aa6cb480 dma aeb51000 length 512 last
+[20285.493135] dwc3 dwc3.0.auto: ep1out-bulk: cmd 'Start Transfer' params 00000000 a9eaf000 00000000
+[20285.493465] dwc3 dwc3.0.auto: Command Complete --> 0
+
+Signed-off-by: Huang Rui <ray.huang@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/misc/usbtest.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/usb/misc/usbtest.c
++++ b/drivers/usb/misc/usbtest.c
+@@ -1149,6 +1149,11 @@ static int unlink1(struct usbtest_dev *d
+ urb->context = &completion;
+ urb->complete = unlink1_callback;
+
++ if (usb_pipeout(urb->pipe)) {
++ simple_fill_buf(urb);
++ urb->transfer_flags |= URB_ZERO_PACKET;
++ }
++
+ /* keep the endpoint busy. there are lots of hc/hcd-internal
+ * states, and testing should get to all of them over time.
+ *
+@@ -1279,6 +1284,11 @@ static int unlink_queued(struct usbtest_
+ unlink_queued_callback, &ctx);
+ ctx.urbs[i]->transfer_dma = buf_dma;
+ ctx.urbs[i]->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
++
++ if (usb_pipeout(ctx.urbs[i]->pipe)) {
++ simple_fill_buf(ctx.urbs[i]);
++ ctx.urbs[i]->transfer_flags |= URB_ZERO_PACKET;
++ }
+ }
+
+ /* Submit all the URBs and then unlink URBs num - 4 and num - 2. */
projects / thirdparty / kernel / stable-queue.git / commitdiff
