Merge branch 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6

* 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  USB: cdc-acm: fix potential null-pointer dereference on disconnect
  USB: cdc-acm: fix potential null-pointer dereference
  USB: cdc-acm: fix memory corruption / panic
  USB: Fix 'bad dma' problem on WDM device disconnect
  usb: wwan: fix compilation without CONFIG_PM_RUNTIME
  USB: uss720 fixup refcount position
  usb: musb: blackfin: fix typo in new bfin_musb_vbus_status func
  usb: musb: blackfin: fix typo in new dev_pm_ops struct
  usb: musb: blackfin: fix typo in platform driver name
  usb: musb: Fix for merge issue
  ehci-hcd: Bug fix: don't set a QH's Halt bit
  USB: Do not pass negative length to snoop_urb()

1 files changed, 6 insertions, 1 deletions

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index f492a7f2b6ee..e057e5381465 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -297,6 +297,8 @@ static void acm_ctrl_irq(struct urb *urb)
         if (!ACM_READY(acm))
                 goto exit;
 
+        usb_mark_last_busy(acm->dev);
+
         data = (unsigned char *)(dr + 1);
         switch (dr->bNotificationType) {
         case USB_CDC_NOTIFY_NETWORK_CONNECTION:
@@ -336,7 +338,6 @@ static void acm_ctrl_irq(struct urb *urb)
                 break;
         }
 exit:
-        usb_mark_last_busy(acm->dev);
         retval = usb_submit_urb(urb, GFP_ATOMIC);
         if (retval)
                 dev_err(&urb->dev->dev, "%s - usb_submit_urb failed with "
@@ -533,6 +534,8 @@ static void acm_softint(struct work_struct *work)
         if (!ACM_READY(acm))
                 return;
         tty = tty_port_tty_get(&acm->port);
+        if (!tty)
+                return;
         tty_wakeup(tty);
         tty_kref_put(tty);
 }
@@ -646,8 +649,10 @@ static void acm_port_down(struct acm *acm)
                 usb_kill_urb(acm->ctrlurb);
                 for (i = 0; i < ACM_NW; i++)
                         usb_kill_urb(acm->wb[i].urb);
+                tasklet_disable(&acm->urb_task);
                 for (i = 0; i < nr; i++)
                         usb_kill_urb(acm->ru[i].urb);
+                tasklet_enable(&acm->urb_task);
                 acm->control->needs_remote_wakeup = 0;
                 usb_autopm_put_interface(acm->control);
         }