From: Nico Huber <nico.h@gmx.de>

The receiver of my Logitech Cordeless Desktop fails to report the
keyboard's class descriptor most times I insert the usb-hid module since I
changed to linux 2.6.  The modell of the receiver is C-BD9-DUAL REV C.  The
request seems not to fail but the count of received characters is zero.

As I said it only fails most times, I worked around making the following
changes in drivers/usb/input/hid-core.c from linux-2.6.11-rc2:

Following the good example of drivers/usb/core/message.c line 575, I
initialized the buffer in hid_get_class_descriptor() to zero.  In the loop
of hid_get_class_descriptor() not waiting for any result but waiting for a
result wich is lower the requested size of the class descriptor (line
1290).  usb_hid_configure() should not try to parse the expected length but
the received (line 1653).

Attached is a patch with these changes
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Peter Bartosch wrote:
> Hello all,
>
>
> i think i found a possible buffer overflow in hid-core (2.6.10-rc2):

Agreed, and sorry it took so long to reply/patch this.
(from 2004-DEC-01)

> when i interpret this code right, the buffer (buf) will overflow when
> the iManufacturer stringlength is 0 and the iProduct stringlength
> is > 64!

Thanks, here's a patch for it.

Fix potential buffer overflow (by a device descriptor):
buf size is only 64 bytes.
Signed-off-by: Randy Dunlap <rddunlap@osdl.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

This removes the TIGLUSB-documentation, silverlink.txt.
Signed-off-by: Mikkel Krautz <krautz@gmail.com>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

This removes the TIGLUSB-maintainers from the MAINTAINERS-file.
Signed-off-by: Mikkel Krautz <krautz@gmail.com>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

This removes the tiusb boot-parameter from kernel-parameters.txt.
Signed-off-by: Mikkel Krautz <krautz@gmail.com>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

This patch updates the unusual_devs entry for the SCM multimedia card
adapter.  Apparently earlier versions of the device included wrong
descriptors but later versions did not.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

open takes the semaphore too late. This fixes it.
Signed-off-by: Oliver Neukum <oliver@neukum.name>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Add support for another AX8817x network device,
found in a docking station.

T:  Bus=01 Lev=02 Prnt=03 Port=00 Cnt=01 Dev#=  4 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=02(comm.) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1631 ProdID=6200 Rev= 0.01
S:  Manufacturer=goodway corp usb
S:  Product=gwusb2e
S:  SerialNumber=01
C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=450mA
I:  If#= 0 Alt= 0 #EPs= 3 Cls=00(>ifc ) Sub=00 Prot=00 Driver=(none)
E:  Ad=81(I) Atr=03(Int.) MxPS=   8 Ivl=128ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Signed-off-by: Olaf Hering <olh@suse.de>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

On Wed, 2005-01-19 at 15:39 -0800, John Mock wrote:
> New to 2.6.11-rc1 is that 'lsusb' exhibits 'endian' problems on the
> PowerMac.

Is that really new to 2.6.11-rc1? The kernel byte-swaps the bcdUSB,
idVendor, idProduct, and bcdDevice fields in the device descriptor. It
should probably swap them back before copying it up to userspace.

From: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

> > ----- Forwarded message from Andi Kleen <ak@suse.de> -----
> > Someone added an test for AMD 8111 in EHCI, returning
> > an error in reset.
> >
> > When triggered it would cause an NULL pointer oops because
> > it would usb_hcd_put an half initialized hcd without
> > initialized class.  I added a new usb_hcd_free function
> > to handle such half baked objects.

Andi's diagnosis is correct -- the embedded class_device was not fully
initialized -- but the solution is wrong.  The correct patch
is below.  This was clearly my fault, an error in driver-model
programming brought on by lack of documentation about which fields in the
driver-model structures need to be set for which API calls.  (Greg, long
ago I sent you a documentation patch to try and help remedy this problem,
but it seems to have fallen by the wayside.)
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

 When using custom baud rates, the code does:


        if ((new_serial.baud_base != priv->baud_base) ||
             (new_serial.baud_base < 9600))
                 return -EINVAL;

 Which translates to english as:

 	If you changed the baud-base, OR the new one is
 	invalid, return invalid.

 but it should be:

 	If you changed the baud-base, OR the new one is
 	invalid, return invalid.


From: Rogier Wolff <R.E.Wolff@harddisk-recovery.nl>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Remove code from platform independent code, which is not used
in Linux.
Signed-off-by: Armin Schindler <armin@melware.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Removed check for NULL pointer before doing vfree(), it's done in
vfree().
Signed-off-by: Armin Schindler <armin@melware.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch adds asm/uaccess.h to files which uses copy_to/from_user()
and adds the use of the drivers internal API call to copy_to/from_user()
in platform independent code.
Signed-off-by: Armin Schindler <armin@melware.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

reiserfs_file_write() casts its (size_t) count parameter to int, which can become
a problem on 64-bit architectures

This attempts to fix this by changing the variables dealing with count
and offset and the "min_t" comparisons to use "size_t" through-out.
Acked-by: Marcelo Tosatti <marcelo.tosatti@cyclades.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Acked-by: Marcelo Tosatti <marcelo.tosatti@cyclades.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Fix signedness and remove the now unnecessary cast.
Acked-by: Marcelo Tosatti <marcelo.tosatti@cyclades.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This adds BTFIXUPs needed for sparc32.
Signed-off-by: Tom 'spot' Callaway <tcallawa@redhat.com>
Acked-by: William Irwin <wli@holomorphy.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This replaces a K&R-style function definition with its ANSI counterpart.

This fixes a bug where attempting to remove the viocd module when no
virtual cdroms where actually present would cause an oops.  The driver
was not completing its initialisation in this case.
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into starflyer.(none):/foo/airlied/bitkeeper/drm-latest

into starflyer.(none):/foo/airlied/bitkeeper/drm-latest

The flush_tlb_kernel_range call in drm_memory.h was removed in 2003, so
there's no more reason for this #include.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Dave Airlie <airlied@linux.ie>

unify the initializer.
Signed-off-by: Dave Airlie <airlied@linux.ie>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into kernel.bkbits.net:/home/vojtech/for-linus

       value contains the page code in high 16 bits.
Signed-off-by: Vojtech Pavlik <vojtech@suse.cz>

into silver.ucw.cz:/home/vojtech/bk/input

into kernel.bkbits.net:/home/vojtech/for-linus

into kernel.bkbits.net:/home/vojtech/for-linus

Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

same story as for amd64 - ptr_to_compat() + normal __user annotations
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

 * new helper - ptr_to_compat(); inverse to compat_ptr(), with proper
   typechecking.  A lot of open-coded equivalents replaced with using
   that one.
 * a couple of severely misguiding places got back to sanity - we had
   basically
	put_user((long)p, &foo->compat_uptr_t_field);

That will, of course, cast (long)p further - to u32, but that fact is
carefully obfuscated...  Sanitized by replacing (long)p in such places
with ptr_to_compat(p); fortunately, there hadn't been many of those...
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

OK, #/* <multiline comment block> */ is legitimate C, but WTF had
these guys been smoking?
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>