Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  USB: fix oops on disconnect in cdc-acm
  USB: storage: include Prolific Technology USB drive in unusual_devs list
  USB: ftdi_sio: add product_id for Marvell OpenRD Base, Client
  USB: ftdi_sio: add vendor and product id for Bayer glucose meter serial converter cable
  USB: EHCI: fix counting of transaction error retries
  USB: EHCI: fix two new bugs related to Clear-TT-Buffer
  USB: usbfs: fix -ENOENT error code to be -ENODEV
  USB: musb: fix the nop registration for OMAP3EVM
  USB: devio: Properly do access_ok() checks
  USB: pl2303: New vendor and product id

12 files changed, 53 insertions, 18 deletions

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index e1f89416ef8c..2bfc41ece0e1 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -387,7 +387,6 @@ static void acm_rx_tasklet(unsigned long _acm)
         struct acm_ru *rcv;
         unsigned long flags;
         unsigned char throttled;
-        struct usb_host_endpoint *ep;
 
         dbg("Entering acm_rx_tasklet");
 
@@ -463,14 +462,12 @@ urbs:
 
                 rcv->buffer = buf;
 
-                ep = (usb_pipein(acm->rx_endpoint) ? acm->dev->ep_in : acm->dev->ep_out)
-                                [usb_pipeendpoint(acm->rx_endpoint)];
-                if (usb_endpoint_xfer_int(&ep->desc))
+                if (acm->is_int_ep)
                         usb_fill_int_urb(rcv->urb, acm->dev,
                                          acm->rx_endpoint,
                                          buf->base,
                                          acm->readsize,
-                                         acm_read_bulk, rcv, ep->desc.bInterval);
+                                         acm_read_bulk, rcv, acm->bInterval);
                 else
                         usb_fill_bulk_urb(rcv->urb, acm->dev,
                                           acm->rx_endpoint,
@@ -1183,6 +1180,9 @@ made_compressed_probe:
         spin_lock_init(&acm->read_lock);
         mutex_init(&acm->mutex);
         acm->rx_endpoint = usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress);
+        acm->is_int_ep = usb_endpoint_xfer_int(epread);
+        if (acm->is_int_ep)
+                acm->bInterval = epread->bInterval;
         tty_port_init(&acm->port);
         acm->port.ops = &acm_port_ops;
 
diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
index 1602324808ba..c4a0ee8ffccf 100644
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -126,6 +126,8 @@ struct acm {
         unsigned int ctrl_caps;                         /* control capabilities from the class specific header */
         unsigned int susp_count;                        /* number of suspended interfaces */
         int combined_interfaces:1;                      /* control and data collapsed */
+        int is_int_ep:1;                                /* interrupt endpoints contrary to spec used */
+        u8 bInterval;
         struct acm_wb *delayed_wb;                      /* write queued for a device about to be woken */
 };
 
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 38b8bce782d6..4247eccf858c 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -595,7 +595,7 @@ static int usbdev_open(struct inode *inode, struct file *file)
         if (!ps)
                 goto out;
 
-        ret = -ENOENT;
+        ret = -ENODEV;
 
         /* usbdev device-node */
         if (imajor(inode) == USB_DEVICE_MAJOR)
@@ -1321,7 +1321,8 @@ static int get_urb32(struct usbdevfs_urb *kurb,
                      struct usbdevfs_urb32 __user *uurb)
 {
         __u32  uptr;
-        if (get_user(kurb->type, &uurb->type) ||
+        if (!access_ok(VERIFY_READ, uurb, sizeof(*uurb)) ||
+            __get_user(kurb->type, &uurb->type) ||
             __get_user(kurb->endpoint, &uurb->endpoint) ||
             __get_user(kurb->status, &uurb->status) ||
             __get_user(kurb->flags, &uurb->flags) ||
@@ -1536,8 +1537,9 @@ static int proc_ioctl_compat(struct dev_state *ps, compat_uptr_t arg)
         u32 udata;
 
         uioc = compat_ptr((long)arg);
-        if (get_user(ctrl.ifno, &uioc->ifno) ||
-            get_user(ctrl.ioctl_code, &uioc->ioctl_code) ||
+        if (!access_ok(VERIFY_READ, uioc, sizeof(*uioc)) ||
+            __get_user(ctrl.ifno, &uioc->ifno) ||
+            __get_user(ctrl.ioctl_code, &uioc->ioctl_code) ||
             __get_user(udata, &uioc->data))
                 return -EFAULT;
         ctrl.data = compat_ptr(udata);
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 7d03549c3339..11c627ce6022 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -903,7 +903,8 @@ static int ehci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                         /* already started */
                         break;
                 case QH_STATE_IDLE:
-                        WARN_ON(1);
+                        /* QH might be waiting for a Clear-TT-Buffer */
+                        qh_completions(ehci, qh);
                         break;
                 }
                 break;
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 9a1384747f3b..7673554fa64d 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -375,12 +375,11 @@ qh_completions (struct ehci_hcd *ehci, struct ehci_qh *qh)
                                  */
                                 if ((token & QTD_STS_XACT) &&
                                                 QTD_CERR(token) == 0 &&
-                                                --qh->xacterrs > 0 &&
+                                                ++qh->xacterrs < QH_XACTERR_MAX &&
                                                 !urb->unlinked) {
                                         ehci_dbg(ehci,
         "detected XactErr len %zu/%zu retry %d\n",
-        qtd->length - QTD_LENGTH(token), qtd->length,
-        QH_XACTERR_MAX - qh->xacterrs);
+        qtd->length - QTD_LENGTH(token), qtd->length, qh->xacterrs);
 
                                         /* reset the token in the qtd and the
                                          * qh overlay (which still contains
@@ -494,7 +493,7 @@ halt:
                 last = qtd;
 
                 /* reinit the xacterr counter for the next qtd */
-                qh->xacterrs = QH_XACTERR_MAX;
+                qh->xacterrs = 0;
         }
 
         /* last urb's completion might still need calling */
@@ -940,7 +939,8 @@ static void qh_link_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
         head->qh_next.qh = qh;
         head->hw_next = dma;
 
-        qh->xacterrs = QH_XACTERR_MAX;
+        qh_get(qh);
+        qh->xacterrs = 0;
         qh->qh_state = QH_STATE_LINKED;
         /* qtd completions reported later by interrupt */
 }
@@ -1080,7 +1080,7 @@ submit_async (
          * the HC and TT handle it when the TT has a buffer ready.
          */
         if (likely (qh->qh_state == QH_STATE_IDLE))
-                qh_link_async (ehci, qh_get (qh));
+                qh_link_async(ehci, qh);
  done:
         spin_unlock_irqrestore (&ehci->lock, flags);
         if (unlikely (qh == NULL))
@@ -1115,8 +1115,6 @@ static void end_unlink_async (struct ehci_hcd *ehci)
                         && HC_IS_RUNNING (ehci_to_hcd(ehci)->state))
                 qh_link_async (ehci, qh);
         else {
-                qh_put (qh);            // refcount from async list
-
                 /* it's not free to turn the async schedule on/off; leave it
                  * active but idle for a while once it empties.
                  */
@@ -1124,6 +1122,7 @@ static void end_unlink_async (struct ehci_hcd *ehci)
                                 && ehci->async->qh_next.qh == NULL)
                         timer_action (ehci, TIMER_ASYNC_OFF);
         }
+        qh_put(qh);                     /* refcount from async list */
 
         if (next) {
                 ehci->reclaim = NULL;
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index 74f7f83b29ad..edd61ee90323 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -542,6 +542,7 @@ static int qh_link_periodic (struct ehci_hcd *ehci, struct ehci_qh *qh)
                 }
         }
         qh->qh_state = QH_STATE_LINKED;
+        qh->xacterrs = 0;
         qh_get (qh);
 
         /* update per-qh bandwidth for usbfs */
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 70073b157f0a..803adcb5ac1d 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -12,6 +12,7 @@ config USB_MUSB_HDRC
         depends on !SUPERH
         select NOP_USB_XCEIV if ARCH_DAVINCI
         select TWL4030_USB if MACH_OMAP_3430SDP
+        select NOP_USB_XCEIV if MACH_OMAP3EVM
         select USB_OTG_UTILS
         tristate 'Inventra Highspeed Dual Role Controller (TI, ADI, ...)'
         help
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index b574878c78b2..8fec5d4455c9 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -699,6 +699,9 @@ static struct usb_device_id id_table_combined [] = {
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) },
         { USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) },
+        { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
+        { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { },                                    /* Optional parameter entry */
         { }                                     /* Terminating entry */
 };
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index 24dbd99e87d7..8c92b88166ae 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -954,6 +954,20 @@
 #define AURICAL_USB_PID         0x0010  /* Aurical USB Audiometer */
 
 /*
+ * Bayer Ascensia Contour blood glucose meter USB-converter cable.
+ * http://winglucofacts.com/cables/
+ */
+#define BAYER_VID                      0x1A79
+#define BAYER_CONTOUR_CABLE_PID        0x6001
+
+/*
+ * Marvell OpenRD Base, Client
+ * http://www.open-rd.org
+ * OpenRD Base, Client use VID 0x0403
+ */
+#define MARVELL_OPENRD_PID      0x9e90
+
+/*
  *   BmRequestType:  1100 0000b
  *   bRequest:       FTDI_E2_READ
  *   wValue:         0
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 7d15bfa7c2db..3e86815b2705 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -95,6 +95,7 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) },
         { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
         { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
+        { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
         { }                                     /* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 12aac7d2462d..ee9505e1dd92 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -126,3 +126,7 @@
 /* Cressi Edy (diving computer) PC interface */
 #define CRESSI_VENDOR_ID        0x04b8
 #define CRESSI_EDY_PRODUCT_ID   0x0521
+
+/* Sony, USB data cable for CMD-Jxx mobile phones */
+#define SONY_VENDOR_ID          0x054c
+#define SONY_QN3USB_PRODUCT_ID  0x0437
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 1b9c5dd0fb27..7477d411959f 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -838,6 +838,13 @@ UNUSUAL_DEV( 0x066f, 0x8000, 0x0001, 0x0001,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_FIX_CAPACITY ),
 
+/* Reported by Rogerio Brito <rbrito@ime.usp.br> */
+UNUSUAL_DEV( 0x067b, 0x2317, 0x0001, 0x001,
+                "Prolific Technology, Inc.",
+                "Mass Storage Device",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_NOT_LOCKABLE ),
+
 /* Reported by Richard -=[]=- <micro_flyer@hotmail.com> */
 /* Change to bcdDeviceMin (0x0100 to 0x0001) reported by
  * Thomas Bartosik <tbartdev@gmx-topmail.de> */