1. 24 3月, 2011 10 次提交
    • J
      USB: cdc-acm: fix memory corruption / panic · 23b80550
      Johan Hovold 提交于
      Prevent read urbs from being resubmitted from tasklet after port close.
      
      The receive tasklet was not disabled on port close, which could lead to
      corruption of receive lists on consecutive port open. In particular,
      read urbs could be re-submitted before port open, added to free list in
      open, and then added a second time to the free list in the completion
      handler.
      
      cdc-acm.c: Entering acm_tty_open.
      cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x3 len: 0x0 result: 0
      cdc-acm.c: Entering acm_rx_tasklet
      cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da280, rcv 0xf57fbc24, buf 0xf57fbd64
      cdc-acm.c: set line: 115200 0 0 8
      cdc-acm.c: acm_control_msg: rq: 0x20 val: 0x0 len: 0x7 result: 7
      cdc-acm.c: acm_tty_close
      cdc-acm.c: acm_port_down
      cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x0 len: 0x0 result: 0
      cdc-acm.c: acm_ctrl_irq - urb shutting down with status: -2
      cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da300, rcv 0xf57fbc10, buf 0xf57fbd50
      cdc-acm.c: Entering acm_read_bulk with status -2
      cdc_acm 4-1:1.1: Aborting, acm not ready
      cdc-acm.c: Entering acm_read_bulk with status -2
      cdc_acm 4-1:1.1: Aborting, acm not ready
      cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da380, rcv 0xf57fbbfc, buf 0xf57fbd3c
      cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da400, rcv 0xf57fbbe8, buf 0xf57fbd28
      cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da480, rcv 0xf57fbbd4, buf 0xf57fbd14
      cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da900, rcv 0xf57fbbc0, buf 0xf57fbd00
      cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da980, rcv 0xf57fbbac, buf 0xf57fbcec
      cdc-acm.c: acm_rx_tasklet: sending urb 0xf50daa00, rcv 0xf57fbb98, buf 0xf57fbcd8
      cdc-acm.c: acm_rx_tasklet: sending urb 0xf50daa80, rcv 0xf57fbb84, buf 0xf57fbcc4
      cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dab00, rcv 0xf57fbb70, buf 0xf57fbcb0
      cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dab80, rcv 0xf57fbb5c, buf 0xf57fbc9c
      cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dac00, rcv 0xf57fbb48, buf 0xf57fbc88
      cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dac80, rcv 0xf57fbb34, buf 0xf57fbc74
      cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dad00, rcv 0xf57fbb20, buf 0xf57fbc60
      cdc-acm.c: acm_rx_tasklet: sending urb 0xf50dad80, rcv 0xf57fbb0c, buf 0xf57fbc4c
      cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da880, rcv 0xf57fbaf8, buf 0xf57fbc38
      cdc-acm.c: Entering acm_tty_open.
      cdc-acm.c: acm_control_msg: rq: 0x22 val: 0x3 len: 0x0 result: 0
      cdc-acm.c: Entering acm_rx_tasklet
      cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da280, rcv 0xf57fbc24, buf 0xf57fbd64
      cdc-acm.c: Entering acm_tty_write to write 3 bytes,
      cdc-acm.c: Get 3 bytes...
      cdc-acm.c: acm_write_start susp_count: 0
      cdc-acm.c: Entering acm_read_bulk with status 0
      ------------[ cut here ]------------
      WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:57 list_del+0x10c/0x120()
      Hardware name: Vostro 1520
      list_del corruption. next->prev should be f57fbc10, but was f57fbaf8
      Modules linked in: cdc_acm
      Pid: 3, comm: ksoftirqd/0 Not tainted 2.6.37+ #39
      Call Trace:
       [<c103c7e2>] warn_slowpath_common+0x72/0xa0
       [<c11dd8ac>] ? list_del+0x10c/0x120
       [<c11dd8ac>] ? list_del+0x10c/0x120
       [<c103c8b3>] warn_slowpath_fmt+0x33/0x40
       [<c11dd8ac>] list_del+0x10c/0x120
       [<f8051dbf>] acm_rx_tasklet+0xef/0x3e0 [cdc_acm]
       [<c135465d>] ? net_rps_action_and_irq_enable+0x6d/0x80
       [<c1042bb6>] tasklet_action+0xe6/0x140
       [<c104342f>] __do_softirq+0xaf/0x210
       [<c1043380>] ? __do_softirq+0x0/0x210
       <IRQ>  [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
       [<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
       [<c105ac24>] ? kthread+0x74/0x80
       [<c105abb0>] ? kthread+0x0/0x80
       [<c100337a>] ? kernel_thread_helper+0x6/0x10
      ---[ end trace efd9a11434f0082e ]---
      ------------[ cut here ]------------
      WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:57 list_del+0x10c/0x120()
      Hardware name: Vostro 1520
      list_del corruption. next->prev should be f57fbd50, but was f57fbdb0
      Modules linked in: cdc_acm
      Pid: 3, comm: ksoftirqd/0 Tainted: G        W   2.6.37+ #39
      Call Trace:
       [<c103c7e2>] warn_slowpath_common+0x72/0xa0
       [<c11dd8ac>] ? list_del+0x10c/0x120
       [<c11dd8ac>] ? list_del+0x10c/0x120
       [<c103c8b3>] warn_slowpath_fmt+0x33/0x40
       [<c11dd8ac>] list_del+0x10c/0x120
       [<f8051dd6>] acm_rx_tasklet+0x106/0x3e0 [cdc_acm]
       [<c135465d>] ? net_rps_action_and_irq_enable+0x6d/0x80
       [<c1042bb6>] tasklet_action+0xe6/0x140
       [<c104342f>] __do_softirq+0xaf/0x210
       [<c1043380>] ? __do_softirq+0x0/0x210
       <IRQ>  [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
       [<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
       [<c105ac24>] ? kthread+0x74/0x80
       [<c105abb0>] ? kthread+0x0/0x80
       [<c100337a>] ? kernel_thread_helper+0x6/0x10
      ---[ end trace efd9a11434f0082f ]---
      cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da300, rcv 0xf57fbc10, buf 0xf57fbd50
      cdc-acm.c: disconnected from network
      cdc-acm.c: acm_rx_tasklet: sending urb 0xf50da380, rcv 0xf57fbbfc, buf 0xf57fbd3c
      cdc-acm.c: Entering acm_rx_tasklet
      ------------[ cut here ]------------
      WARNING: at /home/johan/src/linux/linux-2.6/lib/list_debug.c:48 list_del+0xd5/0x120()
      Hardware name: Vostro 1520
      list_del corruption, next is LIST_POISON1 (00100100)
      Modules linked in: cdc_acm
      Pid: 3, comm: ksoftirqd/0 Tainted: G        W   2.6.37+ #39
      Call Trace:
       [<c103c7e2>] warn_slowpath_common+0x72/0xa0
       [<c11dd875>] ? list_del+0xd5/0x120
       [<c11dd875>] ? list_del+0xd5/0x120
       [<c103c8b3>] warn_slowpath_fmt+0x33/0x40
       [<c11dd875>] list_del+0xd5/0x120
       [<f8051fac>] acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm]
       [<c106dbab>] ? trace_hardirqs_on+0xb/0x10
       [<c1042b30>] ? tasklet_action+0x60/0x140
       [<c1042bb6>] tasklet_action+0xe6/0x140
       [<c104342f>] __do_softirq+0xaf/0x210
       [<c1043380>] ? __do_softirq+0x0/0x210
       <IRQ>  [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
       [<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
       [<c105ac24>] ? kthread+0x74/0x80
       [<c105abb0>] ? kthread+0x0/0x80
       [<c100337a>] ? kernel_thread_helper+0x6/0x10
      ---[ end trace efd9a11434f00830 ]---
      BUG: unable to handle kernel paging request at 00200200
      IP: [<c11dd7bd>] list_del+0x1d/0x120
      *pde = 00000000
      Oops: 0000 [#1] PREEMPT SMP
      last sysfs file: /sys/devices/pci0000:00/0000:00:1a.1/usb4/4-1/4-1:1.0/tty/ttyACM0/uevent
      Modules linked in: cdc_acm
      Pid: 3, comm: ksoftirqd/0 Tainted: G        W   2.6.37+ #39 0T816J/Vostro 1520
      EIP: 0060:[<c11dd7bd>] EFLAGS: 00010046 CPU: 0
      EIP is at list_del+0x1d/0x120
      EAX: f57fbd3c EBX: f57fb800 ECX: ffff8000 EDX: 00200200
      ESI: f57fbe90 EDI: f57fbd3c EBP: f600bf54 ESP: f600bf3c
       DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
      Process ksoftirqd/0 (pid: 3, ti=f600a000 task=f60791c0 task.ti=f6082000)
      Stack:
       c1527e84 00000030 c1527e54 00100100 f57fb800 f57fbd3c f600bf98 f8051fac
       f8053104 f8052b94 f600bf6c c106dbab f600bf80 00000286 f60791c0 c1042b30
       f57fbda8 f57f5800 f57fbdb0 f57fbd80 f57fbe7c c1656b04 00000000 f600bfb0
      Call Trace:
       [<f8051fac>] ? acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm]
       [<c106dbab>] ? trace_hardirqs_on+0xb/0x10
       [<c1042b30>] ? tasklet_action+0x60/0x140
       [<c1042bb6>] ? tasklet_action+0xe6/0x140
       [<c104342f>] ? __do_softirq+0xaf/0x210
       [<c1043380>] ? __do_softirq+0x0/0x210
       <IRQ>
       [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
       [<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
       [<c105ac24>] ? kthread+0x74/0x80
       [<c105abb0>] ? kthread+0x0/0x80
       [<c100337a>] ? kernel_thread_helper+0x6/0x10
      Code: ff 48 14 e9 57 ff ff ff 90 90 90 90 90 90 55 89 e5 83 ec 18 81 38 00 01 10 00 0f 84 9c 00 00 00 8b 50 04 81 fa 00 02 20 00 74 33 <8b> 12 39 d0 75 5c 8b 10 8b 4a 04 39 c8 0f 85 b5 00 00 00 8b 48
      EIP: [<c11dd7bd>] list_del+0x1d/0x120 SS:ESP 0068:f600bf3c
      CR2: 0000000000200200
      ---[ end trace efd9a11434f00831 ]---
      Kernel panic - not syncing: Fatal exception in interrupt
      Pid: 3, comm: ksoftirqd/0 Tainted: G      D W   2.6.37+ #39
      Call Trace:
       [<c13fede1>] ? printk+0x1d/0x24
       [<c13fecce>] panic+0x66/0x15c
       [<c10067df>] oops_end+0x8f/0x90
       [<c1025476>] no_context+0xc6/0x160
       [<c10255a8>] __bad_area_nosemaphore+0x98/0x140
       [<c103cf68>] ? release_console_sem+0x1d8/0x210
       [<c1025667>] bad_area_nosemaphore+0x17/0x20
       [<c1025a49>] do_page_fault+0x279/0x420
       [<c1006a8f>] ? show_trace+0x1f/0x30
       [<c13fede1>] ? printk+0x1d/0x24
       [<c10257d0>] ? do_page_fault+0x0/0x420
       [<c140333b>] error_code+0x5f/0x64
       [<c103007b>] ? select_task_rq_fair+0x37b/0x6a0
       [<c10257d0>] ? do_page_fault+0x0/0x420
       [<c11dd7bd>] ? list_del+0x1d/0x120
       [<f8051fac>] acm_rx_tasklet+0x2dc/0x3e0 [cdc_acm]
       [<c106dbab>] ? trace_hardirqs_on+0xb/0x10
       [<c1042b30>] ? tasklet_action+0x60/0x140
       [<c1042bb6>] tasklet_action+0xe6/0x140
       [<c104342f>] __do_softirq+0xaf/0x210
       [<c1043380>] ? __do_softirq+0x0/0x210
       <IRQ>  [<c1042c9a>] ? run_ksoftirqd+0x8a/0x1c0
       [<c1042c10>] ? run_ksoftirqd+0x0/0x1c0
       [<c105ac24>] ? kthread+0x74/0x80
       [<c105abb0>] ? kthread+0x0/0x80
       [<c100337a>] ? kernel_thread_helper+0x6/0x10
      panic occurred, switching back to text console
      ------------[ cut here ]------------
      
      Cc: stable <stable@kernel.org>
      Signed-off-by: NJohan Hovold <jhovold@gmail.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      23b80550
    • R
      USB: Fix 'bad dma' problem on WDM device disconnect · 878b753e
      Robert Lukassen 提交于
      In the WDM class driver a disconnect event leads to calls to
      usb_free_coherent to put back two USB DMA buffers allocated earlier.
      The call to usb_free_coherent uses a different size parameter
      (desc->wMaxCommand) than the corresponding call to usb_alloc_coherent
      (desc->bMaxPacketSize0).
      
      When a disconnect event occurs, this leads to 'bad dma' complaints
      from usb core because the USB DMA buffer is being pushed back to the
      'buffer-2048' pool from which it has not been allocated.
      
      This patch against the most recent linux-2.6 kernel ensures that the
      parameters used by usb_alloc_coherent & usb_free_coherent calls in
      cdc-wdm.c match.
      Signed-off-by: NRobert Lukassen <robert.lukassen@tomtom.com>
      Cc: stable <stable@kernel.org>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      878b753e
    • O
      usb: wwan: fix compilation without CONFIG_PM_RUNTIME · 97ac01d8
      Oliver Neukum 提交于
      The pm usage counter must be accessed with the proper wrappers
      to allow compilation under all configurations.
      Signed-off-by: NOliver Neukum <oneukum@suse.de>
      Reported-by: NEric Dumazet <eric.dumazet@gmail.com>
      Reported-by: NTao Ma <boyu.mt@taobao.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      97ac01d8
    • P
      USB: uss720 fixup refcount position · adaa3c63
      Peter Holik 提交于
      My testprog do a lot of bitbang - after hours i got following warning and my machine lockups:
      WARNING: at /build/buildd/linux-2.6.38/lib/kref.c:34
      After debugging uss720 driver i discovered that the completion callback was called before
      usb_submit_urb returns. The callback frees the request structure that is krefed on return by
      usb_submit_urb.
      Signed-off-by: NPeter Holik <peter@holik.at>
      Acked-by: NThomas Sailer <t.sailer@alumni.ethz.ch>
      Cc: stable <stable@kernel.org>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      adaa3c63
    • M
      usb: musb: blackfin: fix typo in new bfin_musb_vbus_status func · 45567c28
      Mike Frysinger 提交于
      The common code has a "get" in the middle, but each implementation
      does not have it.
      
      Cc: stable@kernel.org
      Signed-off-by: NMike Frysinger <vapier@gentoo.org>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      45567c28
    • B
      usb: musb: blackfin: fix typo in new dev_pm_ops struct · 8f7e7b87
      Bob Liu 提交于
      Cc: stable@kernel.org
      Signed-off-by: NBob Liu <lliubbo@gmail.com>
      Signed-off-by: NMike Frysinger <vapier@gentoo.org>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      8f7e7b87
    • M
      usb: musb: blackfin: fix typo in platform driver name · 417ddf86
      Mike Frysinger 提交于
      The modularization of the Blackfin driver set the name to "musb-blackfin"
      in all the boards, but "musb-bfin" in the driver itself.  Since the driver
      file name uses "blackfin", change the driver to "musb-blackfin".  This is
      also easier as it's only one file to change.
      
      Cc: stable@kernel.org
      Signed-off-by: NMike Frysinger <vapier@gentoo.org>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      417ddf86
    • H
      usb: musb: Fix for merge issue · 5f1e8ce7
      Hema HK 提交于
      There was conflict while merging 2 patches. Enabling vbus code
      is wrongly moved to error check if loop.
      
      This is a fix to resolve the merge issue.
      Signed-off-by: NHema HK <hemahk@ti.com>
      Cc: Felipe Balbi <balbi@ti.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      5f1e8ce7
    • A
      ehci-hcd: Bug fix: don't set a QH's Halt bit · b5a3b3d9
      Alan Stern 提交于
      This patch (as1453) fixes a long-standing bug in the ehci-hcd driver.
      
      There is no need to set the Halt bit in the overlay region for an
      unlinked or blocked QH.  Contrary to what the comment says, setting
      the Halt bit does not cause the QH to be patched later; that decision
      (made in qh_refresh()) depends only on whether the QH is currently
      pointing to a valid qTD.  Likewise, setting the Halt bit does not
      prevent completions from activating the QH while it is "stopped"; they
      are prevented by the fact that qh_completions() temporarily changes
      qh->qh_state to QH_STATE_COMPLETING.
      
      On the other hand, there are circumstances in which the QH will be
      reactivated _without_ being patched; this happens after an URB beyond
      the head of the queue is unlinked.  Setting the Halt bit will then
      cause the hardware to see the QH with both the Active and Halt bits
      set, an invalid combination that will prevent the queue from
      advancing and may even crash some controllers.
      
      Apparently the only reason this hasn't been reported before is that
      unlinking URBs from the middle of a running queue is quite uncommon.
      However Test 17, recently added to the usbtest driver, does exactly
      this, and it confirms the presence of the bug.
      
      In short, there is no reason to set the Halt bit for an unlinked or
      blocked QH, and there is a very good reason not to set it.  Therefore
      the code that sets it is removed.
      Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
      Tested-by: NAndiry Xu <andiry.xu@amd.com>
      CC: David Brownell <david-b@pacbell.net>
      CC: <stable@kernel.org>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      b5a3b3d9
    • M
      USB: Do not pass negative length to snoop_urb() · 9d02b426
      Michal Sojka 提交于
      When `echo Y > /sys/module/usbcore/parameters/usbfs_snoop` and
      usb_control_msg() returns error, a lot of kernel memory is dumped to dmesg
      until unhandled kernel paging request occurs.
      Signed-off-by: NMichal Sojka <sojkam1@fel.cvut.cz>
      Cc: stable@kernel.org
      Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      9d02b426
  2. 23 3月, 2011 30 次提交