this fixes
- a leak in the error code path of open()
- removes SLAB_ATOMIC where it isn't needed
- uses le16_to_cpu (yes Pete, unaligned access is taken care of)

- don't pass buffers allocated on stack to the sync helpers
- check errors in probe
- fix count in open
- proper macros

This patch makes the usb-midi driver use usb_ifnum_to_if(), thereby
removing assumptions about which interface is stored in which array entry.
Similarly, it stores the bAlternateSetting value rather than the array
index for an altsetting entry.

Like the earlier patch for the audio driver, this also changes the driver
to use the in-memory rawdescriptor buffer rather than reading a
configuration descriptor from the device.  Unlike that earlier patch, this
time there's no question that the deallocation of the buffer is done
correctly.  (I suspect the audio driver just left out a call to kfree.)

you forgot to drop a spinlock before you report an error. A deadlock
will occur.

Arghh - while trying to follow this I just realized the pl2303 is DMA'ing
to the stack - not good!
Could you please just try with the patch below. I'm not sure if this might
cause the MA620 trouble but it's definedly a bug and maybe it improves
things for you...

Marc-Christian Petersen wrote:
>
> I think the attached patch is needed to stop showing us USB Gadget support if
> Support for USB is disabled.

No it isn't.  But maybe the attached patch would clarify what's
really going on:  CONFIG_USB is the host side, and CONFIG_USB_GADGET
is the peripheral side.

Somehow I sent you a version of this code with a misplaced
semicolon ... it makes for awkward failures!

Please merge.  Bad semicolon!

Some of the 480 Mbit/sec USB host-to-host links have ALI
chips in them.  They seem to work with no problem, given
this patch, even when the ends talk different speed.

a few more IDs added, could you please apply it?

We have rewritten the brlvger (Tieman Voyager USB Braille display) driver
so that it works from user-space through usbfs. It appears to work just as
well as the in-kernel driver.

The brlvger driver in the 2.6.x kernel is now obsolete and should be
removed. The attached patch against 2.6.3 does this. Please apply.
NB: The following files are completely deleted:
    Documentation/usb/brlvger.txt
    drivers/usb/misc/brlvger.c
    include/linux/brlvger.h

The new Voyager driver is available (stil under GPL) as part of BRLTTY,
starting with version 3.5pre1 (http://mielke.cc/brltty).
Thanks to Dave Mielke who implemented BRLTTY's usbfs functionality, among
lots of other stuff.

On Mon, 8 Mar 2004, Greg KH wrote:

> Oh, could you look at drivers/isdn/hisax/hfc_usb.c if you get a chance?
> I tried to figure out the mess there with regards to act_altsetting, but
> gave up :(

You're right, it is a mess.  Beats me why they didn't use a plain old
"for" statement to do that altsetting loop.  Probably the most confusing
part is where the code needlessly resets intf->act_altsetting.

Anyway, this patch sets things right.  I haven't tried to compile it, but
any errors ought to be pretty small, obvious, and easy to fix.

My intention was to go through the files under driver/usb (in alphabetical
order!) and then do the ones outside that subtree -- I've got a little
list.  But it's no problem to take care of this one first.

Some systems don't save the internal state of the UHCI registers across a
PM suspend/resume cycle very well.  This patch saves & restores the
Frame Number and the Framelist Base Address registers (in addition to the
Interrupt Enable register, which was added separately in a recent patch.)

This patch updates the USB audio class driver to use the usb_ifnum_to_if()
and usb_altnum_to_altsetting() routines, thereby removing assumptions
about which interface or altsetting is stored in which array entry.

It also simplifies the driver's probe() routine by using the raw
configuration descriptor already loaded into memory instead of reading the
descriptor from the device.  Now, either the current driver has a bug and
never deallocates the buffer used to hold the descriptor, or else I've
introduced a double-free error.  There's no obvious place where the buffer
gets freed, but it's hard to be certain.

It would be good if someone could try out this patch.  I can't test it,
not having any USB audio devices handy.  If the double-free error is
present, it will show up when the device is disconnected and the
configuration data is released.

This patch makes the necessary updates to the bluetty, cdc-acm, and usblp
class drivers for the new interface/altsetting paradigm.  The changes are
quite small.

Unfortunately, the audio and usb-midi drivers are in much worse shape.
They will require more in-depth hacking, to come later...

The attached patch updates wanXL card driver. Please apply to Linux 2.6.
Thanks.

Changes:
* fixed initialization kernel panic, introduced with recent alloc_netdev()
  wan patch,
* wanxl_rx_intr() port# now checked before accessing port structure,
* cleanups etc.
--
Krzysztof Halasa, B*FH

* Add National DP83840 PHY rev b/c setup.  Only rev a was being setup.

From: Joe Perches <joe@perches.com>

Use %08llx for a dma_addr_t, not the recently-added %llx.

The carmel driver will want to use this rather
than muck around in queue internals directly.

Declarations come before statements, please.

Current gcc warns about this too, bless them:

crypto/arc4.c: In function `arc4_crypt':
crypto/arc4.c:65: warning: ISO C90 forbids mixed declarations and code

From: Zwane Mwaikambo <zwane@linuxpower.ca>

It looks like a block request snuck through before we had initialised the
motor_off_timer timers.  So I pushed the timer init earlier.

From: Marc-Christian Petersen <m.c.p@wolk-project.de>

OSS Sound Driver Forte needs ac97_codec.

drivers/i2c/busses/i2c-elv.c: In function `i2c_bitelv_init':

drivers/i2c/busses/i2c-elv.c:155: warning: unsigned int format, long int arg (arg 2)
drivers/i2c/busses/i2c-elv.c:155: warning: unsigned int format, long int arg (arg 2)
drivers/i2c/busses/i2c-velleman.c: In function `i2c_bitvelle_init':
drivers/i2c/busses/i2c-velleman.c:141: warning: unsigned int format, long int arg (arg 2)
drivers/i2c/busses/i2c-velleman.c:141: warning: unsigned int format, long int arg (arg 2)

From: David Joerg <davidjoerg@web.de>

Fix the description of the IO ports for the IDE primary and secondary
interfaces.

From: Aneesh Kumar KV <aneesh.kumar@digital.com>

We need to set the tasks's exit code prior to waking it, not afterwards.

Acked by rth.

Dave Kleikamp <shaggy@austin.ibm.com> points out a race between
nobh_prepare_write() and end_buffer_read_sync().  end_buffer_read_sync()
calls unlock_buffer(), waking the nobh_prepare_write() thread, which
immediately frees the buffer_head.  end_buffer_read_sync() then calls
put_bh() which decrements b_count for the already freed structure.  The
SLAB_DEBUG code detects the slab corruption.

We fix this by giving nobh_prepare_write() a private buffer_head end_o
handler which doesn't touch the buffer's contents after unlocking it.

From: Eric Sandeen <sandeen@sgi.com>

Several functions in buffer.c are using unsigned long where they should be
using sector_t.

Also, use pgoff_t in several places so it is easier to tell what is beingused
as a pagecache index, what is being used as a disk index and what is being
used as an offset-into-page.

If a large pci_alloc_consistent() GFP_ATOMIC allocation fails this driver's
recovery code will call emu10k1_wavein_close() far earlier than it should: it
goes splat in emu10k1_timer_uninstall().

Fix it by simply removing that call: we haven't allocated any resources yet
anyway.

Note that one of the callers of emu10k1_wavein_open(), emu10k1_audio_read()
will sit there stupidly retrying the open.  But it has a sleep in there so
something might eventually give way.

From: Markus Lidel <Markus.Lidel@shadowconnect.com>

drivers/message/i2o/i2o_block.c:

 - corrected the initialization sequence of the request queues.

 - added initialization to queue spinlocks.

 - release device in i2o_scan because else the device could not be queried.

 - i2o_block event threads wait on signal KILL but signal TERM was sent.

drivers/message/i2o/i2o_core.c:

 - set the HRT length to 0 at initialization, to avoid calling free on
   unallocated memory.

 - i2o_core event threads wait on signal KILL but signal TERM was sent.

 - added a limit of 3 tries to get the HRT from the controller.

 - removed the dpt parameter, which was used to force DPT controllers get
   handled by the i2o driver.  Now all available i2o controllers will be
   handled by this driver.

drivers/message/i2o/i2o_scsi.c:

 - beautifying of printk calls.

 - added scsi_unregister to properly clean up on module unload.

drivers/message/i2o/Kconfig:

 - added help for i2o_block and i2o_scsi to describe the differences between
   the two drivers.

include/linux/i2o-dev.h:

 - cleaned typo "tate" into "state".

include/linux/i2o.h:

 - removed defines from i2o_block and insert it here.

(Acked by Alan)

From: Gerd Knorr <kraxel@bytesex.org>

This patch fixes a bug in the v4l1-compat module and makes it pass the
correct buffer type to the v4l2 driver on VIDIOC_STREAM(ON|OFF) ioctls.

From: Arjan van de Ven <arjanv@redhat.com>

From: Chris Mason <mason@suse.com>

find_group_other looks buggy for ext2 and ext3 in 2.6, it can cause -ENOSPC
errors when the fs has plenty of free room.

To hit the bug, you need a filesystem where:

parent_group has no free blocks (but might have free inodes) Every other
group with free inodes has no free blocks.

That gets you down to the final linear search in find_group_other.  The
linear search has two bugs:

group = parent_group + 1; means we start searching at parent_group + 2
because the loop increments group before using it.

for(i = 2 ; i < ngroups ; i++) means we don't search through all the
groups.

The end result is that parent_group and parent_group + 1 are not checked
for free inodes in the final linear search.  ext3 has the same problem.

From: Andreas Kies <andikies@t-online.de>

Fix improperly handled 16 bit sample size.  If you use an odd number of
bytes in 16 bit mode the driver fails to work.

In file included from drivers/misc/ibmasm/uart.c:27:
include/linux/serial_core.h: In function `uart_handle_dcd_change':
include/linux/serial_core.h:407: `TASK_INTERRUPTIBLE' undeclared (first use in this function)

From: Christoph Hellwig <hch@lst.de>

sleep_on hurts my eyes and this offender is compltely unused, so..

From: Arnd Bergmann <arnd@arndb.de>

This use of deprecated struct initializers was hidden behind macro magic
and has appearantly not been noticed before.