--- /dev/null
+From 72d92e865d1560723e1957ee3f393688c49ca5bf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Stefan=20M=C3=A4tje?= <Stefan.Maetje@esd.eu>
+Date: Wed, 18 Oct 2017 13:25:17 +0200
+Subject: can: esd_usb2: Fix can_dlc value for received RTR, frames
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Mätje <Stefan.Maetje@esd.eu>
+
+commit 72d92e865d1560723e1957ee3f393688c49ca5bf upstream.
+
+The dlc member of the struct rx_msg contains also the ESD_RTR flag to
+mark received RTR frames. Without the fix the can_dlc value for received
+RTR frames would always be set to 8 by get_can_dlc() instead of the
+received value.
+
+Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device")
+Signed-off-by: Stefan Mätje <stefan.maetje@esd.eu>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/esd_usb2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/can/usb/esd_usb2.c
++++ b/drivers/net/can/usb/esd_usb2.c
+@@ -334,7 +334,7 @@ static void esd_usb2_rx_can_msg(struct e
+ }
+
+ cf->can_id = id & ESD_IDMASK;
+- cf->can_dlc = get_can_dlc(msg->msg.rx.dlc);
++ cf->can_dlc = get_can_dlc(msg->msg.rx.dlc & ~ESD_RTR);
+
+ if (id & ESD_EXTID)
+ cf->can_id |= CAN_EFF_FLAG;
--- /dev/null
+From 97819f943063b622eca44d3644067c190dc75039 Mon Sep 17 00:00:00 2001
+From: Wolfgang Grandegger <wg@grandegger.com>
+Date: Thu, 14 Sep 2017 18:37:14 +0200
+Subject: can: gs_usb: fix busy loop if no more TX context is available
+
+From: Wolfgang Grandegger <wg@grandegger.com>
+
+commit 97819f943063b622eca44d3644067c190dc75039 upstream.
+
+If sending messages with no cable connected, it quickly happens that
+there is no more TX context available. Then "gs_can_start_xmit()"
+returns with "NETDEV_TX_BUSY" and the upper layer does retry
+immediately keeping the CPU busy. To fix that issue, I moved
+"atomic_dec(&dev->active_tx_urbs)" from "gs_usb_xmit_callback()" to
+the TX done handling in "gs_usb_receive_bulk_callback()". Renaming
+"active_tx_urbs" to "active_tx_contexts" and moving it into
+"gs_[alloc|free]_tx_context()" would also make sense.
+
+Signed-off-by: Wolfgang Grandegger <wg@grandegger.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/gs_usb.c | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -356,6 +356,8 @@ static void gs_usb_recieve_bulk_callback
+
+ gs_free_tx_context(txc);
+
++ atomic_dec(&dev->active_tx_urbs);
++
+ netif_wake_queue(netdev);
+ }
+
+@@ -444,14 +446,6 @@ static void gs_usb_xmit_callback(struct
+ urb->transfer_buffer_length,
+ urb->transfer_buffer,
+ urb->transfer_dma);
+-
+- atomic_dec(&dev->active_tx_urbs);
+-
+- if (!netif_device_present(netdev))
+- return;
+-
+- if (netif_queue_stopped(netdev))
+- netif_wake_queue(netdev);
+ }
+
+ static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb, struct net_device *netdev)
usb-devio-revert-usb-devio-don-t-corrupt-user-memory.patch
+usb-core-fix-out-of-bounds-access-bug-in-usb_get_bos_descriptor.patch
+usb-serial-metro-usb-add-ms7820-device-id.patch
+usb-cdc_acm-add-quirk-for-elatec-twn3.patch
+usb-quirks-add-quirk-for-worlde-mini-midi-keyboard.patch
+usb-hub-allow-reset-retry-for-usb2-devices-on-connect-bounce.patch
+can-gs_usb-fix-busy-loop-if-no-more-tx-context-is-available.patch
+can-esd_usb2-fix-can_dlc-value-for-received-rtr-frames.patch
--- /dev/null
+From 765fb2f181cad669f2beb87842a05d8071f2be85 Mon Sep 17 00:00:00 2001
+From: Maksim Salau <msalau@iotecha.com>
+Date: Wed, 11 Oct 2017 11:10:52 +0300
+Subject: usb: cdc_acm: Add quirk for Elatec TWN3
+
+From: Maksim Salau <msalau@iotecha.com>
+
+commit 765fb2f181cad669f2beb87842a05d8071f2be85 upstream.
+
+Elatec TWN3 has the union descriptor on data interface. This results in
+failure to bind the device to the driver with the following log:
+ usb 1-1.2: new full speed USB device using streamplug-ehci and address 4
+ usb 1-1.2: New USB device found, idVendor=09d8, idProduct=0320
+ usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
+ usb 1-1.2: Product: RFID Device (COM)
+ usb 1-1.2: Manufacturer: OEM
+ cdc_acm 1-1.2:1.0: Zero length descriptor references
+ cdc_acm: probe of 1-1.2:1.0 failed with error -22
+
+Adding the NO_UNION_NORMAL quirk for the device fixes the issue.
+
+`lsusb -v` of the device:
+
+Bus 001 Device 003: ID 09d8:0320
+Device Descriptor:
+ bLength 18
+ bDescriptorType 1
+ bcdUSB 2.00
+ bDeviceClass 2 Communications
+ bDeviceSubClass 0
+ bDeviceProtocol 0
+ bMaxPacketSize0 32
+ idVendor 0x09d8
+ idProduct 0x0320
+ bcdDevice 3.00
+ iManufacturer 1 OEM
+ iProduct 2 RFID Device (COM)
+ iSerial 0
+ bNumConfigurations 1
+ Configuration Descriptor:
+ bLength 9
+ bDescriptorType 2
+ wTotalLength 67
+ bNumInterfaces 2
+ bConfigurationValue 1
+ iConfiguration 0
+ bmAttributes 0x80
+ (Bus Powered)
+ MaxPower 250mA
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 0
+ bAlternateSetting 0
+ bNumEndpoints 1
+ bInterfaceClass 2 Communications
+ bInterfaceSubClass 2 Abstract (modem)
+ bInterfaceProtocol 1 AT-commands (v.25ter)
+ iInterface 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x83 EP 3 IN
+ bmAttributes 3
+ Transfer Type Interrupt
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0020 1x 32 bytes
+ bInterval 2
+ Interface Descriptor:
+ bLength 9
+ bDescriptorType 4
+ bInterfaceNumber 1
+ bAlternateSetting 0
+ bNumEndpoints 2
+ bInterfaceClass 10 CDC Data
+ bInterfaceSubClass 0 Unused
+ bInterfaceProtocol 0
+ iInterface 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x02 EP 2 OUT
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0020 1x 32 bytes
+ bInterval 0
+ Endpoint Descriptor:
+ bLength 7
+ bDescriptorType 5
+ bEndpointAddress 0x81 EP 1 IN
+ bmAttributes 2
+ Transfer Type Bulk
+ Synch Type None
+ Usage Type Data
+ wMaxPacketSize 0x0020 1x 32 bytes
+ bInterval 0
+ CDC Header:
+ bcdCDC 1.10
+ CDC Call Management:
+ bmCapabilities 0x03
+ call management
+ use DataInterface
+ bDataInterface 1
+ CDC ACM:
+ bmCapabilities 0x06
+ sends break
+ line coding and serial state
+ CDC Union:
+ bMasterInterface 0
+ bSlaveInterface 1
+Device Status: 0x0000
+ (Bus Powered)
+
+Signed-off-by: Maksim Salau <msalau@iotecha.com>
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-acm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1779,6 +1779,9 @@ static const struct usb_device_id acm_id
+ { USB_DEVICE(0xfff0, 0x0100), /* DATECS FP-2000 */
+ .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
+ },
++ { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */
++ .driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */
++ },
+
+ { USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */
+ .driver_info = CLEAR_HALT_CONDITIONS,
--- /dev/null
+From 1c0edc3633b56000e18d82fc241e3995ca18a69e Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 18 Oct 2017 12:49:38 -0400
+Subject: USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor()
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 1c0edc3633b56000e18d82fc241e3995ca18a69e upstream.
+
+Andrey used the syzkaller fuzzer to find an out-of-bounds memory
+access in usb_get_bos_descriptor(). The code wasn't checking that the
+next usb_dev_cap_header structure could fit into the remaining buffer
+space.
+
+This patch fixes the error and also reduces the bNumDeviceCaps field
+in the header to match the actual number of capabilities found, in
+cases where there are fewer than expected.
+
+Reported-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Tested-by: Andrey Konovalov <andreyknvl@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/config.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -855,10 +855,12 @@ int usb_get_bos_descriptor(struct usb_de
+ for (i = 0; i < num; i++) {
+ buffer += length;
+ cap = (struct usb_dev_cap_header *)buffer;
+- length = cap->bLength;
+
+- if (total_len < length)
++ if (total_len < sizeof(*cap) || total_len < cap->bLength) {
++ dev->bos->desc->bNumDeviceCaps = i;
+ break;
++ }
++ length = cap->bLength;
+ total_len -= length;
+
+ if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
--- /dev/null
+From 1ac7db63333db1eeff901bfd6bbcd502b4634fa4 Mon Sep 17 00:00:00 2001
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+Date: Tue, 17 Oct 2017 16:07:33 +0300
+Subject: usb: hub: Allow reset retry for USB2 devices on connect bounce
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+commit 1ac7db63333db1eeff901bfd6bbcd502b4634fa4 upstream.
+
+If the connect status change is set during reset signaling, but
+the status remains connected just retry port reset.
+
+This solves an issue with connecting a 90W HP Thunderbolt 3 dock
+with a Lenovo Carbon x1 (5th generation) which causes a 30min loop
+of a high speed device being re-discovererd before usb ports starts
+working.
+
+[...]
+[ 389.023845] usb 3-1: new high-speed USB device number 55 using xhci_hcd
+[ 389.491841] usb 3-1: new high-speed USB device number 56 using xhci_hcd
+[ 389.959928] usb 3-1: new high-speed USB device number 57 using xhci_hcd
+[...]
+
+This is caused by a high speed device that doesn't successfully go to the
+enabled state after the second port reset. Instead the connection bounces
+(connected, with connect status change), bailing out completely from
+enumeration just to restart from scratch.
+
+Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1716332
+
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hub.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2667,13 +2667,16 @@ static int hub_port_wait_reset(struct us
+ if (!(portstatus & USB_PORT_STAT_CONNECTION))
+ return -ENOTCONN;
+
+- /* bomb out completely if the connection bounced. A USB 3.0
+- * connection may bounce if multiple warm resets were issued,
++ /* Retry if connect change is set but status is still connected.
++ * A USB 3.0 connection may bounce if multiple warm resets were issued,
+ * but the device may have successfully re-connected. Ignore it.
+ */
+ if (!hub_is_superspeed(hub->hdev) &&
+- (portchange & USB_PORT_STAT_C_CONNECTION))
+- return -ENOTCONN;
++ (portchange & USB_PORT_STAT_C_CONNECTION)) {
++ usb_clear_port_feature(hub->hdev, port1,
++ USB_PORT_FEAT_C_CONNECTION);
++ return -EAGAIN;
++ }
+
+ if (!(portstatus & USB_PORT_STAT_ENABLE))
+ return -EBUSY;
--- /dev/null
+From 2811501e6d8f5747d08f8e25b9ecf472d0dc4c7d Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+Date: Tue, 3 Oct 2017 11:16:43 +0300
+Subject: usb: quirks: add quirk for WORLDE MINI MIDI keyboard
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+
+commit 2811501e6d8f5747d08f8e25b9ecf472d0dc4c7d upstream.
+
+This keyboard doesn't implement Get String descriptors properly even
+though string indexes are valid. What happens is that when requesting
+for the String descriptor, the device disconnects and
+reconnects. Without this quirk, this loop will continue forever.
+
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Владимир Мартьянов <vilgeforce@gmail.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -214,6 +214,10 @@ static const struct usb_device_id usb_qu
+ /* Corsair Strafe RGB */
+ { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
+
++ /* MIDI keyboard WORLDE MINI */
++ { USB_DEVICE(0x1c75, 0x0204), .driver_info =
++ USB_QUIRK_CONFIG_INTF_STRINGS },
++
+ /* Acer C120 LED Projector */
+ { USB_DEVICE(0x1de1, 0xc102), .driver_info = USB_QUIRK_NO_LPM },
+
--- /dev/null
+From 31dc3f819bac28a0990b36510197560258ab7421 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 12 Oct 2017 14:50:46 +0200
+Subject: USB: serial: metro-usb: add MS7820 device id
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 31dc3f819bac28a0990b36510197560258ab7421 upstream.
+
+Add device-id entry for (Honeywell) Metrologic MS7820 bar code scanner.
+
+The device has two interfaces (in this mode?); a vendor-specific
+interface with two interrupt endpoints and a second HID interface, which
+we do not bind to.
+
+Reported-by: Ladislav Dobrovsky <ladislav.dobrovsky@gmail.com>
+Tested-by: Ladislav Dobrovsky <ladislav.dobrovsky@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/metro-usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/metro-usb.c
++++ b/drivers/usb/serial/metro-usb.c
+@@ -45,6 +45,7 @@ struct metrousb_private {
+ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(FOCUS_VENDOR_ID, FOCUS_PRODUCT_ID_BI) },
+ { USB_DEVICE(FOCUS_VENDOR_ID, FOCUS_PRODUCT_ID_UNI) },
++ { USB_DEVICE_INTERFACE_CLASS(0x0c2e, 0x0730, 0xff) }, /* MS7820 */
+ { }, /* Terminating entry. */
+ };
+ MODULE_DEVICE_TABLE(usb, id_table);
projects / thirdparty / kernel / stable-queue.git / commitdiff
