diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2015-01-12 10:51:04 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2015-01-12 10:51:04 -0800 |
| commit | 06087cb42dc1da096c37f51ea12ad676f00569a9 (patch) | |
| tree | 22408ce4ca111f74fec50994b7d38b89f33dd738 /drivers/usb/gadget | |
| parent | 9c9d82492b73991e8e13a6c0af06e44816c31438 (diff) | |
| parent | 5fb694f96e7c19e66b1c55124b98812e32e3efa5 (diff) | |
| download | op-kernel-dev-06087cb42dc1da096c37f51ea12ad676f00569a9.zip op-kernel-dev-06087cb42dc1da096c37f51ea12ad676f00569a9.tar.gz | |
Merge tag 'fixes-for-v3.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus
Felipe writes:
usb: fixes for v3.19-rc5
Just three fixes this time. An oops fix in ep_write() from gadgetfs,
another oops for the Atmel UDC when unloading a gadget driver and
the fix for PHY deferred probing.
Signed-off-by: Felipe Balbi <balbi@ti.com>
Conflicts:
drivers/usb/phy/phy.c
Diffstat (limited to 'drivers/usb/gadget')
| -rw-r--r-- | drivers/usb/gadget/legacy/inode.c | 1 | ||||
| -rw-r--r-- | drivers/usb/gadget/udc/atmel_usba_udc.c | 12 |
2 files changed, 12 insertions, 1 deletions
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c index 0804861..db49ec4 100644 --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -441,6 +441,7 @@ ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) kbuf = memdup_user(buf, len); if (IS_ERR(kbuf)) { value = PTR_ERR(kbuf); + kbuf = NULL; goto free1; } diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c index 93328ea..9f93bed 100644 --- a/drivers/usb/gadget/udc/atmel_usba_udc.c +++ b/drivers/usb/gadget/udc/atmel_usba_udc.c @@ -828,7 +828,7 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req) { struct usba_ep *ep = to_usba_ep(_ep); struct usba_udc *udc = ep->udc; - struct usba_request *req = to_usba_req(_req); + struct usba_request *req; unsigned long flags; u32 status; @@ -837,6 +837,16 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req) spin_lock_irqsave(&udc->lock, flags); + list_for_each_entry(req, &ep->queue, queue) { + if (&req->req == _req) + break; + } + + if (&req->req != _req) { + spin_unlock_irqrestore(&udc->lock, flags); + return -EINVAL; + } + if (req->using_dma) { /* * If this request is currently being transferred, |
