Merge master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6: (81 commits)
  [PATCH] USB: omninet: fix up debugging comments
  [PATCH] USB serial: add navman driver
  [PATCH] USB: Fix irda-usb use after use
  [PATCH] USB: rtl8150 small fix
  [PATCH] USB: ftdi_sio: add Icom ID1 USB product and vendor ids
  [PATCH] USB: cp2101: add new device IDs
  [PATCH] USB: fix check_ctrlrecip to allow control transfers in state ADDRESS
  [PATCH] USB: vicam.c: fix a NULL pointer dereference
  [PATCH] USB: ZC0301 driver bugfix
  [PATCH] USB: add support for Creativelabs Silvercrest USB keyboard
  [PATCH] USB: storage: new unusual_devs.h entry: Mitsumi 7in1 Card Reader
  [PATCH] USB: storage: unusual_devs.h entry 0420:0001
  [PATCH] USB: storage: another unusual_devs.h entry
  [PATCH] USB: storage: sandisk unusual_devices entry
  [PATCH] USB: fix initdata issue in isp116x-hcd
  [PATCH] USB: usbcore: usb_set_configuration oops (NULL ptr dereference)
  [PATCH] USB: usbcore: Don't assume a USB configuration includes any interfaces
  [PATCH] USB: ub 03 drop stall clearing
  [PATCH] USB: ub 02 remove diag
  [PATCH] USB: ub 01 remove first_open
  ...

1 files changed, 10 insertions, 14 deletions

diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 2b68998fe4b3..545da37afca7 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -134,26 +134,21 @@ static ssize_t usbdev_read(struct file *file, char __user *buf, size_t nbytes, l
 	}
 
 	if (pos < sizeof(struct usb_device_descriptor)) {
-		struct usb_device_descriptor *desc = kmalloc(sizeof(*desc), GFP_KERNEL);
-		if (!desc) {
-			ret = -ENOMEM;
-			goto err;
-		}
-		memcpy(desc, &dev->descriptor, sizeof(dev->descriptor));
-		le16_to_cpus(&desc->bcdUSB);
-		le16_to_cpus(&desc->idVendor);
-		le16_to_cpus(&desc->idProduct);
-		le16_to_cpus(&desc->bcdDevice);
+		struct usb_device_descriptor temp_desc ; /* 18 bytes - fits on the stack */
+
+		memcpy(&temp_desc, &dev->descriptor, sizeof(dev->descriptor));
+		le16_to_cpus(&temp_desc.bcdUSB);
+		le16_to_cpus(&temp_desc.idVendor);
+		le16_to_cpus(&temp_desc.idProduct);
+		le16_to_cpus(&temp_desc.bcdDevice);
 
 		len = sizeof(struct usb_device_descriptor) - pos;
 		if (len > nbytes)
 			len = nbytes;
-		if (copy_to_user(buf, ((char *)desc) + pos, len)) {
-			kfree(desc);
+		if (copy_to_user(buf, ((char *)&temp_desc) + pos, len)) {
 			ret = -EFAULT;
 			goto err;
 		}
-		kfree(desc);
 
 		*ppos += len;
 		buf += len;
@@ -498,7 +493,8 @@ static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype, unsig
 {
 	int ret = 0;
 
-	if (ps->dev->state != USB_STATE_CONFIGURED)
+	if (ps->dev->state != USB_STATE_ADDRESS
+	 && ps->dev->state != USB_STATE_CONFIGURED)
 		return -EHOSTUNREACH;
 	if (USB_TYPE_VENDOR == (USB_TYPE_MASK & requesttype))
 		return 0;