--- /dev/null
+From ba2d8ce9db0a61505362bb17b8899df3d3326146 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dcbw@redhat.com>
+Date: Thu, 8 Nov 2012 12:47:41 -0600
+Subject: cdc-acm: implement TIOCSSERIAL to avoid blocking close(2)
+
+From: Dan Williams <dcbw@redhat.com>
+
+commit ba2d8ce9db0a61505362bb17b8899df3d3326146 upstream.
+
+Some devices (ex Nokia C7) simply don't respond at all when data is sent
+to some of their USB interfaces. The data gets stuck in the TTYs queue
+and sits there until close(2), which them blocks because closing_wait
+defaults to 30 seconds (even though the fd is O_NONBLOCK). This is
+rarely desired. Implement the standard mechanism to adjust closing_wait
+and let applications handle it how they want to.
+
+See also 02303f73373aa1da19dbec510ec5a4e2576f9610 for usb_wwan.c.
+
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Acked-by: Oliver Neukum <oneukum@suse.de>
+Tested-by: Aleksander Morgado <aleksander@gnu.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-acm.c | 38 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 38 insertions(+)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -787,6 +787,10 @@ static int get_serial_info(struct acm *a
+ tmp.flags = ASYNC_LOW_LATENCY;
+ tmp.xmit_fifo_size = acm->writesize;
+ tmp.baud_base = le32_to_cpu(acm->line.dwDTERate);
++ tmp.close_delay = acm->port.close_delay / 10;
++ tmp.closing_wait = acm->port.closing_wait == ASYNC_CLOSING_WAIT_NONE ?
++ ASYNC_CLOSING_WAIT_NONE :
++ acm->port.closing_wait / 10;
+
+ if (copy_to_user(info, &tmp, sizeof(tmp)))
+ return -EFAULT;
+@@ -794,6 +798,37 @@ static int get_serial_info(struct acm *a
+ return 0;
+ }
+
++static int set_serial_info(struct acm *acm,
++ struct serial_struct __user *newinfo)
++{
++ struct serial_struct new_serial;
++ unsigned int closing_wait, close_delay;
++ int retval = 0;
++
++ if (copy_from_user(&new_serial, newinfo, sizeof(new_serial)))
++ return -EFAULT;
++
++ close_delay = new_serial.close_delay * 10;
++ closing_wait = new_serial.closing_wait == ASYNC_CLOSING_WAIT_NONE ?
++ ASYNC_CLOSING_WAIT_NONE : new_serial.closing_wait * 10;
++
++ mutex_lock(&acm->port.mutex);
++
++ if (!capable(CAP_SYS_ADMIN)) {
++ if ((close_delay != acm->port.close_delay) ||
++ (closing_wait != acm->port.closing_wait))
++ retval = -EPERM;
++ else
++ retval = -EOPNOTSUPP;
++ } else {
++ acm->port.close_delay = close_delay;
++ acm->port.closing_wait = closing_wait;
++ }
++
++ mutex_unlock(&acm->port.mutex);
++ return retval;
++}
++
+ static int acm_tty_ioctl(struct tty_struct *tty,
+ unsigned int cmd, unsigned long arg)
+ {
+@@ -804,6 +839,9 @@ static int acm_tty_ioctl(struct tty_stru
+ case TIOCGSERIAL: /* gets serial port data */
+ rv = get_serial_info(acm, (struct serial_struct __user *) arg);
+ break;
++ case TIOCSSERIAL:
++ rv = set_serial_info(acm, (struct serial_struct __user *) arg);
++ break;
+ }
+
+ return rv;
--- /dev/null
+From 70f77b3f7ec010ff9624c1f2e39a81babc9e2429 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 9 Jun 2012 19:10:27 +0300
+Subject: ftrace: Clear bits properly in reset_iter_read()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 70f77b3f7ec010ff9624c1f2e39a81babc9e2429 upstream.
+
+There is a typo here where '&' is used instead of '|' and it turns the
+statement into a noop. The original code is equivalent to:
+
+ iter->flags &= ~((1 << 2) & (1 << 4));
+
+Link: http://lkml.kernel.org/r/20120609161027.GD6488@elgon.mountain
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/ftrace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -2437,7 +2437,7 @@ static void reset_iter_read(struct ftrac
+ {
+ iter->pos = 0;
+ iter->func_pos = 0;
+- iter->flags &= ~(FTRACE_ITER_PRINTALL & FTRACE_ITER_HASH);
++ iter->flags &= ~(FTRACE_ITER_PRINTALL | FTRACE_ITER_HASH);
+ }
+
+ static void *t_start(struct seq_file *m, loff_t *pos)
--- /dev/null
+From 12f8f74b2a4d26c4facfa7ef99487cf0930f6ef7 Mon Sep 17 00:00:00 2001
+From: Zheng Liu <gnehzuil.liu@gmail.com>
+Date: Thu, 8 Nov 2012 16:58:46 -0800
+Subject: perf test: fix a build error on builtin-test
+
+From: Zheng Liu <gnehzuil.liu@gmail.com>
+
+commit 12f8f74b2a4d26c4facfa7ef99487cf0930f6ef7 upstream.
+
+Recently I build perf and get a build error on builtin-test.c. The error is as
+following:
+
+$ make
+ CC perf.o
+ CC builtin-test.o
+cc1: warnings being treated as errors
+builtin-test.c: In function ‘sched__get_first_possible_cpu’:
+builtin-test.c:977: warning: implicit declaration of function ‘CPU_ALLOC’
+builtin-test.c:977: warning: nested extern declaration of ‘CPU_ALLOC’
+builtin-test.c:977: warning: assignment makes pointer from integer without a cast
+builtin-test.c:978: warning: implicit declaration of function ‘CPU_ALLOC_SIZE’
+builtin-test.c:978: warning: nested extern declaration of ‘CPU_ALLOC_SIZE’
+builtin-test.c:979: warning: implicit declaration of function ‘CPU_ZERO_S’
+builtin-test.c:979: warning: nested extern declaration of ‘CPU_ZERO_S’
+builtin-test.c:982: warning: implicit declaration of function ‘CPU_FREE’
+builtin-test.c:982: warning: nested extern declaration of ‘CPU_FREE’
+builtin-test.c:992: warning: implicit declaration of function ‘CPU_ISSET_S’
+builtin-test.c:992: warning: nested extern declaration of ‘CPU_ISSET_S’
+builtin-test.c:998: warning: implicit declaration of function ‘CPU_CLR_S’
+builtin-test.c:998: warning: nested extern declaration of ‘CPU_CLR_S’
+make: *** [builtin-test.o] Error 1
+
+This problem is introduced in 3e7c439a. CPU_ALLOC and related macros are
+missing in sched__get_first_possible_cpu function. In 54489c18, commiter
+mentioned that CPU_ALLOC has been removed. So CPU_ALLOC calls in this
+function are removed to let perf to be built.
+
+Signed-off-by: Vinson Lee <vlee@twitter.com>
+Signed-off-by: Zheng Liu <wenqing.lz@taobao.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Mike Galbraith <efault@gmx.de>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Vinson Lee <vlee@twitter.com>
+Cc: Zheng Liu <wenqing.lz@taobao.com>
+Link: http://lkml.kernel.org/r/1352422726-31114-1-git-send-email-vlee@twitter.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/builtin-test.c | 38 ++++++++++++--------------------------
+ 1 file changed, 12 insertions(+), 26 deletions(-)
+
+--- a/tools/perf/builtin-test.c
++++ b/tools/perf/builtin-test.c
+@@ -604,19 +604,13 @@ out_free_threads:
+ #undef nsyscalls
+ }
+
+-static int sched__get_first_possible_cpu(pid_t pid, cpu_set_t **maskp,
+- size_t *sizep)
++static int sched__get_first_possible_cpu(pid_t pid, cpu_set_t *maskp)
+ {
+- cpu_set_t *mask;
+- size_t size;
+ int i, cpu = -1, nrcpus = 1024;
+ realloc:
+- mask = CPU_ALLOC(nrcpus);
+- size = CPU_ALLOC_SIZE(nrcpus);
+- CPU_ZERO_S(size, mask);
++ CPU_ZERO(maskp);
+
+- if (sched_getaffinity(pid, size, mask) == -1) {
+- CPU_FREE(mask);
++ if (sched_getaffinity(pid, sizeof(*maskp), maskp) == -1) {
+ if (errno == EINVAL && nrcpus < (1024 << 8)) {
+ nrcpus = nrcpus << 2;
+ goto realloc;
+@@ -626,19 +620,14 @@ realloc:
+ }
+
+ for (i = 0; i < nrcpus; i++) {
+- if (CPU_ISSET_S(i, size, mask)) {
+- if (cpu == -1) {
++ if (CPU_ISSET(i, maskp)) {
++ if (cpu == -1)
+ cpu = i;
+- *maskp = mask;
+- *sizep = size;
+- } else
+- CPU_CLR_S(i, size, mask);
++ else
++ CPU_CLR(i, maskp);
+ }
+ }
+
+- if (cpu == -1)
+- CPU_FREE(mask);
+-
+ return cpu;
+ }
+
+@@ -653,8 +642,8 @@ static int test__PERF_RECORD(void)
+ .freq = 10,
+ .mmap_pages = 256,
+ };
+- cpu_set_t *cpu_mask = NULL;
+- size_t cpu_mask_size = 0;
++ cpu_set_t cpu_mask;
++ size_t cpu_mask_size = sizeof(cpu_mask);
+ struct perf_evlist *evlist = perf_evlist__new(NULL, NULL);
+ struct perf_evsel *evsel;
+ struct perf_sample sample;
+@@ -718,8 +707,7 @@ static int test__PERF_RECORD(void)
+ evsel->attr.sample_type |= PERF_SAMPLE_TIME;
+ perf_evlist__config_attrs(evlist, &opts);
+
+- err = sched__get_first_possible_cpu(evlist->workload.pid, &cpu_mask,
+- &cpu_mask_size);
++ err = sched__get_first_possible_cpu(evlist->workload.pid, &cpu_mask);
+ if (err < 0) {
+ pr_debug("sched__get_first_possible_cpu: %s\n", strerror(errno));
+ goto out_delete_evlist;
+@@ -730,9 +718,9 @@ static int test__PERF_RECORD(void)
+ /*
+ * So that we can check perf_sample.cpu on all the samples.
+ */
+- if (sched_setaffinity(evlist->workload.pid, cpu_mask_size, cpu_mask) < 0) {
++ if (sched_setaffinity(evlist->workload.pid, cpu_mask_size, &cpu_mask) < 0) {
+ pr_debug("sched_setaffinity: %s\n", strerror(errno));
+- goto out_free_cpu_mask;
++ goto out_delete_evlist;
+ }
+
+ /*
+@@ -916,8 +904,6 @@ found_exit:
+ }
+ out_err:
+ perf_evlist__munmap(evlist);
+-out_free_cpu_mask:
+- CPU_FREE(cpu_mask);
+ out_delete_evlist:
+ perf_evlist__delete(evlist);
+ out:
--- /dev/null
+From 878d7439d0f45a95869e417576774673d1fa243f Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 18 Oct 2012 04:55:36 -0700
+Subject: rcu: Fix batch-limit size problem
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 878d7439d0f45a95869e417576774673d1fa243f upstream.
+
+Commit 29c00b4a1d9e27 (rcu: Add event-tracing for RCU callback
+invocation) added a regression in rcu_do_batch()
+
+Under stress, RCU is supposed to allow to process all items in queue,
+instead of a batch of 10 items (blimit), but an integer overflow makes
+the effective limit being 1. So, unless there is frequent idle periods
+(during which RCU ignores batch limits), RCU can be forced into a
+state where it cannot keep up with the callback-generation rate,
+eventually resulting in OOM.
+
+This commit therefore converts a few variables in rcu_do_batch() from
+int to long to fix this problem, along with the module parameters
+controlling the batch limits.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/rcutree.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+--- a/kernel/rcutree.c
++++ b/kernel/rcutree.c
+@@ -212,13 +212,13 @@ DEFINE_PER_CPU(struct rcu_dynticks, rcu_
+ #endif
+ };
+
+-static int blimit = 10; /* Maximum callbacks per rcu_do_batch. */
+-static int qhimark = 10000; /* If this many pending, ignore blimit. */
+-static int qlowmark = 100; /* Once only this many pending, use blimit. */
+-
+-module_param(blimit, int, 0444);
+-module_param(qhimark, int, 0444);
+-module_param(qlowmark, int, 0444);
++static long blimit = 10; /* Maximum callbacks per rcu_do_batch. */
++static long qhimark = 10000; /* If this many pending, ignore blimit. */
++static long qlowmark = 100; /* Once only this many pending, use blimit. */
++
++module_param(blimit, long, 0444);
++module_param(qhimark, long, 0444);
++module_param(qlowmark, long, 0444);
+
+ int rcu_cpu_stall_suppress __read_mostly; /* 1 = suppress stall warnings. */
+ int rcu_cpu_stall_timeout __read_mostly = CONFIG_RCU_CPU_STALL_TIMEOUT;
+@@ -1769,7 +1769,8 @@ static void rcu_do_batch(struct rcu_stat
+ {
+ unsigned long flags;
+ struct rcu_head *next, *list, **tail;
+- int bl, count, count_lazy, i;
++ long bl, count, count_lazy;
++ int i;
+
+ /* If no callbacks are ready, just return.*/
+ if (!cpu_has_callbacks_ready_to_invoke(rdp)) {
--- /dev/null
+From 54f7be5b831254199522523ccab4c3d954bbf576 Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <srostedt@redhat.com>
+Date: Thu, 29 Nov 2012 22:27:22 -0500
+Subject: ring-buffer: Fix NULL pointer if rb_set_head_page() fails
+
+From: Steven Rostedt <srostedt@redhat.com>
+
+commit 54f7be5b831254199522523ccab4c3d954bbf576 upstream.
+
+The function rb_set_head_page() searches the list of ring buffer
+pages for a the page that has the HEAD page flag set. If it does
+not find it, it will do a WARN_ON(), disable the ring buffer and
+return NULL, as this should never happen.
+
+But if this bug happens to happen, not all callers of this function
+can handle a NULL pointer being returned from it. That needs to be
+fixed.
+
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/ring_buffer.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -1396,6 +1396,8 @@ rb_insert_pages(struct ring_buffer_per_c
+ struct list_head *head_page_with_bit;
+
+ head_page = &rb_set_head_page(cpu_buffer)->list;
++ if (!head_page)
++ break;
+ prev_page = head_page->prev;
+
+ first_page = pages->next;
+@@ -2934,7 +2936,7 @@ unsigned long ring_buffer_oldest_event_t
+ unsigned long flags;
+ struct ring_buffer_per_cpu *cpu_buffer;
+ struct buffer_page *bpage;
+- unsigned long ret;
++ unsigned long ret = 0;
+
+ if (!cpumask_test_cpu(cpu, buffer->cpumask))
+ return 0;
+@@ -2949,7 +2951,8 @@ unsigned long ring_buffer_oldest_event_t
+ bpage = cpu_buffer->reader_page;
+ else
+ bpage = rb_set_head_page(cpu_buffer);
+- ret = bpage->page->time_stamp;
++ if (bpage)
++ ret = bpage->page->time_stamp;
+ raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+
+ return ret;
+@@ -3260,6 +3263,8 @@ rb_get_reader_page(struct ring_buffer_pe
+ * Splice the empty reader page into the list around the head.
+ */
+ reader = rb_set_head_page(cpu_buffer);
++ if (!reader)
++ goto out;
+ cpu_buffer->reader_page->list.next = rb_list_head(reader->list.next);
+ cpu_buffer->reader_page->list.prev = reader->list.prev;
+
--- /dev/null
+From 9366c1ba13fbc41bdb57702e75ca4382f209c82f Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <srostedt@redhat.com>
+Date: Thu, 29 Nov 2012 22:31:16 -0500
+Subject: ring-buffer: Fix race between integrity check and readers
+
+From: Steven Rostedt <srostedt@redhat.com>
+
+commit 9366c1ba13fbc41bdb57702e75ca4382f209c82f upstream.
+
+The function rb_check_pages() was added to make sure the ring buffer's
+pages were sane. This check is done when the ring buffer size is modified
+as well as when the iterator is released (closing the "trace" file),
+as that was considered a non fast path and a good place to do a sanity
+check.
+
+The problem is that the check does not have any locks around it.
+If one process were to read the trace file, and another were to read
+the raw binary file, the check could happen while the reader is reading
+the file.
+
+The issues with this is that the check requires to clear the HEAD page
+before doing the full check and it restores it afterward. But readers
+require the HEAD page to exist before it can read the buffer, otherwise
+it gives a nasty warning and disables the buffer.
+
+By adding the reader lock around the check, this keeps the race from
+happening.
+
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/ring_buffer.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -3783,12 +3783,17 @@ void
+ ring_buffer_read_finish(struct ring_buffer_iter *iter)
+ {
+ struct ring_buffer_per_cpu *cpu_buffer = iter->cpu_buffer;
++ unsigned long flags;
+
+ /*
+ * Ring buffer is disabled from recording, here's a good place
+- * to check the integrity of the ring buffer.
++ * to check the integrity of the ring buffer.
++ * Must prevent readers from trying to read, as the check
++ * clears the HEAD page and readers require it.
+ */
++ raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
+ rb_check_pages(cpu_buffer);
++ raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
+
+ atomic_dec(&cpu_buffer->record_disabled);
+ atomic_dec(&cpu_buffer->buffer->resize_disabled);
acpi-video-add-asus-ul30vt-to-acpi-video-detect-blacklist.patch
usb-ohci-workaround-for-hardware-bug-retired-tds-not-added-to-the-done-queue.patch
xhci-extend-fresco-logic-msi-quirk.patch
+ftrace-clear-bits-properly-in-reset_iter_read.patch
+ring-buffer-fix-null-pointer-if-rb_set_head_page-fails.patch
+ring-buffer-fix-race-between-integrity-check-and-readers.patch
+cdc-acm-implement-tiocsserial-to-avoid-blocking-close-2.patch
+perf-test-fix-a-build-error-on-builtin-test.patch
+usb-ehci-bugfix-urb-hcpriv-should-not-be-null.patch
+rcu-fix-batch-limit-size-problem.patch
+staging-bcm-add-two-products-and-remove-an-existing-product.patch
--- /dev/null
+From 4f29ef050848245f7c180b95ccf67dfcd76b1fd8 Mon Sep 17 00:00:00 2001
+From: Kevin McKinney <klmckinney1@gmail.com>
+Date: Mon, 12 Nov 2012 22:20:30 -0500
+Subject: Staging: bcm: Add two products and remove an existing product.
+
+From: Kevin McKinney <klmckinney1@gmail.com>
+
+commit 4f29ef050848245f7c180b95ccf67dfcd76b1fd8 upstream.
+
+This patch adds two new products and modifies
+the device id table to include them. In addition,
+product of 0xbccd - BCM_USB_PRODUCT_ID_SM250 is
+removed because Beceem, ZTE, Sprint use this id
+for block devices.
+
+Reported-by: Muhammad Minhazul Haque <mdminhazulhaque@gmail.com>
+Signed-off-by: Kevin McKinney <klmckinney1@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/bcm/InterfaceInit.c | 3 ++-
+ drivers/staging/bcm/InterfaceInit.h | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/bcm/InterfaceInit.c
++++ b/drivers/staging/bcm/InterfaceInit.c
+@@ -4,11 +4,12 @@ static struct usb_device_id InterfaceUsb
+ { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_T3) },
+ { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_T3B) },
+ { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_T3L) },
+- { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_SM250) },
++ { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_SYM) },
+ { USB_DEVICE(BCM_USB_VENDOR_ID_ZTE, BCM_USB_PRODUCT_ID_226) },
+ { USB_DEVICE(BCM_USB_VENDOR_ID_FOXCONN, BCM_USB_PRODUCT_ID_1901) },
+ { USB_DEVICE(BCM_USB_VENDOR_ID_ZTE, BCM_USB_PRODUCT_ID_ZTE_TU25) },
+ { USB_DEVICE(BCM_USB_VENDOR_ID_ZTE, BCM_USB_PRODUCT_ID_ZTE_226) },
++ { USB_DEVICE(BCM_USB_VENDOR_ID_ZTE, BCM_USB_PRODUCT_ID_ZTE_326) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(usb, InterfaceUsbtable);
+--- a/drivers/staging/bcm/InterfaceInit.h
++++ b/drivers/staging/bcm/InterfaceInit.h
+@@ -8,11 +8,11 @@
+ #define BCM_USB_PRODUCT_ID_T3 0x0300
+ #define BCM_USB_PRODUCT_ID_T3B 0x0210
+ #define BCM_USB_PRODUCT_ID_T3L 0x0220
+-#define BCM_USB_PRODUCT_ID_SM250 0xbccd
+ #define BCM_USB_PRODUCT_ID_SYM 0x15E
+ #define BCM_USB_PRODUCT_ID_1901 0xe017
+ #define BCM_USB_PRODUCT_ID_226 0x0132 /* not sure if this is valid */
+ #define BCM_USB_PRODUCT_ID_ZTE_226 0x172
++#define BCM_USB_PRODUCT_ID_ZTE_326 0x173 /* ZTE AX326 */
+ #define BCM_USB_PRODUCT_ID_ZTE_TU25 0x0007
+
+ #define BCM_USB_MINOR_BASE 192
--- /dev/null
+From 2656a9abcf1ec8dd5fee6a75d6997a0f2fa0094e Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Thu, 8 Nov 2012 10:17:01 -0500
+Subject: USB: EHCI: bugfix: urb->hcpriv should not be NULL
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 2656a9abcf1ec8dd5fee6a75d6997a0f2fa0094e upstream.
+
+This patch (as1632b) fixes a bug in ehci-hcd. The USB core uses
+urb->hcpriv to determine whether or not an URB is active; host
+controller drivers are supposed to set this pointer to a non-NULL
+value when an URB is queued. However ehci-hcd sets it to NULL for
+isochronous URBs, which defeats the check in usbcore.
+
+In itself this isn't a big deal. But people have recently found that
+certain sequences of actions will cause the snd-usb-audio driver to
+reuse URBs without waiting for them to complete. In the absence of
+proper checking by usbcore, the URBs get added to their endpoint list
+twice. This leads to list corruption and a system freeze.
+
+The patch makes ehci-hcd assign a meaningful value to urb->hcpriv for
+isochronous URBs. Improving robustness always helps.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Artem S. Tashkinov <t.artem@lycos.com>
+Reported-by: Christof Meerwald <cmeerw@cmeerw.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ehci-q.c | 12 +++---------
+ drivers/usb/host/ehci-sched.c | 4 ++--
+ 2 files changed, 5 insertions(+), 11 deletions(-)
+
+--- a/drivers/usb/host/ehci-q.c
++++ b/drivers/usb/host/ehci-q.c
+@@ -264,15 +264,9 @@ ehci_urb_done(struct ehci_hcd *ehci, str
+ __releases(ehci->lock)
+ __acquires(ehci->lock)
+ {
+- if (likely (urb->hcpriv != NULL)) {
+- struct ehci_qh *qh = (struct ehci_qh *) urb->hcpriv;
+-
+- /* S-mask in a QH means it's an interrupt urb */
+- if ((qh->hw->hw_info2 & cpu_to_hc32(ehci, QH_SMASK)) != 0) {
+-
+- /* ... update hc-wide periodic stats (for usbfs) */
+- ehci_to_hcd(ehci)->self.bandwidth_int_reqs--;
+- }
++ if (usb_pipetype(urb->pipe) == PIPE_INTERRUPT) {
++ /* ... update hc-wide periodic stats */
++ ehci_to_hcd(ehci)->self.bandwidth_int_reqs--;
+ }
+
+ if (unlikely(urb->unlinked)) {
+--- a/drivers/usb/host/ehci-sched.c
++++ b/drivers/usb/host/ehci-sched.c
+@@ -1646,7 +1646,7 @@ static void itd_link_urb(
+
+ /* don't need that schedule data any more */
+ iso_sched_free (stream, iso_sched);
+- urb->hcpriv = NULL;
++ urb->hcpriv = stream;
+
+ ++ehci->isoc_count;
+ enable_periodic(ehci);
+@@ -2045,7 +2045,7 @@ static void sitd_link_urb(
+
+ /* don't need that schedule data any more */
+ iso_sched_free (stream, sched);
+- urb->hcpriv = NULL;
++ urb->hcpriv = stream;
+
+ ++ehci->isoc_count;
+ enable_periodic(ehci);
projects / thirdparty / kernel / stable-queue.git / commitdiff
