Linux kernel source tree https://git.amat.us/linux/atom/drivers/usb?h=v3.2.18 2012-05-11T12:14:43Z 2012-05-11T12:14:43Z Laurent Pinchart laurent.pinchart@ideasonboard.com 2012-04-24T09:29:42Z urn:sha1:cbc0551878f39fce33be5dd54ec6773664498386 commit 6f6543f53f9ce136e01d7114bf6f0818ca54fb41 upstream. The field is used to pass the UVC request data length, but can also be used to signal an error when setting it to a negative value. Switch from unsigned int to __s32. Reported-by: Fernandez Gonzalo <gfernandez@copreci.es> Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 2012-05-11T12:14:42Z Felipe Balbi balbi@ti.com 2012-04-18T10:59:30Z urn:sha1:30b770c334f69cf5bc8ce4e277084b6205ce34ef commit 15b120d67019d691e4389372967332d74a80522a upstream. pullup() is already called properly by udc-core.c and there's no need to call it from udc_stop(), in fact that will cause issues. Reviewed-by: Alexander Shishkin <alexander.shishkin@linux.intel.com> Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Felipe Balbi <balbi@ti.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 2012-05-11T12:14:42Z Alan Stern stern@rowland.harvard.edu 2012-04-11T20:09:10Z urn:sha1:4c3fbeafa241fbead0d8724c3d5ea9da96151a74 commit c85dcdac5852295cf6822f5c4331a6ddab72581f upstream. This patch (as1539) fixes a minor bug in the mass-storage gadget drivers. When an unknown command is received, the error code sent back is "Invalid Field in CDB" rather than "Invalid Command". This is because the bitmask of CDB bytes allowed to be nonzero is incorrect. When handling an unknown command, we don't care which command bytes are nonzero. All the bits in the mask should be set, not just eight of them. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> CC: <Michal Nazarewicz <mina86@mina86.com> Signed-off-by: Felipe Balbi <balbi@ti.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 2012-05-11T12:14:42Z Alan Stern stern@rowland.harvard.edu 2012-04-24T18:07:22Z urn:sha1:f845dfabaf943e9d1bd97c1c023ee5c58ba04352 commit 151b61284776be2d6f02d48c23c3625678960b97 upstream. This patch (as1545) fixes a problem affecting several ASUS computers: The machine crashes or corrupts memory when going into suspend if the ehci-hcd driver is bound to any controllers. Users have been forced to unbind or unload ehci-hcd before putting their systems to sleep. After extensive testing, it was determined that the machines don't like going into suspend when any EHCI controllers are in the PCI D3 power state. Presumably this is a firmware bug, but there's nothing we can do about it except to avoid putting the controllers in D3 during system sleep. The patch adds a new flag to indicate whether the problem is present, and avoids changing the controller's power state if the flag is set. Runtime suspend is unaffected; this matters only for system suspend. However as a side effect, the controller will not respond to remote wakeup requests while the system is asleep. Hence USB wakeup is not functional -- but of course, this is already true in the current state of affairs. This fixes Bugzilla #42728. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Tested-by: Steven Rostedt <rostedt@goodmis.org> Tested-by: Andrey Rahmatullin <wrar@wrar.name> Tested-by: Oleksij Rempel (fishor) <bug-track@fisher-privat.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [bwh: Backported to 3.2: adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 2012-05-11T12:14:41Z Oliver Neukum oliver@neukum.org 2012-04-26T19:59:10Z urn:sha1:670515c56290b7b7435f066e9bc0999fa1fc29b7 commit 5c22837adca7c30b66121cf18ad3e160134268d4 upstream. This patch fixes a race whereby a pointer to a buffer would be overwritten while the buffer was in use leading to a double free and a memory leak. This causes crashes. This bug was introduced in 2.6.34 Signed-off-by: Oliver Neukum <oneukum@suse.de> Tested-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 2012-05-11T12:14:15Z Felipe Balbi balbi@ti.com 2012-03-21T09:44:00Z urn:sha1:0ae5d66e40cde5a95ed16d28a480d2ce91834bfc commit cd423dd3634a5232a3019eb372b144619a61cd16 upstream. due to a HW limitation we have a bounce buffer for ep0 out transfers which are not aligned with MaxPacketSize. On such case we were not increment r->actual as we should. This patch fixes that mistake. Signed-off-by: Felipe Balbi <balbi@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 2012-05-11T12:14:06Z Shubhrajyoti D shubhrajyoti@ti.com 2012-03-22T07:18:06Z urn:sha1:2e67ffa6107563e7c147d3648d7b457c0ac571d8 commit ad579699c4f0274bf522a9252ff9b20c72197e48 upstream. pm_runtime_get_sync returns a signed integer. In case of errors it returns a negative value. This patch fixes the error check by making it signed instead of unsigned thus preventing register access if get_sync_fails. Also passes the error cause to the debug message. Cc: Kishon Vijay Abraham I <kishon@ti.com> Signed-off-by: Shubhrajyoti D <shubhrajyoti@ti.com> Signed-off-by: Felipe Balbi <balbi@ti.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 2012-05-11T12:14:05Z Kishon Vijay Abraham I kishon@ti.com 2012-03-21T16:00:20Z urn:sha1:f48a6c0a5a021f575ca37d923b4149317bcb4c63 commit 3006dc8c627d738693e910c159630e4368c9e86c upstream. pm_runtime_enable is being called after omap2430_musb_init. Hence pm_runtime_get_sync in omap2430_musb_init does not have any effect (does not enable clocks) resulting in a crash during register access. It is fixed here. Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com> Signed-off-by: Felipe Balbi <balbi@ti.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 2012-05-11T12:14:05Z Andrzej Pietrasiewicz andrzej.p@samsung.com 2012-03-28T07:30:50Z urn:sha1:5292bdd3ee31c6893a62df34b39e3814bfa4b553 commit 92b0abf80c5c5f0e0d71d1309688a330fd74731b upstream. usb: gadget: eliminate NULL pointer dereference (bugfix) This patch fixes a bug which causes NULL pointer dereference in ffs_ep0_ioctl. The bug happens when the FunctionFS is not bound (either has not been bound yet or has been bound and then unbound) and can be reproduced with running the following commands: $ insmod g_ffs.ko $ mount -t functionfs func /dev/usbgadget $ ./null where null.c is: #include <fcntl.h> #include <linux/usb/functionfs.h> int main(void) { int fd = open("/dev/usbgadget/ep0", O_RDWR); ioctl(fd, FUNCTIONFS_CLEAR_HALT); return 0; } Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com> Signed-off-by: Felipe Balbi <balbi@ti.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> 2012-05-11T12:14:04Z Alan Stern stern@rowland.harvard.edu 2012-04-26T15:31:57Z urn:sha1:2eefeef94ff4472fb873c5803122358ba43a66db commit 320cd1e750f1bf3e47eb41209dcb2be07264cb76 upstream. This patch (as1548) fixes a recently-introduced incompatibility between the UDC core and the dummy-hcd driver. Commit 8ae8090c82eb407267001f75b3d256b3bd4ae691 (usb: gadget: udc-core: fix asymmetric calls in remove_driver) moved the usb_gadget_udc_stop() call in usb_gadget_remove_driver() below the usb_gadget_disconnect() call. As a result, usb_gadget_disconnect() gets called at a time when the gadget driver believes it has been unbound but dummy-hcd believes it has not. A nasty error ensues when dummy-hcd calls the gadget driver's disconnect method a second time. To fix the problem, this patch moves the gadget driver's unbind notification after the usb_gadget_disconnect() call. Now nothing happens between the two unbind notifications, so nothing goes wrong. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Tested-by: Alexander Shishkin <alexander.shishkin@linux.intel.com> Signed-off-by: Felipe Balbi <balbi@ti.com> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>