Merge branch 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh...

* 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  USB: cdc-acm: fix potential null-pointer dereference on disconnect
  USB: cdc-acm: fix potential null-pointer dereference
  USB: cdc-acm: fix memory corruption / panic
  USB: Fix 'bad dma' problem on WDM device disconnect
  usb: wwan: fix compilation without CONFIG_PM_RUNTIME
  USB: uss720 fixup refcount position
  usb: musb: blackfin: fix typo in new bfin_musb_vbus_status func
  usb: musb: blackfin: fix typo in new dev_pm_ops struct
  usb: musb: blackfin: fix typo in platform driver name
  usb: musb: Fix for merge issue
  ehci-hcd: Bug fix: don't set a QH's Halt bit
  USB: Do not pass negative length to snoop_urb()

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index f492a7f2b6ee2e74cd56aa44b03fbd55ba74e613..e057e5381465b1a12c03e550f3ff6b2f9d4d24e0 100644 (file)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -297,6 +297,8 @@ static void acm_ctrl_irq(struct urb *urb)
        if (!ACM_READY(acm))
                goto exit;
 
+       usb_mark_last_busy(acm->dev);
+
        data = (unsigned char *)(dr + 1);
        switch (dr->bNotificationType) {
        case USB_CDC_NOTIFY_NETWORK_CONNECTION:
@@ -336,7 +338,6 @@ static void acm_ctrl_irq(struct urb *urb)
                break;
        }
 exit:
-       usb_mark_last_busy(acm->dev);
        retval = usb_submit_urb(urb, GFP_ATOMIC);
        if (retval)
                dev_err(&urb->dev->dev, "%s - usb_submit_urb failed with "
@@ -533,6 +534,8 @@ static void acm_softint(struct work_struct *work)
        if (!ACM_READY(acm))
                return;
        tty = tty_port_tty_get(&acm->port);
+       if (!tty)
+               return;
        tty_wakeup(tty);
        tty_kref_put(tty);
 }
@@ -646,8 +649,10 @@ static void acm_port_down(struct acm *acm)
                usb_kill_urb(acm->ctrlurb);
                for (i = 0; i < ACM_NW; i++)
                        usb_kill_urb(acm->wb[i].urb);
+               tasklet_disable(&acm->urb_task);
                for (i = 0; i < nr; i++)
                        usb_kill_urb(acm->ru[i].urb);
+               tasklet_enable(&acm->urb_task);
                acm->control->needs_remote_wakeup = 0;
                usb_autopm_put_interface(acm->control);
        }

diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 47085e5879abb57758601722bb62c7734380a254..a97c018dd41980ebc6a9087d235f7ee1fdc965b4 100644 (file)
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -281,7 +281,7 @@ static void cleanup(struct wdm_device *desc)
                          desc->sbuf,
                          desc->validity->transfer_dma);
        usb_free_coherent(interface_to_usbdev(desc->intf),
-                         desc->wMaxCommand,
+                         desc->bMaxPacketSize0,
                          desc->inbuf,
                          desc->response->transfer_dma);
        kfree(desc->orq);

diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index a7131ad630f9ad54535205017352ee10175df384..37518dfdeb987188089eb43c3147417ce14615a9 100644 (file)
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -802,7 +802,7 @@ static int proc_control(struct dev_state *ps, void __user *arg)
                                    tbuf, ctrl.wLength, tmo);
                usb_lock_device(dev);
                snoop_urb(dev, NULL, pipe, max(i, 0), min(i, 0), COMPLETE,
-                       tbuf, i);
+                         tbuf, max(i, 0));
                if ((i > 0) && ctrl.wLength) {
                        if (copy_to_user(ctrl.data, tbuf, i)) {
                                free_page((unsigned long)tbuf);

diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index fe99895fb098753bf5e88c3ab9cd0984c10fffc1..98ded66e8d3fc5ccfbe4bfd9170c51e99cf3b752 100644 (file)
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -315,7 +315,6 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
        int                     stopped;
        unsigned                count = 0;
        u8                      state;
-       const __le32            halt = HALT_BIT(ehci);
        struct ehci_qh_hw       *hw = qh->hw;
 
        if (unlikely (list_empty (&qh->qtd_list)))
@@ -422,7 +421,6 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
                                        && !(qtd->hw_alt_next
                                                & EHCI_LIST_END(ehci))) {
                                stopped = 1;
-                               goto halt;
                        }
 
                /* stop scanning when we reach qtds the hc is using */
@@ -456,16 +454,6 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
                                 */
                                ehci_clear_tt_buffer(ehci, qh, urb, token);
                        }
-
-                       /* force halt for unlinked or blocked qh, so we'll
-                        * patch the qh later and so that completions can't
-                        * activate it while we "know" it's stopped.
-                        */
-                       if ((halt & hw->hw_token) == 0) {
-halt:
-                               hw->hw_token |= halt;
-                               wmb ();
-                       }
                }
 
                /* unless we already know the urb's status, collect qtd status

diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c
index f7a2057380321fa7c102b140ce0bf2f4374e9db1..8b1d94a769140ca0ab6f9f6a082384b8725c9873 100644 (file)
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -177,12 +177,11 @@ static struct uss720_async_request *submit_async_request(struct parport_uss720_p
        spin_lock_irqsave(&priv->asynclock, flags);
        list_add_tail(&rq->asynclist, &priv->asynclist);
        spin_unlock_irqrestore(&priv->asynclock, flags);
+       kref_get(&rq->ref_count);
        ret = usb_submit_urb(rq->urb, mem_flags);
-       if (!ret) {
-               kref_get(&rq->ref_count);
+       if (!ret)
                return rq;
-       }
-       kref_put(&rq->ref_count, destroy_async);
+       destroy_async(&rq->ref_count);
        err("submit_async_request submit_urb failed with %d", ret);
        return NULL;
 }

diff --git a/drivers/usb/musb/blackfin.c b/drivers/usb/musb/blackfin.c
index 9d49d1cd7ce2308024fb7d2b7cc73538e00dd9cc..52312e8af213a4d0d6cdd515aa50757fd06bfa56 100644 (file)
--- a/drivers/usb/musb/blackfin.c
+++ b/drivers/usb/musb/blackfin.c
@@ -322,7 +322,7 @@ static void bfin_musb_try_idle(struct musb *musb, unsigned long timeout)
                mod_timer(&musb_conn_timer, jiffies + TIMER_DELAY);
 }
 
-static int bfin_musb_get_vbus_status(struct musb *musb)
+static int bfin_musb_vbus_status(struct musb *musb)
 {
        return 0;
 }
@@ -540,7 +540,7 @@ static struct dev_pm_ops bfin_pm_ops = {
        .resume         = bfin_resume,
 };
 
-#define DEV_PM_OPS     &bfin_pm_op,
+#define DEV_PM_OPS     &bfin_pm_ops
 #else
 #define DEV_PM_OPS     NULL
 #endif
@@ -548,7 +548,7 @@ static struct dev_pm_ops bfin_pm_ops = {
 static struct platform_driver bfin_driver = {
        .remove         = __exit_p(bfin_remove),
        .driver         = {
-               .name   = "musb-bfin",
+               .name   = "musb-blackfin",
                .pm     = DEV_PM_OPS,
        },
 };

diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 5c7b321d3959751f94281ab6cc2205e228bc142f..98519c5d8b5cc23e5407dac87a521004d8885f59 100644 (file)
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1880,12 +1880,12 @@ int usb_gadget_probe_driver(struct usb_gadget_driver *driver,
                if (retval < 0) {
                        DBG(1, "add_hcd failed, %d\n", retval);
                        goto err2;
-
-                       if ((musb->xceiv->last_event == USB_EVENT_ID)
-                                               && musb->xceiv->set_vbus)
-                               otg_set_vbus(musb->xceiv, 1);
                }
 
+               if ((musb->xceiv->last_event == USB_EVENT_ID)
+                                       && musb->xceiv->set_vbus)
+                       otg_set_vbus(musb->xceiv, 1);
+
                hcd->self.uses_pio_for_control = 1;
 
                if (musb->xceiv->last_event == USB_EVENT_NONE)

diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
index a65ddd5438693e7d235a190eb44f2f9ac163e534..e4fad5e643d74d6ab01995b0e84b9b53ea47fff7 100644 (file)
--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -698,8 +698,7 @@ static void play_delayed(struct usb_serial_port *port)
                        /* we have to throw away the rest */
                        do {
                                unbusy_queued_urb(urb, portdata);
-                               //extremely dirty
-                               atomic_dec(&port->serial->interface->dev.power.usage_count);
+                               usb_autopm_put_interface_no_suspend(port->serial->interface);
                        } while ((urb = usb_get_from_anchor(&portdata->delayed)));
                        break;
                }