commit cee12bcdaea811683461ea4b062216760adaa700 Author: Greg Kroah-Hartman Date: Thu Jul 30 16:06:41 2009 -0700 Linux 2.6.27.29 commit 7793fe88d9be428873468ccec2f107b1dc1c0bc2 Author: Ralf Baechle Date: Tue Jul 28 13:59:36 2009 -0700 NET: Fix locking issues in PPP, 6pack, mkiss and strip line disciplines. [ Upstream commit adeab1afb7de89555c69aab5ca21300c14af6369 ] Guido Trentalancia reports: I am trying to use the kiss driver in the Linux kernel that is being shipped with Fedora 10 but unfortunately I get the following oops: mkiss: AX.25 Multikiss, Hans Albas PE1AYX mkiss: ax0: crc mode is auto. ADDRCONF(NETDEV_CHANGE): ax0: link becomes ready ------------[ cut here ]------------ WARNING: at kernel/softirq.c:77 __local_bh_disable+0x2f/0x83() (Not tainted) [...] unloaded: microcode] Pid: 0, comm: swapper Not tainted 2.6.27.25-170.2.72.fc10.i686 #1 [] warn_on_slowpath+0x65/0x8b [] ? _spin_unlock_irqrestore+0x22/0x38 [] ? __enqueue_entity+0xe3/0xeb [] ? enqueue_entity+0x203/0x20b [] ? enqueue_task_fair+0x3b/0x3f [] ? resched_task+0x3a/0x6e [] ? _spin_unlock_irqrestore+0x22/0x38 [] ? _spin_lock_bh+0xb/0x16 [] __local_bh_disable+0x2f/0x83 [] local_bh_disable+0xb/0xd [] _spin_lock_bh+0xb/0x16 [] mkiss_receive_buf+0x2fb/0x3a6 [mkiss] [] flush_to_ldisc+0xf7/0x198 [] tty_flip_buffer_push+0x41/0x51 [] ftdi_process_read+0x375/0x4ad [ftdi_sio] [] ftdi_read_bulk_callback+0x130/0x138 [ftdi_sio] [] usb_hcd_giveback_urb+0x63/0x93 [] uhci_giveback_urb+0xe5/0x15f [] uhci_scan_schedule+0x52e/0x767 [] ? psmouse_handle_byte+0xc/0xe5 [] ? acpi_ev_gpe_detect+0xd6/0xe1 [] uhci_irq+0x110/0x125 [] usb_hcd_irq+0x40/0xa3 [] handle_IRQ_event+0x2f/0x64 [] handle_level_irq+0x74/0xbe [] ? handle_level_irq+0x0/0xbe [] do_IRQ+0xc7/0xfe [] common_interrupt+0x28/0x30 [] ? acpi_idle_enter_simple+0x162/0x19d [] cpuidle_idle_call+0x60/0x92 [] cpu_idle+0x101/0x134 [] rest_init+0x4e/0x50 ======================= ---[ end trace b7cc8076093467ad ]--- ------------[ cut here ]------------ WARNING: at kernel/softirq.c:136 _local_bh_enable_ip+0x3d/0xc4() [...] Pid: 0, comm: swapper Tainted: G W 2.6.27.25-170.2.72.fc10.i686 [] warn_on_slowpath+0x65/0x8b [] ? _spin_unlock_irqrestore+0x22/0x38 [] ? __enqueue_entity+0xe3/0xeb [] ? enqueue_entity+0x203/0x20b [] ? enqueue_task_fair+0x3b/0x3f [] ? resched_task+0x3a/0x6e [] ? _spin_unlock_irqrestore+0x22/0x38 [] ? _spin_lock_bh+0xb/0x16 [] ? mkiss_receive_buf+0x33d/0x3a6 [mkiss] [] _local_bh_enable_ip+0x3d/0xc4 [] local_bh_enable_ip+0x8/0xa [] _spin_unlock_bh+0x11/0x13 [] mkiss_receive_buf+0x33d/0x3a6 [mkiss] [] flush_to_ldisc+0xf7/0x198 [] tty_flip_buffer_push+0x41/0x51 [] ftdi_process_read+0x375/0x4ad [ftdi_sio] [] ftdi_read_bulk_callback+0x130/0x138 [ftdi_sio] [] usb_hcd_giveback_urb+0x63/0x93 [] uhci_giveback_urb+0xe5/0x15f [] uhci_scan_schedule+0x52e/0x767 [] ? psmouse_handle_byte+0xc/0xe5 [] ? acpi_ev_gpe_detect+0xd6/0xe1 [] uhci_irq+0x110/0x125 [] usb_hcd_irq+0x40/0xa3 [] handle_IRQ_event+0x2f/0x64 [] handle_level_irq+0x74/0xbe [] ? handle_level_irq+0x0/0xbe [] do_IRQ+0xc7/0xfe [] common_interrupt+0x28/0x30 [] ? acpi_idle_enter_simple+0x162/0x19d [] cpuidle_idle_call+0x60/0x92 [] cpu_idle+0x101/0x134 [] rest_init+0x4e/0x50 ======================= ---[ end trace b7cc8076093467ad ]--- mkiss: ax0: Trying crc-smack mkiss: ax0: Trying crc-flexnet The issue was, that the locking code in mkiss was assuming it was only ever being called in process or bh context. Fixed by converting the involved locking code to use irq-safe locks. Review of other networking line disciplines shows that 6pack, both sync and async PPP and STRIP have similar issues. The ppp_async one is the most interesting one as it sorts out half of the issue as far back as 2004 in commit http://git.kernel.org/?p=linux/kernel/git/tglx/history.git;a=commitdiff;h=2996d8deaeddd01820691a872550dc0cfba0c37d Signed-off-by: Ralf Baechle Reported-by: Guido Trentalancia Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 4662e31e5b9ae9ad4e0422c97ed9c757ac6d678f Author: Krzysztof Halasa Date: Tue Jul 14 11:01:54 2009 +0000 E100: work around the driver using streaming DMA mapping for RX descriptors. [ Upstream commit 303d67c288319768b19ed8dbed429fef7eb7c275 ] E100 places it's RX packet descriptors inside skb->data and uses them with bidirectional streaming DMA mapping. Unfortunately it fails to transfer skb->data ownership to the device after it reads the descriptor's status, breaking on non-coherent (e.g., ARM) platforms. This have to be converted to use coherent memory for the descriptors. Signed-off-by: Krzysztof Halasa Acked-by: Jeff Kirsher Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 2fe2c6bb0303064bde3b8ca0fd90c4367868486e Author: David Dillow Date: Wed Jul 22 09:17:06 2009 -0700 r8169: avoid losing MSI interrupts [ Upstream commit f11a377b3f4e897d11f0e8d1fc688667e2f19708 ] The 8169 chip only generates MSI interrupts when all enabled event sources are quiescent and one or more sources transition to active. If not all of the active events are acknowledged, or a new event becomes active while the existing ones are cleared in the handler, we will not see a new interrupt. The current interrupt handler masks off the Rx and Tx events once the NAPI handler has been scheduled, which opens a race window in which we can get another Rx or Tx event and never ACK'ing it, stopping all activity until the link is reset (ifconfig down/up). Fix this by always ACK'ing all event sources, and loop in the handler until we have all sources quiescent. Signed-off-by: David Dillow Tested-by: Michael Buesch Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 4afc4dd4a332ebb48fde7cd30822ab5c5cd80d2d Author: David Brownell Date: Sat Jun 20 01:21:53 2009 -0700 usbnet cdc_subset: fix issues talking to PXA gadgets [ Upstream commit 6be832529a8129c9d90a1d3a78c5d503a710b6fc ] The host-side CDC subset driver is binding more specifically than it should ... only to PXA 210/25x/26x Linux-USB gadgets. Loosen that restriction to match the gadget driver driver. This will various PXA 27x and PXA 3xx devices happier when talking to Linux hosts, potentially others. Signed-off-by: David Brownell Tested-by: Aric D. Blumer Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 3154ee5364cf95cc3948589d870f6f6c957ba0a3 Author: David S. Miller Date: Tue Jun 16 05:40:30 2009 -0700 x25: Fix sleep from timer on socket destroy. [ Upstream commit 14ebaf81e13ce66bff275380b246796fd16cbfa1 ] If socket destuction gets delayed to a timer, we try to lock_sock() from that timer which won't work. Use bh_lock_sock() in that case. Signed-off-by: David S. Miller Tested-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman commit b0267e68735995b9b6d8e5d237b58fb25238bbaa Author: Anton Vorontsov Date: Fri Jun 26 09:28:42 2009 -0700 sky2: Fix checksum endianness [ Upstream commit b9389796fa4c87fbdff33816e317cdae5f36dd0b ] sky2 driver on PowerPC targets floods kernel log with following errors: eth1: hw csum failure. Call Trace: [ef84b8a0] [c00075e4] show_stack+0x50/0x160 (unreliable) [ef84b8d0] [c02fa178] netdev_rx_csum_fault+0x3c/0x5c [ef84b8f0] [c02f6920] __skb_checksum_complete_head+0x7c/0x84 [ef84b900] [c02f693c] __skb_checksum_complete+0x14/0x24 [ef84b910] [c0337e08] tcp_v4_rcv+0x4c8/0x6f8 [ef84b940] [c031a9c8] ip_local_deliver+0x98/0x210 [ef84b960] [c031a788] ip_rcv+0x38c/0x534 [ef84b990] [c0300338] netif_receive_skb+0x260/0x36c [ef84b9c0] [c025de00] sky2_poll+0x5dc/0xcf8 [ef84ba20] [c02fb7fc] net_rx_action+0xc0/0x144 The NIC is Yukon-2 EC chip revision 1. Converting checksum field from le16 to CPU byte order fixes the issue. Signed-off-by: Anton Vorontsov Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit e9f839f938d9e7843ac1c55246f6518745004713 Author: Michael Buesch Date: Thu Jun 18 07:03:47 2009 +0000 pegasus usb-net: Fix endianness bugs [ Upstream commit e3453f6342110d60edb37be92c4a4f668ca8b0c4 ] This fixes various endianness bugs. Some harmless and some real ones. This is tested on a PowerPC-64 machine. Signed-off-by: Michael Buesch Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit a00433ce2410baac10a57649bc67a8822577c5f9 Author: Herbert Xu Date: Wed Jun 24 03:55:41 2009 -0700 ipsec: Fix name of CAST algorithm [ Upstream commit 245acb87729bc76ba65c7476665c01837e0cdccb ] Our CAST algorithm is called cast5, not cast128. Clearly nobody has ever used it :) Signed-off-by: Herbert Xu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 44c470335d131e943fbaa4d34eb42a555591a478 Author: Ramon de Carvalho Valle Date: Tue Jul 28 13:58:22 2009 -0500 eCryptfs: parse_tag_3_packet check tag 3 packet encrypted key size (CVE-2009-2407) commit f151cd2c54ddc7714e2f740681350476cda03a28 upstream. The parse_tag_3_packet function does not check if the tag 3 packet contains a encrypted key size larger than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES. Signed-off-by: Ramon de Carvalho Valle [tyhicks@linux.vnet.ibm.com: Added printk newline and changed goto to out_free] Signed-off-by: Tyler Hicks Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 77773e094d22e44976a559b03d33726d24b3d817 Author: Tyler Hicks Date: Tue Jul 28 13:57:01 2009 -0500 eCryptfs: Check Tag 11 literal data buffer size (CVE-2009-2406) commit 6352a29305373ae6196491e6d4669f301e26492e upstream. Tag 11 packets are stored in the metadata section of an eCryptfs file to store the key signature(s) used to encrypt the file encryption key. After extracting the packet length field to determine the key signature length, a check is not performed to see if the length would exceed the key signature buffer size that was passed into parse_tag_11_packet(). Thanks to Ramon de Carvalho Valle for finding this bug using fsfuzzer. Signed-off-by: Tyler Hicks Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 3379cb9e7cfcde9dd9e775175383daea231ae423 Author: Giuseppe Mazzotta Date: Sun Jul 12 21:02:27 2009 -0700 Input: wistron_btns - recognize Maxdata Pro 7000 notebooks commit e705cee427e319665969ef7ac664f3612dec8899 upstream. This patch adds DMI information to automatically load the correct layout for the Maxdata Pro 7000X/DX notebook models. Such notebooks are clones of Fujitsu Amilo V2000, the hook for the v2000 is being used and I have tested that perfectly works. The immediate result of integrating this patch is that the five special buttons will work on these specific notebook models and that the RF killswitch will not be activated after suspend. This patch definitively obsoletes the fsam7400 module which I was still needing to enable wifi and to fix the RF killswitch suspend problem; in the current 2.6.30 kernel it is necessary to load the wistron_btns module with options 'force=1 keymap=1557/MS2141', which was not anyway a complete workaround. Signed-off-by: Giuseppe Mazzotta Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman commit 760fc210853f9b1893572c41ea42f878ae57b97f Author: Len Brown Date: Fri May 8 00:22:29 2009 -0400 ACPI: suspend: don't let device _PS3 failure prevent suspend commit 19bde778c1fd2574cc020a618d7d576f260271ca upstream. 6328a57401dc5f5cf9931738eb7268fcd8058c49 "Enable PNPACPI _PSx Support, v3" added a call to acpi_bus_set_power(handle, ACPI_STATE_D3) to pnpacpi_disable_resource() before the existing call to evaluate _DIS on the device. This caused suspend to fail on the system in http://bugzilla.kernel.org/show_bug.cgi?id=13243 because the sanity check to verify we entered _PS3 failed on the serial port. As a work-around, that sanity check can be disabled system-wide with "acpi.power_nocheck=1" Or perhaps we should just shrug off the _PS3 failure and carry on with _DIS like we used to -- which is what this patch does. Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit d2423fbb8d344ece0e3b6116cd30fc6d1d8a4692 Author: Witold Szczeponik Date: Mon Mar 30 19:31:06 2009 +0200 Enable PNPACPI _PSx Support, v3 commit 6328a57401dc5f5cf9931738eb7268fcd8058c49 upstream. (This is an update to the patch presented earlier in http://lkml.org/lkml/2008/12/8/284, with new error handling.) This patch sets the power of PnP ACPI devices to D0 when they are activated and to D3 when they are disabled. The latter is in correspondence with the ACPI 3.0 specification, whereas the former is added in order to be able to power up a device after it has been previously disabled (or when booting up a system). (As a consequence, the patch makes the PnP ACPI code more ACPI compliant.) Section 6.2.2 of the ACPI Specification (at least versions 1.0b and 3.0a) states: "Prior to running this control method [_DIS], the OS[PM] will have already put the device in the D3 state." Unfortunately, there is no clear statement as to when to put a device in the D0 state. :-( Therefore, the patch executes the method calls as _PS3/_DIS and _SRS/_PS0. What is clear: "If the device is disabled, _SRS enables the device at the specified resources." (From the ACPI 3.0a Specification.) The patch fixes a problem with some IBM ThinkPads (at least the 600E and the 600X) where the serial ports have a dedicated power source that needs to be brought up before the serial port can be used. Without this patch, the serial port is enabled but has no power. (In the past, the tpctl utility had to be utilized to turn on the power, but support for this feature stopped with version 5.9 as it did not support the more recent kernel versions.) The error handlers that handle any errors that can occur during the power up/power down phases return the error codes to the caller directly. Comments welcome! :-) No regressions were observed on hardware that does not require this patch. The patch is applied against 2.6.27.x. Signed-off-by: Witold Szczeponik Acked-by: Zhao Yakui Signed-off-by: Len Brown Signed-off-by: Greg Kroah-Hartman commit f6388ebe44447698ac59b5c080cdd124ba14e578 Author: Alexey Starikovskiy Date: Wed Jan 14 02:57:47 2009 +0300 ACPI: EC: Limit workaround for ASUS notebooks even more commit 235c4a59278eb07e61d909f1f0c233733034a8b3 upstream. References: http://bugzilla.kernel.org/show_bug.cgi?id=11884 Signed-off-by: Alexey Starikovskiy Signed-off-by: Len Brown Cc: Thomas Renninger Signed-off-by: Greg Kroah-Hartman commit e62dadc0d24e3cfe4b8e45abae52ae72ab5c9dd1 Author: Trond Myklebust Date: Wed Mar 11 14:37:58 2009 -0400 SUNRPC: Don't disconnect if a connection is still in progress. commit 40d2549db5f515e415894def98b49db7d4c56714 upstream. Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 905e167d6445fb70c40d91c100cf88d7ad78a6ed Author: Trond Myklebust Date: Wed Mar 11 14:37:58 2009 -0400 SUNRPC: Ensure we set XPRT_CLOSING only after we've sent a tcp FIN... commit 670f94573104b4a25525d3fcdcd6496c678df172 upstream. ...so that we can distinguish between when we need to shutdown and when we don't. Also remove the call to xs_tcp_shutdown() from xs_tcp_connect(), since xprt_connect() makes the same test. Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 33a03f71c22bde120f8915bf0125ef6f40a55b46 Author: Trond Myklebust Date: Wed Mar 11 14:37:57 2009 -0400 SUNRPC: Avoid an unnecessary task reschedule on ENOTCONN commit 15f081ca8ddfe150fb639c591b18944a539da0fc upstream. If the socket is unconnected, and xprt_transmit() returns ENOTCONN, we currently give up the lock on the transport channel. Doing so means that the lock automatically gets assigned to the next task in the xprt->sending queue, and so that task needs to be woken up to do the actual connect. The following patch aims to avoid that unnecessary task switch. Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman commit 034b03f44cba675abf2550324c4b2ebc1a4a85b3 Author: Linus Torvalds Date: Mon Jun 22 10:25:25 2009 -0700 x86: don't use 'access_ok()' as a range check in get_user_pages_fast() [ Upstream commit 7f8189068726492950bf1a2dcfd9b51314560abf - modified for stable to not use the sloppy __VIRTUAL_MASK_SHIFT ] It's really not right to use 'access_ok()', since that is meant for the normal "get_user()" and "copy_from/to_user()" accesses, which are done through the TLB, rather than through the page tables. Why? access_ok() does both too few, and too many checks. Too many, because it is meant for regular kernel accesses that will not honor the 'user' bit in the page tables, and because it honors the USER_DS vs KERNEL_DS distinction that we shouldn't care about in GUP. And too few, because it doesn't do the 'canonical' check on the address on x86-64, since the TLB will do that for us. So instead of using a function that isn't meant for this, and does something else and much more complicated, just do the real rules: we don't want the range to overflow, and on x86-64, we want it to be a canonical low address (on 32-bit, all addresses are canonical). Acked-by: Ingo Molnar Cc: H. Peter Anvin Cc: Thomas Gleixner Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 30629ea3f895f3329530598d6b048e116a9bc593 Author: Andi Kleen Date: Sat Jul 18 08:56:57 2009 +0200 x86-64: Fix bad_srat() to clear all state commit 429b2b319af3987e808c18f6b81313104caf782c upstream. Need to clear both nodes and nodes_add state for start/end. Signed-off-by: Andi Kleen LKML-Reference: <20090718065657.GA2898@basil.fritz.box> Signed-off-by: H. Peter Anvin Signed-off-by: Greg Kroah-Hartman commit e9d83e0a2edc0e528434bad4a7018533a27219cc Author: Josef Bacik Date: Sun Jul 5 12:08:18 2009 -0700 mm: mark page accessed before we write_end() commit c8236db9cd7aa492dcfcdcca702638e704abed49 upstream. In testing a backport of the write_begin/write_end AOPs, a 10% re-read regression was noticed when running iozone. This regression was introduced because the old AOPs would always do a mark_page_accessed(page) after the commit_write, but when the new AOPs where introduced, the only place this was kept was in pagecache_write_end(). This patch does the same thing in the generic case as what is done in pagecache_write_end(), which is just to mark the page accessed before we do write_end(). Signed-off-by: Josef Bacik Acked-by: Nick Piggin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 0ec8973e2473b358976f838020e4b98cbb80181e Author: NeilBrown Date: Wed Jul 1 11:14:04 2009 +1000 md: avoid dereferencing NULL pointer when accessing suspend_* sysfs attributes. commit b8d966efd9a46a9a35beac50cbff6e30565125ef upstream. If we try to modify one of the md/ sysfs files suspend_lo or suspend_hi when the array is not active, we dereference a NULL. Protect against that. Signed-off-by: NeilBrown Signed-off-by: Greg Kroah-Hartman commit 9b4ad0edf130c29ff92c48d5a20e418aeefe2f8f Author: Jiri Slaby Date: Sat Jul 11 13:42:37 2009 +0200 hwmon: (max6650) Fix lock imbalance commit 025dc740d01f99ccba945df1f9ef9e06b1c15d96 upstream. Add omitted update_lock to one switch/case in set_div. Signed-off-by: Jiri Slaby Acked-by: Hans J. Koch Signed-off-by: Jean Delvare Signed-off-by: Greg Kroah-Hartman commit 76fc198abd7d734d45a433e4e560521f0c9cacbc Author: Amerigo Wang Date: Wed Jul 1 01:06:26 2009 -0400 elf: fix one check-after-use commit e2dbe12557d85d81f4527879499f55681c3cca4f upstream. Check before use it. Signed-off-by: WANG Cong Cc: Alexander Viro Cc: David Howells Acked-by: Roland McGrath Acked-by: James Morris Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 062ca00319a240aed40c341a12ce75429f99cfee Author: Jiri Slaby Date: Fri Jun 19 23:24:11 2009 +0200 HID: hiddev, fix lock imbalance commit 4859484b0957ddc7fe3e0fa349d98b0f1c7876bd upstream. Add omitted BKL to one switch/case. Signed-off-by: Jiri Slaby Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 1e6b7c85d1cc4c3125522b50d7f23abf45441939 Author: Takashi Iwai Date: Fri Jul 24 16:51:47 2009 +0200 ALSA: hda - Fix mute control with some ALC262 models commit 8de56b7deb2534a586839eda52843c1dae680dc5 upstream. The master mute switch is wrongly implemented as checking the pointer instead of its value, thus it can be never muted. This patch fixes the issue. Reference: Novell bnc#404873 https://bugzilla.novell.com/show_bug.cgi?id=404873 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit ef29b161d4dc93595b6b3c5ba74f17edb29247e9 Author: Takashi Iwai Date: Mon Jul 20 15:42:51 2009 +0200 ALSA: ca0106 - Fix the max capture buffer size commit 34fdeb2d07102e07ecafe79dec170bd6733f2e56 upstream. The capture buffer size with 64kB seems broken with CA0106. At least, either the update timing or the DMA position is wrong, and this screws up pulseaudio badly. This patch restricts the max buffer size less than that to make life a bit easier. Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 3c0258ef01da990be4b7e5ab3ae1c8642f26ba98 Author: Greg Kroah-Hartman Date: Fri Jun 26 08:05:20 2009 -0700 USB: ti_usb_3410_5052: fix duplicate device ids. commit 3c43f27bf57b0502df2478253699559ee1d43f6d upstream. commit 1a1fab513734b3a4fca1bee8229e5ff7e1cb873c accidentally added the device id to both tables in the driver, which causes problems as this is only a single port device, not a multiple port device. Signed-off-by: Greg Kroah-Hartman commit 358a8a7674166d6cf2dbb1378151483844a54197 Author: David Brownell Date: Fri Jun 19 03:09:04 2009 -0700 USB: RNDIS gadget, fix issues talking from PXA commit 4e19f220d4e84f5728cb7edde36352ab425cfba4 upstream. The reworked Ethernet gadget has an RNDIS interop problem when used with the CDC subset driver ... e.g. on PXA 2xx and 3xx hardware, which currently has a hard time talking to MS-Windows hosts. The issue is that Microsoft requires USB_CLASS_COMM. Fix by tweaking the CDC subset driver to not switch to USB_CLASS_VENDOR_SPEC if RNDIS is used in some other device configuration. [ UPDATED: some "statements" were comma-terminated; fix that. ] Signed-off-by: David Brownell Cc: Aric Blumer Signed-off-by: Greg Kroah-Hartman commit 0a9b8d3bae0dfe231e244e3b1952886248bd683e Author: Alan Stern Date: Mon Jun 29 11:04:54 2009 -0400 USB: handle zero-length usbfs submissions correctly commit 9180135bc80ab11199d482b6111e23f74d65af4a upstream. This patch (as1262) fixes a bug in usbfs: It refuses to accept zero-length transfers, and it insists that the buffer pointer be valid even if there is no data being transferred. The patch also consolidates a bunch of repetitive access_ok() checks into a single check, which incidentally fixes the lack of such a check for Isochronous URBs. Signed-off-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit d84b737af8969ff13cf2f1d2942ce50a6d9aa554 Author: Oliver Neukum Date: Tue Jun 30 09:44:24 2009 +0200 USB: fix uninitialised variable in ti_do_download commit 87ea8c887905d8b13ae90b537117592ed027632a upstream. Signed-off-by: Oliver Neukum Cc: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 4f487d4dae272ae4431af968d67aa358d59c5479 Author: Oliver Neukum Date: Sun Jun 28 23:34:14 2009 +0200 USB: fix memleak in usbfs commit d794a02111cd3393da69bc7d6dd2b6074bd037cc upstream. This patch fixes a memory leak in devio.c::processcompl If writing to user space fails the packet must be discarded, as it already has been removed from the queue of completed packets. Signed-off-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman commit 0efd92d2374b8c77951c10648948ea27200043d6 Author: Alan Stern Date: Mon Jun 29 14:34:59 2009 -0400 USB: EHCI: report actual_length for iso transfers commit ec6d67e39f5638c792eb7490bf32586ccb9d8005 upstream. This patch (as1259b) makes ehci-hcd return the total number of bytes transferred in urb->actual_length for Isochronous transfers. Until now, the actual_length value was unaccountably left at 0. Signed-off-by: Alan Stern Acked-by: David Brownell Signed-off-by: Greg Kroah-Hartman commit a40cc98181ba4a88ef00ba567fc4ae2cce5b6257 Author: Clemens Ladisch Date: Thu Jul 2 08:31:30 2009 +0200 sound: virtuoso: fix Xonar D1/DX silence after resume commit 826390796d09444b93e1f957582f8970ddfd9b3d upstream. When resuming, we better take the DACs out of the reset state before trying to use them. Reference: kernel bug #13599 http://bugzilla.kernel.org/show_bug.cgi?id=13599 Signed-off-by: Clemens Ladisch Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit 2a1495a3933cb333301693b32311f0798e6d2607 Author: Clemens Ladisch Date: Mon Jul 13 13:21:58 2009 +0200 sound: usb-audio: add workaround for Blue Microphones devices commit 8886f33f25083a47d5fa24ad7b57bb708c5c5403 upstream. Blue Microphones USB devices have an alternate setting that sends two channels of data to the computer. Unfortunately, the descriptors of that altsetting have a wrong channel setting, which means that any recorded data from such a device has twice the sample rate from what would be expected. This patch adds a workaround to ignore that altsetting. Since these devices have only one actual channel, no data is lost. Signed-off-by: Clemens Ladisch Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit d9120d6d357e869bd8d064b38ac33a6b48ba36c9 Author: James Bottomley Date: Wed Jun 24 19:55:22 2009 +0000 SCSI: zalon: fix oops on attach failure commit d3a263a8168f78874254ea9da9595cfb0f3e96d7 upstream. I recently discovered on my zalon that if the attachment fails because of a bus misconfiguration (I scrapped my HVD array, so the card is now unterminated) then the system oopses. The reason is that if ncr_attach() returns NULL (signalling failure) that NULL is passed by the goto failed straight into ncr_detach() which oopses. The fix is just to return -ENODEV in this case. Signed-off-by: James Bottomley Signed-off-by: Greg Kroah-Hartman commit 77a09356416cd30aaef5111c5a20c2167479e635 Author: Tilman Schmidt Date: Wed Jul 1 11:20:57 2009 +0000 gigaset: accept connection establishment messages in any order commit bceb0f126f25184eaec3f3c8f00c92b0d899e5de upstream. ISDN connection setup failed if the "connection active" and "B channel up" messages from the device arrived in a different order than expected. Modify the state machine to accept them in any order. Impact: bugfix Signed-off-by: Tilman Schmidt Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit c6e23180eed05084ec631b2d2de0e94df8b48c74 Author: Paul E. McKenney Date: Thu Jun 25 12:31:37 2009 -0700 fix RCU-callback-after-kmem_cache_destroy problem in sl[aou]b commit 7ed9f7e5db58c6e8c2b4b738a75d5dcd8e17aad5 upstream. Jesper noted that kmem_cache_destroy() invokes synchronize_rcu() rather than rcu_barrier() in the SLAB_DESTROY_BY_RCU case, which could result in RCU callbacks accessing a kmem_cache after it had been destroyed. Acked-by: Matt Mackall Reported-by: Jesper Dangaard Brouer Signed-off-by: Paul E. McKenney Signed-off-by: Pekka Enberg Signed-off-by: Greg Kroah-Hartman