Skip to content

L
linux
Switch branch/tag
  1. 30 Jun, 2010 4 commits
    • Sarah Sharp's avatar
      USB: xHCI: Fix bug in link TRB activation change. · 6cc30d85
      Sarah Sharp authored 
      Commit 6c12db90 introduced a bug for
control transfers.  The patch was supposed to change when the link TRBs at
the end of each ring segment were given to the hardware.  If a transfer
descriptor (TD) ended just before the link TRB, the code wouldn't give
back the link TRB to the hardware; instead it would be given back in
prepare_ring() just before the next TD was enqueued at the top of the
ring.

Unfortunately, the code relied on checking the chain bit of the TRB to
determine whether the TD ended just before the link TRB.  It assumed that
the ring enqueuing code would call prepare_ring() before enqueuing the
next TD.  However, control transfers are made of multiple TDs, and
prepare_ring() is only called once before enqueuing two or three TDs.

If the first or second TD of the control transfer ended just before the
link TRB, then the code in inc_enq() would not move the enqueue pointer
past the link TRB, and the link TRB would get overwritten.  This would
cause the xHCI driver to start writing to memory past the ring segment,
and eventually the system would crash or hang.

The fix is to add a flag to inc_enq() that says whether the caller will
enqueue more TDs before calling prepare_ring().  If the chain bit is
cleared (meaning this is the last TRB in a TD), and the caller will not
enqueue more TDs, then we defer giving back the link TRB.
Signed-off-by: default avatarSarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable <stable@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      6cc30d85
    • Michal Nazarewicz's avatar
      USB: gadget: g_fs: possible invalid pointer reference bug fixed · f588c0db
      Michal Nazarewicz authored 
      During __gfs_do_config() some invalid pointers may be left
in usb_configuration::interfaces array from previous calls
to the __gfs_do_config() for the same configuration.  This
will always happen if an user space function which has
a fewer then the last user space function registers itself.
Composite's set_config() function that a pointer after the
last interface in usb_configuration::interface is NULL
unless the array is full.

This patch makes the __gfs_do_config() make sure that if the
usb_configuration::interface is not full then a pointer
after the last interface is NULL.
Signed-off-by: default avatarMichal Nazarewicz <m.nazarewicz@samsung.com>
Signed-off-by: default avatarKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      f588c0db
    • Jon Povey's avatar
      USB: g_serial: fix tty cleanup on unload · b23097b7
      Jon Povey authored 
      Call put_tty_driver() in cleanup function, to fix Oops when trying to open
gadget serial char device after module unload.
Signed-off-by: default avatarJon Povey <jon.povey@racelogic.co.uk>
Acked-by: default avatarDavid Brownell <dbrownell@users.sourceforge.net>
Cc: stable <stable@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      b23097b7
    • Jon Povey's avatar
      USB: g_serial: don't set low_latency flag · 44a0c019
      Jon Povey authored 
      No longer set low_latency flag as it causes this warning backtrace:

  WARNING: at kernel/mutex.c:207 __mutex_lock_slowpath+0x6c/0x288()

Fix associated locking and wakeups.
Signed-off-by: default avatarJon Povey <jon.povey@racelogic.co.uk>
Cc: Maulik Mankad <x0082077@ti.com>
Cc: stable <stable@kernel.org>
Acked-by: default avatarDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      44a0c019
  3. 28 Jun, 2010 1 commit
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://neil.brown.name/md · 93416253
      Linus Torvalds authored 
      * 'for-linus' of git://neil.brown.name/md:
  md/raid5: don't include 'spare' drives when reshaping to fewer devices.
  md/raid5: add a missing 'continue' in a loop.
  md/raid5: Allow recovered part of partially recovered devices to be in-sync
  md/raid5: More careful check for "has array failed".
  md: Don't update ->recovery_offset when reshaping an array to fewer devices.
  md/raid5: avoid oops when number of devices is reduced then increased.
  md: enable raid4->raid0 takeover
  md: clear layout after ->raid0 takeover
  md: fix raid10 takeover: use new_layout for setup_conf
  md: fix handling of array level takeover that re-arranges devices.
  md: raid10: Fix null pointer dereference in fix_read_error()
  Restore partition detection of newly created md arrays.
      93416253
  5. 27 Jun, 2010 24 commits
  7. 26 Jun, 2010 8 commits
  9. 25 Jun, 2010 2 commits
  11. 24 Jun, 2010 1 commit
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7