--- /dev/null
+From 6e8a914ad619042c5f25a4feb663357c4170fd8d Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 10 Jul 2020 15:33:51 +0200
+Subject: ALSA: line6: Perform sanity check for each URB creation
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 6e8a914ad619042c5f25a4feb663357c4170fd8d upstream.
+
+LINE6 drivers create stream URBs with a fixed pipe without checking
+its validity, and this may lead to a kernel WARNING at the submission
+when a malformed USB descriptor is passed.
+
+For avoiding the kernel warning, perform the similar sanity checks for
+each pipe type at creating a URB.
+
+Reported-by: syzbot+c190f6858a04ea7fbc52@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/s5hv9iv4hq8.wl-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/line6/capture.c | 2 ++
+ sound/usb/line6/playback.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+--- a/sound/usb/line6/capture.c
++++ b/sound/usb/line6/capture.c
+@@ -291,6 +291,8 @@ int line6_create_audio_in_urbs(struct sn
+ urb->interval = LINE6_ISO_INTERVAL;
+ urb->error_count = 0;
+ urb->complete = audio_in_callback;
++ if (usb_urb_ep_type_check(urb))
++ return -EINVAL;
+ }
+
+ return 0;
+--- a/sound/usb/line6/playback.c
++++ b/sound/usb/line6/playback.c
+@@ -436,6 +436,8 @@ int line6_create_audio_out_urbs(struct s
+ urb->interval = LINE6_ISO_INTERVAL;
+ urb->error_count = 0;
+ urb->complete = audio_out_callback;
++ if (usb_urb_ep_type_check(urb))
++ return -EINVAL;
+ }
+
+ return 0;
--- /dev/null
+From 9b7e5208a941e2e491a83eb5fa83d889e888fa2f Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 10 Jul 2020 18:06:56 +0200
+Subject: ALSA: usb-audio: Fix race against the error recovery URB submission
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 9b7e5208a941e2e491a83eb5fa83d889e888fa2f upstream.
+
+USB MIDI driver has an error recovery mechanism to resubmit the URB in
+the delayed timer handler, and this may race with the standard start /
+stop operations. Although both start and stop operations themselves
+don't race with each other due to the umidi->mutex protection, but
+this isn't applied to the timer handler.
+
+For fixing this potential race, the following changes are applied:
+
+- Since the timer handler can't use the mutex, we apply the
+ umidi->disc_lock protection at each input stream URB submission;
+ this also needs to change the GFP flag to GFP_ATOMIC
+- Add a check of the URB refcount and skip if already submitted
+- Move the timer cancel call at disconnection to the beginning of the
+ procedure; this assures the in-flight timer handler is gone properly
+ before killing all pending URBs
+
+Reported-by: syzbot+0f4ecfe6a2c322c81728@syzkaller.appspotmail.com
+Reported-by: syzbot+5f1d24c49c1d2c427497@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200710160656.16819-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/midi.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -1477,6 +1477,8 @@ void snd_usbmidi_disconnect(struct list_
+ spin_unlock_irq(&umidi->disc_lock);
+ up_write(&umidi->disc_rwsem);
+
++ del_timer_sync(&umidi->error_timer);
++
+ for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) {
+ struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i];
+ if (ep->out)
+@@ -1503,7 +1505,6 @@ void snd_usbmidi_disconnect(struct list_
+ ep->in = NULL;
+ }
+ }
+- del_timer_sync(&umidi->error_timer);
+ }
+ EXPORT_SYMBOL(snd_usbmidi_disconnect);
+
+@@ -2260,16 +2261,22 @@ void snd_usbmidi_input_stop(struct list_
+ }
+ EXPORT_SYMBOL(snd_usbmidi_input_stop);
+
+-static void snd_usbmidi_input_start_ep(struct snd_usb_midi_in_endpoint *ep)
++static void snd_usbmidi_input_start_ep(struct snd_usb_midi *umidi,
++ struct snd_usb_midi_in_endpoint *ep)
+ {
+ unsigned int i;
++ unsigned long flags;
+
+ if (!ep)
+ return;
+ for (i = 0; i < INPUT_URBS; ++i) {
+ struct urb *urb = ep->urbs[i];
+- urb->dev = ep->umidi->dev;
+- snd_usbmidi_submit_urb(urb, GFP_KERNEL);
++ spin_lock_irqsave(&umidi->disc_lock, flags);
++ if (!atomic_read(&urb->use_count)) {
++ urb->dev = ep->umidi->dev;
++ snd_usbmidi_submit_urb(urb, GFP_ATOMIC);
++ }
++ spin_unlock_irqrestore(&umidi->disc_lock, flags);
+ }
+ }
+
+@@ -2285,7 +2292,7 @@ void snd_usbmidi_input_start(struct list
+ if (umidi->input_running || !umidi->opened[1])
+ return;
+ for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i)
+- snd_usbmidi_input_start_ep(umidi->endpoints[i].in);
++ snd_usbmidi_input_start_ep(umidi, umidi->endpoints[i].in);
+ umidi->input_running = 1;
+ }
+ EXPORT_SYMBOL(snd_usbmidi_input_start);
--- /dev/null
+From 6363d2065cd399cf9d6dc9d08c437f8658831100 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Sun, 24 May 2020 16:51:34 -0700
+Subject: HID: magicmouse: do not set up autorepeat
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 6363d2065cd399cf9d6dc9d08c437f8658831100 upstream.
+
+Neither the trackpad, nor the mouse want input core to generate autorepeat
+events for their buttons, so let's reset the bit (as hid-input sets it for
+these devices based on the usage vendor code).
+
+Cc: stable@vger.kernel.org
+Reported-by: Yariv <oigevald+kernel@gmail.com>
+Tested-by: Yariv <oigevald+kernel@gmail.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-magicmouse.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/hid/hid-magicmouse.c
++++ b/drivers/hid/hid-magicmouse.c
+@@ -451,6 +451,12 @@ static int magicmouse_setup_input(struct
+ __set_bit(MSC_RAW, input->mscbit);
+ }
+
++ /*
++ * hid-input may mark device as using autorepeat, but neither
++ * the trackpad, nor the mouse actually want it.
++ */
++ __clear_bit(EV_REP, input->evbit);
++
+ return 0;
+ }
+
mtd-rawnand-oxnas-keep-track-of-registered-devices.patch
mtd-rawnand-oxnas-unregister-all-devices-on-error.patch
mtd-rawnand-oxnas-release-all-devices-in-the-_remove-path.patch
+hid-magicmouse-do-not-set-up-autorepeat.patch
+alsa-line6-perform-sanity-check-for-each-urb-creation.patch
+alsa-usb-audio-fix-race-against-the-error-recovery-urb-submission.patch
+usb-c67x00-fix-use-after-free-in-c67x00_giveback_urb.patch
+usb-dwc2-fix-shutdown-callback-in-platform.patch
+usb-chipidea-core-add-wakeup-support-for-extcon.patch
+usb-gadget-function-fix-missing-spinlock-in-f_uac1_legacy.patch
+usb-serial-iuu_phoenix-fix-memory-corruption.patch
+usb-serial-cypress_m8-enable-simply-automated-upb-pim.patch
+usb-serial-ch341-add-new-product-id-for-ch340.patch
+usb-serial-option-add-gosuncn-gm500-series.patch
+usb-serial-option-add-quectel-eg95-lte-modem.patch
--- /dev/null
+From 211f08347355cba1f769bbf3355816a12b3ddd55 Mon Sep 17 00:00:00 2001
+From: Tom Rix <trix@redhat.com>
+Date: Wed, 8 Jul 2020 06:12:43 -0700
+Subject: USB: c67x00: fix use after free in c67x00_giveback_urb
+
+From: Tom Rix <trix@redhat.com>
+
+commit 211f08347355cba1f769bbf3355816a12b3ddd55 upstream.
+
+clang static analysis flags this error
+
+c67x00-sched.c:489:55: warning: Use of memory after it is freed [unix.Malloc]
+ usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
+ ^~~~~~~~~~~~
+Problem happens in this block of code
+
+ c67x00_release_urb(c67x00, urb);
+ usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb);
+ spin_unlock(&c67x00->lock);
+ usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
+
+In the call to c67x00_release_urb has this freeing of urbp
+
+ urbp = urb->hcpriv;
+ urb->hcpriv = NULL;
+ list_del(&urbp->hep_node);
+ kfree(urbp);
+
+And so urbp is freed before usb_hcd_giveback_urb uses it as its 3rd
+parameter.
+
+Since all is required is the status, pass the status directly as is
+done in c64x00_urb_dequeue
+
+Fixes: e9b29ffc519b ("USB: add Cypress c67x00 OTG controller HCD driver")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200708131243.24336-1-trix@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/c67x00/c67x00-sched.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/c67x00/c67x00-sched.c
++++ b/drivers/usb/c67x00/c67x00-sched.c
+@@ -500,7 +500,7 @@ c67x00_giveback_urb(struct c67x00_hcd *c
+ c67x00_release_urb(c67x00, urb);
+ usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb);
+ spin_unlock(&c67x00->lock);
+- usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
++ usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, status);
+ spin_lock(&c67x00->lock);
+ }
+
--- /dev/null
+From 876d4e1e8298ad1f94d9e9392fc90486755437b4 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@nxp.com>
+Date: Tue, 7 Jul 2020 14:06:01 +0800
+Subject: usb: chipidea: core: add wakeup support for extcon
+
+From: Peter Chen <peter.chen@nxp.com>
+
+commit 876d4e1e8298ad1f94d9e9392fc90486755437b4 upstream.
+
+If wakeup event occurred by extcon event, it needs to call
+ci_irq again since the first ci_irq calling at extcon notifier
+only wakes up controller, but do noop for event handling,
+it causes the extcon use case can't work well from low power mode.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 3ecb3e09b042 ("usb: chipidea: Use extcon framework for VBUS and ID detect")
+Reported-by: Philippe Schenker <philippe.schenker@toradex.com>
+Tested-by: Philippe Schenker <philippe.schenker@toradex.com>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Link: https://lore.kernel.org/r/20200707060601.31907-2-peter.chen@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/chipidea/core.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/drivers/usb/chipidea/core.c
++++ b/drivers/usb/chipidea/core.c
+@@ -1159,6 +1159,29 @@ static void ci_controller_suspend(struct
+ enable_irq(ci->irq);
+ }
+
++/*
++ * Handle the wakeup interrupt triggered by extcon connector
++ * We need to call ci_irq again for extcon since the first
++ * interrupt (wakeup int) only let the controller be out of
++ * low power mode, but not handle any interrupts.
++ */
++static void ci_extcon_wakeup_int(struct ci_hdrc *ci)
++{
++ struct ci_hdrc_cable *cable_id, *cable_vbus;
++ u32 otgsc = hw_read_otgsc(ci, ~0);
++
++ cable_id = &ci->platdata->id_extcon;
++ cable_vbus = &ci->platdata->vbus_extcon;
++
++ if (!IS_ERR(cable_id->edev) && ci->is_otg &&
++ (otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS))
++ ci_irq(ci->irq, ci);
++
++ if (!IS_ERR(cable_vbus->edev) && ci->is_otg &&
++ (otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS))
++ ci_irq(ci->irq, ci);
++}
++
+ static int ci_controller_resume(struct device *dev)
+ {
+ struct ci_hdrc *ci = dev_get_drvdata(dev);
+@@ -1191,6 +1214,7 @@ static int ci_controller_resume(struct d
+ enable_irq(ci->irq);
+ if (ci_otg_is_fsm_mode(ci))
+ ci_otg_fsm_wakeup_by_srp(ci);
++ ci_extcon_wakeup_int(ci);
+ }
+
+ return 0;
--- /dev/null
+From 4fdf228cdf6925af45a2066d403821e0977bfddb Mon Sep 17 00:00:00 2001
+From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+Date: Sat, 30 May 2020 11:41:50 +0400
+Subject: usb: dwc2: Fix shutdown callback in platform
+
+From: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+
+commit 4fdf228cdf6925af45a2066d403821e0977bfddb upstream.
+
+To avoid lot of interrupts from dwc2 core, which can be asserted in
+specific conditions need to disable interrupts on HW level instead of
+disable IRQs on Kernel level, because of IRQ can be shared between
+drivers.
+
+Cc: stable@vger.kernel.org
+Fixes: a40a00318c7fc ("usb: dwc2: add shutdown callback to platform variant")
+Tested-by: Frank Mori Hess <fmh6jj@gmail.com>
+Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
+Reviewed-by: Doug Anderson <dianders@chromium.org>
+Reviewed-by: Frank Mori Hess <fmh6jj@gmail.com>
+Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/dwc2/platform.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc2/platform.c
++++ b/drivers/usb/dwc2/platform.c
+@@ -338,7 +338,8 @@ static void dwc2_driver_shutdown(struct
+ {
+ struct dwc2_hsotg *hsotg = platform_get_drvdata(dev);
+
+- disable_irq(hsotg->irq);
++ dwc2_disable_global_interrupts(hsotg);
++ synchronize_irq(hsotg->irq);
+ }
+
+ /**
--- /dev/null
+From 8778eb0927ddcd3f431805c37b78fa56481aeed9 Mon Sep 17 00:00:00 2001
+From: Zhang Qiang <qiang.zhang@windriver.com>
+Date: Mon, 6 Jul 2020 13:14:55 +0800
+Subject: usb: gadget: function: fix missing spinlock in f_uac1_legacy
+
+From: Zhang Qiang <qiang.zhang@windriver.com>
+
+commit 8778eb0927ddcd3f431805c37b78fa56481aeed9 upstream.
+
+Add a missing spinlock protection for play_queue, because
+the play_queue may be destroyed when the "playback_work"
+work func and "f_audio_out_ep_complete" callback func
+operate this paly_queue at the same time.
+
+Fixes: c6994e6f067cf ("USB: gadget: add USB Audio Gadget driver")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Zhang Qiang <qiang.zhang@windriver.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/f_uac1_legacy.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/gadget/function/f_uac1_legacy.c
++++ b/drivers/usb/gadget/function/f_uac1_legacy.c
+@@ -339,7 +339,9 @@ static int f_audio_out_ep_complete(struc
+
+ /* Copy buffer is full, add it to the play_queue */
+ if (audio_buf_size - copy_buf->actual < req->actual) {
++ spin_lock_irq(&audio->lock);
+ list_add_tail(©_buf->list, &audio->play_queue);
++ spin_unlock_irq(&audio->lock);
+ schedule_work(&audio->playback_work);
+ copy_buf = f_audio_buffer_alloc(audio_buf_size);
+ if (IS_ERR(copy_buf))
--- /dev/null
+From 5d0136f8e79f8287e6a36780601f0ce797cf11c2 Mon Sep 17 00:00:00 2001
+From: Igor Moura <imphilippini@gmail.com>
+Date: Tue, 23 Jun 2020 05:11:11 -0300
+Subject: USB: serial: ch341: add new Product ID for CH340
+
+From: Igor Moura <imphilippini@gmail.com>
+
+commit 5d0136f8e79f8287e6a36780601f0ce797cf11c2 upstream.
+
+Add PID for CH340 that's found on some ESP8266 dev boards made by
+LilyGO. The specific device that contains such serial converter can be
+seen here: https://github.com/LilyGO/LILYGO-T-OI.
+
+Apparently, it's a regular CH340, but I've confirmed with others that
+also bought this board that the PID found on this device (0x7522)
+differs from other devices with the "same" converter (0x7523).
+Simply adding its PID to the driver and rebuilding it made it work
+as expected.
+
+Signed-off-by: Igor Moura <imphilippini@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ch341.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/ch341.c
++++ b/drivers/usb/serial/ch341.c
+@@ -84,6 +84,7 @@
+
+ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x4348, 0x5523) },
++ { USB_DEVICE(0x1a86, 0x7522) },
+ { USB_DEVICE(0x1a86, 0x7523) },
+ { USB_DEVICE(0x1a86, 0x5523) },
+ { },
--- /dev/null
+From 5c45d04c5081c1830d674f4d22d4400ea2083afe Mon Sep 17 00:00:00 2001
+From: James Hilliard <james.hilliard1@gmail.com>
+Date: Tue, 16 Jun 2020 16:04:03 -0600
+Subject: USB: serial: cypress_m8: enable Simply Automated UPB PIM
+
+From: James Hilliard <james.hilliard1@gmail.com>
+
+commit 5c45d04c5081c1830d674f4d22d4400ea2083afe upstream.
+
+This is a UPB (Universal Powerline Bus) PIM (Powerline Interface Module)
+which allows for controlling multiple UPB compatible devices from Linux
+using the standard serial interface.
+
+Based on vendor application source code there are two different models
+of USB based PIM devices in addition to a number of RS232 based PIM's.
+
+The vendor UPB application source contains the following USB ID's:
+
+ #define USB_PCS_VENDOR_ID 0x04b4
+ #define USB_PCS_PIM_PRODUCT_ID 0x5500
+
+ #define USB_SAI_VENDOR_ID 0x17dd
+ #define USB_SAI_PIM_PRODUCT_ID 0x5500
+
+The first set of ID's correspond to the PIM variant sold by Powerline
+Control Systems while the second corresponds to the Simply Automated
+Incorporated PIM. As the product ID for both of these match the default
+cypress HID->COM RS232 product ID it assumed that they both use an
+internal variant of this HID->COM RS232 converter hardware. However
+as the vendor ID for the Simply Automated variant is different we need
+to also add it to the cypress_M8 driver so that it is properly
+detected.
+
+Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
+Link: https://lore.kernel.org/r/20200616220403.1807003-1-james.hilliard1@gmail.com
+Cc: stable@vger.kernel.org
+[ johan: amend VID define entry ]
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/cypress_m8.c | 2 ++
+ drivers/usb/serial/cypress_m8.h | 3 +++
+ 2 files changed, 5 insertions(+)
+
+--- a/drivers/usb/serial/cypress_m8.c
++++ b/drivers/usb/serial/cypress_m8.c
+@@ -63,6 +63,7 @@ static const struct usb_device_id id_tab
+
+ static const struct usb_device_id id_table_cyphidcomrs232[] = {
+ { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) },
++ { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) },
+ { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) },
+ { USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) },
+ { } /* Terminating entry */
+@@ -77,6 +78,7 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB) },
+ { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB_LT20) },
+ { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) },
++ { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) },
+ { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) },
+ { USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) },
+ { USB_DEVICE(VENDOR_ID_DAZZLE, PRODUCT_ID_CA42) },
+--- a/drivers/usb/serial/cypress_m8.h
++++ b/drivers/usb/serial/cypress_m8.h
+@@ -25,6 +25,9 @@
+ #define VENDOR_ID_CYPRESS 0x04b4
+ #define PRODUCT_ID_CYPHIDCOM 0x5500
+
++/* Simply Automated HID->COM UPB PIM (using Cypress PID 0x5500) */
++#define VENDOR_ID_SAI 0x17dd
++
+ /* FRWD Dongle - a GPS sports watch */
+ #define VENDOR_ID_FRWD 0x6737
+ #define PRODUCT_ID_CYPHIDCOM_FRWD 0x0001
--- /dev/null
+From e7b931bee739e8a77ae216e613d3b99342b6dec0 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 15 Jul 2020 11:02:45 +0200
+Subject: USB: serial: iuu_phoenix: fix memory corruption
+
+From: Johan Hovold <johan@kernel.org>
+
+commit e7b931bee739e8a77ae216e613d3b99342b6dec0 upstream.
+
+The driver would happily overwrite its write buffer with user data in
+256 byte increments due to a removed buffer-space sanity check.
+
+Fixes: 5fcf62b0f1f2 ("tty: iuu_phoenix: fix locking.")
+Cc: stable <stable@vger.kernel.org> # 2.6.31
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/iuu_phoenix.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/serial/iuu_phoenix.c
++++ b/drivers/usb/serial/iuu_phoenix.c
+@@ -704,14 +704,16 @@ static int iuu_uart_write(struct tty_str
+ struct iuu_private *priv = usb_get_serial_port_data(port);
+ unsigned long flags;
+
+- if (count > 256)
+- return -ENOMEM;
+-
+ spin_lock_irqsave(&priv->lock, flags);
+
++ count = min(count, 256 - priv->writelen);
++ if (count == 0)
++ goto out;
++
+ /* fill the buffer */
+ memcpy(priv->writebuf + priv->writelen, buf, count);
+ priv->writelen += count;
++out:
+ spin_unlock_irqrestore(&priv->lock, flags);
+
+ return count;
--- /dev/null
+From 08d4ef5cc9203a113702f24725f6cf4db476c958 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= <jorgen.storvist@gmail.com>
+Date: Tue, 23 Jun 2020 00:13:59 +0200
+Subject: USB: serial: option: add GosunCn GM500 series
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jörgen Storvist <jorgen.storvist@gmail.com>
+
+commit 08d4ef5cc9203a113702f24725f6cf4db476c958 upstream.
+
+Add USB IDs for GosunCn GM500 series cellular modules.
+
+RNDIS config:
+usb-devices
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 12 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=305a ProdID=1404 Rev=03.18
+S: Manufacturer=Android
+S: Product=Android
+S: SerialNumber=
+C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#=0x0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host
+I: If#=0x1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
+I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+
+MBIM config:
+usb-devices
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=305a ProdID=1405 Rev=03.18
+S: Manufacturer=Android
+S: Product=Android
+S: SerialNumber=
+C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#=0x3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+I: If#=0x4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+
+ECM config:
+usb-devices
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=305a ProdID=1406 Rev=03.18
+S: Manufacturer=Android
+S: Product=Android
+S: SerialNumber=
+C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#=0x3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
+I: If#=0x4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
+
+Signed-off-by: Jörgen Storvist <jorgen.storvist@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -2030,6 +2030,9 @@ static const struct usb_device_id option
+ .driver_info = RSVD(4) | RSVD(5) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */
+ .driver_info = RSVD(6) },
++ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */
++ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */
++ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
--- /dev/null
+From da6902e5b6dbca9081e3d377f9802d4fd0c5ea59 Mon Sep 17 00:00:00 2001
+From: AceLan Kao <acelan.kao@canonical.com>
+Date: Tue, 7 Jul 2020 16:15:53 +0800
+Subject: USB: serial: option: add Quectel EG95 LTE modem
+
+From: AceLan Kao <acelan.kao@canonical.com>
+
+commit da6902e5b6dbca9081e3d377f9802d4fd0c5ea59 upstream.
+
+Add support for Quectel Wireless Solutions Co., Ltd. EG95 LTE modem
+
+T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 5 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=2c7c ProdID=0195 Rev=03.18
+S: Manufacturer=Android
+S: Product=Android
+C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+
+Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -248,6 +248,7 @@ static void option_instat_callback(struc
+ /* These Quectel products use Quectel's vendor ID */
+ #define QUECTEL_PRODUCT_EC21 0x0121
+ #define QUECTEL_PRODUCT_EC25 0x0125
++#define QUECTEL_PRODUCT_EG95 0x0195
+ #define QUECTEL_PRODUCT_BG96 0x0296
+ #define QUECTEL_PRODUCT_EP06 0x0306
+ #define QUECTEL_PRODUCT_EM12 0x0512
+@@ -1100,6 +1101,8 @@ static const struct usb_device_id option
+ .driver_info = RSVD(4) },
+ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25),
+ .driver_info = RSVD(4) },
++ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95),
++ .driver_info = RSVD(4) },
+ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff),
projects / thirdparty / kernel / stable-queue.git / commitdiff
