]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.4-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 15 Dec 2019 09:36:46 +0000 (10:36 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 15 Dec 2019 09:36:46 +0000 (10:36 +0100)
added patches:
iio-humidity-hdc100x-fix-iio_humidityrelative-channel-reporting.patch
staging-gigaset-add-endpoint-type-sanity-check.patch
staging-gigaset-fix-general-protection-fault-on-probe.patch
staging-gigaset-fix-illegal-free-on-probe-errors.patch
staging-rtl8188eu-fix-interface-sanity-check.patch
staging-rtl8712-fix-interface-sanity-check.patch
usb-adutux-fix-interface-sanity-check.patch
usb-atm-ueagle-atm-add-missing-endpoint-check.patch
usb-idmouse-fix-interface-sanity-checks.patch
usb-serial-io_edgeport-fix-epic-endpoint-lookup.patch
xhci-increase-sts_halt-timeout-in-xhci_suspend.patch

12 files changed:
queue-4.4/iio-humidity-hdc100x-fix-iio_humidityrelative-channel-reporting.patch [new file with mode: 0644]
queue-4.4/series
queue-4.4/staging-gigaset-add-endpoint-type-sanity-check.patch [new file with mode: 0644]
queue-4.4/staging-gigaset-fix-general-protection-fault-on-probe.patch [new file with mode: 0644]
queue-4.4/staging-gigaset-fix-illegal-free-on-probe-errors.patch [new file with mode: 0644]
queue-4.4/staging-rtl8188eu-fix-interface-sanity-check.patch [new file with mode: 0644]
queue-4.4/staging-rtl8712-fix-interface-sanity-check.patch [new file with mode: 0644]
queue-4.4/usb-adutux-fix-interface-sanity-check.patch [new file with mode: 0644]
queue-4.4/usb-atm-ueagle-atm-add-missing-endpoint-check.patch [new file with mode: 0644]
queue-4.4/usb-idmouse-fix-interface-sanity-checks.patch [new file with mode: 0644]
queue-4.4/usb-serial-io_edgeport-fix-epic-endpoint-lookup.patch [new file with mode: 0644]
queue-4.4/xhci-increase-sts_halt-timeout-in-xhci_suspend.patch [new file with mode: 0644]

diff --git a/queue-4.4/iio-humidity-hdc100x-fix-iio_humidityrelative-channel-reporting.patch b/queue-4.4/iio-humidity-hdc100x-fix-iio_humidityrelative-channel-reporting.patch
new file mode 100644 (file)
index 0000000..0cfff2c
--- /dev/null
@@ -0,0 +1,34 @@
+From 342a6928bd5017edbdae376042d8ad6af3d3b943 Mon Sep 17 00:00:00 2001
+From: Chris Lesiak <chris.lesiak@licor.com>
+Date: Thu, 21 Nov 2019 20:39:42 +0000
+Subject: iio: humidity: hdc100x: fix IIO_HUMIDITYRELATIVE channel reporting
+
+From: Chris Lesiak <chris.lesiak@licor.com>
+
+commit 342a6928bd5017edbdae376042d8ad6af3d3b943 upstream.
+
+The IIO_HUMIDITYRELATIVE channel was being incorrectly reported back
+as percent when it should have been milli percent. This is via an
+incorrect scale value being returned to userspace.
+
+Signed-off-by: Chris Lesiak <chris.lesiak@licor.com>
+Acked-by: Matt Ranostay <matt.ranostay@konsulko.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/humidity/hdc100x.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/humidity/hdc100x.c
++++ b/drivers/iio/humidity/hdc100x.c
+@@ -215,7 +215,7 @@ static int hdc100x_read_raw(struct iio_d
+                       *val2 = 65536;
+                       return IIO_VAL_FRACTIONAL;
+               } else {
+-                      *val = 100;
++                      *val = 100000;
+                       *val2 = 65536;
+                       return IIO_VAL_FRACTIONAL;
+               }
index 9c3cd892c2aa927e58c6f87c8a2329599d0f7b5c..c12113e2e270bbe1f9c293e222d191d5e7ff2655 100644 (file)
@@ -81,3 +81,14 @@ proc-fix-coredump-vs-read-proc-stat-race.patch
 fs-proc-array.c-allow-reporting-eip-esp-for-all-coredumping-threads.patch
 usb-gadget-configfs-fix-missing-spin_lock_init.patch
 usb-allow-usb-device-to-be-warm-reset-in-suspended-state.patch
+staging-rtl8188eu-fix-interface-sanity-check.patch
+staging-rtl8712-fix-interface-sanity-check.patch
+staging-gigaset-fix-general-protection-fault-on-probe.patch
+staging-gigaset-fix-illegal-free-on-probe-errors.patch
+staging-gigaset-add-endpoint-type-sanity-check.patch
+xhci-increase-sts_halt-timeout-in-xhci_suspend.patch
+iio-humidity-hdc100x-fix-iio_humidityrelative-channel-reporting.patch
+usb-atm-ueagle-atm-add-missing-endpoint-check.patch
+usb-idmouse-fix-interface-sanity-checks.patch
+usb-serial-io_edgeport-fix-epic-endpoint-lookup.patch
+usb-adutux-fix-interface-sanity-check.patch
diff --git a/queue-4.4/staging-gigaset-add-endpoint-type-sanity-check.patch b/queue-4.4/staging-gigaset-add-endpoint-type-sanity-check.patch
new file mode 100644 (file)
index 0000000..7f94c0b
--- /dev/null
@@ -0,0 +1,51 @@
+From ed9ed5a89acba51b82bdff61144d4e4a4245ec8a Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 2 Dec 2019 09:56:10 +0100
+Subject: staging: gigaset: add endpoint-type sanity check
+
+From: Johan Hovold <johan@kernel.org>
+
+commit ed9ed5a89acba51b82bdff61144d4e4a4245ec8a upstream.
+
+Add missing endpoint-type sanity checks to probe.
+
+This specifically prevents a warning in USB core on URB submission when
+fuzzing USB descriptors.
+
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20191202085610.12719-4-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/isdn/gigaset/usb-gigaset.c |   12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/isdn/gigaset/usb-gigaset.c
++++ b/drivers/isdn/gigaset/usb-gigaset.c
+@@ -708,6 +708,12 @@ static int gigaset_probe(struct usb_inte
+       endpoint = &hostif->endpoint[0].desc;
++      if (!usb_endpoint_is_bulk_out(endpoint)) {
++              dev_err(&interface->dev, "missing bulk-out endpoint\n");
++              retval = -ENODEV;
++              goto error;
++      }
++
+       buffer_size = le16_to_cpu(endpoint->wMaxPacketSize);
+       ucs->bulk_out_size = buffer_size;
+       ucs->bulk_out_epnum = usb_endpoint_num(endpoint);
+@@ -727,6 +733,12 @@ static int gigaset_probe(struct usb_inte
+       endpoint = &hostif->endpoint[1].desc;
++      if (!usb_endpoint_is_int_in(endpoint)) {
++              dev_err(&interface->dev, "missing int-in endpoint\n");
++              retval = -ENODEV;
++              goto error;
++      }
++
+       ucs->busy = 0;
+       ucs->read_urb = usb_alloc_urb(0, GFP_KERNEL);
diff --git a/queue-4.4/staging-gigaset-fix-general-protection-fault-on-probe.patch b/queue-4.4/staging-gigaset-fix-general-protection-fault-on-probe.patch
new file mode 100644 (file)
index 0000000..8af6f38
--- /dev/null
@@ -0,0 +1,40 @@
+From 53f35a39c3860baac1e5ca80bf052751cfb24a99 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 2 Dec 2019 09:56:08 +0100
+Subject: staging: gigaset: fix general protection fault on probe
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 53f35a39c3860baac1e5ca80bf052751cfb24a99 upstream.
+
+Fix a general protection fault when accessing the endpoint descriptors
+which could be triggered by a malicious device due to missing sanity
+checks on the number of endpoints.
+
+Reported-by: syzbot+35b1c403a14f5c89eba7@syzkaller.appspotmail.com
+Fixes: 07dc1f9f2f80 ("[PATCH] isdn4linux: Siemens Gigaset drivers - M105 USB DECT adapter")
+Cc: stable <stable@vger.kernel.org>     # 2.6.17
+Cc: Hansjoerg Lipp <hjlipp@web.de>
+Cc: Tilman Schmidt <tilman@imap.cc>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20191202085610.12719-2-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/isdn/gigaset/usb-gigaset.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/isdn/gigaset/usb-gigaset.c
++++ b/drivers/isdn/gigaset/usb-gigaset.c
+@@ -688,6 +688,11 @@ static int gigaset_probe(struct usb_inte
+               return -ENODEV;
+       }
++      if (hostif->desc.bNumEndpoints < 2) {
++              dev_err(&interface->dev, "missing endpoints\n");
++              return -ENODEV;
++      }
++
+       dev_info(&udev->dev, "%s: Device matched ... !\n", __func__);
+       /* allocate memory for our device state and initialize it */
diff --git a/queue-4.4/staging-gigaset-fix-illegal-free-on-probe-errors.patch b/queue-4.4/staging-gigaset-fix-illegal-free-on-probe-errors.patch
new file mode 100644 (file)
index 0000000..030fd44
--- /dev/null
@@ -0,0 +1,47 @@
+From 84f60ca7b326ed8c08582417493982fe2573a9ad Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 2 Dec 2019 09:56:09 +0100
+Subject: staging: gigaset: fix illegal free on probe errors
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 84f60ca7b326ed8c08582417493982fe2573a9ad upstream.
+
+The driver failed to initialise its receive-buffer pointer, something
+which could lead to an illegal free on late probe errors.
+
+Fix this by making sure to clear all driver data at allocation.
+
+Fixes: 2032e2c2309d ("usb_gigaset: code cleanup")
+Cc: stable <stable@vger.kernel.org>     # 2.6.33
+Cc: Tilman Schmidt <tilman@imap.cc>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20191202085610.12719-3-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/isdn/gigaset/usb-gigaset.c |    6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/isdn/gigaset/usb-gigaset.c
++++ b/drivers/isdn/gigaset/usb-gigaset.c
+@@ -574,8 +574,7 @@ static int gigaset_initcshw(struct cards
+ {
+       struct usb_cardstate *ucs;
+-      cs->hw.usb = ucs =
+-              kmalloc(sizeof(struct usb_cardstate), GFP_KERNEL);
++      cs->hw.usb = ucs = kzalloc(sizeof(struct usb_cardstate), GFP_KERNEL);
+       if (!ucs) {
+               pr_err("out of memory\n");
+               return -ENOMEM;
+@@ -587,9 +586,6 @@ static int gigaset_initcshw(struct cards
+       ucs->bchars[3] = 0;
+       ucs->bchars[4] = 0x11;
+       ucs->bchars[5] = 0x13;
+-      ucs->bulk_out_buffer = NULL;
+-      ucs->bulk_out_urb = NULL;
+-      ucs->read_urb = NULL;
+       tasklet_init(&cs->write_tasklet,
+                    gigaset_modem_fill, (unsigned long) cs);
diff --git a/queue-4.4/staging-rtl8188eu-fix-interface-sanity-check.patch b/queue-4.4/staging-rtl8188eu-fix-interface-sanity-check.patch
new file mode 100644 (file)
index 0000000..8dce5ea
--- /dev/null
@@ -0,0 +1,36 @@
+From 74ca34118a0e05793935d804ccffcedd6eb56596 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 10 Dec 2019 12:47:50 +0100
+Subject: staging: rtl8188eu: fix interface sanity check
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 74ca34118a0e05793935d804ccffcedd6eb56596 upstream.
+
+Make sure to use the current alternate setting when verifying the
+interface descriptors to avoid binding to an invalid interface.
+
+Failing to do so could cause the driver to misbehave or trigger a WARN()
+in usb_submit_urb() that kernels with panic_on_warn set would choke on.
+
+Fixes: c2478d39076b ("staging: r8188eu: Add files for new driver - part 20")
+Cc: stable <stable@vger.kernel.org>     # 3.12
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20191210114751.5119-2-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8188eu/os_dep/usb_intf.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+@@ -82,7 +82,7 @@ static struct dvobj_priv *usb_dvobj_init
+       phost_conf = pusbd->actconfig;
+       pconf_desc = &phost_conf->desc;
+-      phost_iface = &usb_intf->altsetting[0];
++      phost_iface = usb_intf->cur_altsetting;
+       piface_desc = &phost_iface->desc;
+       pdvobjpriv->NumInterfaces = pconf_desc->bNumInterfaces;
diff --git a/queue-4.4/staging-rtl8712-fix-interface-sanity-check.patch b/queue-4.4/staging-rtl8712-fix-interface-sanity-check.patch
new file mode 100644 (file)
index 0000000..2625536
--- /dev/null
@@ -0,0 +1,36 @@
+From c724f776f048538ecfdf53a52b7a522309f5c504 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 10 Dec 2019 12:47:51 +0100
+Subject: staging: rtl8712: fix interface sanity check
+
+From: Johan Hovold <johan@kernel.org>
+
+commit c724f776f048538ecfdf53a52b7a522309f5c504 upstream.
+
+Make sure to use the current alternate setting when verifying the
+interface descriptors to avoid binding to an invalid interface.
+
+Failing to do so could cause the driver to misbehave or trigger a WARN()
+in usb_submit_urb() that kernels with panic_on_warn set would choke on.
+
+Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel")
+Cc: stable <stable@vger.kernel.org>     # 2.6.37
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20191210114751.5119-3-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8712/usb_intf.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/rtl8712/usb_intf.c
++++ b/drivers/staging/rtl8712/usb_intf.c
+@@ -263,7 +263,7 @@ static uint r8712_usb_dvobj_init(struct
+       pdvobjpriv->padapter = padapter;
+       padapter->EepromAddressSize = 6;
+-      phost_iface = &pintf->altsetting[0];
++      phost_iface = pintf->cur_altsetting;
+       piface_desc = &phost_iface->desc;
+       pdvobjpriv->nr_endpoint = piface_desc->bNumEndpoints;
+       if (pusbd->speed == USB_SPEED_HIGH) {
diff --git a/queue-4.4/usb-adutux-fix-interface-sanity-check.patch b/queue-4.4/usb-adutux-fix-interface-sanity-check.patch
new file mode 100644 (file)
index 0000000..631b320
--- /dev/null
@@ -0,0 +1,36 @@
+From 3c11c4bed02b202e278c0f5c319ae435d7fb9815 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 10 Dec 2019 12:25:59 +0100
+Subject: USB: adutux: fix interface sanity check
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 3c11c4bed02b202e278c0f5c319ae435d7fb9815 upstream.
+
+Make sure to use the current alternate setting when verifying the
+interface descriptors to avoid binding to an invalid interface.
+
+Failing to do so could cause the driver to misbehave or trigger a WARN()
+in usb_submit_urb() that kernels with panic_on_warn set would choke on.
+
+Fixes: 03270634e242 ("USB: Add ADU support for Ontrak ADU devices")
+Cc: stable <stable@vger.kernel.org>     # 2.6.19
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20191210112601.3561-3-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/misc/adutux.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/misc/adutux.c
++++ b/drivers/usb/misc/adutux.c
+@@ -686,7 +686,7 @@ static int adu_probe(struct usb_interfac
+       init_waitqueue_head(&dev->read_wait);
+       init_waitqueue_head(&dev->write_wait);
+-      iface_desc = &interface->altsetting[0];
++      iface_desc = &interface->cur_altsetting[0];
+       /* set up the endpoint information */
+       for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
diff --git a/queue-4.4/usb-atm-ueagle-atm-add-missing-endpoint-check.patch b/queue-4.4/usb-atm-ueagle-atm-add-missing-endpoint-check.patch
new file mode 100644 (file)
index 0000000..8eaeb3e
--- /dev/null
@@ -0,0 +1,90 @@
+From 09068c1ad53fb077bdac288869dec2435420bdc4 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 10 Dec 2019 12:25:58 +0100
+Subject: USB: atm: ueagle-atm: add missing endpoint check
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 09068c1ad53fb077bdac288869dec2435420bdc4 upstream.
+
+Make sure that the interrupt interface has an endpoint before trying to
+access its endpoint descriptors to avoid dereferencing a NULL pointer.
+
+The driver binds to the interrupt interface with interface number 0, but
+must not assume that this interface or its current alternate setting are
+the first entries in the corresponding configuration arrays.
+
+Fixes: b72458a80c75 ("[PATCH] USB: Eagle and ADI 930 usb adsl modem driver")
+Cc: stable <stable@vger.kernel.org>     # 2.6.16
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20191210112601.3561-2-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/atm/ueagle-atm.c |   18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/atm/ueagle-atm.c
++++ b/drivers/usb/atm/ueagle-atm.c
+@@ -2167,10 +2167,11 @@ resubmit:
+ /*
+  * Start the modem : init the data and start kernel thread
+  */
+-static int uea_boot(struct uea_softc *sc)
++static int uea_boot(struct uea_softc *sc, struct usb_interface *intf)
+ {
+-      int ret, size;
+       struct intr_pkt *intr;
++      int ret = -ENOMEM;
++      int size;
+       uea_enters(INS_TO_USBDEV(sc));
+@@ -2195,6 +2196,11 @@ static int uea_boot(struct uea_softc *sc
+       if (UEA_CHIP_VERSION(sc) == ADI930)
+               load_XILINX_firmware(sc);
++      if (intf->cur_altsetting->desc.bNumEndpoints < 1) {
++              ret = -ENODEV;
++              goto err0;
++      }
++
+       intr = kmalloc(size, GFP_KERNEL);
+       if (!intr) {
+               uea_err(INS_TO_USBDEV(sc),
+@@ -2211,8 +2217,7 @@ static int uea_boot(struct uea_softc *sc
+       usb_fill_int_urb(sc->urb_int, sc->usb_dev,
+                        usb_rcvintpipe(sc->usb_dev, UEA_INTR_PIPE),
+                        intr, size, uea_intr, sc,
+-                       sc->usb_dev->actconfig->interface[0]->altsetting[0].
+-                       endpoint[0].desc.bInterval);
++                       intf->cur_altsetting->endpoint[0].desc.bInterval);
+       ret = usb_submit_urb(sc->urb_int, GFP_KERNEL);
+       if (ret < 0) {
+@@ -2227,6 +2232,7 @@ static int uea_boot(struct uea_softc *sc
+       sc->kthread = kthread_create(uea_kthread, sc, "ueagle-atm");
+       if (IS_ERR(sc->kthread)) {
+               uea_err(INS_TO_USBDEV(sc), "failed to create thread\n");
++              ret = PTR_ERR(sc->kthread);
+               goto err2;
+       }
+@@ -2241,7 +2247,7 @@ err1:
+       kfree(intr);
+ err0:
+       uea_leaves(INS_TO_USBDEV(sc));
+-      return -ENOMEM;
++      return ret;
+ }
+ /*
+@@ -2604,7 +2610,7 @@ static int uea_bind(struct usbatm_data *
+       if (ret < 0)
+               goto error;
+-      ret = uea_boot(sc);
++      ret = uea_boot(sc, intf);
+       if (ret < 0)
+               goto error_rm_grp;
diff --git a/queue-4.4/usb-idmouse-fix-interface-sanity-checks.patch b/queue-4.4/usb-idmouse-fix-interface-sanity-checks.patch
new file mode 100644 (file)
index 0000000..b23e015
--- /dev/null
@@ -0,0 +1,36 @@
+From 59920635b89d74b9207ea803d5e91498d39e8b69 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 10 Dec 2019 12:26:00 +0100
+Subject: USB: idmouse: fix interface sanity checks
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 59920635b89d74b9207ea803d5e91498d39e8b69 upstream.
+
+Make sure to use the current alternate setting when verifying the
+interface descriptors to avoid binding to an invalid interface.
+
+Failing to do so could cause the driver to misbehave or trigger a WARN()
+in usb_submit_urb() that kernels with panic_on_warn set would choke on.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20191210112601.3561-4-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/misc/idmouse.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/misc/idmouse.c
++++ b/drivers/usb/misc/idmouse.c
+@@ -342,7 +342,7 @@ static int idmouse_probe(struct usb_inte
+       int result;
+       /* check if we have gotten the data or the hid interface */
+-      iface_desc = &interface->altsetting[0];
++      iface_desc = interface->cur_altsetting;
+       if (iface_desc->desc.bInterfaceClass != 0x0A)
+               return -ENODEV;
diff --git a/queue-4.4/usb-serial-io_edgeport-fix-epic-endpoint-lookup.patch b/queue-4.4/usb-serial-io_edgeport-fix-epic-endpoint-lookup.patch
new file mode 100644 (file)
index 0000000..c1bfa47
--- /dev/null
@@ -0,0 +1,50 @@
+From 7c5a2df3367a2c4984f1300261345817d95b71f8 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 10 Dec 2019 12:26:01 +0100
+Subject: USB: serial: io_edgeport: fix epic endpoint lookup
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 7c5a2df3367a2c4984f1300261345817d95b71f8 upstream.
+
+Make sure to use the current alternate setting when looking up the
+endpoints on epic devices to avoid binding to an invalid interface.
+
+Failing to do so could cause the driver to misbehave or trigger a WARN()
+in usb_submit_urb() that kernels with panic_on_warn set would choke on.
+
+Fixes: 6e8cf7751f9f ("USB: add EPIC support to the io_edgeport driver")
+Cc: stable <stable@vger.kernel.org>     # 2.6.21
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20191210112601.3561-5-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/io_edgeport.c |   10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/serial/io_edgeport.c
++++ b/drivers/usb/serial/io_edgeport.c
+@@ -2859,16 +2859,18 @@ static int edge_startup(struct usb_seria
+       response = 0;
+       if (edge_serial->is_epic) {
++              struct usb_host_interface *alt;
++
++              alt = serial->interface->cur_altsetting;
++
+               /* EPIC thing, set up our interrupt polling now and our read
+                * urb, so that the device knows it really is connected. */
+               interrupt_in_found = bulk_in_found = bulk_out_found = false;
+-              for (i = 0; i < serial->interface->altsetting[0]
+-                                              .desc.bNumEndpoints; ++i) {
++              for (i = 0; i < alt->desc.bNumEndpoints; ++i) {
+                       struct usb_endpoint_descriptor *endpoint;
+                       int buffer_size;
+-                      endpoint = &serial->interface->altsetting[0].
+-                                                      endpoint[i].desc;
++                      endpoint = &alt->endpoint[i].desc;
+                       buffer_size = usb_endpoint_maxp(endpoint);
+                       if (!interrupt_in_found &&
+                           (usb_endpoint_is_int_in(endpoint))) {
diff --git a/queue-4.4/xhci-increase-sts_halt-timeout-in-xhci_suspend.patch b/queue-4.4/xhci-increase-sts_halt-timeout-in-xhci_suspend.patch
new file mode 100644 (file)
index 0000000..42603e4
--- /dev/null
@@ -0,0 +1,43 @@
+From 7c67cf6658cec70d8a43229f2ce74ca1443dc95e Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Wed, 11 Dec 2019 16:20:05 +0200
+Subject: xhci: Increase STS_HALT timeout in xhci_suspend()
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit 7c67cf6658cec70d8a43229f2ce74ca1443dc95e upstream.
+
+I've recently observed failed xHCI suspend attempt on AMD Raven Ridge
+system:
+kernel: xhci_hcd 0000:04:00.4: WARN: xHC CMD_RUN timeout
+kernel: PM: suspend_common(): xhci_pci_suspend+0x0/0xd0 returns -110
+kernel: PM: pci_pm_suspend(): hcd_pci_suspend+0x0/0x30 returns -110
+kernel: PM: dpm_run_callback(): pci_pm_suspend+0x0/0x150 returns -110
+kernel: PM: Device 0000:04:00.4 failed to suspend async: error -110
+
+Similar to commit ac343366846a ("xhci: Increase STS_SAVE timeout in
+xhci_suspend()") we also need to increase the HALT timeout to make it be
+able to suspend again.
+
+Cc: <stable@vger.kernel.org> # 5.2+
+Fixes: f7fac17ca925 ("xhci: Convert xhci_handshake() to use readl_poll_timeout_atomic()")
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20191211142007.8847-5-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/xhci.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -929,7 +929,7 @@ static bool xhci_pending_portevent(struc
+ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
+ {
+       int                     rc = 0;
+-      unsigned int            delay = XHCI_MAX_HALT_USEC;
++      unsigned int            delay = XHCI_MAX_HALT_USEC * 2;
+       struct usb_hcd          *hcd = xhci_to_hcd(xhci);
+       u32                     command;