usb_buffer_map_sg() may return -1. This will result in a read from
pdx->PixelUrb[frameInfo][-1]
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This patch adds PCI dependencies to staging drivers that require it.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This fixes a build error when selecting the rtl8192su driver as a
module. This has been reported by me, and the opensuse kernel developer
team, and I finally tracked it down.
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Staging: rt2870: Revert d44ca7 Removal of kernel_thread() API
The sanity check this patch introduced triggers on shutdown, apparently due to
threads having already exited by the time BUG_ON() is reached.
Signed-off-by: Mike Galbraith <efault@gmx.de>
Cc: Peter Teoh <htmldeveloper@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Required for vmalloc_32 and vfree declarations on non-x86 platforms.
Signed-off-by: Amit Kucheria <amit.kucheria@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This driver is not needed, as the existing mos7840 driver works
properly for this device.
Thanks to Russell Lang for doing the work to figure this out.
Cc: Russell Lang <gsview@ghostgum.com.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
I'm about to merge "oom: move oom_adj value from task_struct to
mm_struct", and this fixup is needed to repair linux-next's
drivers/staging/android/lowmemorykiller.c.
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
a standard memory leak, as later allocations may fail even if prior
allocations did not. Then the prior allocations must be undone.
Signed-off-by: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
tty_port_tty_get() was called without a corresponding tty_kref_put()
in qt_read_bulk_callback() and qt_close().
Signed-off-by: Bill Pemberton <wfp5p@virginia.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6:
Staging: stlc45xx: convert config_interface to bss_info_changed, fixing a build error
Staging: comedi: s626: use subvendor:subdevice ids for SAA7146 board
Staging: prevent rtl8192su from crashing dev_ioctl in SIOCGIWNAME
Staging: prevent rtl8187se from crashing dev_ioctl() in SIOCGIWNAME
Staging: rtl8192su: convert to net_device_ops
Staging: serqt_usb2: declare qt_open static in serqt_usb2
Staging: serqt_usb2: fix qt_close parameters in serqt_usb2
Staging: comedi: jr3_pci.c: add required includes
Staging: meilhaus: add email address to TODO
Staging: rspiusb: use NULL virtual address instead of a bogus one
Staging: vt6655: compile fix
Staging: rt2870: Add USB ID for Sitecom WL-608
See commit 2d0ddec5b2 (mac80211: unify config_interface and
bss_info_changed)
This fixes a build error.
Signed-off-by: Alexander Beregalov <a.beregalov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The current s626 comedi driver in staging conflicts with philips SAA7146
media/dvb based cards, because it claims the same vendor:device pci id
for all subdevice/subvendor ids. What happens is that for people that have a
philips SAA7146 media/dvb based card, s626 if available gets loaded by udev
and makes system freeze (https://qa.mandriva.com/show_bug.cgi?id=51445).
The s626 driver shouldn't claim all 1131:7146 devices. Fix this by
specifying specific known subvendor:subdevice ids in its pci id table
list.
Also s626_attach is modified to use now pci_get_subsys instead of
pci_get_device as reported by Ian Abbott, and now we loop over pci id
table entries in case more ids are added in the future.
Reference: http://lkml.org/lkml/2009/6/16/552
Signed-off-by: Herton Ronaldo Krzesinski <herton@mandriva.com.br>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
(adapted from the rtl8187se patch)
ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and
on certain conditions, the concatenated string will be larger than IFNAMSIZ
including the terminating zero.
length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17
This fix uses strl{cpy,cat} in addition to the reduction of the total
possible length of the output string by a char.
It can be applied to 2.6.30-stable as well.
Signed-off-by: Dan Aloni <dan@aloni.org>
Cc: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
I repeatedly get __stack_chk_fail panic()s with this driver before
applying the attached fix.
ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and
on certain conditions, the concatenated string will be larger than IFNAMSIZ
including the terminating zero.
length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17
This fix uses strl{cpy,cat} in addition to the reduction of the total
possible length of the output string by a char.
It can be applied to 2.6.30-stable as well.
Signed-off-by: Dan Aloni <dan@aloni.org>
Cc: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit e3804cbebb removed
COMPAT_NET_DEV_OPS so this change is needed to make rtl8192su
buildable again.
Loosely based on Alexander's patch for rtl8187se, untested.
Cc: Alexander Beregalov <a.beregalov@gmail.com>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The parameter list for qt_close() was from the old non usb-serial
driver.
Signed-off-by: Bill Pemberton <wfp5p@virginia.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Fix this build errors:
jr3_pci.c:739: error: 'jiffies' undeclared
jr3_pci.c:748: error: implicit declaration of function 'msecs_to_jiffies'
jr3_pci.c:763: error: implicit declaration of function 'add_timer'
jr3_pci.c:790: error: implicit declaration of function 'init_timer'
jr3_pci.c:951: error: implicit declaration of function 'del_timer_sync'
Signed-off-by: Alexander Beregalov <a.beregalov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The main problem here is that I just cannot see how this could ever
be correct:
usb_fill_bulk_urb(pdx->PixelUrb[frameInfo][i], pdx->udev, epAddr,
(dma_addr_t *) sg_dma_address(&pdx->sgl[frameInfo][i]),
sg_dma_len(&pdx->sgl[frameInfo][i]),
You cannot take a DMA address, cast it to a _pointer to_ a DMA address,
and then regard it as a virtual address of the transfer buffer.
However, finding the right virtual address was too hard for me,
so I just stubbed it with NULL. At least usbmon won't oops then
(it will not show any data but it's better than crashing).
Also, too big a buffer was allocated elsewhere.
And since we're at it, drop clearly unnecessary usb_buffer_alloc too,
leaving it where it may be useful.
Signed-off-by: Pete Zaitcev <zaitcev@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Add the USB id 0x0DF6,0x003F to the rt2870.h file such that the
Sitecom WL-608 device will be recognized by this driver.
Signed-off-by: Jorrit Schippers <jorrit@ncode.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
The existing code had the following race:
Thread-1 Thread-2
inc/read in_use
inc/read in_use
inc tx_free_list[qos].len
inc tx_free_list[qos].len
The actual in_use value was incremented twice, but thread-1 is going
to free memory based on its stale value, and will free one too many
times. The result is that memory is freed back to the kernel while
its packet is still in the transmit buffer. If the memory is
overwritten before it is transmitted, the hardware will put a valid
checksum on it and send it out (just like it does with good packets).
If by chance the TCP flags are clobbered but not the addresses or
ports, the result can be a broken TCP stream.
The fix is to track the number of freed packets in a single location
(a Fetch-and-Add Unit register). That way it can never get out of sync
with itself.
We try to free up to MAX_SKB_TO_FREE (currently 10) buffers at a time.
If fewer are available we adjust the free count with the difference.
The action of claiming buffers to free is atomic so two threads cannot
claim the same buffers.
Signed-off-by: David Daney <ddaney@caviumnetworks.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
