aboutsummaryrefslogtreecommitdiffstats
path: root/drivers (follow)
AgeCommit message (Collapse)AuthorFilesLines
2009-11-30b44: Fix wedge when using netconsole.David S. Miller1-3/+0
Fixes kernel bugzilla #14691 Due to the way netpoll works, it is perfectly legal to see NAPI already scheduled when new device events are pending in b44_interrupt(). So logging a message about it is wrong and in fact harmful. Based upon a patch by Andreas Mohr. Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-30wan: cosa: drop chan->wsem on error pathDan Carpenter1-0/+1
The other paths all drop chan->wsem. This was found by a static checker (smatch). Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Jan "Yenya" Kasprzak <kas@fi.muni.cz> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-29ep93xx-eth: check for zero MAC address on probe, not on device openFlorian Fainelli1-9/+3
If we happen to have registered the driver without passing a MAC address, we will print a zero MAC address and register the interface with this invalid address, this is confusin. This patch moves the checking of a valid ethernet address and the generation of a random one down from the open function to the probe function. Signed-off-by: Florian Fainelli <florian@openwrt.org> Acked-by: Lennert Buytenhek <buytenh@wantstofly.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-29NET: smc91x: Fix irq flagsRussell King - ARM Linux1-1/+1
smc91x.h defines SMC_IRQ_FLAGS to be -1 when it wants the interrupt flags to be taken from the resource structure. However, d280ead changed this to checking for non-zero resource flags. Unfortunately, this means that on some platforms, we end up passing '-1' to request_irq rather than the desired result. Combine the two conditions into one so that the IRQ flags are taken from the resource if either SMC_IRQ_FLAGS is -1 or the resource flags specify an interrupt trigger. This restores network on at least the Versatile platform. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk> Acked-by: Eric Miao <eric.y.miao@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-29smsc9420: prevent BUG() if ethtool is called with interface downSteve Glendinning1-0/+14
This patch fixes a null pointer dereference BUG() if ethtool is used on an smsc9420 interface while it is down, because the phy_dev is only allocated while the interface is up. Signed-off-by: Steve Glendinning <steve.glendinning@smsc.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-29r8169: restore mac addr in rtl8169_remove_one and rtl_shutdownIvan Vecera1-0/+7
The newer chipsets (all PCI-E) are known that they need full power cycle (AC or battery removal) to reset MAC address to a hardwired one. Previous patch to address this problem loads the original MAC address from EEPROM. But it brought other problem for which it is necessary to introduce a new module parameter. However, it might suffice to restore the initial MAC address before shutdown/reboot/kexec and when removing the module. Signed-off-by: Ivan Vecera <ivecera@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-29e100: Use pci pool to work around GFP_ATOMIC order 5 memory allocation failureRoger Oksanen1-6/+11
pci_alloc_consistent uses GFP_ATOMIC allocation that may fail on some systems with limited memory (Bug #14265). pci_pool_alloc allows waiting with GFP_KERNEL. Tested-by: Karol Lewandowski <karol.k.lewandowski@gmail.com> Signed-off-by: Roger Oksanen <roger.oksanen@cs.helsinki.fi> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-23macvlan: fix gso_max_size settingPatrick McHardy1-0/+2
gso_max_size must be set based on the value of the underlying device to support devices not using the full 64k. Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-23Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6David S. Miller1-0/+2
2009-11-23ath9k: set ps_default as falseJohn W. Linville1-0/+2
Copied from original one-line patch here: http://bugzilla.kernel.org/show_bug.cgi?id=14267#c26 Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-11-23hso: fix soft-lockupAntti Kaijanmäki1-1/+3
Fix soft-lockup in hso.c which is triggered on SMP machine when modem is removed while file descriptor(s) under /dev are still open: old version called kref_put() too early which resulted in destroying hso_serial and hso_device objects which were still used later on. Signed-off-by: Antti Kaijanmäki <antti.kaijanmaki@nomovok.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-23hso: fix debug routinesAntti Kaijanmäki1-2/+2
Signed-off-by: Antti Kaijanmäki <antti.kaijanmaki@nomovok.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-23stmmac: do not fail when the timer cannot be used.Giuseppe CAVALLARO2-22/+29
If the external timer cannot be used the driver will continue to work without mitigation. Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-23stmmac: fixed a compilation error when use the external timerGiuseppe CAVALLARO1-2/+2
Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-22Au1x00: fix crash when trying register_netdev()Alexander Beregalov1-7/+8
Andreas Lohre reported that the driver crashes when trying to register_netdev(), he sugessted to move dev->netdev_ops initialization before calling register_netdev(), it worked for him. Reported-by: Andreas Lohre <alohre@gmail.com> Signed-off-by: Alexander Beregalov <a.beregalov@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-21netxen : fix BOND_MODE_TLB/ALB mode.Narender Kumar3-4/+8
o Along with netdev->perm_addr, mac address will be maintained in device private structure. o Device limitation: We need to set mac address when ever interface comes up. In ALB/TAL mode, bonding driver calls set_mac for all slave with bond mac address. But bonding driver set netdev->dev_addr field to its original value, after enslaving interfaces. When ever active slave changes, it swap dev_addr of inactive slave with active. Yet it doesn't notify driver about change in netdev->dev_addr. As netxen driver need to set mac addr when ever interface comes up, it can't rely on netdev->dev_addr field. Specially in case of bonding mode ALB/TLB. Signed-off-by: Narender Kumar <narender.kumar@qlogic.com> Signed-off-by: Amit Kumar Salecha <amit.salecha@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-21netxen: fix promisc for NX2031.Narender Kumar2-11/+40
Kernel crashes, if promisc mode set without disabling rx queue. Before changing mode in NX2031 chip, wait till rx queue drains. Signed-off-by: Narender Kumar <narender.kumar@qlogic.com> Signed-off-by: Amit Kumar Salecha <amit.salecha@qlogic.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-21netxen: fix memory initializationAmit Kumar Salecha1-0/+2
Avoid resetting memory during initialization, skip this memory block during driver probe. Signed-off-by: Amit Kumar Salecha <amit@netxen.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-20TI DaVinci EMAC: Minor macro related updateschaithrika@ti.com1-15/+11
Use BIT for macro definitions wherever possible, remove unused and redundant macros. Signed-off-by: Chaithrika U S <chaithrika@ti.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-20drivers/net: ks8851_mll ethernet network driver -resubmitDavid J. Choi1-74/+68
Summary of Changes: -Fix to receive multicast packets by setting the corresponding hardware bit during initialization. -Fix to re-enable the interface [by interface up command(ifup)] while the interface is down. -Fix to be able to down the interface by passing the last parameter correctly to request_irq(). -Remove to read 4 extra bytes from the receiving queue after reading a packet, even though it does not cause a predictable issue now. -Remove occurrences of transmission done interrupt in order to tx throughput enhancement. -Enable IP checksum for packet receiving by setting the corresponding hardware bit during initialization. -Relocate ks_enable_int()/ks_disable_int() in order not to declare those functions at the beginning of the file. -Rename ks_enable()/_disable() to ks_enable_qmu()/ks_disable_qmu() in order to give more meaningful names and relocate them not declaire those functions at the beginning of the file. Signed-off-by: David J. Choi <david.choi@micrel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-20net: ETHOC should depend on HAS_DMAGeert Uytterhoeven1-1/+1
When building for Sun 3: drivers/net/ethoc.c:1091: undefined reference to `dma_free_coherent' drivers/built-in.o: In function `ethoc_probe': drivers/net/ethoc.c:965: undefined reference to `dma_alloc_coherent' drivers/net/ethoc.c:1063: undefined reference to `dma_free_coherent' Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-20e1000e: do not initiate autonegotiation during OEM configurationBruce Allan1-1/+2
When configuring the OEM bits in the PHY on 82577/82578, do not restart autonegotiation if the firmware is blocking it (e.g. when an IDE-R session is active) because the link must not go down. Signed-off-by: Bruce Allan <bruce.w.allan@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-20e1000e: remove unnecessary 82577 workaround causing link issuesBruce Allan1-10/+0
A workaround for pre-release versions of 82577 is causing link issues on some switches. The workaround is no longer needed on production parts so remove it. Signed-off-by: Bruce Allan <bruce.w.allan@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-20e1000e: flow control thresholds not correct when changing mtuBruce Allan1-4/+3
When changing MTU, save it off prior to resetting otherwise the flow control thresholds may be miscalculated. Signed-off-by: Bruce Allan <bruce.w.allan@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-20e1000e: add Tx timeout factor for 100MbpsBruce Allan1-1/+1
On some devices (e.g. 82578) not having a Tx timeout factor when linked at 100Mbps can cause false reports of hardware hangs on busy hubs. Signed-off-by: Bruce Allan <bruce.w.allan@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-20e1000e: set flow control thresholds properly after enabling/disabling pauseBruce Allan1-2/+10
When flow control (pause) parameters were changed via ethtool (i.e. enabled or disabled), the newly calculated thresholds were not being written to the device for non-fiber media. Signed-off-by: Bruce Allan <bruce.w.allan@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-20e1000e: read of PHY register may access wrong page on 82578Bruce Allan1-24/+22
Remove unnecessary workaround that mistakenly does not perform a page select operation for PHY registers 29 and 30 (assuming these are the PHY debug port address and data registers) on 82578 which can cause reads of the Transmit with No Carrier Sense statistics register on page 778 to be read from an incorrect page. Also error out if the page select operation fails. Signed-off-by: Bruce Allan <bruce.w.allan@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-20e1000e: partial revert of 3ec2a2b8 plus FC workraround for 82577/8Bruce Allan3-12/+32
Commit 3ec2a2b80f3eb53851fe4cef9e65b5d33376ef89 broke Tx/Rx when using jumbo frames on certain parts (i.e. only PAUSE frames could be exchanged once the high water mark was reached preventing normal packet traffic). This patch reverts the breakage and sets appropriate high and low water marks of the Rx FIFO for 82577/82578 which require a workaround due to a flow control issue in hardware. Signed-off-by: Bruce Allan <bruce.w.allan@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-20ixgbe: move tc variable to CONFIG_IXGBE_DCBJaswinder Singh Rajput1-1/+1
tc is required by CONFIG_IXGBE_DCB. This also fixes compilation warning: drivers/net/ixgbe/ixgbe_main.c: In function ‘ixgbe_tx_is_paused’: drivers/net/ixgbe/ixgbe_main.c:245: warning: unused variable ‘tc’ Signed-off-by: Jaswinder Singh Rajput <jaswinderrajput@gmail.com> Acked-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-19veth: Fix veth_get_stats()Eric Dumazet1-19/+16
veth_get_stats() can be called in parallel on several cpus. It's better to not reset dev->stats as it could give wrong result on one cpu. Use temporary variables, then store the final results. Also, we should loop on every possible cpus, not only online cpus, or cpu hotplug can suddenly give wrong veth stats. Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-19ieee802154: dont leak skbs in ieee802154_fake_xmit()Eric Dumazet1-4/+1
ieee802154_fake_xmit() should free skbs since it returns NETDEV_TX_OK Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Acked-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-18Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreqLinus Torvalds3-12/+44
* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq: [CPUFREQ] Fix stale cpufreq_cpu_governor pointer [CPUFREQ] Resolve time unit thinko in ondemand/conservative govs [CPUFREQ] speedstep-ich: fix error caused by 394122ab144dae4b276d74644a2f11c44a60ac5c [CPUFREQ] Fix use after free on governor restore [CPUFREQ] acpi-cpufreq: blacklist Intel 0f68: Fix HT detection and put in notification message [CPUFREQ] powernow-k8: Fix test in get_transition_latency() [CPUFREQ] longhaul: select Longhaul version 2 for capable CPUs
2009-11-18Merge branch 'agp-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/agp-2.6Linus Torvalds1-6/+5
* 'agp-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/agp-2.6: agp/intel-agp: Set dma_mask for capable chipsets before agp_add_bridge()
2009-11-19agp/intel-agp: Set dma_mask for capable chipsets before agp_add_bridge()David Woodhouse1-6/+5
We should set this before calling agp_add_bridge() so that it's done before we map the scratch page too. This should probably fix the regression reported as k.o. bug #14627. Signed-off-by: David Woodhouse <David.Woodhouse@intel.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
2009-11-18Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6Linus Torvalds35-442/+352
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (42 commits) cxgb3: fix premature page unmap ibm_newemac: Fix EMACx_TRTR[TRT] bit shifts vlan: Fix register_vlan_dev() error path gro: Fix illegal merging of trailer trash sungem: Fix Serdes detection. net: fix mdio section mismatch warning ppp: fix BUG on non-linear SKB (multilink receive) ixgbe: Fixing EEH handler to handle more than one error net: Fix the rollback test in dev_change_name() Revert "isdn: isdn_ppp: Use SKB list facilities instead of home-grown implementation." TI Davinci EMAC : Fix Console Hang when bringing the interface down smsc911x: Fix Console Hang when bringing the interface down. mISDN: fix error return in HFCmulti_init() forcedeth: mac address fix r6040: fix version printing Bluetooth: Fix regression with L2CAP configuration in Basic Mode Bluetooth: Select Basic Mode as default for SOCK_SEQPACKET Bluetooth: Set general bonding security for ACL by default r8169: Fix receive buffer length when MTU is between 1515 and 1536 can: add the missing netlink get_xstats_size callback ...
2009-11-18Merge branch 'sh/for-2.6.32' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6Linus Torvalds1-0/+1
* 'sh/for-2.6.32' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: sh: Fixup last users of irq_chip->typename uio: pm_runtime_disable is needed if failed
2009-11-18Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6Linus Torvalds9-22/+78
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: USB: option.c: add support for D-Link DWM-162-U5 USB: usbmon: fix bug in mon_buff_area_shrink USB: xhci: Fix scratchpad deallocation. USB: xhci: Fix TRB physical to virtual address translation. USB: xhci: Fix bug memory free after failed initialization. USB: cdc_acm: Fix memory leak after hangup USB: cdc_acm: Fix race condition when opening tty USB: ohci: quirk AMD prefetch for USB 1.1 ISO transfer
2009-11-18Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6Linus Torvalds2-0/+24
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6: tty: cp210x: Fix carrier handling tty_port: If we are opened non blocking we still need to raise the carrier
2009-11-18cxgb3: fix premature page unmapDivy Le Ray1-2/+2
unmap Rx page only when guaranteed that this page won't be used anymore to allocate rx page chunks. Signed-off-by: Divy Le Ray <divy@chelsio.com> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-18ibm_newemac: Fix EMACx_TRTR[TRT] bit shiftsDave Mitchell1-2/+2
The TRT bit shifts were reversed for EMAC4 and non-EMAC4 during the port from ibm_emac to ibm_newemac. This patch corrects that error. Signed-off-by: Dave Mitchell <dmitchell@appliedmicro.com> Acked-by: Feng Kan <fkan@appliedmicro.com> Acked-by: Prodyut Hazarika <phazarika@appliedmicro.com> Acked-by: Stefan Roese <sr@denx.de> Signed-off-by: David S. Miller <davem@davemloft.net>
2009-11-17[CPUFREQ] Fix stale cpufreq_cpu_governor pointerPrarit Bhargava1-2/+30
Dave, Attached is an update of my patch against the cpufreq fixes branch. Before applying the patch I compiled and booted the tree to see if the panic was still there -- to my surprise it was not. This is because of the conversion of cpufreq_cpu_governor to a char[]. While the panic is kaput, the problem of stale data continues and my patch is still valid. It is possible to end up with the wrong governor after hotplug events because CPUFREQ_DEFAULT_GOVERNOR is statically linked to a default, while the cpu siblings may have had a different governor assigned by a user. ie) the patch is still needed in order to keep the governors assigned properly when hotplugging devices Signed-off-by: Prarit Bhargava <prarit@redhat.com> Signed-off-by: Dave Jones <davej@redhat.com>
2009-11-17[CPUFREQ] Resolve time unit thinko in ondemand/conservative govsPallipadi, Venkatesh2-4/+4
ondemand and conservative governors are messing up time units in the code path where NO_HZ is not enabled and ignore_nice is set. The walltime idletime stored is in jiffies and nice time calculation is happening in microseconds. The problem was reported and diagnosed by Alexander here. http://marc.info/?l=linux-kernel&m=125752550404513&w=2 The patch below fixes this thinko. Reported-by: Alexander Miller <Miller@fmi.uni-stuttgart.de> Tested-by: Alexander Miller <Miller@fmi.uni-stuttgart.de> Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com> Signed-off-by: Dave Jones <davej@redhat.com>
2009-11-17[CPUFREQ] Fix use after free on governor restoreDmitry Monakhov1-6/+10
Currently on governer backup/restore path we storing governor's pointer. This is wrong because one may unload governor's module after cpu goes offline. As result use-after-free will take place on restored cpu. It is not easy to exploit this bug, but still we have to close this issue ASAP. Issue was introduced by following commit 084f34939424161669467c19280dbcf637730314 ##TESTCASE## #!/bin/sh -x modprobe acpi_cpufreq # Any non default governor, in may case it is "ondemand" modprobe cpufreq_ondemand echo ondemand > /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor rmmod acpi_cpufreq rmmod cpufreq_ondemand modprobe acpi_cpufreq # << use-after-free here. Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org> Signed-off-by: Dave Jones <davej@redhat.com>
2009-11-17drivers/video/da8xx-fb.c: fix error returnRoel Kluin1-1/+1
The return should be negative on errors Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Cc: Sudhakar Rajashekhara <sudhakar.raj@ti.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-11-17spi: error status should be negativeRoel Kluin1-1/+1
Return a negative error value instead of a positive Signed-off-by: Roel Kluin <roel.kluin@gmail.com> Cc: David Brownell <dbrownell@users.sourceforge.net> Cc: dmitry pervushin <dpervushin@embeddedalley.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-11-17USB: option.c: add support for D-Link DWM-162-U5Zhang Le1-0/+2
Add D-Link DWM-162-U5 device id 1e0e:ce16 into option driver. The device has 4 interfaces, of which 1 is handled by storage and the other 3 by option driver. The device appears first as CD-only 05c6:2100 device and must be switched to 1e0e:ce16 mode either by using "eject CD" or usb_modeswitch. The MessageContent for usb_modeswitch.conf is: "55534243e0c26a85000000000000061b000000020000000000000000000000" Signed-off-by: Zhang Le <r0bertz@gentoo.org> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-11-17USB: usbmon: fix bug in mon_buff_area_shrinkAlan Stern1-4/+7
This patch (as1299b) fixes a bug in an error-handling path of usbmon's binary interface. The storage area for URB data is divided into fixed-size blocks. If an URB's data can't be copied, the area reserved for it should be decreased to the size of the truncated information (rounded up to a block boundary). Rounding up the amount to be removed and subtracting it from the reserved size is definitely the wrong thing to do. Also, when the data for an isochronous URB can't be copied, we can still copy the isoc packet descriptors. In fact the current code does copy the descriptors, but then sets the capture length to 0 so they remain inaccessible. The capture length should be reduced to the length of the descriptors, not set to 0. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Acked-by: Pete Zaitcev <zaitcev@redhat.com> CC: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-11-17USB: xhci: Fix scratchpad deallocation.Sarah Sharp1-1/+1
The scratchpad_free() function uses xhci->page_size to free some memory with pci_free_consistent(). However, the page_size is set to zero before the call, causing kernel oopses on driver unload. Call scratchpad_free() before setting xhci->page_size to zero. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Acked-by: John Youn <John.Youn@synopsys.com> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-11-17USB: xhci: Fix TRB physical to virtual address translation.Sarah Sharp1-2/+5
The trb_in_td() function in the xHCI driver is supposed to translate a physical transfer buffer request (TRB) into a virtual pointer to the ring segment that TRB is in. Unfortunately, a mistake in this function may cause endless loops as the driver searches through the linked list of ring segments over and over again. Fix a couple bugs that may lead to loops or bad output: 1. Bail out if we get a NULL pointer when translating the segment's private structure and the starting DMA address of the segment chunk. If this happens, we've been handed a starting TRB pointer from a different ring. 2. Make sure the function works when there's multiple segments in the ring. In the while loop to search through the ring segments, use the current segment variable (cur_seg), rather than the starting segment variable (start_seg) that is passed in. 3. Stop searching the ring if we've run through all the segments in the ring. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
2009-11-17USB: xhci: Fix bug memory free after failed initialization.Sarah Sharp1-3/+5
If the xHCI driver fails during the memory initialization, xhci->ir_set may not be a valid pointer. Check that it points to valid DMA'able memory before writing to that address during the memory freeing process. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>