summaryrefslogtreecommitdiff
path: root/drivers/usb/class
AgeCommit message (Collapse)Author
2012-07-26usb: cdc-acm: fix packet loss issueSteve Lin
There is race between acm_suspend and acm_read_bulk_callback. Host may receive bulk transfer right before suspend. The packet will be discarded if this urb is killed in acm_suspend. This patch checks the actual length of urb and processes it in this case. Bug 996268 Signed-off-by: Steve Lin <stlin@nvidia.com> Change-Id: Ief2b42708160b67903f976ec60da825d46c4720b Reviewed-on: http://git-master/r/117135 (cherry picked from commit af3e96c987fbae8a135d1ff18872b9c32e09b67f) Reviewed-on: http://git-master/r/118105 Reviewed-by: Automatic_Commit_Validation_User Tested-by: Steve Lin <stlin@nvidia.com> Reviewed-by: Steve Lin <stlin@nvidia.com>
2012-04-16USB: cdc-acm: disconnect stuck issue and acm_tty_open crashVinayak Pane
acm_disconnect() should not kill the anchored URB because they are already killed by stop_data_traffic(). Submit read URBs before control urb is sent because there is a possibility of response coming immediately after ctrl is sent. Bug 957744 Bug 961808 (cherry picked from commit 05c10cbe01f0275e5fe121d763692261c51987fc) Reviewed-on: http://git-master/r/93673 Signed-off-by: Vinayak Pane <vpane@nvidia.com> Change-Id: I5597e239ec3722afb6b4c1cd5fbe228e30af2a2d Reviewed-on: http://git-master/r/96585 Reviewed-by: Simone Willett <swillett@nvidia.com> Tested-by: Simone Willett <swillett@nvidia.com>
2012-04-16usb: cdc-acm: fix anchored urb leakVinayak Pane
Anchored urbs needs to put ref count after unanchoring them at resume. Bug 944250 Signed-off-by: Vinayak Pane <vpane@nvidia.com> Reviewed-on: http://git-master/r/86015 (cherry picked from commit eb88ad392bdc05ce216d6adeec54c4f4856ec78a) Change-Id: I7e5413fb8866db9a15da57166402cb567f07391a Reviewed-on: http://git-master/r/96333 Tested-by: Vinayak Pane <vpane@nvidia.com> Reviewed-by: Automatic_Commit_Validation_User Reviewed-by: Steve Lin <stlin@nvidia.com>
2012-03-05arm : tegra : comm: AT command loss WARSeshendra Gadagottu
Workaround to avoid make cdc-acm susp_count to negative. Bug 935834 Change-Id: I251049537e21662de329f11ecbad0ce15abb1037 Signed-off-by: Seshendra Gadagottu<sgadagottu@nvidia.com> Reviewed-on: http://git-master/r/84288 (cherry picked from commit d056c04d453bc641e856a61251e7d0aa2dcce73b) Reviewed-on: http://git-master/r/87505 Reviewed-by: Simone Willett <swillett@nvidia.com> Tested-by: Simone Willett <swillett@nvidia.com>
2012-03-05usb: cdc-acm: Add acm handle validity checkSeshendra Gadagottu
Added check for acm handle validity before doing any action in acm_suspend, acm_resume and acm_reset_resume functions. Bug 939237 Change-Id: Idc5d7db6bd405056a90b85009825ccbd03547757 Signed-off-by: Seshendra Gadagottu<sgadagottu@nvidia.com> Reviewed-on: http://git-master/r/83413 (cherry picked from commit 1dd9736cd2df12c0315a44c95010cb64eee04050) Reviewed-on: http://git-master/r/87504 Reviewed-by: Steve Lin <stlin@nvidia.com>
2012-02-21usb: cdc-acm: Fix compilation warning in cdc-acm driver.Steve Lin
Bug 934177 Change-Id: If101278cf553bd92ad98a9485cedf0c3bf1df39a Signed-off-by: Steve Lin <stlin@nvidia.com> Reviewed-on: http://git-master/r/83913
2012-02-09USB: cdc-wdm: call wake_up_all to allow driver to shutdown on device removalBjørn Mork
commit 62aaf24dc125d7c55c93e313d15611f152b030c7 upstream. wdm_disconnect() waits for the mutex held by wdm_read() before calling wake_up_all(). This causes a deadlock, preventing device removal to complete. Do the wake_up_all() before we start waiting for the locks. Signed-off-by: Bjørn Mork <bjorn@mork.no> Cc: Oliver Neukum <oliver@neukum.org> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Varun Wadekar <vwadekar@nvidia.com> Change-Id: Ic92d101f26698708a10ba276eff70825d19d6c89 Reviewed-on: http://git-master/r/79686 Reviewed-by: Simone Willett <swillett@nvidia.com> Tested-by: Simone Willett <swillett@nvidia.com>
2012-02-09USB: cdc-wdm: use two mutexes to allow simultaneous read and writeBjørn Mork
commit e8537bd2c4f325a4796da33564ddcef9489b7feb upstream. using a separate read and write mutex for locking is sufficient to make the driver accept simultaneous read and write. This improves useability a lot. Signed-off-by: Bjørn Mork <bjorn@mork.no> Cc: Oliver Neukum <oneukum@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Varun Wadekar <vwadekar@nvidia.com> Change-Id: I10ed5f0e41b379f0fef8a22abde46d4231162ff9 Reviewed-on: http://git-master/r/79672 Reviewed-by: Simone Willett <swillett@nvidia.com> Tested-by: Simone Willett <swillett@nvidia.com>
2012-02-09USB: cdc-wdm: updating desc->length must be protected by spin_lockBjørn Mork
commit c428b70c1e115c5649707a602742e34130d19428 upstream. wdm_in_callback() will also touch this field, so we cannot change it without locking Signed-off-by: Bjørn Mork <bjorn@mork.no> Acked-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Varun Wadekar <vwadekar@nvidia.com> Change-Id: I7eb2367de1a74be1ac68578354113154595d02cc Reviewed-on: http://git-master/r/79671 Reviewed-by: Simone Willett <swillett@nvidia.com> Tested-by: Simone Willett <swillett@nvidia.com>
2012-02-08USB: cdc-wdm: better allocate a buffer that is at least as big as we tell ↵Bjørn Mork
the USB core commit 655e247daf52b202a6c2d0f8a06dd2051e756ce4 upstream. As it turns out, there was a mismatch between the allocated inbuf size (desc->bMaxPacketSize0, typically something like 64) and the length we specified in the URB (desc->wMaxCommand, typically something like 2048) Signed-off-by: Bjørn Mork <bjorn@mork.no> Cc: Oliver Neukum <oliver@neukum.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Varun Wadekar <vwadekar@nvidia.com> Change-Id: I00872baa6896dfdd076fdcfc57956f1420973a7f Reviewed-on: http://git-master/r/79687 Reviewed-by: Simone Willett <swillett@nvidia.com> Tested-by: Simone Willett <swillett@nvidia.com>
2012-02-08USB: cdc-wdm: Avoid hanging on interface with no USB_CDC_DMM_TYPEBjørn Mork
commit 15699e6fafc3a90e5fdc2ef30555a04dee62286f upstream. The probe does not strictly require the USB_CDC_DMM_TYPE descriptor, which is a good thing as it makes the driver usable on non-conforming interfaces. A user could e.g. bind to it to a CDC ECM interface by using the new_id and bind sysfs files. But this would fail with a 0 buffer length due to the missing descriptor. Fix by defining a reasonable fallback size: The minimum device receive buffer size required by the CDC WMC standard, revision 1.1 Signed-off-by: Bjørn Mork <bjorn@mork.no> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Varun Wadekar <vwadekar@nvidia.com> Change-Id: Ie2ff55501d19fe5273dd0485e23b1dc28cbd4d2c Reviewed-on: http://git-master/r/79688 Reviewed-by: Automatic_Commit_Validation_User Reviewed-by: Simone Willett <swillett@nvidia.com> Tested-by: Simone Willett <swillett@nvidia.com>
2012-01-24arm: usb: cdc: Modifed USB buffer logic for autopm issueSeshendra Gadagottu
Modifed usb buffer anchor mechanism to process pending urb requests. cdc-acm has buffer mechanism to buffer first pending request. This mechanism is replaced with new anchor mechanism which can buffer any number of requests. BUG 919145 Reviewed-on: http://git-master/r/72944 Change-Id: Ibcedc92457013bd616b194e9ea3ce73e69fcdde6 Reviewed-by: Michael Hsu <mhsu@nvidia.com> Reviewed-by: Steve Lin <stlin@nvidia.com> Signed-off-by: Seshendra Gadagottu<sgadagottu@nvidia.com> Signed-off-by: Varun Wadekar <vwadekar@nvidia.com> Reviewed-on: http://git-master/r/76821 Reviewed-by: Automatic_Commit_Validation_User
2012-01-16Merge branch 'linux-3.1.y' into android-tegra-nv-3.1Varun Wadekar
Linux 3.1.9 Conflicts: Makefile Change-Id: I22227ab33ba7ddaba8e6fe049393c58a83d73648 Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
2012-01-12usb: cdc-acm: Fix acm_tty_hangup() vs. acm_tty_close() raceThilo-Alexander Ginkel
[Not upstream s it was fixed differently there for 3.3 with a much more "intrusive" rework of the driver - gregkh] There is a race condition involving acm_tty_hangup() and acm_tty_close() where hangup() would attempt to access tty->driver_data without proper locking and NULL checking after close() has potentially already set it to NULL. One possibility to (sporadically) trigger this behavior is to perform a suspend/resume cycle with a running WWAN data connection. This patch addresses the issue by introducing a NULL check for tty->driver_data in acm_tty_hangup() protected by open_mutex and exiting gracefully when hangup() is invoked on a device that has already been closed. Signed-off-by: Thilo-Alexander Ginkel <thilo@ginkel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2012-01-12drivers/usb/class/cdc-acm.c: clear dangling pointerJulia Lawall
commit e7c8e8605d0bafc705ff27f9da98a1668427cc0f upstream. On some failures, the country_code field of an acm structure is freed without freeing the acm structure itself. Elsewhere, operations including memcpy and kfree are performed on the country_code field. The patch sets the country_code field to NULL when it is freed, and likewise sets the country_code_size field to 0. Signed-off-by: Julia Lawall <julia@diku.dk> Acked-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2012-01-05Linux 3.1.7Varun Wadekar
Change-Id: I99507d7cfdcee064f808856dc2ce99d806fd864f
2011-12-21USB: cdc-acm: add IDs for Motorola H24 HSPA USB module.Krzysztof Hałasa
commit 6abff5dc4d5a2c90e597137ce8987e7fd439259b upstream. Add USB IDs for Motorola H24 HSPA USB module. Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl> Acked-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-12-21usb: cdc: fix build breakVarun Wadekar
Change-Id: I844648f0833ededabda0f2d6aebae214d600b796 Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
2011-12-21arm: usb: cdc: Fix cdc-acm auto pm issuesSeshendra Gadagottu
Buffer usb urb request during suspend/resuming and send it after resume is done. Make "needs_remote_wakeup = 0" to pass auto suspend check. BUG 909614 Change-Id: Ia966a8dc8ab6f808220562f08b072c66bb4678a1 Reviewed-on: http://git-master/r/70166 Reviewed-by: Simone Willett <swillett@nvidia.com> Tested-by: Simone Willett <swillett@nvidia.com>
2011-12-21usb: class: cdc-acm: Fix NO_UNION_NORMAL detection in CDC-ACM.Michael Hsu
Use AND operator instead of equality operator to test for NO_UNION_NORMAL quirk. This allows devices with multiple quirks to be properly tested against the NO_UNION_NORMAL feature. Change-Id: I4c6b019f161ddd91f40ad8e533cab2b435a68ddb Signed-off-by: Michael Hsu <mhsu@nvidia.com> Reviewed-on: http://git-master/r/69892 Reviewed-by: Automatic_Commit_Validation_User Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com> Reviewed-by: Seshendra Gadagottu <sgadagottu@nvidia.com>
2011-11-30usb: cdc-acm: remove tty_hangup in acm_reset_resumeSteve Lin
Do not call tty_hangup in acm_reset_resume for certain modems. Bug 889308 Reviewed-on: http://git-master/r/59177 (cherry picked from commit d57d67f6f563aa8f6c21c544f02cac3002103d21) Change-Id: If10a09fdbb130e5734dba54b0e98c6cc6959c5d3 Reviewed-on: http://git-master/r/66987 Reviewed-by: Varun Colbert <vcolbert@nvidia.com> Tested-by: Varun Colbert <vcolbert@nvidia.com> Rebase-Id: R4e6d948d1e5f05ec2aaaba8560f0bbdae9ea87df
2011-11-30usb: cdc-acm: blocking non-real ACM deviceMichael Hsu
Adding a new quirk tag to prevent ACM driver taking over the interfaces of a device which is not a real ACM device. Bug 860566 Reviewed-on: http://git-master/r/55303 (cherry picked from commit 354c48f813fad182d9ce2c2fcf404d89f75e46cf) Change-Id: I951328549980cf0b284907ef8e216acf9b2a8c59 Reviewed-on: http://git-master/r/62776 Reviewed-by: Varun Colbert <vcolbert@nvidia.com> Tested-by: Varun Colbert <vcolbert@nvidia.com> Rebase-Id: R8fbe1a32c92114407783f9745616ed8304676b49
2011-11-30arm: tegra: usb: Exclude incompatible device from CDC-ACM driver.Michael Hsu
A certain flashless modem has a boot ROM which incorrectly reports itself as being USB CDC-ACM class compliant. Prevent the CDC-ACM driver from printing error message about "This device cannot do calls on its own. It is not a modem." when this device is present on usb bus. Original-Change-Id: If1ef27980b3cc454233309a5066070e6250dd24e Reviewed-on: http://git-master/r/41105 Reviewed-by: Michael Hsu <mhsu@nvidia.com> Tested-by: Michael Hsu <mhsu@nvidia.com> Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com> Rebase-Id: Ra7b68fb265acffe22a2de5d31bad82363607b87e
2011-11-30usb: cdc-acm: Add supported modem to CDC-ACM driver.Michael Hsu
Prevent CDC-ACM driver from creating tty devices for each USB interface on supported modem. Only create one tty device, leaving other USB interfaces available for other uses (such as RAW-IP). Original-Change-Id: I457659783c61f3f76e8026683dbbf2ddb3098ba2 Reviewed-on: http://git-master/r/30599 Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com> Tested-by: Bharat Nihalani <bnihalani@nvidia.com> Rebase-Id: R6d73e98556be72f8a078a715d9551d672e0c82d5
2011-11-26USB: cdc-acm: Fix disconnect() vs close() raceHavard Skinnemoen
commit 5dc2470c602da8851907ec18942cd876c3b4ecc1 upstream. There's a race between the USB disconnect handler and the TTY close handler which may cause the acm object to be freed while it's still being used. This may lead to things like http://article.gmane.org/gmane.linux.usb.general/54250 and https://lkml.org/lkml/2011/5/29/64 This is the simplest fix I could come up with. Holding on to open_mutex while closing the TTY device prevents acm_disconnect() from freeing the acm object between acm->port.count drops to 0 and the TTY side of the cleanups are finalized. Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com> Cc: Oliver Neukum <oliver@neukum.name> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-11-11usb: cdc-acm: Owen SI-30 supportDenis Pershin
commit 65e52f41fa944cef2e6d4222b8c54f46cc575214 upstream. here is the patch to support Owen SI-30 device. This is a pulse counter controller. http://www.owen.ru/en/catalog/93788515 usb-drivers output: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 4 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=02(commc) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1 P: Vendor=03eb ProdID=0030 Rev=01.01 C: #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr=0mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=02 Prot=00 Driver=cdc_acm I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_acm This patch is installed on my home system which receives data from this controller connected to cold water counter. Signed-off-by: Denis Pershin <dyp@perchine.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-08-08USB: assign instead of equal in usbtmc.cMaxim Nikulin
Assign operator instead of equality test in the usbtmc_ioctl_abort_bulk_in() function. Signed-off-by: Maxim A. Nikulin <M.A.Nikulin@gmail.com> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-07-01usb/class: use printk_ratelimited() instead of printk_ratelimit()Manuel Zerpies
Since printk_ratelimit() shouldn't be used anymore (see comment in include/linux/printk.h), replace it with printk_ratelimited() Signed-off-by: Manuel Zerpies <manuel.f.zerpies@ww.stud.uni-erlangen.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-06-06USB: cdc-acm: Adding second ACM channel support for Nokia E7 and C7Toby Gray
This adds the Nokia E7 and C7 to the list of devices in cdc-acm, allowing the secondary ACM channel on the device to be exposed. Without this patch the ACM driver won't claim this secondary channel as it's marked as having a vendor-specific protocol. Signed-off-by: Toby Gray <toby.gray@realvnc.com> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-05-11USB: cdc_acm: Fix oops when Droids MuIn LCD is connectedErik Slagter
The Droids MuIn LCD operates like a serial remote terminal. Data received are displayed directly on the LCD. This patch fixes the kernel null pointer oops when it is plugged in. Add NO_DATA_INTERFACE quirk to tell the driver that "control" and "data" interfaces are not separated for this device, which prevents dereferencing a null pointer in the device probe code. Signed-off-by: Erik Slagter <erik@slagter.name> Signed-off-by: Maxin B. John <maxin.john@gmail.com> Tested-by: Erik Slagter <erik@slagter.name> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-04-29USB: cdc-wdm: reset handling according to new requirementsOliver Neukum
This patch - ensures no IO takes place during resets - reports resets to user space Signed-off-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-04-13USB: cdc-acm: re-write read processingJohan Hovold
Kill rx tasklet, which is no longer needed, and re-write read processing. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-04-13USB: cdc-acm: clean up read urb allocationJohan Hovold
Allocate read urbs and read buffers in the same loop during probe. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-04-13USB: cdc-acm: clean up open error handlingJohan Hovold
No need to kill ctrl urb on errors as this is done later during close. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-04-13USB: cdc-acm: clean up rx_buflimit referencesJohan Hovold
Clean up references to rx_buflimit. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-04-13USB: cdc-acm: remove unused drain-delay codeJohan Hovold
The drain-delay code is no longer used, so remove it. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-04-13USB: cdc-acm: remove superfluous prototypeJohan Hovold
Remove unnecessary acm_tty_chars_in_buffer prototype. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-04-13USB: cdc-acm: remove version information and changelogJohan Hovold
Remove driver version and changelog which can be retrieved from git history. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-04-13USB: cdc-acm: use dev_vdbg in read/write pathsJohan Hovold
Replace dev_dbg with verbose dev_vdbg in read/write paths where appropriate. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-04-13USB: cdc-acm: clean up verbose debugJohan Hovold
Clean up use of verbose debug. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-04-13USB: cdc-acm: replace dbg macros with dev_dbgJohan Hovold
Replace all remaining instances of dbg with dev_dbg. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-04-13USB: cdc-acm: clean up dev_err and dev_dbgJohan Hovold
Clean up some dev_err and dev_dbg messages and make sure that the appropriate interface device is used for reporting consistently throughout. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-04-13USB: cdc-acm: use dev_err to report failed allocationsJohan Hovold
Upgrade out-of-memory dev_dbg to dev_err. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-04-13USB: cdc-acm: add missing newlines to dev_dbg and dev_errJohan Hovold
Add missing newline to two dev_dbg and dev_err messages. Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-03-31Fix common misspellingsLucas De Marchi
Fixes generated by 'codespell' and manually reviewed. Signed-off-by: Lucas De Marchi <lucas.demarchi@profusion.mobi>
2011-03-23USB: cdc-acm: fix potential null-pointer dereference on disconnectJohan Hovold
Fix potential null-pointer exception on disconnect introduced by commit 11ea859d64b69a747d6b060b9ed1520eab1161fe (USB: additional power savings for cdc-acm devices that support remote wakeup). Only access acm->dev after making sure it is non-null in control urb completion handler. Cc: stable <stable@kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-03-23USB: cdc-acm: fix potential null-pointer dereferenceJohan Hovold
Must check return value of tty_port_tty_get. Cc: stable <stable@kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-03-23USB: cdc-acm: fix memory corruption / panicJohan Hovold
Prevent read urbs from being resubmitted from tasklet after port close. The receive tasklet was not disabled on port close, which could lead to corruption of receive lists on consecutive port open. In particular, read urbs could be re-submitted before port open, added to free list in open, and then added a second time to the free list in the completion handler. cdc-acm.c: Entering acm_tty_open. cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x3 len: 0x0 result: 0 cdc-acm.c: Entering acm_rx_tasklet cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da280, rcv 0xf57fbc24, buf 0xf57fbd64 cdc-acm.c: set line: 115200 0 0 8 cdc-acm.c: acm_control_msg: rq: 0x20 val: 0x0 len: 0x7 result: 7 cdc-acm.c: acm_tty_close cdc-acm.c: acm_port_down cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x0 len: 0x0 result: 0 cdc-acm.c: acm_ctrl_irq - urb shutting down with status: -2 cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da300, rcv 0xf57fbc10, buf 0xf57fbd50 cdc-acm.c: Entering acm_read_bulk with status -2 cdc_acm 4-1:1.1: Aborting, acm not ready cdc-acm.c: Entering acm_read_bulk with status -2 cdc_acm 4-1:1.1: Aborting, acm not ready cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da380, rcv 0xf57fbbfc, buf 0xf57fbd3c cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da400, rcv 0xf57fbbe8, buf 0xf57fbd28 cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da480, rcv 0xf57fbbd4, buf 0xf57fbd14 cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da900, rcv 0xf57fbbc0, buf 0xf57fbd00 cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da980, rcv 0xf57fbbac, buf 0xf57fbcec cdc-acm.c: acm_rx_tasklet: sending urb 0xf50daa00, rcv 0xf57fbb98, buf 0xf57fbcd8 cdc-acm.c: acm_rx_tasklet: sending urb 0xf50daa80, rcv 0xf57fbb84, buf 0xf57fbcc4 cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dab00, rcv 0xf57fbb70, buf 0xf57fbcb0 cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dab80, rcv 0xf57fbb5c, buf 0xf57fbc9c cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dac00, rcv 0xf57fbb48, buf 0xf57fbc88 cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dac80, rcv 0xf57fbb34, buf 0xf57fbc74 cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dad00, rcv 0xf57fbb20, buf 0xf57fbc60 cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dad80, rcv 0xf57fbb0c, buf 0xf57fbc4c cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da880, rcv 0xf57fbaf8, buf 0xf57fbc38 cdc-acm.c: Entering acm_tty_open. cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x3 len: 0x0 result: 0 cdc-acm.c: Entering acm_rx_tasklet cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da280, rcv 0xf57fbc24, buf 0xf57fbd64 cdc-acm.c: Entering acm_tty_write to write 3 bytes, cdc-acm.c: Get 3 bytes... cdc-acm.c: acm_write_start susp_count: 0 cdc-acm.c: Entering acm_read_bulk with status 0 ------------[ cut here ]------------ WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:57 list_del+0x10c/0x120() Hardware name: Vostro 1520 list_del corruption. next->prev should be f57fbc10, but was f57fbaf8 Modules linked in: cdc_acm Pid: 3, comm: ksoftirqd/0 Not tainted 2.6.37+ #39 Call Trace: [<c103c7e2>] warn_slowpath_common+0x72/0xa0 [<c11dd8ac>] ? list_del+0x10c/0x120 [<c11dd8ac>] ? list_del+0x10c/0x120 [<c103c8b3>] warn_slowpath_fmt+0x33/0x40 [<c11dd8ac>] list_del+0x10c/0x120 [<f8051dbf>] acm_rx_tasklet+0xef/0x3e0 [cdc_acm] [<c135465d>] ? net_rps_action_and_irq_enable+0x6d/0x80 [<c1042bb6>] tasklet_action+0xe6/0x140 [<c104342f>] __do_softirq+0xaf/0x210 [<c1043380>] ? __do_softirq+0x0/0x210 <IRQ> [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0 [<c1042c10>] ? run_ksoftirqd+0x0/0x1c0 [<c105ac24>] ? kthread+0x74/0x80 [<c105abb0>] ? kthread+0x0/0x80 [<c100337a>] ? kernel_thread_helper+0x6/0x10 ---[ end trace efd9a11434f0082e ]--- ------------[ cut here ]------------ WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:57 list_del+0x10c/0x120() Hardware name: Vostro 1520 list_del corruption. next->prev should be f57fbd50, but was f57fbdb0 Modules linked in: cdc_acm Pid: 3, comm: ksoftirqd/0 Tainted: G W 2.6.37+ #39 Call Trace: [<c103c7e2>] warn_slowpath_common+0x72/0xa0 [<c11dd8ac>] ? list_del+0x10c/0x120 [<c11dd8ac>] ? list_del+0x10c/0x120 [<c103c8b3>] warn_slowpath_fmt+0x33/0x40 [<c11dd8ac>] list_del+0x10c/0x120 [<f8051dd6>] acm_rx_tasklet+0x106/0x3e0 [cdc_acm] [<c135465d>] ? net_rps_action_and_irq_enable+0x6d/0x80 [<c1042bb6>] tasklet_action+0xe6/0x140 [<c104342f>] __do_softirq+0xaf/0x210 [<c1043380>] ? __do_softirq+0x0/0x210 <IRQ> [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0 [<c1042c10>] ? run_ksoftirqd+0x0/0x1c0 [<c105ac24>] ? kthread+0x74/0x80 [<c105abb0>] ? kthread+0x0/0x80 [<c100337a>] ? kernel_thread_helper+0x6/0x10 ---[ end trace efd9a11434f0082f ]--- cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da300, rcv 0xf57fbc10, buf 0xf57fbd50 cdc-acm.c: disconnected from network cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da380, rcv 0xf57fbbfc, buf 0xf57fbd3c cdc-acm.c: Entering acm_rx_tasklet ------------[ cut here ]------------ WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:48 list_del+0xd5/0x120() Hardware name: Vostro 1520 list_del corruption, next is LIST_POISON1 (00100100) Modules linked in: cdc_acm Pid: 3, comm: ksoftirqd/0 Tainted: G W 2.6.37+ #39 Call Trace: [<c103c7e2>] warn_slowpath_common+0x72/0xa0 [<c11dd875>] ? list_del+0xd5/0x120 [<c11dd875>] ? list_del+0xd5/0x120 [<c103c8b3>] warn_slowpath_fmt+0x33/0x40 [<c11dd875>] list_del+0xd5/0x120 [<f8051fac>] acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm] [<c106dbab>] ? trace_hardirqs_on+0xb/0x10 [<c1042b30>] ? tasklet_action+0x60/0x140 [<c1042bb6>] tasklet_action+0xe6/0x140 [<c104342f>] __do_softirq+0xaf/0x210 [<c1043380>] ? __do_softirq+0x0/0x210 <IRQ> [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0 [<c1042c10>] ? run_ksoftirqd+0x0/0x1c0 [<c105ac24>] ? kthread+0x74/0x80 [<c105abb0>] ? kthread+0x0/0x80 [<c100337a>] ? kernel_thread_helper+0x6/0x10 ---[ end trace efd9a11434f00830 ]--- BUG: unable to handle kernel paging request at 00200200 IP: [<c11dd7bd>] list_del+0x1d/0x120 *pde = 00000000 Oops: 0000 [#1] PREEMPT SMP last sysfs file: /sys/devices/pci0000:00/0000:00:1a.1/usb4/4-1/4-1:1.0/tty/ttyACM0/uevent Modules linked in: cdc_acm Pid: 3, comm: ksoftirqd/0 Tainted: G W 2.6.37+ #39 0T816J/Vostro 1520 EIP: 0060:[<c11dd7bd>] EFLAGS: 00010046 CPU: 0 EIP is at list_del+0x1d/0x120 EAX: f57fbd3c EBX: f57fb800 ECX: ffff8000 EDX: 00200200 ESI: f57fbe90 EDI: f57fbd3c EBP: f600bf54 ESP: f600bf3c DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 Process ksoftirqd/0 (pid: 3, ti=f600a000 task=f60791c0 task.ti=f6082000) Stack: c1527e84 00000030 c1527e54 00100100 f57fb800 f57fbd3c f600bf98 f8051fac f8053104 f8052b94 f600bf6c c106dbab f600bf80 00000286 f60791c0 c1042b30 f57fbda8 f57f5800 f57fbdb0 f57fbd80 f57fbe7c c1656b04 00000000 f600bfb0 Call Trace: [<f8051fac>] ? acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm] [<c106dbab>] ? trace_hardirqs_on+0xb/0x10 [<c1042b30>] ? tasklet_action+0x60/0x140 [<c1042bb6>] ? tasklet_action+0xe6/0x140 [<c104342f>] ? __do_softirq+0xaf/0x210 [<c1043380>] ? __do_softirq+0x0/0x210 <IRQ> [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0 [<c1042c10>] ? run_ksoftirqd+0x0/0x1c0 [<c105ac24>] ? kthread+0x74/0x80 [<c105abb0>] ? kthread+0x0/0x80 [<c100337a>] ? kernel_thread_helper+0x6/0x10 Code: ff 48 14 e9 57 ff ff ff 90 90 90 90 90 90 55 89 e5 83 ec 18 81 38 00 01 10 00 0f 84 9c 00 00 00 8b 50 04 81 fa 00 02 20 00 74 33 <8b> 12 39 d0 75 5c 8b 10 8b 4a 04 39 c8 0f 85 b5 00 00 00 8b 48 EIP: [<c11dd7bd>] list_del+0x1d/0x120 SS:ESP 0068:f600bf3c CR2: 0000000000200200 ---[ end trace efd9a11434f00831 ]--- Kernel panic - not syncing: Fatal exception in interrupt Pid: 3, comm: ksoftirqd/0 Tainted: G D W 2.6.37+ #39 Call Trace: [<c13fede1>] ? printk+0x1d/0x24 [<c13fecce>] panic+0x66/0x15c [<c10067df>] oops_end+0x8f/0x90 [<c1025476>] no_context+0xc6/0x160 [<c10255a8>] __bad_area_nosemaphore+0x98/0x140 [<c103cf68>] ? release_console_sem+0x1d8/0x210 [<c1025667>] bad_area_nosemaphore+0x17/0x20 [<c1025a49>] do_page_fault+0x279/0x420 [<c1006a8f>] ? show_trace+0x1f/0x30 [<c13fede1>] ? printk+0x1d/0x24 [<c10257d0>] ? do_page_fault+0x0/0x420 [<c140333b>] error_code+0x5f/0x64 [<c103007b>] ? select_task_rq_fair+0x37b/0x6a0 [<c10257d0>] ? do_page_fault+0x0/0x420 [<c11dd7bd>] ? list_del+0x1d/0x120 [<f8051fac>] acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm] [<c106dbab>] ? trace_hardirqs_on+0xb/0x10 [<c1042b30>] ? tasklet_action+0x60/0x140 [<c1042bb6>] tasklet_action+0xe6/0x140 [<c104342f>] __do_softirq+0xaf/0x210 [<c1043380>] ? __do_softirq+0x0/0x210 <IRQ> [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0 [<c1042c10>] ? run_ksoftirqd+0x0/0x1c0 [<c105ac24>] ? kthread+0x74/0x80 [<c105abb0>] ? kthread+0x0/0x80 [<c100337a>] ? kernel_thread_helper+0x6/0x10 panic occurred, switching back to text console ------------[ cut here ]------------ Cc: stable <stable@kernel.org> Signed-off-by: Johan Hovold <jhovold@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-03-23USB: Fix 'bad dma' problem on WDM device disconnectRobert Lukassen
In the WDM class driver a disconnect event leads to calls to usb_free_coherent to put back two USB DMA buffers allocated earlier. The call to usb_free_coherent uses a different size parameter (desc->wMaxCommand) than the corresponding call to usb_alloc_coherent (desc->bMaxPacketSize0). When a disconnect event occurs, this leads to 'bad dma' complaints from usb core because the USB DMA buffer is being pushed back to the 'buffer-2048' pool from which it has not been allocated. This patch against the most recent linux-2.6 kernel ensures that the parameters used by usb_alloc_coherent & usb_free_coherent calls in cdc-wdm.c match. Signed-off-by: Robert Lukassen <robert.lukassen@tomtom.com> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2011-02-24Merge 2.6.38-rc6 into tty-nextGreg Kroah-Hartman
This was to resolve a merge issue with drivers/char/Makefile and drivers/tty/serial/68328serial.c Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
generated by cgit v1.2.3 (git 2.0.4) at 2024-06-30 15:43:22 +0000