| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6:
serial: cpm_uart: implement the cpm_uart_early_write() function for console poll
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6
* 'omap-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6:
OMAP: hwmod: Fix the missing braces
OMAP4: clock: Fix multi-omap boot with reset un-used clocks
OMAP3: PM: fix IO daisy chain enable to use PM_WKEN reg
omap: GPIO: fix auto-disable of debounce clock
omap: DMTIMER: Ack pending interrupt always when stopping a timer
omap: Stalker board: switch over to gpio_set_debounce
omap: fix build failure due to missing include dma-mapping.h
omap iommu: Fix Memory leak
|
|
As discussed with Mike Reed, add him as the maintainer of the qla1280
driver as I no longer have any hardware and he is actively looking
after it.
Signed-off-by: Jes Sorensen <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
|
|
futex_find_get_task is currently used (through lookup_pi_state) from two
contexts, futex_requeue and futex_lock_pi_atomic. None of the paths
looks it needs the credentials check, though. Different (e)uids
shouldn't matter at all because the only thing that is important for
shared futex is the accessibility of the shared memory.
The credentail check results in glibc assert failure or process hang (if
glibc is compiled without assert support) for shared robust pthread
mutex with priority inheritance if a process tries to lock already held
lock owned by a process with a different euid:
pthread_mutex_lock.c:312: __pthread_mutex_lock_full: Assertion `(-(e)) != 3 || !robust' failed.
The problem is that futex_lock_pi_atomic which is called when we try to
lock already held lock checks the current holder (tid is stored in the
futex value) to get the PI state. It uses lookup_pi_state which in turn
gets task struct from futex_find_get_task. ESRCH is returned either
when the task is not found or if credentials check fails.
futex_lock_pi_atomic simply returns if it gets ESRCH. glibc code,
however, doesn't expect that robust lock returns with ESRCH because it
should get either success or owner died.
Signed-off-by: Michal Hocko <[email protected]>
Acked-by: Darren Hart <[email protected]>
Cc: Ingo Molnar <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: Nick Piggin <[email protected]>
Cc: Alexey Kuznetsov <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
|
|
When two systems using bonding devices in adaptive load
balancing (ALB) communicates with each other, an endless
ping-pong of ARP replies starts between these two systems.
What happens? In the ALB mode, bonding driver keeps track
of each client connected in a hash table, so it can do the
receive load balancing (RLB). This hash table is updated
when an ARP reply is received, then it scans for the client
entry, updates its MAC address and flag it to be announced
later. Therefore, two seconds later, the alb monitor runs
and send for each updated client entry two ARP replies
updating this specific client. The same process happens on
the receiving system, causing the endless ping-pong of arp
replies.
See more information including the relevant functions below:
System 1 System 2
bond0 bond0
ping <system2>
ARP request --------->
<--------- ARP reply
+->rlb_arp_recv <---------------------+ <--- loop begins
| rlb_update_entry_from_arp |
| client_info->ntt = 1; |
| bond_info->rx_ntt = 1; |
| |
| <communication succeed> |
| |
| bond_alb_monitor |
| rlb_update_rx_clients |
| rlb_update_client |
| arp_create(ARPOP_REPLY) |
| send ARP reply --------------> V
| send ARP reply -------------->
| rlb_arp_recv
| rlb_update_entry_from_arp
| client_info->ntt = 1;
| bond_info->rx_ntt = 1;
| < snipped, same as in system 1>
+------- <-------------- send ARP reply
<-------------- send ARP reply
Besides the unneeded networking traffic, this loop breaks
a cluster because a backup system can't take over the IP
address. There is always one system sending an ARP reply
poisoning the network.
This patch fixes the problem adding a check for the MAC
address before updating it. Thus, if the MAC address didn't
change, there is no need to update neither to announce it later.
Signed-off-by: Flavio Leitner <[email protected]>
Signed-off-by: Jay Vosburgh <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
Fix abuse of the preincrement operator as detected when building with gcc
4.6.0:
CC [M] drivers/bluetooth/hci_bcsp.o
drivers/bluetooth/hci_bcsp.c: In function 'bcsp_prepare_pkt':
drivers/bluetooth/hci_bcsp.c:247:20: warning: operation on 'bcsp->msgq_txseq' may be undefined
Reported-by: Justin P. Mattock <[email protected]>
Signed-off-by: David Howells <[email protected]>
Acked-by: Gustavo F. Padovan <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
Some controllers (KW, Dove) limits the TX IP/layer4 checksum offloading to a max size.
Signed-off-by: Saeed Bishara <[email protected]>
Acked-by: Lennert Buytenhek <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
|
|
Typo in down_spin() meant it only read the low 32 bits of the
"serve" value, instead of the full 64 bits. This results in the
system hanging when the values in ticket/serve get larger than
32-bits. A big enough system running the right test can hit this
in a just a few hours.
Broken since 883a3acf5b0d4782ac35981227a0d094e8b44850
[IA64] Re-implement spinaphores using ticket lock concepts
Reported via IRC by Bjorn Helgaas
Signed-off-by: Tony Luck <[email protected]>
|
|
Determine the size of the xfrm_mark struct, not of its pointer.
Signed-off-by: Andreas Steffen <[email protected]>
Acked-by: Jamal Hadi Salim <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
|
|
Add another device ID as listed in the vendor driver version
0003.0825.2009.
Signed-off-by: Ben Hutchings <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Signed-off-by: Ben Hutchings <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Add device id for Zyxel NWD-270N USB dongle.
Signed-off-by: Ozan Çağlayan <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
There are only 6 elements in the cb_pcidda_boards[] array so the
original code read past the end. After this change nothing uses N_BOARDS
so I removed the definition.
Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
This patch adds some device ids.
The list of supported devices was extracted from realteks driver package.
(0x050d, 0x815F) and (0x0df6, 0x004b) are not in the official list of
supported devices and may not work correctly.
In case of problems with these, they should probably be removed from the list.
Signed-off-by: Florian Schilhabel <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
This patch removes some device-ids.
The list of unsupported devices was extracted from realteks driver package.
removed IDs are:
(0x0bda, 0x8192)
(0x0bda, 0x8709)
(0x07aa, 0x0043)
(0x050d, 0x805E)
(0x0df6, 0x0031)
(0x1740, 0x9201)
(0x2001, 0x3301)
(0x5a57, 0x0290)
These devices are _not_ rtl819su based.
Signed-off-by: Florian Schilhabel <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
In commit bbfb5652, the spacing in the definitions of eqMacAddr and cpMacAddr
in drivers/staging/rtl8187se/r8180_core.c were changed to conform to kernel
standards. These definitions were duplicates of lines found in
drivers/staging/rtl8187se/ieee80211/dot11d.h. Once the change was made, the
following warnings were emitted:
CC [M] drivers/staging/rtl8187se/r8180_core.o
drivers/staging/rtl8187se/r8180_core.c:69:0: warning: "eqMacAddr" redefined
drivers/staging/rtl8187se/ieee80211/dot11d.h:39:0: note: this is the location of the previous definition
drivers/staging/rtl8187se/r8180_core.c:70:0: warning: "cpMacAddr" redefined
drivers/staging/rtl8187se/ieee80211/dot11d.h:40:0: note: this is the location of the previous definition
The fix is to keep only the difinition in the header file.
Signed-off-by: Larry Finger <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
I got a wlags49_h2 driver build error in linux-next when CONFIG_SYSFS is not set.
CC [M] drivers/staging/wlags49_h2/wl_cs.o
In file included from drivers/staging/wlags49_h2/wl_cs.c:104:
drivers/staging/wlags49_h2/wl_sysfs.h: In function ‘register_wlags_sysfs’:
drivers/staging/wlags49_h2/wl_sysfs.h:5: error: parameter name omitted
drivers/staging/wlags49_h2/wl_sysfs.h: In function ‘unregister_wlags_sysfs’:
drivers/staging/wlags49_h2/wl_sysfs.h:6: error: parameter name omitted
make[1]: *** [drivers/staging/wlags49_h2/wl_cs.o] Error 1
make: *** [_module_drivers/staging/wlags49_h2] Error 2
This is due a wrong function definition (it does not include parameters names).
Signed-off-by: Javier Martinez Canillas <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
On ia64, the build fails with incompatible implicit definition of strlen.
This patch adds the <linux/string.h> include to get the real prototype.
Signed-off-by: Jeff Mahoney <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Added autoloading based on pci id and dmi strings.
Signed-off-by: Haiyang Zhang <[email protected]>
Signed-off-by: Hank Janssen <[email protected]>
Cc: stable <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
There is a possible race condition when hv_utils starts to load immediately
after hv_vmbus is loading - null pointer error could happen.
This patch added wait/completion to ensure all channels are ready before
vmbus loading completes. So another module won't have any uninitialized channel.
Signed-off-by: Haiyang Zhang <[email protected]>
Signed-off-by: Hank Janssen <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
I received a report that AI streaming acquisitions do not work properly
for the adl_pci9111 driver when convert_src is TRIG_TIMER and
scan_begin_src is TRIG_FOLLOW (and scan_begin_arg is therefore 0). This
seems to be down to the incorrect setting of dev_private->scan_delay in
pci9111_ai_do_cmd(). Under the previously stated conditions,
dev_private->scan_delay ends up set to (unsigned int)-1, but it ought to
be set to 0. The function sets it to 0 initially, and it only makes
sense to change it if both convert_src and scan_begin_src are set to
TRIG_TIMER.
Note: 'scan_delay' is the number of unwanted scans to discard after each
valid scan. The hardware does not support 'scan' timing as such, just a
regularly paced conversion timer (with automatic channel switching
between conversions). The driver simulates a scan period that is some
(>1) multiple of the conversion period times the scan length
(chanlist_len samples) by reading chanlist_len samples and discarding
the next scan_delay times chanlist_len samples.
Signed-off-by: Ian Abbott <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
I moved the kfree() down a couple lines after the dereference.
Signed-off-by: Dan Carpenter <[email protected]>
Acked-by: Alan Cox <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
In today linux-next I got a compile warning in staging/batman-adv.
This is due a struct bin_attribute read function prototype change and the driver was not updated.
This patch solves the issue
Signed-off-by: Javier Martinez Canillas <[email protected]>
Signed-off-by: Sven Eckelmann <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
copy_to_user() returns the number of bites remaining but we want to
return a negative error code here.
Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Sven Eckelmann <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Signed-off-by: Himanshu Chauhan <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
On fsg_unbind the common->fsg pointer was not NULLed if the
unbound fsg_dev instance was the current one. As an effect,
the incorrect pointer was preserved in all further operations
which caused do_set_interface to reference an invalid region.
This commit fixes this by raising an exception in fsg_bind
which will change the common->fsg pointer. This also requires
an wait queue so that the thread in fsg_bind can wait till the
worker thread handles the exception.
This commit removes also a config and new_config fields of
fsg_common as they are no longer needed since fsg can be
used to determine whether function is active or not.
Moreover, this commit removes possible race condition where
the fsg field was modified in both the worker thread and
form various other contexts. This is fixed by replacing
prev_fsg with new_fsg. At this point, fsg is assigned only
in worker thread.
Signed-off-by: Michal Nazarewicz <[email protected]>
Cc: Kyungmin Park <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
The full speed descriptors were copied to the usb_function structure
in the fsg_bind_config function before call to the usb_ep_autoconfig.
The usb_ep_autoconfig was called in fsg_bind using the original
descriptors. In effect copied descriptors were not updated.
This patch changes the copy full speed descriptors after the call to
usb_op_autoconfig is performed. This way, copied full speed
descriptors have updated values.
Signed-off-by: Michal Nazarewicz <[email protected]>
Cc: Kyungmin Park <[email protected]>
Reported-by: Dries Van Puymbroeck <[email protected]>
Tested-by: Dries Van Puymbroeck <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Setting MUSB Burst Mode 3 automatically enables support for
lower burst modes (BURST4, BURST8, BURST16 or bursts of unspecified
length). There is no need to set these burst modes based on the
packet size. Also enable the burst mode for both mode1 and mode0.
This is a fix for buggy hardware - having the lower burst modes
enabled can potentially cause lockups of the DMA engine used in
OMAP2/3/4 chips.
Signed-off-by: Hema HK <[email protected]>
Signed-off-by: Anand Gadiyar <[email protected]>
Signed-off-by: Ajay Kumar Gupta <[email protected]>
Acked-by: Felipe Balbi <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
The new ulpi code defines fallback stubs for the Blackfin arch, but does
so incorrectly leading to a build failure:
drivers/usb/musb/musb_core.c:227: error: 'musb_ulpi_read' undeclared here (not in a function)
drivers/usb/musb/musb_core.c:228: error: 'musb_ulpi_write' undeclared here (not in a function)
Tweak the fallback stubs so that they do work as intended.
Signed-off-by: Mike Frysinger <[email protected]>
Signed-off-by: Ajay Kumar Gupta <[email protected]>
Acked-by: Felipe Balbi <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Attempt to build MUSB driver with CONFIG_PM=y (e.g. in the OTG mode) on DaVinci
results in these link errors:
drivers/built-in.o: In function `musb_restore_context':
led-triggers.c:(.text+0x714d8): undefined reference to
`musb_platform_restore_context'
drivers/built-in.o: In function `musb_save_context':
led-triggers.c:(.text+0x71788): undefined reference to
`musb_platform_save_context'
This turned out to be caused by commit 9957dd97ec5e98dd334f87ade1d9a0b24d1f86eb
(usb: musb: Fix compile error for omaps for musb_hdrc). Revert it, taking into
account the rename of CONFIG_ARCH_OMAP34XX into CONFIG_ARCH_OMAP3 (which that
commit fixed in a completely inappropriate way) and the recent addition of
OMAP4 support.
Signed-off-by: Sergei Shtylyov <[email protected]>
Signed-off-by: Ajay Kumar Gupta <[email protected]>
Acked-by: Felipe Balbi <[email protected]>
Cc: stable <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Commit 1c25fda4a09e8229800979986ef399401053b46e (usb: musb: handle irqs in the
order dictated by programming guide) forgot to get rid of the old 'STAGE0_MASK'
filter for calling musb_stage0_irq(), so now disconnect and suspend interrupts
are effectively ignored...
Signed-off-by: Sergei Shtylyov <[email protected]>
Cc: stable <[email protected]>
Signed-off-by: Ajay Kumar Gupta <[email protected]>
Acked-by: Felipe Balbi <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
This patch (as1403) is a partial reversion of an earlier change
(commit 5f677f1d45b2bf08085bbba7394392dfa586fa8e "USB: fix remote
wakeup settings during system sleep"). After hearing from a user, I
realized that remote wakeup should be enabled during system sleep
whenever userspace allows it, and not only if a driver requests it
too.
Indeed, there could be a device with no driver, that does nothing but
generate a wakeup request when the user presses a button. Such a
device should be allowed to do its job.
The problem fixed by the earlier patch -- device generating a wakeup
request for no reason, causing system suspend to abort -- was also
addressed by a later patch ("USB: don't enable remote wakeup by
default", accepted but not yet merged into mainline). The device
won't be able to generate the bogus wakeup requests because it will be
disabled for remote wakeup by default. Hence this reversion will not
re-introduce any old problems.
Signed-off-by: Alan Stern <[email protected]>
Cc: stable <[email protected]> [.34]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
CRC should be calculated for Ethernet frame, not for whole recievede EEM data.
This bug shows rarely, because in many times len == skb->len.
Signed-off-by: Jiri Pinkava <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
This patch adds missing kfree(data) before return -ENODEV.
Signed-off-by: Axel Lin <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Stanse found that sleep is called inside atomic context created by
lock_printer_io spinlock in several functions. It's used in process
context only and some functions sleep inside its critical section. As
this is not allowed for spinlocks, switch it to mutex.
Signed-off-by: Jiri Slaby <[email protected]>
Cc: Craig W. Nadler <[email protected]>
Acked-by: David Brownell <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Stanse found that isp1362_sw_reset tries to take a isp1362_hcd->lock,
but it is already held in isp1362_hc_stop. Avoid that by introducing
__isp1362_sw_reset which doesn't take the lock and call it from
isp1362_hc_stop. isp1362_sw_reset is then as simple as lock --
__isp1362_sw_reset -- unlock.
Signed-off-by: Jiri Slaby <[email protected]>
Cc: Lothar Wassmann <[email protected]>
Cc: Michael Hennerich <[email protected]>
Cc: Bryan Wu <[email protected]>
Cc: Mike Frysinger <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
This patch corrects a problem with the merge of a previous
patch to add the CONTEC identifier.
I believe the merge problem occurred with the commit:
dee5658b482e9e2ac7d6205dc876fc11d4008138
Originally I submitted a patch and then they asked me to order the IDs
and resubmit, so did I. But unfortunately in the end somehow both
patches were merged.
Signed-off-by: Daniel Sangorrin <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
This patch (as1401) fixes a bug in usb_sg_init() that can cause an
invalid pointer dereference. An inner loop reuses some local variables
in an unsafe manner, so new variables are introduced.
Signed-off-by: Alan Stern <[email protected]>
Tested-by: Ajay Kumar Gupta <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Gadget disconnect must be called before unbinding to avoid races.
The change fixes an oops on g_ether module unregistering.
Signed-off-by: Vladimir Zapolskiy <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
The old code registered the hcd even if there were no transceivers
detected, leading to oopses like this if we try to probe a non-existant
ULPI:
[ 2.730000] mxc-ehci mxc-ehci.0: unable to init transceiver
[ 2.740000] timeout polling for ULPI device
[ 2.740000] timeout polling for ULPI device
[ 2.750000] mxc-ehci mxc-ehci.0: unable to enable vbus on transceiver
[ 2.750000] mxc-ehci mxc-ehci.0: Freescale On-Chip EHCI Host Controller
[ 2.760000] mxc-ehci mxc-ehci.0: new USB bus registered, assigned bus number 2
[ 2.770000] Unhandled fault: external abort on non-linefetch (0x808) at 0xc4876184
[ 2.770000] Internal error: : 808 [#1] PREEMPT
[ 2.770000] last sysfs file:
[ 2.770000] Modules linked in:
[ 2.770000] CPU: 0 Not tainted (2.6.33.5 #5)
[ 2.770000] PC is at ehci_hub_control+0x4d4/0x8f8
[ 2.770000] LR is at ehci_mxc_setup+0xbc/0xdc
[ 2.770000] pc : [<c0196dfc>] lr : [<c019bc8c>] psr: 00000093
[ 2.770000] sp : c3815e40 ip : 00000001 fp : 60000013
[ 2.770000] r10: c4876184 r9 : 00000000 r8 : c3814000
[ 2.770000] r7 : c391d2cc r6 : 00000001 r5 : 00000001 r4 : 00000000
[ 2.770000] r3 : 80000000 r2 : 00000007 r1 : 80000000 r0 : c4876184
[ 2.770000] Flags: nzcv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel
[ 2.770000] Control: 0005317f Table: a0004000 DAC: 00000017
[ 2.770000] Process swapper (pid: 1, stack limit = 0xc3814270)
...
Signed-off-by: Wolfram Sang <[email protected]>
Cc: Sascha Hauer <[email protected]>
Cc: stable <[email protected]>
Acked-by: Daniel Mack <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
otg_read may return errnos, so bail out correctly to prevent bogus
ID-numbers.
Signed-off-by: Wolfram Sang <[email protected]>
Cc: Sascha Hauer <[email protected]>
Acked-by: Daniel Mack <[email protected]>
Cc: stable <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
As a part of aligning the ISR code for MUSB with the specs, the
ISR code was re-written.
See Commit 1c25fda4a09e8229800979986ef399401053b46e (usb: musb: handle
irqs in the order dictated by programming guide)
With this the suspend interrupt came accidently under CONFIG_USB_MUSB_HDRC_HCD.
The fix brings suspend interrupt handling outside
CONFIG_USB_MUSB_HDRC_HCD.
Signed-off-by: Maulik Mankad <[email protected]>
Cc: David Brownell <[email protected]>
Acked-by: Felipe Balbi <[email protected]>
Cc: stable <[email protected]> [.34]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
In the change by 749da5f82fe33ff68dd4aa1a5e35cd9aa6246dab,
The change in the status when the USB device is connected is wrong.
Therefore, the device is not recognized.
Acked-by: Alan Stern <[email protected]>
CC: Yoshihiro Shimoda <[email protected]>
CC: Paul Mundt" <[email protected]>
Signed-off-by: Nobuhiro Iwamatsu <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Commit 6c12db90f19727c76990e7f4801c67a148b30111 introduced a bug for
control transfers. The patch was supposed to change when the link TRBs at
the end of each ring segment were given to the hardware. If a transfer
descriptor (TD) ended just before the link TRB, the code wouldn't give
back the link TRB to the hardware; instead it would be given back in
prepare_ring() just before the next TD was enqueued at the top of the
ring.
Unfortunately, the code relied on checking the chain bit of the TRB to
determine whether the TD ended just before the link TRB. It assumed that
the ring enqueuing code would call prepare_ring() before enqueuing the
next TD. However, control transfers are made of multiple TDs, and
prepare_ring() is only called once before enqueuing two or three TDs.
If the first or second TD of the control transfer ended just before the
link TRB, then the code in inc_enq() would not move the enqueue pointer
past the link TRB, and the link TRB would get overwritten. This would
cause the xHCI driver to start writing to memory past the ring segment,
and eventually the system would crash or hang.
The fix is to add a flag to inc_enq() that says whether the caller will
enqueue more TDs before calling prepare_ring(). If the chain bit is
cleared (meaning this is the last TRB in a TD), and the caller will not
enqueue more TDs, then we defer giving back the link TRB.
Signed-off-by: Sarah Sharp <[email protected]>
Cc: stable <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
During __gfs_do_config() some invalid pointers may be left
in usb_configuration::interfaces array from previous calls
to the __gfs_do_config() for the same configuration. This
will always happen if an user space function which has
a fewer then the last user space function registers itself.
Composite's set_config() function that a pointer after the
last interface in usb_configuration::interface is NULL
unless the array is full.
This patch makes the __gfs_do_config() make sure that if the
usb_configuration::interface is not full then a pointer
after the last interface is NULL.
Signed-off-by: Michal Nazarewicz <[email protected]>
Signed-off-by: Kyungmin Park <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Call put_tty_driver() in cleanup function, to fix Oops when trying to open
gadget serial char device after module unload.
Signed-off-by: Jon Povey <[email protected]>
Acked-by: David Brownell <[email protected]>
Cc: stable <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
No longer set low_latency flag as it causes this warning backtrace:
WARNING: at kernel/mutex.c:207 __mutex_lock_slowpath+0x6c/0x288()
Fix associated locking and wakeups.
Signed-off-by: Jon Povey <[email protected]>
Cc: Maulik Mankad <[email protected]>
Cc: stable <[email protected]>
Acked-by: David Brownell <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
The cpm_uart_early_write() function which was used for console poll
isn't implemented in the cpm uart driver.
Implementing this function both fixes the build when CONFIG_CONSOLE_POLL
is set and allows kgdboc to work via the cpm uart.
Signed-off-by: Dongdong Deng <[email protected]>
Reviewed-by: Bruce Ashfield <[email protected]>
Cc: stable <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
|
|
Variables given on the make commandline are not exported to $(shell
...) commands, so run the setlocalversion script in the make rule
directly.
Signed-off-by: Michal Marek <[email protected]>
|