When dw_mci_pre_dma_transfer returns failure in some reasons,
dw_mci_submit_data will prepare to switch the PIO mode from DMA.
After switching to PIO mode, DMA(IDMAC in particular) is still
enabled. This makes the corruption in handling interrupt and
the driver lock-up.
Signed-off-by: NSeungwon Jeon <tgih.jun@samsung.com>
Acked-by: NWill Newton <will.newton@imgtec.com>
Signed-off-by: NChris Ball <cjb@laptop.org>

MMC bus is using legacy suspend/resume method, which is not compatible if
runtime pm callbacks are used. In this scenario, MMC bus suspend/resume
callbacks cannot be called when system entering S3. So change to use the
new defined dev_pm_ops for system sleeping mode.

Tested on AM335x Platform. Solves major issue/crash reported at
http://www.mail-archive.com/linux-omap@vger.kernel.org/msg65425.htmlSigned-off-by: NChuanxiao Dong <chuanxiao.dong@intel.com>
Tested-by: NHebbar, Gururaja <gururaja.hebbar@ti.com>
Acked-by: NLinus Walleij <linus.walleij@linaro.org>
Acked-by: NUlf Hansson <ulf.hansson@stericsson.com>
Signed-off-by: NChris Ball <cjb@laptop.org>

of_have_populated_dt() is not expected to be used in drivers but
instead only in early platform init code.
Drivers on the other hand should rely on dev->of_node or of_match_device().
Besides usage of of_have_populated_dt() also throws up build error as below
which was reported by Balaji TK, when omap_hsmmc is built as a module.

ERROR: "allnodes" [drivers/mmc/host/omap_hsmmc.ko] undefined!
make[1]: *** [__modpost] Error 1
make: *** [modules] Error 2

So get rid of all of_have_populated_dt() usage in omap_hsmmc driver and
instead use dev->of_node to make the same dicisions as earlier.
Signed-off-by: NRajendra Nayak <rnayak@ti.com>
Reported-by: NBenoit Cousson <b-cousson@ti.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Acked-by: NRob Herring <rob.herring@calxeda.com>
Reviewed-by: NBalaji T K <balajitk@ti.com>
Signed-off-by: NChris Ball <cjb@laptop.org>

Commit 46856a68 ("mmc: omap_hsmmc: Convert hsmmc driver to use device tree")
introduced in 3.4-rc1 has a missing semi-colon, causing:

drivers/mmc/host/omap_hsmmc.c:1745: error: expected ',' or ';' before 'extern'
Reported-by: NRussell King <linux@arm.linux.org.uk>
Signed-off-by: NChris Ball <cjb@laptop.org>

eMMC v4.5 sanitize operation erases all copies of unmapped
data.  However trim or erase operations must be used first
to unmap the required sectors.  That was not being done.

Fixes apply to linux 3.2 on.
Signed-off-by: NAdrian Hunter <adrian.hunter@intel.com>
Cc: <stable@vger.kernel.org>
Acked-by: NJaehoon Chung <jh80.chung@samsung.com>
Acked-by: NLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: NChris Ball <cjb@laptop.org>

eMMC v4.5 discard operation is significantly different from the
existing trim operation because it is not guaranteed to work with
the new sanitize operation.  Consequently mmc_can_trim() is
separated from mmc_can_discard().

Also the new discard operation does not result in the sectors being
set to all-zeros, so discard_zeroes_data must not be set.

In addition, the new discard has the same timeout as trim, but from
v4.5 trim is defined to use the hc timeout.  The timeout calculation
is adjusted accordingly.

Fixes apply to linux 3.2 on.
Signed-off-by: NAdrian Hunter <adrian.hunter@intel.com>
Cc: <stable@vger.kernel.org>
Acked-by: NJaehoon Chung <jh80.chung@samsung.com>
Acked-by: NLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: NChris Ball <cjb@laptop.org>

This reverts commit cf450136.

It breaks reboot on at least one Thinkpad T43, as reported by Jörg Otte:
 "On reboot it shuts down as normal.
  The last lines displayed are:

  >Unmounting temporary filesystems.. [OK]
  >Deactivating swap...               [OK]
  >Unmounting local filesystems...    [OK]
  >Will now restart
  >    Restarting system

  Then I hear it accessing the cd-drive, but then it's being stuck."

Jörg bisected the regression to this commit.

That commit fixes another machine (see

  https://bugzilla.kernel.org/show_bug.cgi?id=11533

for details) that has a BIOS bug and doesn't support ACPI reset.
However, at least one of those other reporters no longer even has the
machine in question, and had a different workaround to begin with.
Besides, it clearly was a buggy BIOS.  Let's not break the correct case
to fix that case.
Reported-and-bisected-by: NJörg Otte <jrg.otte@googlemail.com>
Cc: linux-acpi@vger.kernel.org
Cc: Len Brown <lenb@kernel.org>
Cc: Peter Anvin <hpa@zytor.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fixed too small hardcoded timeout values for usb_control_msg
in driver for SiliconLabs cp210x-based usb-to-serial adapters.
Replaced with USB_CTRL_GET_TIMEOUT/USB_CTRL_SET_TIMEOUT.
Signed-off-by: NYuri Matylitski <ym@tekinsoft.com>
Acked-by: NKirill A. Shutemov <kirill@shutemov.name>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

tty_unlock is used on all other exits from the function.
Signed-off-by: NJulia Lawall <Julia.Lawall@lip6.fr>
Acked-by: NJiri Slaby <jslaby@suse.cz>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

linux/drivers/xen/manage.c: In function 'do_suspend':
linux/drivers/xen/manage.c:160:5: warning: 'si.cancelled' may be used uninitialized in this function
Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>

A rather annoying and common case is when booting a PVonHVM guest
and exposing the PV KBD and PV VFB - as broken toolstacks don't
always initialize the backends correctly.

Normally The HVM guest is using the VGA driver and the emulated
keyboard for this (though upstream version of QEMU implements
PV KBD, but still uses a VGA driver). We provide a very basic
two-stage wait mechanism - where we wait for 30 seconds for all
devices, and then for 270 for all them except the two mentioned.

That allows us to wait for the essential devices, like network
or disk for the full 6 minutes.

To trigger this, put this in your guest config:

vfb = [ 'vnc=1, vnclisten=0.0.0.0 ,vncunused=1']

instead of this:
vnc=1
vnclisten="0.0.0.0"

CC: stable@kernel.org
Acked-by: NStefano Stabellini <stefano.stabellini@eu.citrix.com>
[v3: Split delay in non-essential (30 seconds) and essential
 devices per Ian and Stefano suggestion]
[v4: Added comments per Stefano suggestion]
Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>

The refactoring of the nv50 logic, introduced in 8663bc7c, modified the
test for the special lane map used on some Apple computers with Nvidia
chipsets. The tested MBA3,1 would still boot, but resume from suspend
stopped working. This patch restores the old test, which fixes the problem.
Signed-off-by: NHenrik Rydberg <rydberg@euromail.se>
Acked-by: NBen Skeggs <bskeggs@redhat.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

When the force changes went in back in 3.3.0, we ended up returning
disconnected in the !force case, and the connected in when forced,
as it hit the hardcoded check.

Fix it so all exits go via the hardcoded check and stop spurious
modesets on platforms with hardcoded EDIDs.

Reported-by: Evan McNabb (Red Hat)
Reviewed-by: NAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: NDave Airlie <airlied@redhat.com>

During DRM release, all the FBs and gem objects are released. If
a gem object is being used as a FB and set to a crtc, it must not
be freed before releasing the framebuffer first.

If FBs are released first, the crtc using the FB is disabled first
so now the GEM object can be freed safely. The CRTC will be enabled
again when the driver restores fbdev mode.
Signed-off-by: NPrathyush K <prathyush.k@samsung.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

NUL-terminate after strncpy.

If the parameter "profile" has length 16 or more, then strncpy
leaves "string" with no NUL terminator, so the following search
for '\n' may read beyond the end of that 16-byte buffer.
If it finds a newline there, then it will also write beyond the
end of that stack buffer.
Signed-off-by: NJim Meyering <meyering@redhat.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

The output of "make versioncheck" points a incorrect include of
version.h in the drivers/gpu/drm/gma500/mdfld_dsi_output.h:

drivers/gpu/drm/gma500/mdfld_dsi_output.h: 32 linux/version.h not needed.

If we take a look in the file, we can agree to remove it.

Cc: David Airlie <airlied@linux.ie>
Cc: <dri-devel@lists.freedesktop.org>
Signed-off-by: NMarcos Paulo de Souza <marcos.souza.org@gmail.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

If AGP is placed in the middle, the size_af is off-by-one, it results
in VRAM being placed at 0x7fffffff instead of 0x8000000.

v2: fix the vram_start setup.
v3: also fix r7xx & newer ASIC

Reported-by: russiane39 on #radeon
Signed-off-by: NJerome Glisse <jglisse@redhat.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

Free event and restore event_space only when page_flip->flags has
DRM_MODE_PAGE_FLIP_EVENT if page_flip() is failed.
Signed-off-by: NJoonyoung Shim <jy0922.shim@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Reviewed-by: NMichel Dänzer <michel.daenzer@amd.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

The check of the encoder type in the commit [e00e8b5e: drm/radeon/kms:
fix analog load detection on DVI-I connectors] is obviously wrong, and
it's the culprit of the regression on my workstation with DVI-analog
connection resulting in the blank output.

Fixed the typo now.
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Reviewed-by: NAlex Deucher <alexander.deucher@amd.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NDave Airlie <airlied@redhat.com>

Commit 4f5ca836 "HID: hid-input: add support for HID devices reporting
Battery Strength" added the CONFIG_HID_BATTERY_STRENGTH option to report
the battery strength of HID devices.  The commit log explicitly mentions
it not working properly with recent userspace, but it is default y
anyway.  This is rather odd, and actually causes problems on real
systems.

This works around Fedora bug
https://bugzilla.redhat.com/show_bug.cgi?id=806295Signed-off-by: NJosh Boyer <jwboyer@redhat.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Allows this module to load correctly with certain debugging options on.

Reported on irc by scientes
Signed-off-by: NDave Airlie <airlied@redhat.com>

This driver anticipates pch_uart_verify_port() is not called
during installation.
However, actually pch_uart_verify_port() is called during
installation.
As a result, memory access violation occurs like below.

0. initial value: use_dma=0
1. starup()
    - dma channel is not allocated because use_dma=0
2. pch_uart_verify_port()
    - Set use_dma=1
3. UART processing acts DMA mode because use_dma=1
     - memory access violation occurs!

This patch fixes the issue.

Solution:
Whenever pch_uart_verify_port() is called and then
dma channel is not allocated, the channel should be allocated.
Signed-off-by: NTomoya MORINAGA <tomoya.rohm@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Since 2.6.30-rc1 clps711x serial driver hungs system. This is a result
of call disable_irq from ISR. synchronize_irq waits for end of interrupt
and goes to infinite loop. This patch fix this problem.
Signed-off-by: NAlexander Shiyan <shc_work@mail.ru>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This call is not needed; the IRQ controller should (and does) set up
interrupts correctly. set_irq_flags() isn't exported to modules, to
this also fixes compilation of ehci-tegra.c as a module.
Signed-off-by: NStephen Warren <swarren@nvidia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Current probing code is setting URB_NO_TRANSFER_DMA_MAP flag into a wrong urb
structure, and this causes BUG_ON with some USB host implementations.
This patch fixes the issue.
Signed-off-by: NTomoki Sekiyama <tomoki.sekiyama@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Removes allocation of coherent buffer for the control-request setup-packet
buffer from the yurex driver. Using coherent buffers for setup-packet is
obsolete and does not work with some USB host implementations.
Signed-off-by: NTomoki Sekiyama <tomoki.sekiyama@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Free the two previously allocated buffers before exiting the function in an
error case.
Signed-off-by: NJulia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Since commit 28c56ea1
(powerpc/usb: fix bug of kernel hang when initializing usb)
the kernel crashes on mpc5121e. mpc5121e doesn't have system interface
registers, accessing this register address space cause the machine check
exception and a kernel crash:
...
[    1.294596] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    1.316491] fsl-ehci fsl-ehci.0: Freescale On-Chip EHCI Host Controller
[    1.337334] fsl-ehci fsl-ehci.0: new USB bus registered, assigned bus number 1
[    1.358548] Machine check in kernel mode.
[    1.375917] Caused by (from SRR1=49030): Transfer error ack signal
[    1.395505] Oops: Machine check, sig: 7 [#1]
[    1.413113] MPC5121 ADS
[    1.428718] Modules linked in:
[    1.444841] NIP: c026efc4 LR: c0278b50 CTR: 00000000
[    1.463342] REGS: df837ba0 TRAP: 0200   Not tainted  (3.3.0-08839-gb5174fa3)
[    1.484083] MSR: 00049030 <EE,ME,IR,DR>  CR: 42042022  XER: 20000000
[    1.504099] TASK = df834000[1] 'swapper' THREAD: df836000
[    1.509667] GPR00: 1c000000 df837c50 df834000 df9d74e0 00000003 00000010 00000000 00000000
[    1.531650] GPR08: 00000020 00000000 c037cdd8 e1088000 22042028 1001a69c 00000000 00000000
[    1.553762] GPR16: 1ffbce70 00000000 1fef5b28 1fef3e08 00000000 00000000 1ffcbc7c c045b264
[    1.575824] GPR24: 0000008b 00000002 c04a7dd0 e1088000 df33c960 df9d74e0 00000000 df9d7400
[    1.612295] NIP [c026efc4] ehci_fsl_setup_phy+0x110/0x124
[    1.632454] LR [c0278b50] ehci_fsl_setup+0x29c/0x304
[    1.652065] Call Trace:
[    1.668923] [df837c50] [c0278a40] ehci_fsl_setup+0x18c/0x304 (unreliable)
[    1.690332] [df837c70] [c025cba4] usb_add_hcd+0x1f0/0x66c
[    1.710377] [df837cb0] [c0277ab8] ehci_fsl_drv_probe+0x180/0x308
[    1.731322] [df837ce0] [c01fc7a8] platform_drv_probe+0x20/0x30
[    1.752202] [df837cf0] [c01fb0ac] driver_probe_device+0x8c/0x214
[    1.773491] [df837d10] [c01f956c] bus_for_each_drv+0x6c/0xa8
[    1.794279] [df837d40] [c01fafdc] device_attach+0xb4/0xd8
[    1.814574] [df837d60] [c01fa44c] bus_probe_device+0xa4/0xb4
[    1.835343] [df837d80] [c01f87a8] device_add+0x52c/0x5dc
[    1.855462] [df837dd0] [c01fcd58] platform_device_add+0x124/0x1d0
[    1.876558] [df837df0] [c036dcec] fsl_usb2_device_register+0xa0/0xd4
[    1.897512] [df837e10] [c036df28] fsl_usb2_mph_dr_of_probe+0x208/0x264
[    1.918253] [df837e90] [c01fc7a8] platform_drv_probe+0x20/0x30
[    1.938300] [df837ea0] [c01fb0ac] driver_probe_device+0x8c/0x214
[    1.958511] [df837ec0] [c01fb2f0] __driver_attach+0xbc/0xc0
[    1.978088] [df837ee0] [c01f9608] bus_for_each_dev+0x60/0x9c
[    1.997589] [df837f10] [c01fab88] driver_attach+0x24/0x34
[    2.016757] [df837f20] [c01fa744] bus_add_driver+0x1ac/0x274
[    2.036339] [df837f50] [c01fb898] driver_register+0x88/0x150
[    2.056052] [df837f70] [c01fcabc] platform_driver_register+0x68/0x78
[    2.076650] [df837f80] [c0446500] fsl_usb2_mph_dr_driver_init+0x18/0x28
[    2.097734] [df837f90] [c0003988] do_one_initcall+0x148/0x1b0
[    2.117934] [df837fc0] [c042d89c] kernel_init+0xfc/0x190
[    2.137667] [df837ff0] [c000d2c4] kernel_thread+0x4c/0x68
[    2.157240] Instruction dump:
[    2.174119] 90050004 4e800020 2f840003 419e0014 2f840004 409eff64 6400c000 4bffff5c
[    2.196000] 64001000 7c0004ac 812b0500 0c090000 <4c00012c> 61290200 7c0004ac 912b0500
[    2.218100] ---[ end trace 21659aedb84ad816 ]---
[    2.237089]
[    3.232940] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000007
[    3.232954]
[    3.271575] Rebooting in 1 seconds..

Check pdata->have_sysif_regs flag before accessing system interface
registers.
Signed-off-by: NAnatolij Gustschin <agust@denx.de>
Cc: Shengzhou Liu <Shengzhou.Liu@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Fatal errors such as a device disconnect must not trigger
error handling. The error returns must be checked.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

del_timer_sync() cannot be used in interrupt.
Replace it with del_timer() and a flag
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1544) fixes a problem affecting some EHCI controllers.
They can generate interrupts whenever the STS_FLR status bit is turned
on, even though that bit is masked out in the Interrupt Enable
register.

Since the driver doesn't use STS_FLR anyway, the patch changes the
interrupt routine to clear that bit whenever it is set, rather than
leaving it alone.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: NTomoya MORINAGA <tomoya.rohm@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/block/xen-blkback/xenbus.c: In function 'xen_blkbk_discard':
drivers/block/xen-blkback/xenbus.c:419:4: warning: passing argument 1 of 'dev_warn' makes pointer from integer without a cast
+[enabled by default]
include/linux/device.h:894:5: note: expected 'const struct device *' but argument is of type 'long int'

It is unclear how that mistake made it in. It surely is wrong.
Acked-by: NJens Axboe <axboe@kernel.dk>
Reported-by: NStephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>

Forbid port runtime pm by default because it has known hotplug issue.
User can allow it by, for example

echo auto > /sys/devices/pci0000:00/0000:00:1f.2/ata2/power/control
Signed-off-by: NLin Ming <ming.m.lin@intel.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

The following build warning is seen in some configurations.

drivers/hwmon/ads1015.c: In function 'show_in':
drivers/hwmon/ads1015.c:129: warning: 'in' may be used uninitialized in this function

Fix by separating the register read function from the code converting the result
into mV.
Signed-off-by: NGuenter Roeck <guenter.roeck@ericsson.com>
Cc: Dirk Eibach <eibach@gdsys.de>
Reviewed-by: NRobert Coulson <robert.coulson@ericsson.com>

Newer BKDG[1] versions recommend a different initialization value for
the running average range register in the northbridge. This improves
the power reading by avoiding counter saturations resulting in bogus
values for anything below about 80% of TDP power consumption.
Updated BIOSes will have this new value set up from the beginning,
but meanwhile we correct this value ourselves.
This needs to be done on all northbridges, even on those where the
driver itself does not register at.

This fixes the driver on all current machines to provide proper
values for idle load.

[1]
http://support.amd.com/us/Processor_TechDocs/42301_15h_Mod_00h-0Fh_BKDG.pdf
Chapter 3.8: D18F5xE0 Processor TDP Running Average (p. 452)
Signed-off-by: NAndre Przywara <andre.przywara@amd.com>
Acked-by: NJean Delvare <khali@linux-fr.org>
[guenter.roeck@ericsson.com: Removed unnecessary return statement]
Signed-off-by: NGuenter Roeck <guenter.roeck@ericsson.com>
Cc: stable@vger.kernel.org # 3.0+

This reverts commit 6fe0d062.

Paul bisected this regression.

The conversion was done blindly and is wrong, as it does not provide a
primary handler to disable the level type irq on the device level.
Neither does it set the IRQF_ONESHOT flag which handles that at the irq
line level.  This can't be done as the interrupt might be shared, though
we might extend the core to force it.

So an interrupt on this line will wake up the thread, but immediately
unmask the irq after that.  Due to the interrupt being level type the
hardware interrupt is raised over and over and prevents the irq thread
from handling it.  Fail.

request_irq() unfortunately does not refuse such a request and the patch
was obviously never tested with real interrupts.
Bisected-by: NPaul Bolle <pebolle@tiscali.nl>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Not only do the pageflip work without it at non-native modes (i.e. with
the panel fitter enabled), it also causes normal (non-pageflipped)
modesets to fail.
Reported-by: NAdam Jackson <ajax@redhat.com>
Tested-by: NAdam Jackson <ajax@redhat.com>
Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
Wanted-by-for-fixes: Dave Airlie <airlied@gmail.com>
Signed-Off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>

This patch (as1542) changes the criterion ehci-hcd uses to tell when
it needs to resume the controller's root hub.  A resume is needed when
a port status change is detected, obviously, but only if the root hub
is currently suspended.

Right now the driver tests whether the root hub is running, and that
is not the correct test.  In particular, if the controller has died
then the root hub should not be restarted.  In addition, some buggy
hardware occasionally requires the root hub to be running and
sending out SOF packets even while it is nominally supposed to be
suspended.

In the end, the test needs to be changed.  Rather than checking whether
the root hub is currently running, the driver will now check whether
the root hub is currently suspended.  This will yield the correct
behavior in all cases.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
CC: Peter Chen <B29397@freescale.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

These devices have a number of non serial interfaces as well.  Use
the existing "Direct IP" blacklist to prevent binding to interfaces
which are handled by other drivers.

We also extend the "Direct IP" blacklist with with interfaces only
seen in "QMI" mode, assuming that these devices use the same
interface numbers for serial interfaces both in "Direct IP" and in
"QMI" mode.
Signed-off-by: NBjørn Mork <bjorn@mork.no>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

A large `nents' from userspace could overflow the allocation size,
leading to memory corruption.

| alloc_sglist()
| usbtest_ioctl()

Use kmalloc_array() to avoid the overflow.
Signed-off-by: NXi Wang <xi.wang@gmail.com>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>