usb/isp1760: Added missing call to usb_hcd_check_unlink_urb() during unlink

commit 17d3e145a4ad680b3d1b1c30d0696a5bbb2b65c4 upstream.

Signed-off-by: Arvid Brodin <arvid.brodin@enea.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

(cherry picked from commit e530d1a21e5c2fe3202b2fdf2f0b61100c12c70e)
USB: Serial: Add device ID for Sierra Wireless MC8305

commit 2f1def2695c223b2aa325e5e47d0d64200a45d23 upstream.

A new device ID pair is added for Sierra Wireless MC8305.

Signed-off-by: Florian Echtler <floe@butterbrot.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

(cherry picked from commit 5be5de4dfc6715b424207c367dc2ed234b0bd6ce)
USB: Serial: Add PID(0xF7C0) to FTDI SIO driver for a zeitcontrol-device

commit ce7e9065958191e6b7ca49d7ed0e1099c486d198 upstream.

Here is a patch for a new PID (zeitcontrol-device mifare-reader FT232BL(like FT232BM but lead free)).

Signed-off-by: Artur Zimmer <artur128@3dzimmer.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

(cherry picked from commit 510c6bcea7b81acf7c86d2d72944ed516223fcbb)
usbnet/cdc_ncm: Don't use stack variables for DMA

commit 75bc8ef528f7c4ea7e80384c5593487b6b3b535e upstream.

The cdc_ncm driver still has a few places where stack variables are
passed to the cdc_ncm_do_request function.  This triggers a stack trace in
lib/dma-debug.c if the CONFIG_DEBUG_DMA_API option is set.

Adjust these calls to pass parameters that have been allocated with
kzalloc.

Signed-off-by: Josh Boyer <jwboyer@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

(cherry picked from commit 91c193f925d75b03f5a7f31ae1358a87af33c78a)
USB: Avoid NULL pointer deref in usb_hcd_alloc_bandwidth.

commit 8a9af4fdf6d5eeb3200a088354d266a87e8260b0 upstream.

usb_ifnum_to_if() can return NULL if the USB device does not have a
configuration installed (usb_device->actconfig == NULL), or if we can't
find the interface number in the installed configuration.  Return an
error instead of crashing.

Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

(cherry picked from commit f6fad686650aaf264b2acee848825e2183a944e3)
ipheth: iPhone 4 Verizon CDMA USB Product ID add

commit 02009afc223aae43b8e18918fc816e4520791537 upstream.

Add USB product ID for iPhone 4 CDMA Verizon
Tested on at least 2 devices

Signed-off-by: Kavan Smith <kavansmith82@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

(cherry picked from commit 869b18a75765d4f29e26ea8de123608fc9907903)
USB: xHCI: prevent infinite loop when processing MSE event

commit c2d7b49f42f50d7fc5cbfd195b785a128723fdf4 upstream.

When a xHC host is unable to handle isochronous transfer in the
interval, it reports a Missed Service Error event and skips some tds.

Currently xhci driver handles MSE event in the following ways:

1. When encounter a MSE event, set ep->skip flag, update event ring
   dequeue pointer and return.

2. When encounter the next event on this ep, the driver will run the
   do-while loop, fetch td from ep's td_list to find the td
   corresponding to this event.  All tds missed are marked as short
   transfer(-EXDEV).

The do-while loop will end in two ways:

1. If the td pointed by the event trb is found;

2. If the ep ring's td_list is empty.

However, if a buggy HW reports some unpredicted event (for example, an
overrun event following a MSE event while the ep ring is actually not
empty), the driver will never find the td, and it will loop until the
td_list is empty.

Unfortunately, the spinlock is dropped when give back a urb in the
do-while loop.  During the spinlock released period, the class driver
may still submit urbs and add tds to the td_list.  This may cause
disaster, since the td_list will never be empty and the loop never ends,
and the system hangs.

To fix this, count the number of TDs on the ep ring before skipping TDs,
and quit the loop when skipped that number of tds.  This guarantees the
do-while loop will end after certain number of cycles, and driver will
not be trapped in an infinite loop.

Signed-off-by: Andiry Xu <andiry.xu@amd.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

(cherry picked from commit 1a0a3b4ea5782d6f1ca10f3254b56d7be24ec4d0)
ASIX: Simplify condition in rx_fixup()

commit bc466e678d0a98f445bf3f9c76fedf18e7dcc6b0 upstream.

Signed-off-by: Marek Vasut <marek.vasut@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

(cherry picked from commit 611778cd2a87a9b7376994caf4faa0caac9d1037)
ASIX: Use only 11 bits of header for data size

commit bca0beb9363f8487ac902931a50eb00180a2d14a upstream.

The AX88772B uses only 11 bits of the header for the actual size. The other bits
are used for something else. This causes dmesg full of messages:

	asix_rx_fixup() Bad Header Length

This patch trims the check to only 11 bits. I believe on older chips, the
remaining 5 top bits are unused.

Signed-off-by: Marek Vasut <marek.vasut@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

(cherry picked from commit f7f00215ba28400e0f61c55e14e3d619888231ae)
Bluetooth: Add MacBookAir4,1 support

commit a63b723d02531f7add0b2b8a0e6a77ee176f1626 upstream.

This patch against current git adds the hardware ID for the Apple
MacBookAir4,1, released in July 2011. The device features a BCM2046
USB chip. The patch was inspired by the previous modifications adding
support for the MacBookAir3,x.

Signed-off-by: Pieter-Augustijn Van Malleghem <p-a@scarlet.be>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

(cherry picked from commit efb1497bcc3a72b1617c6915bb62cf4dfa38c952)