]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.9-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 16 Oct 2020 07:49:18 +0000 (09:49 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 16 Oct 2020 07:49:18 +0000 (09:49 +0200)
added patches:
bluetooth-consolidate-encryption-handling-in-hci_encrypt_cfm.patch
bluetooth-disconnect-if-e0-is-used-for-level-4.patch
bluetooth-fix-update-of-connection-state-in-hci_encrypt_cfm.patch
media-usbtv-fix-refcounting-mixup.patch
reiserfs-fix-oops-during-mount.patch
reiserfs-initialize-inode-keys-properly.patch
staging-comedi-check-validity-of-wmaxpacketsize-of-usb-endpoints-found.patch
usb-serial-ftdi_sio-add-support-for-freecalypso-jtag-uart-adapters.patch
usb-serial-option-add-cellient-mpl200-card.patch
usb-serial-option-add-telit-ft980-ks-composition.patch
usb-serial-pl2303-add-device-id-for-hp-gc-device.patch

12 files changed:
queue-4.9/bluetooth-consolidate-encryption-handling-in-hci_encrypt_cfm.patch [new file with mode: 0644]
queue-4.9/bluetooth-disconnect-if-e0-is-used-for-level-4.patch [new file with mode: 0644]
queue-4.9/bluetooth-fix-update-of-connection-state-in-hci_encrypt_cfm.patch [new file with mode: 0644]
queue-4.9/media-usbtv-fix-refcounting-mixup.patch [new file with mode: 0644]
queue-4.9/reiserfs-fix-oops-during-mount.patch [new file with mode: 0644]
queue-4.9/reiserfs-initialize-inode-keys-properly.patch [new file with mode: 0644]
queue-4.9/series
queue-4.9/staging-comedi-check-validity-of-wmaxpacketsize-of-usb-endpoints-found.patch [new file with mode: 0644]
queue-4.9/usb-serial-ftdi_sio-add-support-for-freecalypso-jtag-uart-adapters.patch [new file with mode: 0644]
queue-4.9/usb-serial-option-add-cellient-mpl200-card.patch [new file with mode: 0644]
queue-4.9/usb-serial-option-add-telit-ft980-ks-composition.patch [new file with mode: 0644]
queue-4.9/usb-serial-pl2303-add-device-id-for-hp-gc-device.patch [new file with mode: 0644]

diff --git a/queue-4.9/bluetooth-consolidate-encryption-handling-in-hci_encrypt_cfm.patch b/queue-4.9/bluetooth-consolidate-encryption-handling-in-hci_encrypt_cfm.patch
new file mode 100644 (file)
index 0000000..3cf4ad8
--- /dev/null
@@ -0,0 +1,104 @@
+From 3ca44c16b0dcc764b641ee4ac226909f5c421aa3 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Tue, 19 May 2020 13:25:19 -0700
+Subject: Bluetooth: Consolidate encryption handling in hci_encrypt_cfm
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+commit 3ca44c16b0dcc764b641ee4ac226909f5c421aa3 upstream.
+
+This makes hci_encrypt_cfm calls hci_connect_cfm in case the connection
+state is BT_CONFIG so callers don't have to check the state.
+
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Cc: Hans-Christian Noren Egtvedt <hegtvedt@cisco.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/net/bluetooth/hci_core.h |   20 ++++++++++++++++++--
+ net/bluetooth/hci_event.c        |   28 +++-------------------------
+ 2 files changed, 21 insertions(+), 27 deletions(-)
+
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -1250,10 +1250,26 @@ static inline void hci_auth_cfm(struct h
+               conn->security_cfm_cb(conn, status);
+ }
+-static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status,
+-                                                              __u8 encrypt)
++static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status)
+ {
+       struct hci_cb *cb;
++      __u8 encrypt;
++
++      if (conn->state == BT_CONFIG) {
++              if (status)
++                      conn->state = BT_CONNECTED;
++
++              hci_connect_cfm(conn, status);
++              hci_conn_drop(conn);
++              return;
++      }
++
++      if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
++              encrypt = 0x00;
++      else if (test_bit(HCI_CONN_AES_CCM, &conn->flags))
++              encrypt = 0x02;
++      else
++              encrypt = 0x01;
+       if (conn->sec_level == BT_SECURITY_SDP)
+               conn->sec_level = BT_SECURITY_LOW;
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -2493,7 +2493,7 @@ static void hci_auth_complete_evt(struct
+                                    &cp);
+               } else {
+                       clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
+-                      hci_encrypt_cfm(conn, ev->status, 0x00);
++                      hci_encrypt_cfm(conn, ev->status);
+               }
+       }
+@@ -2579,22 +2579,7 @@ static void read_enc_key_size_complete(s
+               conn->enc_key_size = rp->key_size;
+       }
+-      if (conn->state == BT_CONFIG) {
+-              conn->state = BT_CONNECTED;
+-              hci_connect_cfm(conn, 0);
+-              hci_conn_drop(conn);
+-      } else {
+-              u8 encrypt;
+-
+-              if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
+-                      encrypt = 0x00;
+-              else if (test_bit(HCI_CONN_AES_CCM, &conn->flags))
+-                      encrypt = 0x02;
+-              else
+-                      encrypt = 0x01;
+-
+-              hci_encrypt_cfm(conn, 0, encrypt);
+-      }
++      hci_encrypt_cfm(conn, 0);
+ unlock:
+       hci_dev_unlock(hdev);
+@@ -2691,14 +2676,7 @@ static void hci_encrypt_change_evt(struc
+       }
+ notify:
+-      if (conn->state == BT_CONFIG) {
+-              if (!ev->status)
+-                      conn->state = BT_CONNECTED;
+-
+-              hci_connect_cfm(conn, ev->status);
+-              hci_conn_drop(conn);
+-      } else
+-              hci_encrypt_cfm(conn, ev->status, ev->encrypt);
++      hci_encrypt_cfm(conn, ev->status);
+ unlock:
+       hci_dev_unlock(hdev);
diff --git a/queue-4.9/bluetooth-disconnect-if-e0-is-used-for-level-4.patch b/queue-4.9/bluetooth-disconnect-if-e0-is-used-for-level-4.patch
new file mode 100644 (file)
index 0000000..941e36b
--- /dev/null
@@ -0,0 +1,145 @@
+From 8746f135bb01872ff412d408ea1aa9ebd328c1f5 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Wed, 20 May 2020 14:20:14 -0700
+Subject: Bluetooth: Disconnect if E0 is used for Level 4
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+commit 8746f135bb01872ff412d408ea1aa9ebd328c1f5 upstream.
+
+E0 is not allowed with Level 4:
+
+BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C page 1319:
+
+  '128-bit equivalent strength for link and encryption keys
+   required using FIPS approved algorithms (E0 not allowed,
+   SAFER+ not allowed, and P-192 not allowed; encryption key
+   not shortened'
+
+SC enabled:
+
+> HCI Event: Read Remote Extended Features (0x23) plen 13
+        Status: Success (0x00)
+        Handle: 256
+        Page: 1/2
+        Features: 0x0b 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+          Secure Simple Pairing (Host Support)
+          LE Supported (Host)
+          Secure Connections (Host Support)
+> HCI Event: Encryption Change (0x08) plen 4
+        Status: Success (0x00)
+        Handle: 256
+        Encryption: Enabled with AES-CCM (0x02)
+
+SC disabled:
+
+> HCI Event: Read Remote Extended Features (0x23) plen 13
+        Status: Success (0x00)
+        Handle: 256
+        Page: 1/2
+        Features: 0x03 0x00 0x00 0x00 0x00 0x00 0x00 0x00
+          Secure Simple Pairing (Host Support)
+          LE Supported (Host)
+> HCI Event: Encryption Change (0x08) plen 4
+        Status: Success (0x00)
+        Handle: 256
+        Encryption: Enabled with E0 (0x01)
+[May 8 20:23] Bluetooth: hci0: Invalid security: expect AES but E0 was used
+< HCI Command: Disconnect (0x01|0x0006) plen 3
+        Handle: 256
+        Reason: Authentication Failure (0x05)
+
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Cc: Hans-Christian Noren Egtvedt <hegtvedt@cisco.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/net/bluetooth/hci_core.h |   10 ++++++----
+ net/bluetooth/hci_conn.c         |   17 +++++++++++++++++
+ net/bluetooth/hci_event.c        |   20 ++++++++------------
+ 3 files changed, 31 insertions(+), 16 deletions(-)
+
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -1271,11 +1271,13 @@ static inline void hci_encrypt_cfm(struc
+       else
+               encrypt = 0x01;
+-      if (conn->sec_level == BT_SECURITY_SDP)
+-              conn->sec_level = BT_SECURITY_LOW;
++      if (!status) {
++              if (conn->sec_level == BT_SECURITY_SDP)
++                      conn->sec_level = BT_SECURITY_LOW;
+-      if (conn->pending_sec_level > conn->sec_level)
+-              conn->sec_level = conn->pending_sec_level;
++              if (conn->pending_sec_level > conn->sec_level)
++                      conn->sec_level = conn->pending_sec_level;
++      }
+       mutex_lock(&hci_cb_list_lock);
+       list_for_each_entry(cb, &hci_cb_list, list) {
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1163,6 +1163,23 @@ int hci_conn_check_link_mode(struct hci_
+                       return 0;
+       }
++       /* AES encryption is required for Level 4:
++        *
++        * BLUETOOTH CORE SPECIFICATION Version 5.2 | Vol 3, Part C
++        * page 1319:
++        *
++        * 128-bit equivalent strength for link and encryption keys
++        * required using FIPS approved algorithms (E0 not allowed,
++        * SAFER+ not allowed, and P-192 not allowed; encryption key
++        * not shortened)
++        */
++      if (conn->sec_level == BT_SECURITY_FIPS &&
++          !test_bit(HCI_CONN_AES_CCM, &conn->flags)) {
++              bt_dev_err(conn->hdev,
++                         "Invalid security: Missing AES-CCM usage");
++              return 0;
++      }
++
+       if (hci_conn_ssp_enabled(conn) &&
+           !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
+               return 0;
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -2626,26 +2626,22 @@ static void hci_encrypt_change_evt(struc
+       clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
++      /* Check link security requirements are met */
++      if (!hci_conn_check_link_mode(conn))
++              ev->status = HCI_ERROR_AUTH_FAILURE;
++
+       if (ev->status && conn->state == BT_CONNECTED) {
+               if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
+                       set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
++              /* Notify upper layers so they can cleanup before
++               * disconnecting.
++               */
++              hci_encrypt_cfm(conn, ev->status);
+               hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
+               hci_conn_drop(conn);
+               goto unlock;
+       }
+-
+-      /* In Secure Connections Only mode, do not allow any connections
+-       * that are not encrypted with AES-CCM using a P-256 authenticated
+-       * combination key.
+-       */
+-      if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
+-          (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
+-           conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
+-              hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
+-              hci_conn_drop(conn);
+-              goto unlock;
+-      }
+       /* Try reading the encryption key size for encrypted ACL links */
+       if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
diff --git a/queue-4.9/bluetooth-fix-update-of-connection-state-in-hci_encrypt_cfm.patch b/queue-4.9/bluetooth-fix-update-of-connection-state-in-hci_encrypt_cfm.patch
new file mode 100644 (file)
index 0000000..7974d47
--- /dev/null
@@ -0,0 +1,46 @@
+From 339ddaa626995bc6218972ca241471f3717cc5f4 Mon Sep 17 00:00:00 2001
+From: Patrick Steinhardt <ps@pks.im>
+Date: Wed, 15 Jul 2020 19:43:33 +0200
+Subject: Bluetooth: Fix update of connection state in `hci_encrypt_cfm`
+
+From: Patrick Steinhardt <ps@pks.im>
+
+commit 339ddaa626995bc6218972ca241471f3717cc5f4 upstream.
+
+Starting with the upgrade to v5.8-rc3, I've noticed I wasn't able to
+connect to my Bluetooth headset properly anymore. While connecting to
+the device would eventually succeed, bluetoothd seemed to be confused
+about the current connection state where the state was flapping hence
+and forth. Bisecting this issue led to commit 3ca44c16b0dc (Bluetooth:
+Consolidate encryption handling in hci_encrypt_cfm, 2020-05-19), which
+refactored `hci_encrypt_cfm` to also handle updating the connection
+state.
+
+The commit in question changed the code to call `hci_connect_cfm` inside
+`hci_encrypt_cfm` and to change the connection state. But with the
+conversion, we now only update the connection state if a status was set
+already. In fact, the reverse should be true: the status should be
+updated if no status is yet set. So let's fix the isuse by reversing the
+condition.
+
+Fixes: 3ca44c16b0dc ("Bluetooth: Consolidate encryption handling in hci_encrypt_cfm")
+Signed-off-by: Patrick Steinhardt <ps@pks.im>
+Acked-by:  Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/net/bluetooth/hci_core.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -1256,7 +1256,7 @@ static inline void hci_encrypt_cfm(struc
+       __u8 encrypt;
+       if (conn->state == BT_CONFIG) {
+-              if (status)
++              if (!status)
+                       conn->state = BT_CONNECTED;
+               hci_connect_cfm(conn, status);
diff --git a/queue-4.9/media-usbtv-fix-refcounting-mixup.patch b/queue-4.9/media-usbtv-fix-refcounting-mixup.patch
new file mode 100644 (file)
index 0000000..fb78b52
--- /dev/null
@@ -0,0 +1,39 @@
+From bf65f8aabdb37bc1a785884374e919477fe13e10 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Thu, 24 Sep 2020 11:14:10 +0200
+Subject: media: usbtv: Fix refcounting mixup
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit bf65f8aabdb37bc1a785884374e919477fe13e10 upstream.
+
+The premature free in the error path is blocked by V4L
+refcounting, not USB refcounting. Thanks to
+Ben Hutchings for review.
+
+[v2] corrected attributions
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Fixes: 50e704453553 ("media: usbtv: prevent double free in error case")
+CC: stable@vger.kernel.org
+Reported-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/usbtv/usbtv-core.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/usb/usbtv/usbtv-core.c
++++ b/drivers/media/usb/usbtv/usbtv-core.c
+@@ -110,7 +110,8 @@ static int usbtv_probe(struct usb_interf
+ usbtv_audio_fail:
+       /* we must not free at this point */
+-      usb_get_dev(usbtv->udev);
++      v4l2_device_get(&usbtv->v4l2_dev);
++      /* this will undo the v4l2_device_get() */
+       usbtv_video_free(usbtv);
+ usbtv_video_fail:
diff --git a/queue-4.9/reiserfs-fix-oops-during-mount.patch b/queue-4.9/reiserfs-fix-oops-during-mount.patch
new file mode 100644 (file)
index 0000000..c1024b7
--- /dev/null
@@ -0,0 +1,55 @@
+From c2bb80b8bdd04dfe32364b78b61b6a47f717af52 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 30 Sep 2020 17:08:20 +0200
+Subject: reiserfs: Fix oops during mount
+
+From: Jan Kara <jack@suse.cz>
+
+commit c2bb80b8bdd04dfe32364b78b61b6a47f717af52 upstream.
+
+With suitably crafted reiserfs image and mount command reiserfs will
+crash when trying to verify that XATTR_ROOT directory can be looked up
+in / as that recurses back to xattr code like:
+
+ xattr_lookup+0x24/0x280 fs/reiserfs/xattr.c:395
+ reiserfs_xattr_get+0x89/0x540 fs/reiserfs/xattr.c:677
+ reiserfs_get_acl+0x63/0x690 fs/reiserfs/xattr_acl.c:209
+ get_acl+0x152/0x2e0 fs/posix_acl.c:141
+ check_acl fs/namei.c:277 [inline]
+ acl_permission_check fs/namei.c:309 [inline]
+ generic_permission+0x2ba/0x550 fs/namei.c:353
+ do_inode_permission fs/namei.c:398 [inline]
+ inode_permission+0x234/0x4a0 fs/namei.c:463
+ lookup_one_len+0xa6/0x200 fs/namei.c:2557
+ reiserfs_lookup_privroot+0x85/0x1e0 fs/reiserfs/xattr.c:972
+ reiserfs_fill_super+0x2b51/0x3240 fs/reiserfs/super.c:2176
+ mount_bdev+0x24f/0x360 fs/super.c:1417
+
+Fix the problem by bailing from reiserfs_xattr_get() when xattrs are not
+yet initialized.
+
+CC: stable@vger.kernel.org
+Reported-by: syzbot+9b33c9b118d77ff59b6f@syzkaller.appspotmail.com
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/reiserfs/xattr.c |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/fs/reiserfs/xattr.c
++++ b/fs/reiserfs/xattr.c
+@@ -664,6 +664,13 @@ reiserfs_xattr_get(struct inode *inode,
+       if (get_inode_sd_version(inode) == STAT_DATA_V1)
+               return -EOPNOTSUPP;
++      /*
++       * priv_root needn't be initialized during mount so allow initial
++       * lookups to succeed.
++       */
++      if (!REISERFS_SB(inode->i_sb)->priv_root)
++              return 0;
++
+       dentry = xattr_lookup(inode, name, XATTR_REPLACE);
+       if (IS_ERR(dentry)) {
+               err = PTR_ERR(dentry);
diff --git a/queue-4.9/reiserfs-initialize-inode-keys-properly.patch b/queue-4.9/reiserfs-initialize-inode-keys-properly.patch
new file mode 100644 (file)
index 0000000..0186ac6
--- /dev/null
@@ -0,0 +1,37 @@
+From 4443390e08d34d5771ab444f601cf71b3c9634a4 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Mon, 21 Sep 2020 15:08:50 +0200
+Subject: reiserfs: Initialize inode keys properly
+
+From: Jan Kara <jack@suse.cz>
+
+commit 4443390e08d34d5771ab444f601cf71b3c9634a4 upstream.
+
+reiserfs_read_locked_inode() didn't initialize key length properly. Use
+_make_cpu_key() macro for key initialization so that all key member are
+properly initialized.
+
+CC: stable@vger.kernel.org
+Reported-by: syzbot+d94d02749498bb7bab4b@syzkaller.appspotmail.com
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/reiserfs/inode.c |    6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/fs/reiserfs/inode.c
++++ b/fs/reiserfs/inode.c
+@@ -1554,11 +1554,7 @@ void reiserfs_read_locked_inode(struct i
+        * set version 1, version 2 could be used too, because stat data
+        * key is the same in both versions
+        */
+-      key.version = KEY_FORMAT_3_5;
+-      key.on_disk_key.k_dir_id = dirino;
+-      key.on_disk_key.k_objectid = inode->i_ino;
+-      key.on_disk_key.k_offset = 0;
+-      key.on_disk_key.k_type = 0;
++      _make_cpu_key(&key, KEY_FORMAT_3_5, dirino, inode->i_ino, 0, 0, 3);
+       /* look for the object's stat data */
+       retval = search_item(inode->i_sb, &key, &path_to_sd);
index d3e93188fec26728cb702a5abc0470aace4aea4e..a93a3f64c83aad6b0d415c244008ba1749f74d3d 100644 (file)
@@ -2,3 +2,14 @@ bluetooth-a2mp-fix-not-initializing-all-members.patch
 bluetooth-l2cap-fix-calling-sk_filter-on-non-socket-based-channel.patch
 bluetooth-mgmt-fix-not-checking-if-bt_hs-is-enabled.patch
 bluetooth-fix-kernel-oops-in-store_pending_adv_report.patch
+bluetooth-consolidate-encryption-handling-in-hci_encrypt_cfm.patch
+bluetooth-fix-update-of-connection-state-in-hci_encrypt_cfm.patch
+bluetooth-disconnect-if-e0-is-used-for-level-4.patch
+media-usbtv-fix-refcounting-mixup.patch
+usb-serial-option-add-cellient-mpl200-card.patch
+usb-serial-option-add-telit-ft980-ks-composition.patch
+staging-comedi-check-validity-of-wmaxpacketsize-of-usb-endpoints-found.patch
+usb-serial-pl2303-add-device-id-for-hp-gc-device.patch
+usb-serial-ftdi_sio-add-support-for-freecalypso-jtag-uart-adapters.patch
+reiserfs-initialize-inode-keys-properly.patch
+reiserfs-fix-oops-during-mount.patch
diff --git a/queue-4.9/staging-comedi-check-validity-of-wmaxpacketsize-of-usb-endpoints-found.patch b/queue-4.9/staging-comedi-check-validity-of-wmaxpacketsize-of-usb-endpoints-found.patch
new file mode 100644 (file)
index 0000000..4c7cc10
--- /dev/null
@@ -0,0 +1,41 @@
+From e1f13c879a7c21bd207dc6242455e8e3a1e88b40 Mon Sep 17 00:00:00 2001
+From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+Date: Sat, 10 Oct 2020 13:59:32 +0530
+Subject: staging: comedi: check validity of wMaxPacketSize of usb endpoints found
+
+From: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+
+commit e1f13c879a7c21bd207dc6242455e8e3a1e88b40 upstream.
+
+While finding usb endpoints in vmk80xx_find_usb_endpoints(), check if
+wMaxPacketSize = 0 for the endpoints found.
+
+Some devices have isochronous endpoints that have wMaxPacketSize = 0
+(as required by the USB-2 spec).
+However, since this doesn't apply here, wMaxPacketSize = 0 can be
+considered to be invalid.
+
+Reported-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com
+Tested-by: syzbot+009f546aa1370056b1c2@syzkaller.appspotmail.com
+Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201010082933.5417-1-anant.thazhemadam@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers/vmk80xx.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/comedi/drivers/vmk80xx.c
++++ b/drivers/staging/comedi/drivers/vmk80xx.c
+@@ -676,6 +676,9 @@ static int vmk80xx_find_usb_endpoints(st
+       if (!devpriv->ep_rx || !devpriv->ep_tx)
+               return -ENODEV;
++      if (!usb_endpoint_maxp(devpriv->ep_rx) || !usb_endpoint_maxp(devpriv->ep_tx))
++              return -EINVAL;
++
+       return 0;
+ }
diff --git a/queue-4.9/usb-serial-ftdi_sio-add-support-for-freecalypso-jtag-uart-adapters.patch b/queue-4.9/usb-serial-ftdi_sio-add-support-for-freecalypso-jtag-uart-adapters.patch
new file mode 100644 (file)
index 0000000..69e38ea
--- /dev/null
@@ -0,0 +1,73 @@
+From 6cf87e5edd9944e1d3b6efd966ea401effc304ee Mon Sep 17 00:00:00 2001
+From: "Mychaela N. Falconia" <falcon@freecalypso.org>
+Date: Wed, 16 Sep 2020 01:56:29 +0000
+Subject: USB: serial: ftdi_sio: add support for FreeCalypso JTAG+UART adapters
+
+From: Mychaela N. Falconia <falcon@freecalypso.org>
+
+commit 6cf87e5edd9944e1d3b6efd966ea401effc304ee upstream.
+
+There exist many FT2232-based JTAG+UART adapter designs in which
+FT2232 Channel A is used for JTAG and Channel B is used for UART.
+The best way to handle them in Linux is to have the ftdi_sio driver
+create a ttyUSB device only for Channel B and not for Channel A:
+a ttyUSB device for Channel A would be bogus and will disappear as
+soon as the user runs OpenOCD or other applications that access
+Channel A for JTAG from userspace, causing undesirable noise for
+users.  The ftdi_sio driver already has a dedicated quirk for such
+JTAG+UART FT2232 adapters, and it requires assigning custom USB IDs
+to such adapters and adding these IDs to the driver with the
+ftdi_jtag_quirk applied.
+
+Boutique hardware manufacturer Falconia Partners LLC has created a
+couple of JTAG+UART adapter designs (one buffered, one unbuffered)
+as part of FreeCalypso project, and this hardware is specifically made
+to be used with Linux hosts, with the intent that Channel A will be
+accessed only from userspace via appropriate applications, and that
+Channel B will be supported by the ftdi_sio kernel driver, presenting
+a standard ttyUSB device to userspace.  Toward this end the hardware
+manufacturer will be programming FT2232 EEPROMs with custom USB IDs,
+specifically with the intent that these IDs will be recognized by
+the ftdi_sio driver with the ftdi_jtag_quirk applied.
+
+Signed-off-by: Mychaela N. Falconia <falcon@freecalypso.org>
+[johan: insert in PID order and drop unused define]
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c     |    5 +++++
+ drivers/usb/serial/ftdi_sio_ids.h |    7 +++++++
+ 2 files changed, 12 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1032,6 +1032,11 @@ static const struct usb_device_id id_tab
+       /* U-Blox devices */
+       { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) },
+       { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) },
++      /* FreeCalypso USB adapters */
++      { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID),
++              .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++      { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID),
++              .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+       { }                                     /* Terminating entry */
+ };
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -38,6 +38,13 @@
+ #define FTDI_LUMEL_PD12_PID   0x6002
++/*
++ * Custom USB adapters made by Falconia Partners LLC
++ * for FreeCalypso project, ID codes allocated to Falconia by FTDI.
++ */
++#define FTDI_FALCONIA_JTAG_BUF_PID    0x7150
++#define FTDI_FALCONIA_JTAG_UNBUF_PID  0x7151
++
+ /* Sienna Serial Interface by Secyourit GmbH */
+ #define FTDI_SIENNA_PID               0x8348
diff --git a/queue-4.9/usb-serial-option-add-cellient-mpl200-card.patch b/queue-4.9/usb-serial-option-add-cellient-mpl200-card.patch
new file mode 100644 (file)
index 0000000..8d25371
--- /dev/null
@@ -0,0 +1,40 @@
+From 3e765cab8abe7f84cb80d4a7a973fc97d5742647 Mon Sep 17 00:00:00 2001
+From: Wilken Gottwalt <wilken.gottwalt@mailbox.org>
+Date: Sat, 3 Oct 2020 11:40:29 +0200
+Subject: USB: serial: option: add Cellient MPL200 card
+
+From: Wilken Gottwalt <wilken.gottwalt@mailbox.org>
+
+commit 3e765cab8abe7f84cb80d4a7a973fc97d5742647 upstream.
+
+Add usb ids of the Cellient MPL200 card.
+
+Signed-off-by: Wilken Gottwalt <wilken.gottwalt@mailbox.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/3db5418fe9e516f4b290736c5a199c9796025e3c.1601715478.git.wilken.gottwalt@mailbox.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -529,6 +529,7 @@ static void option_instat_callback(struc
+ /* Cellient products */
+ #define CELLIENT_VENDOR_ID                    0x2692
+ #define CELLIENT_PRODUCT_MEN200                       0x9005
++#define CELLIENT_PRODUCT_MPL200                       0x9025
+ /* Hyundai Petatel Inc. products */
+ #define PETATEL_VENDOR_ID                     0x1ff4
+@@ -1967,6 +1968,8 @@ static const struct usb_device_id option
+       { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) },
+       { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) },
+       { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
++      { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MPL200),
++        .driver_info = RSVD(1) | RSVD(4) },
+       { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600A) },
+       { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) },
+       { USB_DEVICE_AND_INTERFACE_INFO(TPLINK_VENDOR_ID, TPLINK_PRODUCT_LTE, 0xff, 0x00, 0x00) },      /* TP-Link LTE Module */
diff --git a/queue-4.9/usb-serial-option-add-telit-ft980-ks-composition.patch b/queue-4.9/usb-serial-option-add-telit-ft980-ks-composition.patch
new file mode 100644 (file)
index 0000000..081d585
--- /dev/null
@@ -0,0 +1,37 @@
+From 924a9213358fb92fa3c3225d6d042aa058167405 Mon Sep 17 00:00:00 2001
+From: Leonid Bloch <lb.workbox@gmail.com>
+Date: Sun, 4 Oct 2020 18:58:13 +0300
+Subject: USB: serial: option: Add Telit FT980-KS composition
+
+From: Leonid Bloch <lb.workbox@gmail.com>
+
+commit 924a9213358fb92fa3c3225d6d042aa058167405 upstream.
+
+This commit adds the following Telit FT980-KS composition:
+
+0x1054: rndis, diag, adb, nmea, modem, modem, aux
+
+AT commands can be sent to /dev/ttyUSB2.
+
+Signed-off-by: Leonid Bloch <lb.workbox@gmail.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/ce86bc05-f4e2-b199-0cdc-792715e3f275@asocscloud.com
+Link: https://lore.kernel.org/r/20201004155813.2342-1-lb.workbox@gmail.com
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1172,6 +1172,8 @@ static const struct usb_device_id option
+         .driver_info = NCTRL(2) | RSVD(3) },
+       { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1053, 0xff),    /* Telit FN980 (ECM) */
+         .driver_info = NCTRL(0) | RSVD(1) },
++      { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1054, 0xff),    /* Telit FT980-KS */
++        .driver_info = NCTRL(2) | RSVD(3) },
+       { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+         .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
+       { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
diff --git a/queue-4.9/usb-serial-pl2303-add-device-id-for-hp-gc-device.patch b/queue-4.9/usb-serial-pl2303-add-device-id-for-hp-gc-device.patch
new file mode 100644 (file)
index 0000000..2f8c0ca
--- /dev/null
@@ -0,0 +1,41 @@
+From 031f9664f8f9356cee662335bc56c93d16e75665 Mon Sep 17 00:00:00 2001
+From: Scott Chen <scott@labau.com.tw>
+Date: Thu, 24 Sep 2020 14:27:45 +0800
+Subject: USB: serial: pl2303: add device-id for HP GC device
+
+From: Scott Chen <scott@labau.com.tw>
+
+commit 031f9664f8f9356cee662335bc56c93d16e75665 upstream.
+
+This is adds a device id for HP LD381 which is a pl2303GC-base device.
+
+Signed-off-by: Scott Chen <scott@labau.com.tw>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/pl2303.c |    1 +
+ drivers/usb/serial/pl2303.h |    1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -89,6 +89,7 @@ static const struct usb_device_id id_tab
+       { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
+       { USB_DEVICE(HP_VENDOR_ID, HP_LD220TA_PRODUCT_ID) },
+       { USB_DEVICE(HP_VENDOR_ID, HP_LD381_PRODUCT_ID) },
++      { USB_DEVICE(HP_VENDOR_ID, HP_LD381GC_PRODUCT_ID) },
+       { USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) },
+       { USB_DEVICE(HP_VENDOR_ID, HP_LD960TA_PRODUCT_ID) },
+       { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) },
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -125,6 +125,7 @@
+ /* Hewlett-Packard POS Pole Displays */
+ #define HP_VENDOR_ID          0x03f0
++#define HP_LD381GC_PRODUCT_ID 0x0183
+ #define HP_LM920_PRODUCT_ID   0x026b
+ #define HP_TD620_PRODUCT_ID   0x0956
+ #define HP_LD960_PRODUCT_ID   0x0b39