-tty.current/serial-amba-pl010-fix-set_ldisc.patch

-tty.current/serial-mfd-fix-bug-in-serial_hsu_remove.patch

-usb.current/usb-musb_debugfs-don-t-use-the-struct-file-private_data-field-with-seq_files.patch

-usb.current/usb-ehci-disable-langwell-penwell-lpm-capability.patch

-usb.current/usb-otg-twl4030-fix-phy-initialization-v1.patch

-usb.current/usb-serial-mos-prevent-reading-uninitialized.patch

-usb.current/usb-musb-maintainers-fix-my-mail-address.patch

-staging.current/revert-staging-batman-adv-adding-netfilter-bridge-hooks.patch

-staging.current/staging-vt6655-fix-buffer-overflow.patch

-From sven.eckelmann@gmx.de Sun Sep 5 00:23:24 2010

-From: Sven Eckelmann <sven.eckelmann@gmx.de>

-Date: Sun, 5 Sep 2010 01:58:18 +0200

-Subject: Revert: "Staging: batman-adv: Adding netfilter-bridge hooks"

-To: greg@kroah.com

-Cc: b.a.t.m.a.n@lists.open-mesh.net, Sven Eckelmann <sven.eckelmann@gmx.de>

-Message-ID: <1283644718-653-2-git-send-email-sven.eckelmann@gmx.de>

-

-

-This reverts commit 96d592ed599434d2d5f339a1d282871bc6377d2c.

-

-The netfilter hook seems to be misused and may leak skbs in situations

-when NF_HOOK returns NF_STOLEN. It may not filter everything as

-expected. Also the ethernet bridge tables are not yet capable to

-understand batman-adv packet correctly.

-

-It was only added for testing purposes and can be removed again.

-

-Reported-by: Vasiliy Kulikov <segooon@gmail.com>

-Signed-off-by: Sven Eckelmann <sven.eckelmann@gmx.de>

-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

-

----

- drivers/staging/batman-adv/hard-interface.c | 13 -------------

- drivers/staging/batman-adv/send.c | 8 ++------

- 2 files changed, 2 insertions(+), 19 deletions(-)

-

---- a/drivers/staging/batman-adv/hard-interface.c

-+++ b/drivers/staging/batman-adv/hard-interface.c

-@@ -30,7 +30,6 @@

- #include "hash.h"

-

- #include <linux/if_arp.h>

--#include <linux/netfilter_bridge.h>

-

- #define MIN(x, y) ((x) < (y) ? (x) : (y))

-

-@@ -431,11 +430,6 @@ out:

- return NOTIFY_DONE;

- }

-

--static int batman_skb_recv_finish(struct sk_buff *skb)

--{

-- return NF_ACCEPT;

--}

--

- /* receive a packet with the batman ethertype coming on a hard

- * interface */

- int batman_skb_recv(struct sk_buff *skb, struct net_device *dev,

-@@ -456,13 +450,6 @@ int batman_skb_recv(struct sk_buff *skb,

- if (atomic_read(&module_state) != MODULE_ACTIVE)

- goto err_free;

-

-- /* if netfilter/ebtables wants to block incoming batman

-- * packets then give them a chance to do so here */

-- ret = NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_IN, skb, dev, NULL,

-- batman_skb_recv_finish);

-- if (ret != 1)

-- goto err_out;

--

- /* packet should hold at least type and version */

- if (unlikely(skb_headlen(skb) < 2))

- goto err_free;

---- a/drivers/staging/batman-adv/send.c

-+++ b/drivers/staging/batman-adv/send.c

-@@ -29,7 +29,6 @@

- #include "vis.h"

- #include "aggregation.h"

-

--#include <linux/netfilter_bridge.h>

-

- static void send_outstanding_bcast_packet(struct work_struct *work);

-

-@@ -92,12 +91,9 @@ int send_skb_packet(struct sk_buff *skb,

-

- /* dev_queue_xmit() returns a negative result on error. However on

- * congestion and traffic shaping, it drops and returns NET_XMIT_DROP

-- * (which is > 0). This will not be treated as an error.

-- * Also, if netfilter/ebtables wants to block outgoing batman

-- * packets then giving them a chance to do so here */

-+ * (which is > 0). This will not be treated as an error. */

-

-- return NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,

-- dev_queue_xmit);

-+ return dev_queue_xmit(skb);

- send_skb_err:

- kfree_skb(skb);

- return NET_XMIT_DROP;

-From error27@gmail.com Tue Sep 7 00:45:09 2010

-From: Dan Carpenter <error27@gmail.com>

-Date: Mon, 6 Sep 2010 14:32:30 +0200

-Subject: Staging: vt6655: fix buffer overflow

-To: Greg Kroah-Hartman <gregkh@suse.de>

-Cc: Charles Cl�ment <caratorn@gmail.com>, Jim Lieb <lieb@canonical.com>, devel@driverdev.osuosl.org, kernel-janitors@vger.kernel.org

-Message-ID: <20100906123230.GB2764@bicker>

-Content-Disposition: inline

-

-

-"param->u.wpa_associate.wpa_ie_len" comes from the user. We should

-check it so that the copy_from_user() doesn't overflow the buffer.

-

-Also further down in the function, we assume that if

-"param->u.wpa_associate.wpa_ie_len" is set then "abyWPAIE[0]" is

-initialized. To make that work, I changed the test here to say that if

-"wpa_ie_len" is set then "wpa_ie" has to be a valid pointer or we return

--EINVAL.

-

-Oddly, we only use the first element of the abyWPAIE[] array. So I

-suspect there may be some other issues in this function.

-

-Signed-off-by: Dan Carpenter <error27@gmail.com>

-Cc: stable <stable@kernel.org>

-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

-

----

- drivers/staging/vt6655/wpactl.c | 11 ++++++++---

- 1 file changed, 8 insertions(+), 3 deletions(-)

-

---- a/drivers/staging/vt6655/wpactl.c

-+++ b/drivers/staging/vt6655/wpactl.c

-@@ -766,9 +766,14 @@ static int wpa_set_associate(PSDevice pD

- DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wpa_ie_len = %d\n", param->u.wpa_associate.wpa_ie_len);

-

-

-- if (param->u.wpa_associate.wpa_ie &&

-- copy_from_user(&abyWPAIE[0], param->u.wpa_associate.wpa_ie, param->u.wpa_associate.wpa_ie_len))

-- return -EINVAL;

-+ if (param->u.wpa_associate.wpa_ie_len) {

-+ if (!param->u.wpa_associate.wpa_ie)

-+ return -EINVAL;

-+ if (param->u.wpa_associate.wpa_ie_len > sizeof(abyWPAIE))

-+ return -EINVAL;

-+ if (copy_from_user(&abyWPAIE[0], param->u.wpa_associate.wpa_ie, param->u.wpa_associate.wpa_ie_len))

-+ return -EFAULT;

-+ }

-

- if (param->u.wpa_associate.mode == 1)

- pMgmt->eConfigMode = WMAC_CONFIG_IBSS_STA;

-From mika.westerberg@iki.fi Sat Sep 4 21:04:11 2010

-From: Mika Westerberg <mika.westerberg@iki.fi>

-Date: Sat, 4 Sep 2010 10:23:23 +0300

-Subject: serial: amba-pl010: fix set_ldisc

-To: linux-kernel@vger.kernel.org

-Cc: Alan Cox <alan@linux.intel.com>, Russell King <rmk+kernel@arm.linux.org.uk>, gregkh@suse.de

-Message-ID: <20100904072323.GR25559@gw.healthdatacare.com>

-

-

-Commit d87d9b7d1 ("tty: serial - fix tty referencing in set_ldisc") changed

-set_ldisc to take ldisc number as parameter. This patch fixes AMBA PL010 driver

-according the new prototype.

-

-Signed-off-by: Mika Westerberg <mika.westerberg@iki.fi>

-Cc: Alan Cox <alan@linux.intel.com>

-Cc: Russell King <rmk+kernel@arm.linux.org.uk>

-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

-

----

- drivers/serial/amba-pl010.c | 9 ++-------

- 1 file changed, 2 insertions(+), 7 deletions(-)

-

---- a/drivers/serial/amba-pl010.c

-+++ b/drivers/serial/amba-pl010.c

-@@ -472,14 +472,9 @@ pl010_set_termios(struct uart_port *port

- spin_unlock_irqrestore(&uap->port.lock, flags);

- }

-

--static void pl010_set_ldisc(struct uart_port *port)

-+static void pl010_set_ldisc(struct uart_port *port, int new)

- {

-- int line = port->line;

--

-- if (line >= port->state->port.tty->driver->num)

-- return;

--

-- if (port->state->port.tty->ldisc->ops->num == N_PPS) {

-+ if (new == N_PPS) {

- port->flags |= UPF_HARDPPS_CD;

- pl010_enable_ms(port);

- } else

-From alan@linux.intel.com Tue Sep 7 00:48:03 2010

-From: Feng Tang <feng.tang@intel.com>

-Date: Mon, 06 Sep 2010 13:41:02 +0100

-Subject: serial: mfd: fix bug in serial_hsu_remove()

-To: greg@kroah.com, linux-serial@vger.kernel.org

-Message-ID: <20100906124102.1596.96288.stgit@localhost.localdomain>

-

-

-From: Feng Tang <feng.tang@intel.com>

-

-Medfield HSU driver deal with 4 pci devices(3 uart ports + 1 dma controller),

-so in pci remove func, we need handle them differently

-

-Signed-off-by: Feng Tang <feng.tang@intel.com>

-Signed-off-by: Alan Cox <alan@linux.intel.com>

-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

-

----

- drivers/serial/mfd.c | 17 +++++++++--------

- 1 file changed, 9 insertions(+), 8 deletions(-)

-

---- a/drivers/serial/mfd.c

-+++ b/drivers/serial/mfd.c

-@@ -1423,7 +1423,6 @@ static void hsu_global_init(void)

- }

-

- phsu = hsu;

--

- hsu_debugfs_init(hsu);

- return;

-

-@@ -1435,18 +1434,20 @@ err_free_region:

-

- static void serial_hsu_remove(struct pci_dev *pdev)

- {

-- struct hsu_port *hsu;

-- int i;

-+ void *priv = pci_get_drvdata(pdev);

-+ struct uart_hsu_port *up;

-

-- hsu = pci_get_drvdata(pdev);

-- if (!hsu)

-+ if (!priv)

- return;

-

-- for (i = 0; i < 3; i++)

-- uart_remove_one_port(&serial_hsu_reg, &hsu->port[i].port);

-+ /* For port 0/1/2, priv is the address of uart_hsu_port */

-+ if (pdev->device != 0x081E) {

-+ up = priv;

-+ uart_remove_one_port(&serial_hsu_reg, &up->port);

-+ }

-

- pci_set_drvdata(pdev, NULL);

-- free_irq(hsu->irq, hsu);

-+ free_irq(pdev->irq, priv);

- pci_disable_device(pdev);

- }

-

-From alan@linux.intel.com Tue Sep 7 00:49:05 2010

-From: Alek Du <alek.du@intel.com>

-Date: Mon, 06 Sep 2010 14:50:57 +0100

-Subject: USB: EHCI: Disable langwell/penwell LPM capability

-To: linux-usb@vger.kernel.org

-Message-ID: <20100906135040.4591.72919.stgit@localhost.localdomain>

-

-

-From: Alek Du <alek.du@intel.com>

-

-We have to do so due to HW limitation.

-

-Signed-off-by: Alek Du <alek.du@intel.com>

-Signed-off-by: Alan Cox <alan@linux.intel.com>

-Cc: stable <stable@kernel.org>

-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

-

-

----

- drivers/usb/host/ehci-pci.c | 5 +++++

- 1 file changed, 5 insertions(+)

-

---- a/drivers/usb/host/ehci-pci.c

-+++ b/drivers/usb/host/ehci-pci.c

-@@ -119,6 +119,11 @@ static int ehci_pci_setup(struct usb_hcd

- ehci->broken_periodic = 1;

- ehci_info(ehci, "using broken periodic workaround\n");

- }

-+ if (pdev->device == 0x0806 || pdev->device == 0x0811

-+ || pdev->device == 0x0829) {

-+ ehci_info(ehci, "disable lpm for langwell/penwell\n");

-+ ehci->has_lpm = 0;

-+ }

- break;

- case PCI_VENDOR_ID_TDI:

- if (pdev->device == PCI_DEVICE_ID_TDI_EHCI) {

-From linux-usb-owner@vger.kernel.org Thu Sep 16 12:12:37 2010

-From: Felipe Balbi <balbi@ti.com>

-To: Greg KH <greg@kroah.com>

-Cc: Felipe Balbi <balbi@ti.com>

-Subject: USB: musb: MAINTAINERS: Fix my mail address

-Date: Thu, 9 Sep 2010 09:04:25 +0300

-Message-Id: <1284012265-20479-1-git-send-email-balbi@ti.com>

-

-If we don't, contributors to musb and any USB OMAP

-code will be sending mails to an unexistent inbox.

-

-Signed-off-by: Felipe Balbi <balbi@ti.com>

-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

-

----

- MAINTAINERS | 4 ++--

- 1 file changed, 2 insertions(+), 2 deletions(-)

-

---- a/MAINTAINERS

-+++ b/MAINTAINERS

-@@ -3942,7 +3942,7 @@ F: drivers/char/isicom.c

- F: include/linux/isicom.h

-

- MUSB MULTIPOINT HIGH SPEED DUAL-ROLE CONTROLLER

--M: Felipe Balbi <felipe.balbi@nokia.com>

-+M: Felipe Balbi <balbi@ti.com>

- L: linux-usb@vger.kernel.org

- T: git git://gitorious.org/usb/usb.git

- S: Maintained

-@@ -4240,7 +4240,7 @@ S: Maintained

- F: drivers/char/hw_random/omap-rng.c

-

- OMAP USB SUPPORT

--M: Felipe Balbi <felipe.balbi@nokia.com>

-+M: Felipe Balbi <balbi@ti.com>

- M: David Brownell <dbrownell@users.sourceforge.net>

- L: linux-usb@vger.kernel.org

- L: linux-omap@vger.kernel.org

-From mathias.nyman@nokia.com Tue Sep 7 00:45:41 2010

-From: Mathias Nyman <mathias.nyman@nokia.com>

-Date: Mon, 6 Sep 2010 13:52:01 +0300

-Subject: usb: musb_debugfs: don't use the struct file private_data field with seq_files

-To: linux-usb@vger.kernel.org

-Cc: Mathias Nyman <mathias.nyman@nokia.com>

-Message-ID: <1283770321-16903-1-git-send-email-mathias.nyman@nokia.com>

-

-

-seq_files use the private_data field of a file struct for storing a seq_file structure,

-data should be stored in seq_file's own private field (e.g. file->private_data->private)

-Otherwise seq_release() will free the private data when the file is closed.

-

-Signed-off-by: Mathias Nyman <mathias.nyman@nokia.com>

-Cc: stable <stable@kernel.org>

-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

-

----

- drivers/usb/musb/musb_debugfs.c | 5 ++---

- 1 file changed, 2 insertions(+), 3 deletions(-)

-

---- a/drivers/usb/musb/musb_debugfs.c

-+++ b/drivers/usb/musb/musb_debugfs.c

-@@ -195,15 +195,14 @@ static const struct file_operations musb

-

- static int musb_test_mode_open(struct inode *inode, struct file *file)

- {

-- file->private_data = inode->i_private;

--

- return single_open(file, musb_test_mode_show, inode->i_private);

- }

-

- static ssize_t musb_test_mode_write(struct file *file,

- const char __user *ubuf, size_t count, loff_t *ppos)

- {

-- struct musb *musb = file->private_data;

-+ struct seq_file *s = file->private_data;

-+ struct musb *musb = s->private;

- u8 test = 0;

- char buf[18];

-

-From tom.leiming@gmail.com Tue Sep 7 00:49:51 2010

-From: tom.leiming@gmail.com

-Date: Mon, 6 Sep 2010 23:27:09 +0800

-Subject: USB: otg: twl4030: fix phy initialization(v1)

-To: greg@kroah.com

-Cc: linux-usb@vger.kernel.org, linux-omap@vger.kernel.org, linux-kernel@vger.kernel.org, Ming Lei <tom.leiming@gmail.com>, David Brownell <dbrownell@users.sourceforge.net>, Felipe Balbi <me@felipebalbi.com>, Anand Gadiyar <gadiyar@ti.com>, Mike Frysinger <vapier@gentoo.org>, Sergei Shtylyov <sshtylyov@ru.mvista.com>

-Message-ID: <1283786829-3564-1-git-send-email-tom.leiming@gmail.com>

-

-

-From: Ming Lei <tom.leiming@gmail.com>

-

-Commit 461c317705eca5cac09a360f488715927fd0a927(into 2.6.36-v3)

-is put forward to power down phy if no usb cable is connected,

-but does introduce the two issues below:

-

-1), phy is not into work state if usb cable is connected

-with PC during poweron, so musb device mode is not usable

-in such case, follows the reasons:

- -twl4030_phy_resume is not called, so

- regulators are not enabled

- i2c access are not enabled

- usb mode not configurated

-

-2), The kernel warings[1] of regulators 'unbalanced disables'

-is caused if poweron without usb cable connected

-with PC or b-device.

-

-This patch fixes the two issues above:

- -power down phy only if no usb cable is connected with PC

-and b-device

- -do phy initialization(via __twl4030_phy_resume) if usb cable

-is connected with PC(vbus event) or another b-device(ID event) in

-twl4030_usb_probe.

-

-This patch also doesn't put VUSB3V1 LDO into active mode in

-twl4030_usb_ldo_init until VBUS/ID change detected, so we can

-save more power consumption than before.

-

-This patch is verified OK on Beagle board either connected with

-usb cable or not when poweron.

-

-[1]. warnings of 'unbalanced disables' of regulators.

-[root@OMAP3EVM /]# dmesg

-------------[ cut here ]------------

-WARNING: at drivers/regulator/core.c:1357 _regulator_disable+0x38/0x128()

-unbalanced disables for VUSB1V8

-Modules linked in:

-Backtrace:

-[<c0030c48>] (dump_backtrace+0x0/0x110) from [<c034f5a8>] (dump_stack+0x18/0x1c)

- r7:c78179d8 r6:c01ed6b8 r5:c0410822 r4:0000054d

-[<c034f590>] (dump_stack+0x0/0x1c) from [<c0057da8>] (warn_slowpath_common+0x54/0x6c)

-[<c0057d54>] (warn_slowpath_common+0x0/0x6c) from [<c0057e64>] (warn_slowpath_fmt+0x38/0x40)

- r9:00000000 r8:00000000 r7:c78e6608 r6:00000000 r5:fffffffb

- r4:c78e6c00

-[<c0057e2c>] (warn_slowpath_fmt+0x0/0x40) from [<c01ed6b8>] (_regulator_disable+0x38/0x128)

- r3:c0410e53 r2:c0410ad5

-[<c01ed680>] (_regulator_disable+0x0/0x128) from [<c01ed87c>] (regulator_disable+0x24/0x38)

- r7:c78e6608 r6:00000000 r5:c78e6c40 r4:c78e6c00

-[<c01ed858>] (regulator_disable+0x0/0x38) from [<c02382dc>] (twl4030_phy_power+0x15c/0x17c)

- r5:c78595c0 r4:00000000

-[<c0238180>] (twl4030_phy_power+0x0/0x17c) from [<c023831c>] (twl4030_phy_suspend+0x20/0x2c)

- r6:00000000 r5:c78595c0 r4:c78595c0

-[<c02382fc>] (twl4030_phy_suspend+0x0/0x2c) from [<c0238638>] (twl4030_usb_irq+0x11c/0x16c)

- r5:c78595c0 r4:00000040

-[<c023851c>] (twl4030_usb_irq+0x0/0x16c) from [<c034ec18>] (twl4030_usb_probe+0x2c4/0x32c)

- r6:00000000 r5:00000000 r4:c78595c0

-[<c034e954>] (twl4030_usb_probe+0x0/0x32c) from [<c02152a0>] (platform_drv_probe+0x20/0x24)

- r7:00000000 r6:c047d49c r5:c78e6608 r4:c047d49c

-[<c0215280>] (platform_drv_probe+0x0/0x24) from [<c0214244>] (driver_probe_device+0xd0/0x190)

-[<c0214174>] (driver_probe_device+0x0/0x190) from [<c02143d4>] (__device_attach+0x44/0x48)

- r7:00000000 r6:c78e6608 r5:c78e6608 r4:c047d49c

-[<c0214390>] (__device_attach+0x0/0x48) from [<c0213694>] (bus_for_each_drv+0x50/0x90)

- r5:c0214390 r4:00000000

-[<c0213644>] (bus_for_each_drv+0x0/0x90) from [<c0214474>] (device_attach+0x70/0x94)

- r6:c78e663c r5:c78e6608 r4:c78e6608

-[<c0214404>] (device_attach+0x0/0x94) from [<c02134fc>] (bus_probe_device+0x2c/0x48)

- r7:00000000 r6:00000002 r5:c78e6608 r4:c78e6600

-[<c02134d0>] (bus_probe_device+0x0/0x48) from [<c0211e48>] (device_add+0x340/0x4b4)

-[<c0211b08>] (device_add+0x0/0x4b4) from [<c021597c>] (platform_device_add+0x110/0x16c)

-[<c021586c>] (platform_device_add+0x0/0x16c) from [<c0220cb0>] (add_numbered_child+0xd8/0x118)

- r7:00000000 r6:c045f15c r5:c78e6600 r4:00000000

-[<c0220bd8>] (add_numbered_child+0x0/0x118) from [<c001c618>] (twl_probe+0x3a4/0x72c)

-[<c001c274>] (twl_probe+0x0/0x72c) from [<c02601ac>] (i2c_device_probe+0x7c/0xa4)

-[<c0260130>] (i2c_device_probe+0x0/0xa4) from [<c0214244>] (driver_probe_device+0xd0/0x190)

- r5:c7856e20 r4:c047c860

-[<c0214174>] (driver_probe_device+0x0/0x190) from [<c02143d4>] (__device_attach+0x44/0x48)

- r7:c7856e04 r6:c7856e20 r5:c7856e20 r4:c047c860

-[<c0214390>] (__device_attach+0x0/0x48) from [<c0213694>] (bus_for_each_drv+0x50/0x90)

- r5:c0214390 r4:00000000

-[<c0213644>] (bus_for_each_drv+0x0/0x90) from [<c0214474>] (device_attach+0x70/0x94)

- r6:c7856e54 r5:c7856e20 r4:c7856e20

-[<c0214404>] (device_attach+0x0/0x94) from [<c02134fc>] (bus_probe_device+0x2c/0x48)

- r7:c7856e04 r6:c78fd048 r5:c7856e20 r4:c7856e20

-[<c02134d0>] (bus_probe_device+0x0/0x48) from [<c0211e48>] (device_add+0x340/0x4b4)

-[<c0211b08>] (device_add+0x0/0x4b4) from [<c0211fd8>] (device_register+0x1c/0x20)

-[<c0211fbc>] (device_register+0x0/0x20) from [<c0260aa8>] (i2c_new_device+0xec/0x150)

- r5:c7856e00 r4:c7856e20

-[<c02609bc>] (i2c_new_device+0x0/0x150) from [<c0260dc0>] (i2c_register_adapter+0xa0/0x1c4)

- r7:00000000 r6:c78fd078 r5:c78fd048 r4:c781d5c0

-[<c0260d20>] (i2c_register_adapter+0x0/0x1c4) from [<c0260f80>] (i2c_add_numbered_adapter+0x9c/0xb4)

- r7:00000a28 r6:c04600a8 r5:c78fd048 r4:00000000

-[<c0260ee4>] (i2c_add_numbered_adapter+0x0/0xb4) from [<c034efa4>] (omap_i2c_probe+0x324/0x3e8)

- r5:00000000 r4:c78fd000

-[<c034ec80>] (omap_i2c_probe+0x0/0x3e8) from [<c02152a0>] (platform_drv_probe+0x20/0x24)

-[<c0215280>] (platform_drv_probe+0x0/0x24) from [<c0214244>] (driver_probe_device+0xd0/0x190)

-[<c0214174>] (driver_probe_device+0x0/0x190) from [<c021436c>] (__driver_attach+0x68/0x8c)

- r7:c78b2140 r6:c047e214 r5:c04600e4 r4:c04600b0

-[<c0214304>] (__driver_attach+0x0/0x8c) from [<c021399c>] (bus_for_each_dev+0x50/0x84)

- r7:c78b2140 r6:c047e214 r5:c0214304 r4:00000000

-[<c021394c>] (bus_for_each_dev+0x0/0x84) from [<c0214068>] (driver_attach+0x20/0x28)

- r6:c047e214 r5:c047e214 r4:c00270d0

-[<c0214048>] (driver_attach+0x0/0x28) from [<c0213274>] (bus_add_driver+0xa8/0x228)

-[<c02131cc>] (bus_add_driver+0x0/0x228) from [<c02146a4>] (driver_register+0xb0/0x13c)

-[<c02145f4>] (driver_register+0x0/0x13c) from [<c0215744>] (platform_driver_register+0x4c/0x60)

- r9:00000000 r8:c001f688 r7:00000013 r6:c005b6fc r5:c00083dc

-r4:c00270d0

-[<c02156f8>] (platform_driver_register+0x0/0x60) from [<c001f69c>] (omap_i2c_init_driver+0x14/0x1c)

-[<c001f688>] (omap_i2c_init_driver+0x0/0x1c) from [<c002c460>] (do_one_initcall+0xd0/0x1a4)

-[<c002c390>] (do_one_initcall+0x0/0x1a4) from [<c0008478>] (kernel_init+0x9c/0x154)

-[<c00083dc>] (kernel_init+0x0/0x154) from [<c005b6fc>] (do_exit+0x0/0x688)

- r5:c00083dc r4:00000000

----[ end trace 1b75b31a2719ed1d ]---

-

-Signed-off-by: Ming Lei <tom.leiming@gmail.com>

-Cc: David Brownell <dbrownell@users.sourceforge.net>

-Cc: Felipe Balbi <me@felipebalbi.com>

-Cc: Anand Gadiyar <gadiyar@ti.com>

-Cc: Mike Frysinger <vapier@gentoo.org>

-Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com>

-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

-

----

- drivers/usb/otg/twl4030-usb.c | 78 +++++++++++++++++++++++++++---------------

- 1 file changed, 51 insertions(+), 27 deletions(-)

-

---- a/drivers/usb/otg/twl4030-usb.c

-+++ b/drivers/usb/otg/twl4030-usb.c

-@@ -347,11 +347,20 @@ static void twl4030_i2c_access(struct tw

- }

- }

-

--static void twl4030_phy_power(struct twl4030_usb *twl, int on)

-+static void __twl4030_phy_power(struct twl4030_usb *twl, int on)

- {

-- u8 pwr;

-+ u8 pwr = twl4030_usb_read(twl, PHY_PWR_CTRL);

-+

-+ if (on)

-+ pwr &= ~PHY_PWR_PHYPWD;

-+ else

-+ pwr |= PHY_PWR_PHYPWD;

-

-- pwr = twl4030_usb_read(twl, PHY_PWR_CTRL);

-+ WARN_ON(twl4030_usb_write_verify(twl, PHY_PWR_CTRL, pwr) < 0);

-+}

-+

-+static void twl4030_phy_power(struct twl4030_usb *twl, int on)

-+{

- if (on) {

- regulator_enable(twl->usb3v1);

- regulator_enable(twl->usb1v8);

-@@ -365,15 +374,13 @@ static void twl4030_phy_power(struct twl

- twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0,

- VUSB_DEDICATED2);

- regulator_enable(twl->usb1v5);

-- pwr &= ~PHY_PWR_PHYPWD;

-- WARN_ON(twl4030_usb_write_verify(twl, PHY_PWR_CTRL, pwr) < 0);

-+ __twl4030_phy_power(twl, 1);

- twl4030_usb_write(twl, PHY_CLK_CTRL,

- twl4030_usb_read(twl, PHY_CLK_CTRL) |

- (PHY_CLK_CTRL_CLOCKGATING_EN |

- PHY_CLK_CTRL_CLK32K_EN));

-- } else {

-- pwr |= PHY_PWR_PHYPWD;

-- WARN_ON(twl4030_usb_write_verify(twl, PHY_PWR_CTRL, pwr) < 0);

-+ } else {

-+ __twl4030_phy_power(twl, 0);

- regulator_disable(twl->usb1v5);

- regulator_disable(twl->usb1v8);

- regulator_disable(twl->usb3v1);

-@@ -387,19 +394,25 @@ static void twl4030_phy_suspend(struct t

-

- twl4030_phy_power(twl, 0);

- twl->asleep = 1;

-+ dev_dbg(twl->dev, "%s\n", __func__);

- }

-

--static void twl4030_phy_resume(struct twl4030_usb *twl)

-+static void __twl4030_phy_resume(struct twl4030_usb *twl)

- {

-- if (!twl->asleep)

-- return;

--

- twl4030_phy_power(twl, 1);

- twl4030_i2c_access(twl, 1);

- twl4030_usb_set_mode(twl, twl->usb_mode);

- if (twl->usb_mode == T2_USB_MODE_ULPI)

- twl4030_i2c_access(twl, 0);

-+}

-+

-+static void twl4030_phy_resume(struct twl4030_usb *twl)

-+{

-+ if (!twl->asleep)

-+ return;

-+ __twl4030_phy_resume(twl);

- twl->asleep = 0;

-+ dev_dbg(twl->dev, "%s\n", __func__);

- }

-

- static int twl4030_usb_ldo_init(struct twl4030_usb *twl)

-@@ -408,8 +421,8 @@ static int twl4030_usb_ldo_init(struct t

- twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, 0xC0, PROTECT_KEY);

- twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, 0x0C, PROTECT_KEY);

-

-- /* put VUSB3V1 LDO in active state */

-- twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB_DEDICATED2);

-+ /* Keep VUSB3V1 LDO in sleep state until VBUS/ID change detected*/

-+ /*twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB_DEDICATED2);*/

-

- /* input to VUSB3V1 LDO is from VBAT, not VBUS */

- twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0x14, VUSB_DEDICATED1);

-@@ -502,6 +515,26 @@ static irqreturn_t twl4030_usb_irq(int i

- return IRQ_HANDLED;

- }

-

-+static void twl4030_usb_phy_init(struct twl4030_usb *twl)

-+{

-+ int status;

-+

-+ status = twl4030_usb_linkstat(twl);

-+ if (status >= 0) {

-+ if (status == USB_EVENT_NONE) {

-+ __twl4030_phy_power(twl, 0);

-+ twl->asleep = 1;

-+ } else {

-+ __twl4030_phy_resume(twl);

-+ twl->asleep = 0;

-+ }

-+

-+ blocking_notifier_call_chain(&twl->otg.notifier, status,

-+ twl->otg.gadget);

-+ }

-+ sysfs_notify(&twl->dev->kobj, NULL, "vbus");

-+}

-+

- static int twl4030_set_suspend(struct otg_transceiver *x, int suspend)

- {

- struct twl4030_usb *twl = xceiv_to_twl(x);

-@@ -550,7 +583,6 @@ static int __devinit twl4030_usb_probe(s

- struct twl4030_usb_data *pdata = pdev->dev.platform_data;

- struct twl4030_usb *twl;

- int status, err;

-- u8 pwr;

-

- if (!pdata) {

- dev_dbg(&pdev->dev, "platform_data not available\n");

-@@ -569,10 +601,7 @@ static int __devinit twl4030_usb_probe(s

- twl->otg.set_peripheral = twl4030_set_peripheral;

- twl->otg.set_suspend = twl4030_set_suspend;

- twl->usb_mode = pdata->usb_mode;

--

-- pwr = twl4030_usb_read(twl, PHY_PWR_CTRL);

--

-- twl->asleep = (pwr & PHY_PWR_PHYPWD);

-+ twl->asleep = 1;

-

- /* init spinlock for workqueue */

- spin_lock_init(&twl->lock);

-@@ -610,15 +639,10 @@ static int __devinit twl4030_usb_probe(s

- return status;

- }

-

-- /* The IRQ handler just handles changes from the previous states

-- * of the ID and VBUS pins ... in probe() we must initialize that

-- * previous state. The easy way: fake an IRQ.

-- *

-- * REVISIT: a real IRQ might have happened already, if PREEMPT is

-- * enabled. Else the IRQ may not yet be configured or enabled,

-- * because of scheduling delays.

-+ /* Power down phy or make it work according to

-+ * current link state.

- */

-- twl4030_usb_irq(twl->irq, twl);

-+ twl4030_usb_phy_init(twl);

-

- dev_info(&pdev->dev, "Initialized TWL4030 USB module\n");

- return 0;

-From linux-usb-owner@vger.kernel.org Wed Sep 15 15:20:45 2010

-Subject: USB: serial/mos*: prevent reading uninitialized

- stack memory

-From: Dan Rosenberg <drosenberg@vsecurity.com>

-To: linux-usb@vger.kernel.org

-Cc: linux-kernel@vger.kernel.org, <security@kernel.org>,

- stable@kernel.org

-Date: Wed, 15 Sep 2010 17:44:16 -0400

-Message-ID: <1284587056.6275.100.camel@dan>

-

-The TIOCGICOUNT device ioctl in both mos7720.c and mos7840.c allows

-unprivileged users to read uninitialized stack memory, because the

-"reserved" member of the serial_icounter_struct struct declared on the

-stack is not altered or zeroed before being copied back to the user.

-This patch takes care of it.

-

-Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>

-Cc: stable <stable@kernel.org>

-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

-

----

- drivers/usb/serial/mos7720.c | 3 +++

- drivers/usb/serial/mos7840.c | 3 +++

- 2 files changed, 6 insertions(+)

-

---- a/drivers/usb/serial/mos7720.c

-+++ b/drivers/usb/serial/mos7720.c

-@@ -2024,6 +2024,9 @@ static int mos7720_ioctl(struct tty_stru

-

- case TIOCGICOUNT:

- cnow = mos7720_port->icount;

-+

-+ memset(&icount, 0, sizeof(struct serial_icounter_struct));

-+

- icount.cts = cnow.cts;

- icount.dsr = cnow.dsr;

- icount.rng = cnow.rng;

---- a/drivers/usb/serial/mos7840.c

-+++ b/drivers/usb/serial/mos7840.c

-@@ -2285,6 +2285,9 @@ static int mos7840_ioctl(struct tty_stru

- case TIOCGICOUNT:

- cnow = mos7840_port->icount;

- smp_rmb();

-+

-+ memset(&icount, 0, sizeof(struct serial_icounter_struct));

-+

- icount.cts = cnow.cts;

- icount.dsr = cnow.dsr;

- icount.rng = cnow.rng;

-2.6.36-rc4