linux-toradex.git/drivers/usb, branch v2.6.38.7

USB: Fix unplug of device with active streams

2011-04-21T21:32:58+00:00

commit b214f191d95ba4b5a35aebd69cd129cf7e3b1884 upstream.

If I unplug a device while the UAS driver is loaded, I get an oops
in usb_free_streams().  This is because usb_unbind_interface() calls
usb_disable_interface() which calls usb_disable_endpoint() which sets
ep_out and ep_in to NULL.  Then the UAS driver calls usb_pipe_endpoint()
which returns a NULL pointer and passes an array of NULL pointers to
usb_free_streams().

I think the correct fix for this is to check for the NULL pointer
in usb_free_streams() rather than making the driver check for this
situation.  My original patch for this checked for dev->state ==
USB_STATE_NOTATTACHED, but the call to usb_disable_interface() is
conditional, so not all drivers would want this check.

Note from Sarah Sharp: This patch does avoid a potential dereference,
but the real fix (which will be implemented later) is to set the
.soft_unbind flag in the usb_driver structure for the UAS driver, and
all drivers that allocate streams.  The driver should free any streams
when it is unbound from the interface.  This avoids leaking stream rings
in the xHCI driver when usb_disable_interface() is called.

This should be queued for stable trees back to 2.6.35.

Signed-off-by: Matthew Wilcox 
Signed-off-by: Sarah Sharp 
Signed-off-by: Greg Kroah-Hartman

USB: xhci - also free streams when resetting devices

2011-04-21T21:32:57+00:00

commit 2dea75d96ade3c7cd2bfe73f99c7b3291dc3d03a upstream.

Currently, when resetting a device, xHCI driver disables all but one
endpoints and frees their rings, but leaves alone any streams that
might have been allocated. Later, when users try to free allocated
streams, we oops in xhci_setup_no_streams_ep_input_ctx() because
ep->ring is NULL.

Let's free not only rings but also stream data as well, so that
calling free_streams() on a device that was reset will be safe.

This should be queued for stable trees back to 2.6.35.

Reviewed-by: Micah Elizabeth Scott 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sarah Sharp 
Signed-off-by: Greg Kroah-Hartman

USB: xhci - fix math in xhci_get_endpoint_interval()

2011-04-21T21:32:57+00:00

commit dfa49c4ad120a784ef1ff0717168aa79f55a483a upstream.

When parsing exponent-expressed intervals we subtract 1 from the
value and then expect it to match with original + 1, which is
highly unlikely, and we end with frequent spew:

	usb 3-4: ep 0x83 - rounding interval to 512 microframes

Also, parsing interval for fullspeed isochronous endpoints was
incorrect - according to USB spec they use exponent-based
intervals (but xHCI spec claims frame-based intervals). I trust
USB spec more, especially since USB core agrees with it.

This should be queued for stable kernels back to 2.6.31.

Reviewed-by: Micah Elizabeth Scott 
Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sarah Sharp 
Signed-off-by: Greg Kroah-Hartman

USB: xhci - fix unsafe macro definitions

2011-04-21T21:32:57+00:00

commit 5a6c2f3ff039154872ce597952f8b8900ea0d732 upstream.

Macro arguments used in expressions need to be enclosed in parenthesis
to avoid unpleasant surprises.

This should be queued for kernels back to 2.6.31

Signed-off-by: Dmitry Torokhov 
Signed-off-by: Sarah Sharp 
Signed-off-by: Greg Kroah-Hartman

USB: fix formatting of SuperSpeed endpoints in /proc/bus/usb/devices

2011-04-21T21:32:56+00:00

commit 2868a2b1ba8f9c7f6c4170519ebb6c62934df70e upstream.

Isochronous and interrupt SuperSpeed endpoints use the same mechanisms
for decoding bInterval values as HighSpeed ones so adjust the code
accordingly.

Also bandwidth reservation for SuperSpeed matches highspeed, not
low/full speed.

Signed-off-by: Dmitry Torokhov 
Signed-off-by: Greg Kroah-Hartman

USB: EHCI: unlink unused QHs when the controller is stopped

2011-04-21T21:32:56+00:00

commit 94ae4976e253757e9b03a44d27d41b20f1829d80 upstream.

This patch (as1458) fixes a problem affecting ultra-reliable systems:
When hardware failover of an EHCI controller occurs, the data
structures do not get released correctly.  This is because the routine
responsible for removing unused QHs from the async schedule assumes
the controller is running properly (the frame counter is used in
determining how long the QH has been idle) -- but when a failover
causes the controller to be electronically disconnected from the PCI
bus, obviously it stops running.

The solution is simple: Allow scan_async() to remove a QH from the
async schedule if it has been idle for long enough _or_ if the
controller is stopped.

Signed-off-by: Alan Stern 
Reported-and-Tested-by: Dan Duval 
Signed-off-by: Greg Kroah-Hartman

usb: qcserial add missing errorpath kfrees

2011-04-21T21:32:55+00:00

commit cb62d65f966146a39fdde548cb474dacf1d00fa5 upstream.

There are two -ENODEV error paths in qcprobe where the allocated private
data is not freed, this patch adds the two missing kfrees to avoid
leaking memory on the error path

Signed-off-by: Steven Hardy 
Signed-off-by: Greg Kroah-Hartman

usb: qcserial avoid pointing to freed memory

2011-04-21T21:32:55+00:00

commit 99ab3f9e4eaec35fd2d7159c31b71f17f7e613e3 upstream.

Rework the qcprobe logic such that serial->private is not set when
qcprobe exits with -ENODEV, otherwise serial->private will point to freed
memory on -ENODEV

Signed-off-by: Steven Hardy 
Signed-off-by: Greg Kroah-Hartman

usb: Fix qcserial memory leak on rmmod

2011-04-21T21:32:55+00:00

commit 10c9ab15d6aee153968d150c05b3ee3df89673de upstream.

qcprobe function allocates serial->private but this is never freed, this
patch adds a new function qc_release() which frees serial->private, after
calling usb_wwan_release

Signed-off-by: Steven Hardy 
Signed-off-by: Greg Kroah-Hartman

USB: option: Added support for Samsung GT-B3730/GT-B3710 LTE USB modem.

2011-04-21T21:32:52+00:00

commit 80f9df3e0093ad9f1eeefd2ff7fd27daaa518d25 upstream.

Bind only modem AT command endpoint to option.

Signed-off-by: Marius B. Kotsbak 
Signed-off-by: Greg Kroah-Hartman