scripts-tags.sh-fix-incompatibility-with-pcre2.patch
drm-virtio-fix-null-vs-is_err-checking-in-virtio_gpu_object_shmem_init.patch
drm-virtio-correct-drm_gem_shmem_get_sg_table-error-handling.patch
+usb-serial-option-add-support-for-vw-skoda-carstick-lte.patch
+usb-gadget-u_serial-add-null-pointer-check-in-gserial_resume.patch
+usb-core-don-t-hold-device-lock-while-reading-the-descriptors-sysfs-file.patch
--- /dev/null
+From 45bf39f8df7f05efb83b302c65ae3b9bc92b7065 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Tue, 31 Jan 2023 15:49:04 -0500
+Subject: USB: core: Don't hold device lock while reading the "descriptors" sysfs file
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 45bf39f8df7f05efb83b302c65ae3b9bc92b7065 upstream.
+
+Ever since commit 83e83ecb79a8 ("usb: core: get config and string
+descriptors for unauthorized devices") was merged in 2013, there has
+been no mechanism for reallocating the rawdescriptors buffers in
+struct usb_device after the initial enumeration. Before that commit,
+the buffers would be deallocated when a device was deauthorized and
+reallocated when it was authorized and enumerated.
+
+This means that the locking in the read_descriptors() routine is not
+needed, since the buffers it reads will never be reallocated while the
+routine is running. This locking can interfere with user programs
+trying to read a hub's descriptors via sysfs while new child devices
+of the hub are being initialized, since the hub is locked during this
+procedure.
+
+Since the locking in read_descriptors() hasn't been needed for over
+nine years, we can remove it.
+
+Reported-and-tested-by: Troels Liebe Bentsen <troels@connectedcars.dk>
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+CC: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/Y9l+wDTRbuZABzsE@rowland.harvard.edu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/hub.c | 5 ++---
+ drivers/usb/core/sysfs.c | 5 -----
+ 2 files changed, 2 insertions(+), 8 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2380,9 +2380,8 @@ static int usb_enumerate_device_otg(stru
+ * usb_enumerate_device - Read device configs/intfs/otg (usbcore-internal)
+ * @udev: newly addressed device (in ADDRESS state)
+ *
+- * This is only called by usb_new_device() and usb_authorize_device()
+- * and FIXME -- all comments that apply to them apply here wrt to
+- * environment.
++ * This is only called by usb_new_device() -- all comments that apply there
++ * apply here wrt to environment.
+ *
+ * If the device is WUSB and not authorized, we don't attempt to read
+ * the string descriptors, as they will be errored out by the device
+--- a/drivers/usb/core/sysfs.c
++++ b/drivers/usb/core/sysfs.c
+@@ -889,11 +889,7 @@ read_descriptors(struct file *filp, stru
+ size_t srclen, n;
+ int cfgno;
+ void *src;
+- int retval;
+
+- retval = usb_lock_device_interruptible(udev);
+- if (retval < 0)
+- return -EINTR;
+ /* The binary attribute begins with the device descriptor.
+ * Following that are the raw descriptor entries for all the
+ * configurations (config plus subsidiary descriptors).
+@@ -918,7 +914,6 @@ read_descriptors(struct file *filp, stru
+ off -= srclen;
+ }
+ }
+- usb_unlock_device(udev);
+ return count - nleft;
+ }
+
--- /dev/null
+From 5ec63fdbca604568890c577753c6f66c5b3ef0b5 Mon Sep 17 00:00:00 2001
+From: Prashanth K <quic_prashk@quicinc.com>
+Date: Mon, 13 Feb 2023 23:00:38 +0530
+Subject: usb: gadget: u_serial: Add null pointer check in gserial_resume
+
+From: Prashanth K <quic_prashk@quicinc.com>
+
+commit 5ec63fdbca604568890c577753c6f66c5b3ef0b5 upstream.
+
+Consider a case where gserial_disconnect has already cleared
+gser->ioport. And if a wakeup interrupt triggers afterwards,
+gserial_resume gets called, which will lead to accessing of
+gser->ioport and thus causing null pointer dereference.Add
+a null pointer check to prevent this.
+
+Added a static spinlock to prevent gser->ioport from becoming
+null after the newly added check.
+
+Fixes: aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume callbacks")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Prashanth K <quic_prashk@quicinc.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/1676309438-14922-1-git-send-email-quic_prashk@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/u_serial.c | 23 +++++++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/gadget/function/u_serial.c
++++ b/drivers/usb/gadget/function/u_serial.c
+@@ -81,6 +81,9 @@
+ #define WRITE_BUF_SIZE 8192 /* TX only */
+ #define GS_CONSOLE_BUF_SIZE 8192
+
++/* Prevents race conditions while accessing gser->ioport */
++static DEFINE_SPINLOCK(serial_port_lock);
++
+ /* console info */
+ struct gs_console {
+ struct console console;
+@@ -1376,8 +1379,10 @@ void gserial_disconnect(struct gserial *
+ if (!port)
+ return;
+
++ spin_lock_irqsave(&serial_port_lock, flags);
++
+ /* tell the TTY glue not to do I/O here any more */
+- spin_lock_irqsave(&port->port_lock, flags);
++ spin_lock(&port->port_lock);
+
+ gs_console_disconnect(port);
+
+@@ -1392,7 +1397,8 @@ void gserial_disconnect(struct gserial *
+ tty_hangup(port->port.tty);
+ }
+ port->suspended = false;
+- spin_unlock_irqrestore(&port->port_lock, flags);
++ spin_unlock(&port->port_lock);
++ spin_unlock_irqrestore(&serial_port_lock, flags);
+
+ /* disable endpoints, aborting down any active I/O */
+ usb_ep_disable(gser->out);
+@@ -1426,10 +1432,19 @@ EXPORT_SYMBOL_GPL(gserial_suspend);
+
+ void gserial_resume(struct gserial *gser)
+ {
+- struct gs_port *port = gser->ioport;
++ struct gs_port *port;
+ unsigned long flags;
+
+- spin_lock_irqsave(&port->port_lock, flags);
++ spin_lock_irqsave(&serial_port_lock, flags);
++ port = gser->ioport;
++
++ if (!port) {
++ spin_unlock_irqrestore(&serial_port_lock, flags);
++ return;
++ }
++
++ spin_lock(&port->port_lock);
++ spin_unlock(&serial_port_lock);
+ port->suspended = false;
+ if (!port->start_delayed) {
+ spin_unlock_irqrestore(&port->port_lock, flags);
--- /dev/null
+From 617c331d91077f896111044628c096802551dc66 Mon Sep 17 00:00:00 2001
+From: Florian Zumbiehl <florz@florz.de>
+Date: Mon, 6 Feb 2023 02:04:28 +0100
+Subject: USB: serial: option: add support for VW/Skoda "Carstick LTE"
+
+From: Florian Zumbiehl <florz@florz.de>
+
+commit 617c331d91077f896111044628c096802551dc66 upstream.
+
+Add support for VW/Skoda "Carstick LTE"
+
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1c9e ProdID=7605 Rev=02.00
+S: Manufacturer=USB Modem
+S: Product=USB Modem
+C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA
+I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+
+The stick has AT command interfaces on interfaces 1, 2, and 3, and does PPP
+on interface 3.
+
+Signed-off-by: Florian Zumbiehl <florz@florz.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -402,6 +402,8 @@ static void option_instat_callback(struc
+ #define LONGCHEER_VENDOR_ID 0x1c9e
+
+ /* 4G Systems products */
++/* This one was sold as the VW and Skoda "Carstick LTE" */
++#define FOUR_G_SYSTEMS_PRODUCT_CARSTICK_LTE 0x7605
+ /* This is the 4G XS Stick W14 a.k.a. Mobilcom Debitel Surf-Stick *
+ * It seems to contain a Qualcomm QSC6240/6290 chipset */
+ #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603
+@@ -1976,6 +1978,8 @@ static const struct usb_device_id option
+ .driver_info = RSVD(2) },
+ { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
+ { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
++ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_CARSTICK_LTE),
++ .driver_info = RSVD(0) },
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
+ .driver_info = NCTRL(0) | NCTRL(1) },
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W100),
projects / thirdparty / kernel / stable-queue.git / commitdiff
