Sarah Sharp 6cc30d85a5 USB: xHCI: Fix bug in link TRB activation change. ... Commit 6c12db90f1 introduced a bug for control transfers. The patch was supposed to change when the link TRBs at the end of each ring segment were given to the hardware. If a transfer descriptor (TD) ended just before the link TRB, the code wouldn't give back the link TRB to the hardware; instead it would be given back in prepare_ring() just before the next TD was enqueued at the top of the ring. Unfortunately, the code relied on checking the chain bit of the TRB to determine whether the TD ended just before the link TRB. It assumed that the ring enqueuing code would call prepare_ring() before enqueuing the next TD. However, control transfers are made of multiple TDs, and prepare_ring() is only called once before enqueuing two or three TDs. If the first or second TD of the control transfer ended just before the link TRB, then the code in inc_enq() would not move the enqueue pointer past the link TRB, and the link TRB would get overwritten. This would cause the xHCI driver to start writing to memory past the ring segment, and eventually the system would crash or hang. The fix is to add a flag to inc_enq() that says whether the caller will enqueue more TDs before calling prepare_ring(). If the chain bit is cleared (meaning this is the last TRB in a TD), and the caller will not enqueue more TDs, then we defer giving back the link TRB. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>		2010-06-30 08:16:05 -07:00
..
accessibility	…
acpi	Merge branch 'bugzilla-15951' into release	2010-06-17 12:18:30 -04:00
amba	…
ata	sata_sil24: Use memory barriers before issuing commands	2010-06-10 16:06:48 -04:00
atm	Merge remote branch 'origin' into secretlab/next-devicetree	2010-05-22 00:36:56 -06:00
auxdisplay	auxdisplay: section cleanup in cfag12864bfb driver	2010-05-25 08:07:09 -07:00
base	topology: convert cpu notifier to return encapsulate errno value	2010-05-27 09:12:48 -07:00
block	Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block	2010-06-04 15:37:44 -07:00
bluetooth	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6	2010-05-20 21:04:44 -07:00
cdrom	of: Always use 'struct device.of_node' to get device node pointer.	2010-05-18 16:10:44 -06:00
char	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input	2010-06-27 08:03:00 -07:00
clocksource	clocksource: sh_cmt: Fix up bogus shift value.	2010-06-22 16:41:31 +09:00
connector	…
cpufreq	Merge branch 'x86-cpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip	2010-05-18 08:49:13 -07:00
cpuidle	Merge branch 'idle-release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-idle-2.6	2010-05-28 16:14:17 -07:00
crypto	crypto: crypto4xx - Fix build breakage	2010-06-03 16:57:24 +10:00
dca	…
dio	…
dma	of/dma: fix build breakage in ppc4xx adma driver	2010-06-02 21:02:39 -06:00
edac	Merge branch 'linux_next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/i7core	2010-06-04 15:39:54 -07:00
eisa	…
firewire	firewire: core: check for 1394a compliant IRM, fix inaccessibility of Sony camcorder	2010-06-02 19:48:13 +02:00
firmware	sysfs: add struct file* to bin_attr callbacks	2010-05-21 09:37:31 -07:00
gpio	gpio: Fix inverted rdc321x gpio data out registers	2010-05-28 01:37:59 +02:00
gpu	Revert "drm/i915: Don't enable pipe/plane/VCO early (wait for DPMS on)."	2010-06-08 20:16:28 -07:00
hid	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input	2010-05-27 09:19:55 -07:00
hwmon	hwmon: (k8temp) Bypass core swapping on single-core processors	2010-06-20 09:22:32 +02:00
i2c	i2c: Remove all i2c_set_clientdata(client, NULL) in drivers	2010-06-03 11:33:58 +02:00
ide	powerpc/macio: Fix probing of macio devices by using the right of match table	2010-06-02 17:50:38 +10:00
idle	intel_idle: native hardware cpuidle driver for latest Intel processors	2010-05-28 14:26:20 -04:00
ieee1394	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6	2010-05-27 10:22:06 -07:00
ieee802154	…
infiniband	fix the deadlock in qib_fs	2010-06-04 17:16:27 -04:00
input	Input: wacom - fix serial number handling on Cintiq 21UX2	2010-06-22 11:32:24 -07:00
isdn	ISDN: hysdn, fix potential NULL dereference	2010-06-26 22:12:02 -07:00
leds	i2c: Remove all i2c_set_clientdata(client, NULL) in drivers	2010-06-03 11:33:58 +02:00
lguest	…
macintosh	Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc	2010-06-03 15:46:37 -07:00
mca	…
md	md/raid5: don't include 'spare' drives when reshaping to fewer devices.	2010-06-24 13:36:04 +10:00
media	Merge branch 'v4l_for_2.6.35' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6	2010-06-04 15:38:12 -07:00
memstick	…
message	drivers/message/i2o/i2o_config.c: use memdup_user	2010-05-27 09:12:41 -07:00
mfd	i2c: Remove all i2c_set_clientdata(client, NULL) in drivers	2010-06-03 11:33:58 +02:00
misc	vmware balloon: clamp number of collected non-balloonable pages	2010-06-04 15:21:44 -07:00
mmc	mmc: msm: fix compile error on MSM7x30	2010-06-09 08:51:31 -07:00
mtd	Merge git://git.infradead.org/~dwmw2/mtd-2.6.35	2010-06-07 17:10:06 -07:00
net	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6	2010-06-27 11:28:02 -07:00
nubus	…
of	Merge remote branch 'origin' into secretlab/next-devicetree	2010-05-22 00:36:56 -06:00
oprofile	…
parisc	…
parport	m68k: amiga - Parallel port platform device conversion	2010-05-26 19:51:09 +02:00
pci	Merge branch 'virtio' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux-2.6	2010-06-27 07:49:45 -07:00
pcmcia	pcmcia: avoid validate_cis failure on CIS override	2010-06-07 18:34:16 +02:00
platform	intel_scu_ipc: Length fix	2010-06-01 08:40:47 -07:00
pnp	…
power	i2c: Remove all i2c_set_clientdata(client, NULL) in drivers	2010-06-03 11:33:58 +02:00
pps	…
ps3	…
rapidio	rapidio: fix new kernel-doc warnings	2010-05-30 09:02:47 -07:00
regulator	i2c: Remove all i2c_set_clientdata(client, NULL) in drivers	2010-06-03 11:33:58 +02:00
rtc	rtc: s3c: initialize s3c_rtc_cpu_type before using it	2010-06-04 15:21:44 -07:00
s390	[S390] appldata/extmem/kvm: add missing GFP_KERNEL flag	2010-06-08 18:58:23 +02:00
sbus	Merge branch 'bkl/ioctl' of git://git.kernel.org/pub/scm/linux/kernel/git/frederic/random-tracing	2010-05-24 08:01:10 -07:00
scsi	Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev	2010-06-03 15:48:15 -07:00
serial	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6	2010-06-27 11:28:02 -07:00
sfi	SFI: do not return freed pointer	2010-06-01 12:04:35 -04:00
sh	sh: Make intc messages consistent via pr_fmt.	2010-06-02 18:10:00 +09:00
sn	…
spi	of/spi: mpc512x_psc_spi.c: Fix build failures	2010-06-02 13:45:06 -06:00
ssb	ssb: fix NULL ptr deref when pcihost_wrapper is used	2010-05-28 13:57:01 -04:00
staging	Merge branch 'v4l_for_2.6.35' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6	2010-06-04 15:38:12 -07:00
tc	…
telephony	drivers/telephony/ixj.c: use memdup_user	2010-05-27 09:12:42 -07:00
thermal	…
uio	…
usb	USB: xHCI: Fix bug in link TRB activation change.	2010-06-30 08:16:05 -07:00
uwb	…
vhost	misc: Fix allocation 'borrowed' by vhost_net	2010-06-09 08:50:31 -07:00
video	Merge branch 'for-linus' of git://gitorious.org/linux-omap-dss2/linux	2010-06-27 07:36:16 -07:00
virtio	virtio-pci: disable msi at startup	2010-06-23 22:49:07 +09:30
vlynq	…
w1	sysfs: add struct file* to bin_attr callbacks	2010-05-21 09:37:31 -07:00
watchdog	watchdog: at32ap700x_wdt: register misc device last in probe() function	2010-06-17 09:56:57 +00:00
xen	xen: avoid allocation causing potential swap activity on the resume path	2010-06-03 09:34:45 +01:00
zorro	sysfs: add struct file* to bin_attr callbacks	2010-05-21 09:37:31 -07:00
Kconfig	…
Makefile	intel_idle: native hardware cpuidle driver for latest Intel processors	2010-05-28 14:26:20 -04:00