Recent alterations to the gdth_fill_raw_cmd() path no longer set the
sg_ranz field for zero transfer commands. However, this field is used
lower down in the function to initialise ha->cmd_len to the size of
the firmware packet.  If this uninitialised field contains a bogus
value, ha->cmd_len can become much larger than the actual firmware
packet and end up oopsing in gdth_copy_cmd() as it tries to copy this
huge packet to the device (usually because it runs into an unallocated
page).

The fix is to initialise the sg_ranz field to zero at the start of
gdth_fill_raw_cmd().
Signed-off-by: Joerg Dorchain <joerg@dorchain.net>
Acked-by: "Leubner, Achim" <Achim_Leubner@adaptec.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

This fix's an oops during driver load time.   mptsas_probe calls
mpt_attach(over in mptbase.c).  Inside that call, we read some
manufacturing config pages to setup some defaults.  While reading the
config pages, the firmware doesn't complete the reply in time, and we
have a timeout. The timeout results in hardreset handler being called.
The hardreset handler calls all the fusion upper layer driver reset
callback handlers.  The mptsas_ioc_reset function is the callback
handler in mptsas.c.   So where I'm getting to, is mptsas_ioc_reset is
getting called before scsi_host_alloc is called, and the pointer ioc->sh
is NULL as well as the hostdata. 
Signed-off-by: Judith Lebzelter <judith@osdl.org>
Acked-by: "Moore, Eric" <Eric.Moore@lsi.com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

If a PCI error is detected that cannot be recovered from, there
will be a double call of lpfc_pci_remove_one(), with the second call
resulting in a null-pointer dereference. The first call occurs in
lpfc_io_error_detected(), and the second call during pci device
remove. This patch eliminates the first call; its un-needed.
Signed-off-by: Linas Vepstas <linas@austin.ibm.com>
Acked-by: James Smart <James.Smart@Emulex.Com>
Signed-off-by: James Bottomley <James.Bottomley@SteelEye.com>

This reverts commit d2487cb4.

Russell King points out that it's obviously bogus, and I have to agree.
Not only does "irq" not even exist in that scope, but we obviously need
to free the irq that we actually requested, and that's IRQ_USB.
Reported-by: Russell King <rmk@arm.linux.org.uk>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Greg KH <greg@kroah.com>
Cc: David Brownell <david-b@pacbell.net>,
Cc: Milan Svoboda <msvoboda@ra.rockwell.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [IPV6] fix ipv6_getsockopt_sticky copy_to_user leak
  [IPV6]: Fix for ipv6_setsockopt NULL dereference
  [DCCP]: Initialise write_xmit_timer also on passive sockets
  [IPV4]: Fix rtm_to_ifaddr() error handling.

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
  [IA64] refresh config files
  [IA64] put kdump_find_rsvd_region in __init
  [IA64] Remove sparse warning from unwind code
  [IA64] add missing syscall trace clear
  [IA64] Cleanup in crash.c
  [IA64] kexec: declare ia64_mca_pal_base in mca.h rather than kexec.h
  [IA64] pci_get_legacy_ide_irq should return irq (not GSI)
  [IA64] whitespace fixes for include/asm-ia64/sal.h
  [IA64] Cache error recovery
  [IA64] Proper handling of TLB errors from duplicate itr.d dropins

* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/driver-2.6:
  kobject: new_device->kref wasn't putted after error in kobject_move()
  driver core: export device_rename
  Remove devfs from MAINTAINERS
  Driver core: add device symlink back to sysfs
  Revert "driver core: refcounting fix"

* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/pci-2.6:
  pci: fix section mismatch warning
  PCI: aer: fix section mismatch warning
  pcie: fix section mismatch warning
  PCI: allow multiple calls to pcim_pin_device()

* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6: (23 commits)
  USB Elan FTDI: check for workqueue creation
  USB: fix spinlock recursion in cdc-acm.c
  USB: fix Unaligned access in EHCI driver
  USB: Product ID for FT232RL in ftdi_sio
  USBNET: DM9501: Add Corega FEther USB-TXC support.
  USB: ipaq.c: Additional devices
  USB: further fix for usb-serial
  USB: fix usb-serial device naming bug
  USB: RTS/DTR signal patch for airprime driver
  USB: ftdi_sio: use port_probe / port_remove thereby fixing access to the latency_timer
  usb-serial: fix shutdown / device_unregister order
  USB: add Additional PIDs in ftdi_sio
  USB: add QL355P power supply ids to fdti_sio
  USB: New device IDs for cp2101 driver
  USB: kill dead code from hub.c
  USB: ratelimit debounce error messages
  USB: pxa2xx_udc: fix hardcoded irq number
  UHCI: fix port resume problem
  USB: set the correct interval for interrupt URBs
  USB: goku_udc: Remove crude cache coherency code
  ...

Delay the read of the EC status register until
after the event that caused it occurs -- otherwise
it is possible to read and act on stale status that was
associated with the previous event.

Do this with a perpetually incrementing "event_count" to detect
when a new event occurs and it is safe to read status.

There is no workaround for polling mode -- it is inherently
exposed to reading and acting on stale status, since it
doesn't have an interrupt to tell it the event completed.

http://bugzilla.kernel.org/show_bug.cgi?id=8110Signed-off-by: Alexey Starikovskiy <alexey.y.starikovskiy@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>

Avoid NULL pointer usage if workqueue creation failed.
Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
Cc: Pete Zaitcev <zaitcev@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

this fixes the spinlock recursion issue. The older fix was incomplete.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Acked-by: Pete Zaitcev <zaitcev@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

I get following warnings on spar64:
Kernel unaligned access at TPC[1000c9e4] ehci_hub_control+0x54c/0x68c [ehci_hcd]

Despite of the comment in the patched code, the type cast used there
does make unaligned access. The fix was made as it's done in
ohci-hub.c.
Signed-off-by: Max Dmitrichenko <dmitrmax@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Here is a patch adding the PID for the FT232RL to ftdi_sio. The patch
generates a warning during compilation because get_ftdi_divisor doesn't
explicitly handle the FT232RL with this patch, so I guess you don't want
to use it in its current state. It is all I could come up with with the
knowledge I have of the drivers at the moment, though, and I hope you
can have some use for it at least. It works fine with my DLP-TILT with
an FT232RL.

From: Gard Spreemann <spreeman@stud.ntnu.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Cc: Jeff Garzik <jeff@garzik.org>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Additional devices
Signed-off-by: Andre Spahlinger <uenz@gmx.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

this is a fix for the outstanding usb-serial issues.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Am Montag, 26. Februar 2007 15:16 schrieb Craig Schlenter:
> Hi Greg
> 
> 34ef50e5 is definitely
> the source of the problem. Reverting that makes the
> ftdi port show up as ttyUSB0 again for me and it
> can actually be opened.

This patch should fix the issue.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Craig Schlenter <craig@codefountain.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

I encountered some problems with the airprime driver in use with a Novatel
Merlin XU870:

Closing an open Connection to e.g. /dev/ttyUSB0 doesn't reset the
RTS/DTR lines of the Modem.  Consequently, when I use minicom to
establish a connection by "ATD*99#" the modem doesn't hang up even if i
exit minicom and so I cannot reuse the modem unless I remove it and plug
it in again.

With the attached patch, the RTS/DTR lines are resetted on a close.  The
code was mainly taken from the option.c driver.

Convert all the port specific code in attach / shutdown to use the new
port_probe / port_register callbacks from device_register /
device_unregister allowing adding the sysfs attributes to be added at
the correct time and to the serial port device itself, instead of to
the unadorned usb device, avoiding a NULL dereference.
Signed-off-by: Jim Radford <radford@blackbean.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Ensure that the ->port_remove() callbacks get called before the
->shutdown() callback which makeing the order symmetric with
->attach() being called before ->port_probe().
Signed-off-by: Jim Radford <radford@blackbean.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

I've developed some devices with FTDI chips (FT232xx). FTDI was so kind
to give some own PID's which I can use together with their VID. Some of
the devices are already very popular here and I have customers from
universities, institutes .....

I use the FTDI VID 0x0403. My PID's are:

0xff38 - IBS US485 (USB<-->RS422/485 interface)
0xff39 - IBS PIC-Programmer
0xff3a - IBS Card reader for PCMCIA SRAM-cards
0xff3b - IBS PK1 - Particel counter
0xff3c - IBS RS232 - Monitor
0xff3d - APP 70 (dust monitoring system)
0xff3e - IBS PEDO-Modem (RF modem 868.35 MHz)
0xff3f - future device

The company is "IBS Ing.-Buero Schleusener".


From: Thomas Schleusener <thomas@be-schl.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Here are two new device IDs for the cp2101 driver.
The diff is with linus's tree as of this evending.

From: Jon K Hellan <hellan@acm.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

this kills residual obsoletet code from hub.c
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

flaky hardware can cause a lot of debounce failed messages. To limit
the performance impact, a ratelimit should be used.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

This patch changes last use of hardcoded number of irq to
use platfrom_get_irq.
Signed-off-by: Milan Svoboda <msvoboda@ra.rockwell.com>
Acked-by: David Brownell <david-b@pacbell.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

This patch (as863) fixes a problem encountered sometimes when resuming
a port on a UHCI controller.  The hardware may turn off the
Resume-Detect bit before turning off the Suspend bit, leading usbcore
to think that the port is still suspended and the resume has failed.
The patch makes uhci_finish_suspend() wait until both bits are safely
off.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

This patch (as862) fixes a couple of bugs in the way usbcore handles
intervals for interrupt URBs.  usb_interrupt_msg (and usb_bulk_msg for
backward compatibility) don't set the interval correctly for
high-speed devices.  proc_do_submiturb() doesn't set it correctly when
a bulk URB is submitted to an interrupt endpoint.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

This is deep architecture specific magic and does should not to exist
in a driver.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>