···46464747-EMSGSIZE (a) endpoint maxpacket size is zero; it is not usable4848 in the current interface altsetting.4949- (b) ISO packet is biger than endpoint maxpacket5050- (c) requested data transfer size is invalid (negative)4949+ (b) ISO packet is larger than the endpoint maxpacket.5050+ (c) requested data transfer length is invalid: negative5151+ or too large for the host controller.51525253-ENOSPC This request would overcommit the usb bandwidth reserved5354 for periodic transfers (interrupt, isochronous).
+4-1
drivers/char/drm/drm_context.c
···432432433433 if (ctx.handle != DRM_KERNEL_CONTEXT) {434434 if (dev->driver->context_ctor)435435- dev->driver->context_ctor(dev, ctx.handle);435435+ if (!dev->driver->context_ctor(dev, ctx.handle)) {436436+ DRM_DEBUG( "Running out of ctxs or memory.\n");437437+ return -ENOMEM;438438+ }436439 }437440438441 ctx_entry = drm_alloc(sizeof(*ctx_entry), DRM_MEM_CTXLIST);
+18-7
drivers/hwmon/w83792d.c
···193193 0xE2 } /* (bit3-0) SmartFanII: Fan3 Level 3 */194194};195195196196+#define W83792D_REG_GPIO_EN 0x1A196197#define W83792D_REG_CONFIG 0x40197198#define W83792D_REG_VID_FANDIV 0x47198199#define W83792D_REG_CHIPID 0x49···258257{259258 int i;260259 val = SENSORS_LIMIT(val, 1, 128) >> 1;261261- for (i = 0; i < 6; i++) {260260+ for (i = 0; i < 7; i++) {262261 if (val == 0)263262 break;264263 val >>= 1;···12831282 w83792d_init_client(new_client);1284128312851284 /* A few vars need to be filled upon startup */12861286- for (i = 1; i <= 7; i++) {12871287- data->fan_min[i - 1] = w83792d_read_value(new_client,12851285+ for (i = 0; i < 7; i++) {12861286+ data->fan_min[i] = w83792d_read_value(new_client,12881287 W83792D_REG_FAN_MIN[i]);12891288 }12901289···13071306 device_create_file_fan(new_client, 1);13081307 device_create_file_fan(new_client, 2);13091308 device_create_file_fan(new_client, 3);13101310- device_create_file_fan(new_client, 4);13111311- device_create_file_fan(new_client, 5);13121312- device_create_file_fan(new_client, 6);13131313- device_create_file_fan(new_client, 7);13091309+13101310+ /* Read GPIO enable register to check if pins for fan 4,5 are used as13111311+ GPIO */13121312+ val1 = w83792d_read_value(new_client, W83792D_REG_GPIO_EN);13131313+ if (!(val1 & 0x40))13141314+ device_create_file_fan(new_client, 4);13151315+ if (!(val1 & 0x20))13161316+ device_create_file_fan(new_client, 5);13171317+13181318+ val1 = w83792d_read_value(new_client, W83792D_REG_PIN);13191319+ if (val1 & 0x40)13201320+ device_create_file_fan(new_client, 6);13211321+ if (val1 & 0x04)13221322+ device_create_file_fan(new_client, 7);1314132313151324 device_create_file_temp1(new_client); /* Temp1 */13161325 device_create_file_temp_add(new_client, 2); /* Temp2 */
+3
drivers/usb/atm/cxacru.c
···787787 { /* V = Conexant P = ADSL modem (Hasbani project) */788788 USB_DEVICE(0x0572, 0xcb00), .driver_info = (unsigned long) &cxacru_cb00789789 },790790+ { /* V = Conexant P = ADSL modem (Well PTI-800 */791791+ USB_DEVICE(0x0572, 0xcb02), .driver_info = (unsigned long) &cxacru_cb00792792+ },790793 { /* V = Conexant P = ADSL modem */791794 USB_DEVICE(0x0572, 0xcb01), .driver_info = (unsigned long) &cxacru_cb00792795 },
+2-1
drivers/usb/core/hcd-pci.c
···219219 goto done;220220 }221221 }222222+ synchronize_irq(dev->irq);222223223224 /* FIXME until the generic PM interfaces change a lot more, this224225 * can't use PCI D1 and D2 states. For example, the confusion···393392394393 dev->dev.power.power_state = PMSG_ON;395394396396- hcd->saw_irq = 0;395395+ clear_bit(HCD_FLAG_SAW_IRQ, &hcd->flags);397396398397 if (hcd->driver->resume) {399398 retval = hcd->driver->resume(hcd);
+10-5
drivers/usb/core/hcd.c
···13151315 * finish unlinking the initial failed usb_set_address()13161316 * or device descriptor fetch.13171317 */13181318- if (!hcd->saw_irq && hcd->self.root_hub != urb->dev) {13181318+ if (!test_bit(HCD_FLAG_SAW_IRQ, &hcd->flags)13191319+ && hcd->self.root_hub != urb->dev) {13191320 dev_warn (hcd->self.controller, "Unlink after no-IRQ? "13201321 "Controller is probably using the wrong IRQ."13211322 "\n");13221322- hcd->saw_irq = 1;13231323+ set_bit(HCD_FLAG_SAW_IRQ, &hcd->flags);13231324 }1324132513251326 urb->status = status;···16501649 struct usb_hcd *hcd = __hcd;16511650 int start = hcd->state;1652165116531653- if (start == HC_STATE_HALT)16521652+ if (unlikely(start == HC_STATE_HALT ||16531653+ !test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags)))16541654 return IRQ_NONE;16551655 if (hcd->driver->irq (hcd, r) == IRQ_NONE)16561656 return IRQ_NONE;1657165716581658- hcd->saw_irq = 1;16591659- if (hcd->state == HC_STATE_HALT)16581658+ set_bit(HCD_FLAG_SAW_IRQ, &hcd->flags);16591659+16601660+ if (unlikely(hcd->state == HC_STATE_HALT))16601661 usb_hc_died (hcd);16611662 return IRQ_HANDLED;16621663}···17701767 struct usb_device *rhdev;1771176817721769 dev_info(hcd->self.controller, "%s\n", hcd->product_desc);17701770+17711771+ set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);1773177217741773 /* till now HC has been in an indeterminate state ... */17751774 if (hcd->driver->reset && (retval = hcd->driver->reset(hcd)) < 0) {
+6-1
drivers/usb/core/hcd.h
···7272 * hardware info/state7373 */7474 const struct hc_driver *driver; /* hw-specific hooks */7575- unsigned saw_irq : 1;7575+7676+ /* Flags that need to be manipulated atomically */7777+ unsigned long flags;7878+#define HCD_FLAG_HW_ACCESSIBLE 0x000000017979+#define HCD_FLAG_SAW_IRQ 0x000000028080+7681 unsigned can_wakeup:1; /* hw supports wakeup? */7782 unsigned remote_wakeup:1;/* sw should use wakeup? */7883 unsigned rh_registered:1;/* is root hub registered? */
+38-8
drivers/usb/host/ehci-pci.c
···121121 return 0;122122}123123124124-/* called by khubd or root hub (re)init threads; leaves HC in halt state */125125-static int ehci_pci_reset(struct usb_hcd *hcd)124124+/* called during probe() after chip reset completes */125125+static int ehci_pci_setup(struct usb_hcd *hcd)126126{127127 struct ehci_hcd *ehci = hcd_to_ehci(hcd);128128 struct pci_dev *pdev = to_pci_dev(hcd->self.controller);···141141 if (retval)142142 return retval;143143144144+ /* data structure init */145145+ retval = ehci_init(hcd);146146+ if (retval)147147+ return retval;148148+144149 /* NOTE: only the parts below this line are PCI-specific */145150146151 switch (pdev->vendor) {···159154 /* AMD8111 EHCI doesn't work, according to AMD errata */160155 if (pdev->device == 0x7463) {161156 ehci_info(ehci, "ignoring AMD8111 (errata)\n");162162- return -EIO;157157+ retval = -EIO;158158+ goto done;163159 }164160 break;165161 case PCI_VENDOR_ID_NVIDIA:···213207 /* REVISIT: per-port wake capability (PCI 0x62) currently unused */214208215209 retval = ehci_pci_reinit(ehci, pdev);216216-217217- /* finish init */218218- return ehci_init(hcd);210210+done:211211+ return retval;219212}220213221214/*-------------------------------------------------------------------------*/···233228static int ehci_pci_suspend(struct usb_hcd *hcd, pm_message_t message)234229{235230 struct ehci_hcd *ehci = hcd_to_ehci(hcd);231231+ unsigned long flags;232232+ int rc = 0;236233237234 if (time_before(jiffies, ehci->next_statechange))238235 msleep(10);239236237237+ /* Root hub was already suspended. Disable irq emission and238238+ * mark HW unaccessible, bail out if RH has been resumed. Use239239+ * the spinlock to properly synchronize with possible pending240240+ * RH suspend or resume activity.241241+ *242242+ * This is still racy as hcd->state is manipulated outside of243243+ * any locks =P But that will be a different fix.244244+ */245245+ spin_lock_irqsave (&ehci->lock, flags);246246+ if (hcd->state != HC_STATE_SUSPENDED) {247247+ rc = -EINVAL;248248+ goto bail;249249+ }250250+ writel (0, &ehci->regs->intr_enable);251251+ (void)readl(&ehci->regs->intr_enable);252252+253253+ clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);254254+ bail:255255+ spin_unlock_irqrestore (&ehci->lock, flags);256256+240257 // could save FLADJ in case of Vaux power loss241258 // ... we'd only use it to handle clock skew242259243243- return 0;260260+ return rc;244261}245262246263static int ehci_pci_resume(struct usb_hcd *hcd)···277250278251 if (time_before(jiffies, ehci->next_statechange))279252 msleep(100);253253+254254+ /* Mark hardware accessible again as we are out of D3 state by now */255255+ set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);280256281257 /* If CF is clear, we lost PCI Vaux power and need to restart. */282258 if (readl(&ehci->regs->configured_flag) != FLAG_CF)···349319 /*350320 * basic lifecycle operations351321 */352352- .reset = ehci_pci_reset,322322+ .reset = ehci_pci_setup,353323 .start = ehci_run,354324#ifdef CONFIG_PM355325 .suspend = ehci_pci_suspend,
+16-8
drivers/usb/host/ehci-q.c
···912912 int epnum;913913 unsigned long flags;914914 struct ehci_qh *qh = NULL;915915+ int rc = 0;915916916917 qtd = list_entry (qtd_list->next, struct ehci_qtd, qtd_list);917918 epnum = ep->desc.bEndpointAddress;···927926#endif928927929928 spin_lock_irqsave (&ehci->lock, flags);929929+ if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE,930930+ &ehci_to_hcd(ehci)->flags))) {931931+ rc = -ESHUTDOWN;932932+ goto done;933933+ }934934+930935 qh = qh_append_tds (ehci, urb, qtd_list, epnum, &ep->hcpriv);936936+ if (unlikely(qh == NULL)) {937937+ rc = -ENOMEM;938938+ goto done;939939+ }931940932941 /* Control/bulk operations through TTs don't need scheduling,933942 * the HC and TT handle it when the TT has a buffer ready.934943 */935935- if (likely (qh != NULL)) {936936- if (likely (qh->qh_state == QH_STATE_IDLE))937937- qh_link_async (ehci, qh_get (qh));938938- }944944+ if (likely (qh->qh_state == QH_STATE_IDLE))945945+ qh_link_async (ehci, qh_get (qh));946946+ done:939947 spin_unlock_irqrestore (&ehci->lock, flags);940940- if (unlikely (qh == NULL)) {948948+ if (unlikely (qh == NULL))941949 qtd_list_free (ehci, urb, qtd_list);942942- return -ENOMEM;943943- }944944- return 0;950950+ return rc;945951}946952947953/*-------------------------------------------------------------------------*/
+16-2
drivers/usb/host/ehci-sched.c
···602602603603 spin_lock_irqsave (&ehci->lock, flags);604604605605+ if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE,606606+ &ehci_to_hcd(ehci)->flags))) {607607+ status = -ESHUTDOWN;608608+ goto done;609609+ }610610+605611 /* get qh and force any scheduling errors */606612 INIT_LIST_HEAD (&empty);607613 qh = qh_append_tds (ehci, urb, &empty, epnum, &ep->hcpriv);···1462145614631457 /* schedule ... need to lock */14641458 spin_lock_irqsave (&ehci->lock, flags);14651465- status = iso_stream_schedule (ehci, urb, stream);14591459+ if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE,14601460+ &ehci_to_hcd(ehci)->flags)))14611461+ status = -ESHUTDOWN;14621462+ else14631463+ status = iso_stream_schedule (ehci, urb, stream);14661464 if (likely (status == 0))14671465 itd_link_urb (ehci, urb, ehci->periodic_size << 3, stream);14681466 spin_unlock_irqrestore (&ehci->lock, flags);···1825181518261816 /* schedule ... need to lock */18271817 spin_lock_irqsave (&ehci->lock, flags);18281828- status = iso_stream_schedule (ehci, urb, stream);18181818+ if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE,18191819+ &ehci_to_hcd(ehci)->flags)))18201820+ status = -ESHUTDOWN;18211821+ else18221822+ status = iso_stream_schedule (ehci, urb, stream);18291823 if (status == 0)18301824 sitd_link_urb (ehci, urb, ehci->periodic_size << 3, stream);18311825 spin_unlock_irqrestore (&ehci->lock, flags);
+5-1
drivers/usb/host/ohci-hcd.c
···115115116116/*-------------------------------------------------------------------------*/117117118118-// #define OHCI_VERBOSE_DEBUG /* not always helpful */118118+#undef OHCI_VERBOSE_DEBUG /* not always helpful */119119120120/* For initializing controller (mask in an HCFS mode too) */121121#define OHCI_CONTROL_INIT OHCI_CTRL_CBSR···253253 spin_lock_irqsave (&ohci->lock, flags);254254255255 /* don't submit to a dead HC */256256+ if (!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags)) {257257+ retval = -ENODEV;258258+ goto fail;259259+ }256260 if (!HC_IS_RUNNING(hcd->state)) {257261 retval = -ENODEV;258262 goto fail;
+20-4
drivers/usb/host/ohci-hub.c
···53535454 spin_lock_irqsave (&ohci->lock, flags);55555656+ if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))) {5757+ spin_unlock_irqrestore (&ohci->lock, flags);5858+ return -ESHUTDOWN;5959+ }6060+5661 ohci->hc_control = ohci_readl (ohci, &ohci->regs->control);5762 switch (ohci->hc_control & OHCI_CTRL_HCFS) {5863 case OHCI_USB_RESUME:···145140 struct ohci_hcd *ohci = hcd_to_ohci (hcd);146141 u32 temp, enables;147142 int status = -EINPROGRESS;143143+ unsigned long flags;148144149145 if (time_before (jiffies, ohci->next_statechange))150146 msleep(5);151147152152- spin_lock_irq (&ohci->lock);148148+ spin_lock_irqsave (&ohci->lock, flags);149149+150150+ if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags))) {151151+ spin_unlock_irqrestore (&ohci->lock, flags);152152+ return -ESHUTDOWN;153153+ }154154+155155+153156 ohci->hc_control = ohci_readl (ohci, &ohci->regs->control);154157155158 if (ohci->hc_control & (OHCI_CTRL_IR | OHCI_SCHED_ENABLES)) {···192179 ohci_dbg (ohci, "lost power\n");193180 status = -EBUSY;194181 }195195- spin_unlock_irq (&ohci->lock);182182+ spin_unlock_irqrestore (&ohci->lock, flags);196183 if (status == -EBUSY) {197184 (void) ohci_init (ohci);198185 return ohci_restart (ohci);···310297 /* handle autosuspended root: finish resuming before311298 * letting khubd or root hub timer see state changes.312299 */313313- if ((ohci->hc_control & OHCI_CTRL_HCFS) != OHCI_USB_OPER314314- || !HC_IS_RUNNING(hcd->state)) {300300+ if (unlikely((ohci->hc_control & OHCI_CTRL_HCFS) != OHCI_USB_OPER301301+ || !HC_IS_RUNNING(hcd->state))) {315302 can_suspend = 0;316303 goto done;317304 }···520507 int ports = hcd_to_bus (hcd)->root_hub->maxchild;521508 u32 temp;522509 int retval = 0;510510+511511+ if (unlikely(!test_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags)))512512+ return -ESHUTDOWN;523513524514 switch (typeReq) {525515 case ClearHubFeature:
+25-2
drivers/usb/host/ohci-pci.c
···105105106106static int ohci_pci_suspend (struct usb_hcd *hcd, pm_message_t message)107107{108108- /* root hub was already suspended */109109- return 0;108108+ struct ohci_hcd *ohci = hcd_to_ohci (hcd);109109+ unsigned long flags;110110+ int rc = 0;111111+112112+ /* Root hub was already suspended. Disable irq emission and113113+ * mark HW unaccessible, bail out if RH has been resumed. Use114114+ * the spinlock to properly synchronize with possible pending115115+ * RH suspend or resume activity.116116+ *117117+ * This is still racy as hcd->state is manipulated outside of118118+ * any locks =P But that will be a different fix.119119+ */120120+ spin_lock_irqsave (&ohci->lock, flags);121121+ if (hcd->state != HC_STATE_SUSPENDED) {122122+ rc = -EINVAL;123123+ goto bail;124124+ }125125+ ohci_writel(ohci, OHCI_INTR_MIE, &ohci->regs->intrdisable);126126+ (void)ohci_readl(ohci, &ohci->regs->intrdisable);127127+ clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);128128+ bail:129129+ spin_unlock_irqrestore (&ohci->lock, flags);130130+131131+ return rc;110132}111133112134113135static int ohci_pci_resume (struct usb_hcd *hcd)114136{137137+ set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);115138 usb_hcd_resume_root_hub(hcd);116139 return 0;117140}
+6
drivers/usb/host/uhci-hcd.c
···717717 * at the source, so we must turn off PIRQ.718718 */719719 pci_write_config_word(to_pci_dev(uhci_dev(uhci)), USBLEGSUP, 0);720720+ clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);720721 uhci->hc_inaccessible = 1;721722 hcd->poll_rh = 0;722723···733732 struct uhci_hcd *uhci = hcd_to_uhci(hcd);734733735734 dev_dbg(uhci_dev(uhci), "%s\n", __FUNCTION__);735735+736736+ /* We aren't in D3 state anymore, we do that even if dead as I737737+ * really don't want to keep a stale HCD_FLAG_HW_ACCESSIBLE=0738738+ */739739+ set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);736740737741 if (uhci->rh_state == UHCI_RH_RESET) /* Dead */738742 return 0;
+1
include/linux/mm.h
···956956unsigned long vmalloc_to_pfn(void *addr);957957int remap_pfn_range(struct vm_area_struct *, unsigned long addr,958958 unsigned long pfn, unsigned long size, pgprot_t);959959+int vm_insert_page(struct vm_area_struct *, unsigned long addr, struct page *);959960960961struct page *follow_page(struct vm_area_struct *, unsigned long address,961962 unsigned int foll_flags);
+34-2
mm/memory.c
···11721172 spinlock_t *ptl; 1173117311741174 retval = -EINVAL;11751175- if (PageAnon(page) || !PageReserved(page))11751175+ if (PageAnon(page))11761176 goto out;11771177 retval = -ENOMEM;11781178 flush_dcache_page(page);···11951195out:11961196 return retval;11971197}11981198+11991199+/*12001200+ * This allows drivers to insert individual pages they've allocated12011201+ * into a user vma.12021202+ *12031203+ * The page has to be a nice clean _individual_ kernel allocation.12041204+ * If you allocate a compound page, you need to have marked it as12051205+ * such (__GFP_COMP), or manually just split the page up yourself12061206+ * (which is mainly an issue of doing "set_page_count(page, 1)" for12071207+ * each sub-page, and then freeing them one by one when you free12081208+ * them rather than freeing it as a compound page).12091209+ *12101210+ * NOTE! Traditionally this was done with "remap_pfn_range()" which12111211+ * took an arbitrary page protection parameter. This doesn't allow12121212+ * that. Your vma protection will have to be set up correctly, which12131213+ * means that if you want a shared writable mapping, you'd better12141214+ * ask for a shared writable mapping!12151215+ *12161216+ * The page does not need to be reserved.12171217+ */12181218+int vm_insert_page(struct vm_area_struct *vma, unsigned long addr, struct page *page)12191219+{12201220+ if (addr < vma->vm_start || addr >= vma->vm_end)12211221+ return -EFAULT;12221222+ if (!page_count(page))12231223+ return -EINVAL;12241224+ return insert_page(vma->vm_mm, addr, page, vma->vm_page_prot);12251225+}12261226+EXPORT_SYMBOL_GPL(vm_insert_page);1198122711991228/*12001229 * Somebody does a pfn remapping that doesn't actually work as a vma.···12541225 if (!pfn_valid(pfn))12551226 return -EINVAL;1256122712571257- retval = 0;12581228 page = pfn_to_page(pfn);12291229+ if (!PageReserved(page))12301230+ return -EINVAL;12311231+12321232+ retval = 0;12591233 while (start < end) {12601234 retval = insert_page(vma->vm_mm, start, page, prot);12611235 if (retval < 0)