1. 18 Nov, 2009 7 commits
    • Alan Stern's avatar
      USB: usbmon: fix bug in mon_buff_area_shrink · fca94748
      Alan Stern authored
      This patch (as1299b) fixes a bug in an error-handling path of usbmon's
      binary interface.  The storage area for URB data is divided into
      fixed-size blocks.  If an URB's data can't be copied, the area
      reserved for it should be decreased to the size of the truncated
      information (rounded up to a block boundary).  Rounding up the amount
      to be removed and subtracting it from the reserved size is definitely
      the wrong thing to do.
      
      Also, when the data for an isochronous URB can't be copied, we can
      still copy the isoc packet descriptors.  In fact the current code does
      copy the descriptors, but then sets the capture length to 0 so they
      remain inaccessible.  The capture length should be reduced to the
      length of the descriptors, not set to 0.
      Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
      Acked-by: default avatarPete Zaitcev <zaitcev@redhat.com>
      CC: stable <stable@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      fca94748
    • Sarah Sharp's avatar
      USB: xhci: Fix scratchpad deallocation. · 5294bea4
      Sarah Sharp authored
      The scratchpad_free() function uses xhci->page_size to free some memory
      with pci_free_consistent().  However, the page_size is set to zero before
      the call, causing kernel oopses on driver unload.  Call scratchpad_free()
      before setting xhci->page_size to zero.
      Signed-off-by: default avatarSarah Sharp <sarah.a.sharp@linux.intel.com>
      Acked-by: default avatarJohn Youn <John.Youn@synopsys.com>
      Cc: stable <stable@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      5294bea4
    • Sarah Sharp's avatar
      USB: xhci: Fix TRB physical to virtual address translation. · 2fa88daa
      Sarah Sharp authored
      The trb_in_td() function in the xHCI driver is supposed to translate a
      physical transfer buffer request (TRB) into a virtual pointer to the ring
      segment that TRB is in.
      
      Unfortunately, a mistake in this function may cause endless loops as the
      driver searches through the linked list of ring segments over and over
      again.  Fix a couple bugs that may lead to loops or bad output:
      
      1. Bail out if we get a NULL pointer when translating the segment's
      private structure and the starting DMA address of the segment chunk.  If
      this happens, we've been handed a starting TRB pointer from a different
      ring.
      
      2. Make sure the function works when there's multiple segments in the
      ring.  In the while loop to search through the ring segments, use the
      current segment variable (cur_seg), rather than the starting segment
      variable (start_seg) that is passed in.
      
      3. Stop searching the ring if we've run through all the segments in the
      ring.
      Signed-off-by: default avatarSarah Sharp <sarah.a.sharp@linux.intel.com>
      Cc: stable <stable@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      2fa88daa
    • Sarah Sharp's avatar
      USB: xhci: Fix bug memory free after failed initialization. · d94c05e3
      Sarah Sharp authored
      If the xHCI driver fails during the memory initialization, xhci->ir_set
      may not be a valid pointer.  Check that it points to valid DMA'able memory
      before writing to that address during the memory freeing process.
      Signed-off-by: default avatarSarah Sharp <sarah.a.sharp@linux.intel.com>
      Cc: stable <stable@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      d94c05e3
    • Francesco Lavra's avatar
      USB: cdc_acm: Fix memory leak after hangup · 051522bb
      Francesco Lavra authored
      Am Donnerstag, 10. September 2009 15:43:53 schrieb Dietmar Hilbrich:
      > Hello,
      >
      > i have the following problem with the cdc-acm - driver:
      >
      > I'm using the driver with an "Ericsson F3507G" on a Thinkpad T400.
      >
      > If a disable the device (with the RFKill-Switch) while it is used by a
      > programm like ppp, the driver doesn't seem to correctly clean up the tty,
      > even after the program has been closed)
      >
      > The tty is still active (e.g. there still exists an entry in
      > /sys/dev/char/166:0 if ttyACM0 was used) and if a reacticate the device,
      > this device entry will be skipped and the Device-Nodes ttyACM1, ttyACM2
      > and ttyACM3 will be used.
      >
      > This problem was introduced with the commit
      > 10077d4a (before 2.6.31-rc1) and still
      > exists in 2.6.31.
      >
      > I was able the fix this problem with the following patch:
      >
      > diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
      > index 2bfc41e..0970d2f 100644
      > --- a/drivers/usb/class/cdc-acm.c
      > +++ b/drivers/usb/class/cdc-acm.c
      > @@ -676,6 +676,7 @@ static void acm_tty_hangup(struct tty_struct *tty)
      >         struct acm *acm = tty->driver_data;
      >         tty_port_hangup(&acm->port);
      >         acm_port_down(acm, 0);
      > +       acm_tty_unregister(acm);
      >  }
      
      I have the same problem with cdc-acm (I'm using a Samsung SGH-U900): when I
      unplug it from the USB port during a PPP connection, the ppp daemon gets the
      hangup correctly (and closes the device), but the struct acm corresponding to
      the device disconnected is not freed. Hence reconnecting the device results in
      creation of /dev/ttyACM(x+1). The same happens when the system is hibernated
      during a PPP connection.
      
      This memory leak is due to the fact that when the tty is hung up,
      tty_port_close_start() returns always zero, and acm_tty_close() never reaches
      the point where acm_tty_unregister() is called.
      
      Here is a fix for this.
      Signed-off-by: default avatarFrancesco Lavra <francescolavra@interfree.it>
      Acked-by: default avatarOliver Neukum <oliver@neukum.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      051522bb
    • Henry Gebhardt's avatar
      USB: cdc_acm: Fix race condition when opening tty · 18a77b5d
      Henry Gebhardt authored
      If acm_rx_tasklet() gets called before tty_port_block_til_ready()
      returns, then bulk IN urbs may not be sent. This fixes it.
      Signed-off-by: default avatarHenry Gebhardt <gebhardt@astro.uni-tuebingen.de>
      Acked-by: default avatarOliver Neukum <oliver@neukum.org>
      Cc: stable <stable@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      18a77b5d
    • Libin Yang's avatar
      USB: ohci: quirk AMD prefetch for USB 1.1 ISO transfer · a1f17a87
      Libin Yang authored
      The following patch in the driver is required to avoid USB 1.1 device
      failures that may occur due to requests from USB OHCI controllers may
      be overwritten if the latency for any pending request by the USB
      controller is very long (in the range of milliseconds).
      Signed-off-by: default avatarLibin Yang <libin.yang@amd.com>
      Cc: David Brownell <dbrownell@users.sourceforge.net>
      Cc: Alan Stern <stern@rowland.harvard.edu>
      Cc: stable <stable@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
      a1f17a87
  2. 17 Nov, 2009 16 commits
  3. 16 Nov, 2009 17 commits