Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Three trivial overlapping conflicts.

Signed-off-by: David S. Miller <davem@davemloft.net>

7 files changed, 34 insertions, 35 deletions

diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index 8987cec9549d..ebcadaad89d1 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -473,11 +473,6 @@ static int usb_unbind_interface(struct device *dev)
                 pm_runtime_disable(dev);
         pm_runtime_set_suspended(dev);
 
-        /* Undo any residual pm_autopm_get_interface_* calls */
-        for (r = atomic_read(&intf->pm_usage_cnt); r > 0; --r)
-                usb_autopm_put_interface_no_suspend(intf);
-        atomic_set(&intf->pm_usage_cnt, 0);
-
         if (!error)
                 usb_autosuspend_device(udev);
 
@@ -1633,7 +1628,6 @@ void usb_autopm_put_interface(struct usb_interface *intf)
         int                     status;
 
         usb_mark_last_busy(udev);
-        atomic_dec(&intf->pm_usage_cnt);
         status = pm_runtime_put_sync(&intf->dev);
         dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
                         __func__, atomic_read(&intf->dev.power.usage_count),
@@ -1662,7 +1656,6 @@ void usb_autopm_put_interface_async(struct usb_interface *intf)
         int                     status;
 
         usb_mark_last_busy(udev);
-        atomic_dec(&intf->pm_usage_cnt);
         status = pm_runtime_put(&intf->dev);
         dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
                         __func__, atomic_read(&intf->dev.power.usage_count),
@@ -1684,7 +1677,6 @@ void usb_autopm_put_interface_no_suspend(struct usb_interface *intf)
         struct usb_device       *udev = interface_to_usbdev(intf);
 
         usb_mark_last_busy(udev);
-        atomic_dec(&intf->pm_usage_cnt);
         pm_runtime_put_noidle(&intf->dev);
 }
 EXPORT_SYMBOL_GPL(usb_autopm_put_interface_no_suspend);
@@ -1715,8 +1707,6 @@ int usb_autopm_get_interface(struct usb_interface *intf)
         status = pm_runtime_get_sync(&intf->dev);
         if (status < 0)
                 pm_runtime_put_sync(&intf->dev);
-        else
-                atomic_inc(&intf->pm_usage_cnt);
         dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
                         __func__, atomic_read(&intf->dev.power.usage_count),
                         status);
@@ -1750,8 +1740,6 @@ int usb_autopm_get_interface_async(struct usb_interface *intf)
         status = pm_runtime_get(&intf->dev);
         if (status < 0 && status != -EINPROGRESS)
                 pm_runtime_put_noidle(&intf->dev);
-        else
-                atomic_inc(&intf->pm_usage_cnt);
         dev_vdbg(&intf->dev, "%s: cnt %d -> %d\n",
                         __func__, atomic_read(&intf->dev.power.usage_count),
                         status);
@@ -1775,7 +1763,6 @@ void usb_autopm_get_interface_no_resume(struct usb_interface *intf)
         struct usb_device       *udev = interface_to_usbdev(intf);
 
         usb_mark_last_busy(udev);
-        atomic_inc(&intf->pm_usage_cnt);
         pm_runtime_get_noresume(&intf->dev);
 }
 EXPORT_SYMBOL_GPL(usb_autopm_get_interface_no_resume);
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 82239f27c4cc..e844bb7b5676 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -820,9 +820,11 @@ int usb_string(struct usb_device *dev, int index, char *buf, size_t size)
 
         if (dev->state == USB_STATE_SUSPENDED)
                 return -EHOSTUNREACH;
-        if (size <= 0 || !buf || !index)
+        if (size <= 0 || !buf)
                 return -EINVAL;
         buf[0] = 0;
+        if (index <= 0 || index >= 256)
+                return -EINVAL;
         tbuf = kmalloc(256, GFP_NOIO);
         if (!tbuf)
                 return -ENOMEM;
diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index baf72f95f0f1..213b52508621 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -979,8 +979,18 @@ static int dummy_udc_start(struct usb_gadget *g,
         struct dummy_hcd        *dum_hcd = gadget_to_dummy_hcd(g);
         struct dummy            *dum = dum_hcd->dum;
 
-        if (driver->max_speed == USB_SPEED_UNKNOWN)
+        switch (g->speed) {
+        /* All the speeds we support */
+        case USB_SPEED_LOW:
+        case USB_SPEED_FULL:
+        case USB_SPEED_HIGH:
+        case USB_SPEED_SUPER:
+                break;
+        default:
+                dev_err(dummy_dev(dum_hcd), "Unsupported driver max speed %d\n",
+                                driver->max_speed);
                 return -EINVAL;
+        }
 
         /*
          * SLAVE side init ... the layer above hardware, which
@@ -1784,9 +1794,10 @@ static void dummy_timer(struct timer_list *t)
                 /* Bus speed is 500000 bytes/ms, so use a little less */
                 total = 490000;
                 break;
-        default:
+        default:        /* Can't happen */
                 dev_err(dummy_dev(dum_hcd), "bogus device speed\n");
-                return;
+                total = 0;
+                break;
         }
 
         /* FIXME if HZ != 1000 this will probably misbehave ... */
@@ -1828,7 +1839,7 @@ restart:
 
                 /* Used up this frame's bandwidth? */
                 if (total <= 0)
-                        break;
+                        continue;
 
                 /* find the gadget's ep for this request (if configured) */
                 address = usb_pipeendpoint (urb->pipe);
diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index 6d9fd5f64903..7b306aa22d25 100644
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -314,6 +314,7 @@ static void yurex_disconnect(struct usb_interface *interface)
         usb_deregister_dev(interface, &yurex_class);
 
         /* prevent more I/O from starting */
+        usb_poison_urb(dev->urb);
         mutex_lock(&dev->io_mutex);
         dev->interface = NULL;
         mutex_unlock(&dev->io_mutex);
diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
index 31b024441938..cc794e25a0b6 100644
--- a/drivers/usb/storage/realtek_cr.c
+++ b/drivers/usb/storage/realtek_cr.c
@@ -763,18 +763,16 @@ static void rts51x_suspend_timer_fn(struct timer_list *t)
                 break;
         case RTS51X_STAT_IDLE:
         case RTS51X_STAT_SS:
-                usb_stor_dbg(us, "RTS51X_STAT_SS, intf->pm_usage_cnt:%d, power.usage:%d\n",
-                             atomic_read(&us->pusb_intf->pm_usage_cnt),
+                usb_stor_dbg(us, "RTS51X_STAT_SS, power.usage:%d\n",
                              atomic_read(&us->pusb_intf->dev.power.usage_count));
 
-                if (atomic_read(&us->pusb_intf->pm_usage_cnt) > 0) {
+                if (atomic_read(&us->pusb_intf->dev.power.usage_count) > 0) {
                         usb_stor_dbg(us, "Ready to enter SS state\n");
                         rts51x_set_stat(chip, RTS51X_STAT_SS);
                         /* ignore mass storage interface's children */
                         pm_suspend_ignore_children(&us->pusb_intf->dev, true);
                         usb_autopm_put_interface_async(us->pusb_intf);
-                        usb_stor_dbg(us, "RTS51X_STAT_SS 01, intf->pm_usage_cnt:%d, power.usage:%d\n",
-                                     atomic_read(&us->pusb_intf->pm_usage_cnt),
+                        usb_stor_dbg(us, "RTS51X_STAT_SS 01, power.usage:%d\n",
                                      atomic_read(&us->pusb_intf->dev.power.usage_count));
                 }
                 break;
@@ -807,11 +805,10 @@ static void rts51x_invoke_transport(struct scsi_cmnd *srb, struct us_data *us)
         int ret;
 
         if (working_scsi(srb)) {
-                usb_stor_dbg(us, "working scsi, intf->pm_usage_cnt:%d, power.usage:%d\n",
-                             atomic_read(&us->pusb_intf->pm_usage_cnt),
+                usb_stor_dbg(us, "working scsi, power.usage:%d\n",
                              atomic_read(&us->pusb_intf->dev.power.usage_count));
 
-                if (atomic_read(&us->pusb_intf->pm_usage_cnt) <= 0) {
+                if (atomic_read(&us->pusb_intf->dev.power.usage_count) <= 0) {
                         ret = usb_autopm_get_interface(us->pusb_intf);
                         usb_stor_dbg(us, "working scsi, ret=%d\n", ret);
                 }
diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c
index 97b09a42a10c..dbfb2f24d71e 100644
--- a/drivers/usb/usbip/stub_rx.c
+++ b/drivers/usb/usbip/stub_rx.c
@@ -361,16 +361,10 @@ static int get_pipe(struct stub_device *sdev, struct usbip_header *pdu)
         }
 
         if (usb_endpoint_xfer_isoc(epd)) {
-                /* validate packet size and number of packets */
-                unsigned int maxp, packets, bytes;
-
-                maxp = usb_endpoint_maxp(epd);
-                maxp *= usb_endpoint_maxp_mult(epd);
-                bytes = pdu->u.cmd_submit.transfer_buffer_length;
-                packets = DIV_ROUND_UP(bytes, maxp);
-
+                /* validate number of packets */
                 if (pdu->u.cmd_submit.number_of_packets < 0 ||
-                    pdu->u.cmd_submit.number_of_packets > packets) {
+                    pdu->u.cmd_submit.number_of_packets >
+                    USBIP_MAX_ISO_PACKETS) {
                         dev_err(&sdev->udev->dev,
                                 "CMD_SUBMIT: isoc invalid num packets %d\n",
                                 pdu->u.cmd_submit.number_of_packets);
diff --git a/drivers/usb/usbip/usbip_common.h b/drivers/usb/usbip/usbip_common.h
index bf8afe9b5883..8be857a4fa13 100644
--- a/drivers/usb/usbip/usbip_common.h
+++ b/drivers/usb/usbip/usbip_common.h
@@ -121,6 +121,13 @@ extern struct device_attribute dev_attr_usbip_debug;
 #define USBIP_DIR_OUT   0x00
 #define USBIP_DIR_IN    0x01
 
+/*
+ * Arbitrary limit for the maximum number of isochronous packets in an URB,
+ * compare for example the uhci_submit_isochronous function in
+ * drivers/usb/host/uhci-q.c
+ */
+#define USBIP_MAX_ISO_PACKETS 1024
+
 /**
  * struct usbip_header_basic - data pertinent to every request
  * @command: the usbip request type