--- /dev/null
+From edef1ef134180149694b86386277076f566d165c Mon Sep 17 00:00:00 2001
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Date: Mon, 25 Mar 2019 09:04:39 -0700
+Subject: ACPI / CPPC: Fix guaranteed performance handling
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+commit edef1ef134180149694b86386277076f566d165c upstream.
+
+As per the ACPI specification, "Guaranteed Performance Register" is
+a "Buffer" field and it cannot be "Integer", so treat the "Integer"
+type for "Guaranteed Performance Register" field as invalid and
+ignore its value in that case.
+
+Also save one cpc_read() call when "Guaranteed Performance Register"
+is not present, which means a register defined as:
+"Register(SystemMemory, 0, 0, 0, 0)".
+
+Fixes: 29523f095397 ("ACPI / CPPC: Add support for guaranteed performance")
+Suggested-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: 4.20+ <stable@vger.kernel.org> # 4.20+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/cppc_acpi.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -1108,8 +1108,13 @@ int cppc_get_perf_caps(int cpunum, struc
+ cpc_read(cpunum, nominal_reg, &nom);
+ perf_caps->nominal_perf = nom;
+
+- cpc_read(cpunum, guaranteed_reg, &guaranteed);
+- perf_caps->guaranteed_perf = guaranteed;
++ if (guaranteed_reg->type != ACPI_TYPE_BUFFER ||
++ IS_NULL_REG(&guaranteed_reg->cpc_entry.reg)) {
++ perf_caps->guaranteed_perf = 0;
++ } else {
++ cpc_read(cpunum, guaranteed_reg, &guaranteed);
++ perf_caps->guaranteed_perf = guaranteed;
++ }
+
+ cpc_read(cpunum, lowest_non_linear_reg, &min_nonlinear);
+ perf_caps->lowest_nonlinear_perf = min_nonlinear;
--- /dev/null
+From 3a10e3dd52e80b9a97a3346020024d17b2c272d6 Mon Sep 17 00:00:00 2001
+From: Aditya Pakki <pakki001@umn.edu>
+Date: Mon, 18 Mar 2019 18:44:14 -0500
+Subject: serial: max310x: Fix to avoid potential NULL pointer dereference
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+commit 3a10e3dd52e80b9a97a3346020024d17b2c272d6 upstream.
+
+of_match_device can return a NULL pointer when matching device is not
+found. This patch avoids a scenario causing NULL pointer derefernce.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/max310x.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -1416,6 +1416,8 @@ static int max310x_spi_probe(struct spi_
+ if (spi->dev.of_node) {
+ const struct of_device_id *of_id =
+ of_match_device(max310x_dt_ids, &spi->dev);
++ if (!of_id)
++ return -ENODEV;
+
+ devtype = (struct max310x_devtype *)of_id->data;
+ } else {
--- /dev/null
+From 32f47179833b63de72427131169809065db6745e Mon Sep 17 00:00:00 2001
+From: Aditya Pakki <pakki001@umn.edu>
+Date: Mon, 18 Mar 2019 18:50:56 -0500
+Subject: serial: mvebu-uart: Fix to avoid a potential NULL pointer dereference
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+commit 32f47179833b63de72427131169809065db6745e upstream.
+
+of_match_device on failure to find a matching device can return a NULL
+pointer. The patch checks for such a scenrio and passes the error upstream.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/mvebu-uart.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/tty/serial/mvebu-uart.c
++++ b/drivers/tty/serial/mvebu-uart.c
+@@ -810,6 +810,9 @@ static int mvebu_uart_probe(struct platf
+ return -EINVAL;
+ }
+
++ if (!match)
++ return -ENODEV;
++
+ /* Assume that all UART ports have a DT alias or none has */
+ id = of_alias_get_id(pdev->dev.of_node, "serial");
+ if (!pdev->dev.of_node || id < 0)
--- /dev/null
+From 93bcefd4c6bad4c69dbc4edcd3fbf774b24d930d Mon Sep 17 00:00:00 2001
+From: Hoan Nguyen An <na-hoan@jinso.co.jp>
+Date: Mon, 18 Mar 2019 18:26:32 +0900
+Subject: serial: sh-sci: Fix setting SCSCR_TIE while transferring data
+
+From: Hoan Nguyen An <na-hoan@jinso.co.jp>
+
+commit 93bcefd4c6bad4c69dbc4edcd3fbf774b24d930d upstream.
+
+We disable transmission interrupt (clear SCSCR_TIE) after all data has been transmitted
+(if uart_circ_empty(xmit)). While transmitting, if the data is still in the tty buffer,
+re-enable the SCSCR_TIE bit, which was done at sci_start_tx().
+This is unnecessary processing, wasting CPU operation if the data transmission length is large.
+And further, transmit end, FIFO empty bits disabling have also been performed in the step above.
+
+Signed-off-by: Hoan Nguyen An <na-hoan@jinso.co.jp>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/sh-sci.c | 12 +-----------
+ 1 file changed, 1 insertion(+), 11 deletions(-)
+
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -838,19 +838,9 @@ static void sci_transmit_chars(struct ua
+
+ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+ uart_write_wakeup(port);
+- if (uart_circ_empty(xmit)) {
++ if (uart_circ_empty(xmit))
+ sci_stop_tx(port);
+- } else {
+- ctrl = serial_port_in(port, SCSCR);
+
+- if (port->type != PORT_SCI) {
+- serial_port_in(port, SCxSR); /* Dummy read */
+- sci_clear_SCxSR(port, SCxSR_TDxE_CLEAR(port));
+- }
+-
+- ctrl |= SCSCR_TIE;
+- serial_port_out(port, SCSCR, ctrl);
+- }
+ }
+
+ /* On SH3, SCIF may read end-of-break as a space->mark char */
scsi-zfcp-fix-rport-unblock-if-deleted-scsi-devices-on-scsi_host.patch
scsi-zfcp-fix-scsi_eh-host-reset-with-port_forced-erp-for-non-npiv-fcp-devices.patch
drm-rockchip-vop-reset-scale-mode-when-win-is-disabled.patch
+tty-serial-atmel-add-is_half_duplex-helper.patch
+tty-serial-atmel-rs485-hd-w-dma-enable-rx-after-tx-is-stopped.patch
+tty-mxs-auart-fix-a-potential-null-pointer-dereference.patch
+tty-atmel_serial-fix-a-potential-null-pointer-dereference.patch
+tty-serial-qcom_geni_serial-initialize-baud-in-qcom_geni_console_setup.patch
+staging-comedi-ni_mio_common-fix-divide-by-zero-for-dio-cmdtest.patch
+staging-olpc_dcon_xo_1-add-missing-const-qualifier.patch
+staging-speakup_soft-fix-alternate-speech-with-other-synths.patch
+staging-vt6655-remove-vif-check-from-vnt_interrupt.patch
+staging-vt6655-fix-interrupt-race-condition-on-device-start-up.patch
+staging-erofs-fix-to-handle-error-path-of-erofs_vmap.patch
+staging-erofs-fix-error-handling-when-failed-to-read-compresssed-data.patch
+staging-erofs-keep-corrupted-fs-from-crashing-kernel-in-erofs_readdir.patch
+serial-max310x-fix-to-avoid-potential-null-pointer-dereference.patch
+serial-mvebu-uart-fix-to-avoid-a-potential-null-pointer-dereference.patch
+serial-sh-sci-fix-setting-scscr_tie-while-transferring-data.patch
+usb-serial-cp210x-add-new-device-id.patch
+usb-serial-ftdi_sio-add-additional-novatech-products.patch
+usb-serial-mos7720-fix-mos_parport-refcount-imbalance-on-error-path.patch
+usb-serial-option-set-driver_info-for-sim5218-and-compatibles.patch
+usb-serial-option-add-support-for-quectel-em12.patch
+usb-serial-option-add-olicard-600.patch
+acpi-cppc-fix-guaranteed-performance-handling.patch
--- /dev/null
+From bafd9c64056cd034a1174dcadb65cd3b294ff8f6 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Mon, 4 Mar 2019 14:33:54 +0000
+Subject: staging: comedi: ni_mio_common: Fix divide-by-zero for DIO cmdtest
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit bafd9c64056cd034a1174dcadb65cd3b294ff8f6 upstream.
+
+`ni_cdio_cmdtest()` validates Comedi asynchronous commands for the DIO
+subdevice (subdevice 2) of supported National Instruments M-series
+cards. It is called when handling the `COMEDI_CMD` and `COMEDI_CMDTEST`
+ioctls for this subdevice. There are two causes for a possible
+divide-by-zero error when validating that the `stop_arg` member of the
+passed-in command is not too large.
+
+The first cause for the divide-by-zero is that calls to
+`comedi_bytes_per_scan()` are only valid once the command has been
+copied to `s->async->cmd`, but that copy is only done for the
+`COMEDI_CMD` ioctl. For the `COMEDI_CMDTEST` ioctl, it will use
+whatever was left there by the previous `COMEDI_CMD` ioctl, if any.
+(This is very likely, as it is usual for the application to use
+`COMEDI_CMDTEST` before `COMEDI_CMD`.) If there has been no previous,
+valid `COMEDI_CMD` for this subdevice, then `comedi_bytes_per_scan()`
+will return 0, so the subsequent division in `ni_cdio_cmdtest()` of
+`s->async->prealloc_bufsz / comedi_bytes_per_scan(s)` will be a
+divide-by-zero error. To fix this error, call a new function
+`comedi_bytes_per_scan_cmd(s, cmd)`, based on the existing
+`comedi_bytes_per_scan(s)` but using a specified `struct comedi_cmd` for
+its calculations. (Also refactor `comedi_bytes_per_scan()` to call the
+new function.)
+
+Once the first cause for the divide-by-zero has been fixed, the second
+cause is that `comedi_bytes_per_scan_cmd()` can legitimately return 0 if
+the `scan_end_arg` member of the `struct comedi_cmd` being tested is 0.
+Fix it by only performing the division (and validating that `stop_arg`
+is no more than the maximum value) if `comedi_bytes_per_scan_cmd()`
+returns a non-zero value.
+
+The problem was reported on the COMEDI mailing list here:
+https://groups.google.com/forum/#!topic/comedi_list/4t9WlHzMhKM
+
+Reported-by: Ivan Vasilyev <grabesstimme@gmail.com>
+Tested-by: Ivan Vasilyev <grabesstimme@gmail.com>
+Fixes: f164cbf98fa8 ("staging: comedi: ni_mio_common: add finite regeneration to dio output")
+Cc: <stable@vger.kernel.org> # 4.6+
+Cc: Spencer E. Olson <olsonse@umich.edu>
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/comedidev.h | 2 +
+ drivers/staging/comedi/drivers.c | 33 +++++++++++++++++++++----
+ drivers/staging/comedi/drivers/ni_mio_common.c | 10 +++++--
+ 3 files changed, 38 insertions(+), 7 deletions(-)
+
+--- a/drivers/staging/comedi/comedidev.h
++++ b/drivers/staging/comedi/comedidev.h
+@@ -1001,6 +1001,8 @@ int comedi_dio_insn_config(struct comedi
+ unsigned int mask);
+ unsigned int comedi_dio_update_state(struct comedi_subdevice *s,
+ unsigned int *data);
++unsigned int comedi_bytes_per_scan_cmd(struct comedi_subdevice *s,
++ struct comedi_cmd *cmd);
+ unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s);
+ unsigned int comedi_nscans_left(struct comedi_subdevice *s,
+ unsigned int nscans);
+--- a/drivers/staging/comedi/drivers.c
++++ b/drivers/staging/comedi/drivers.c
+@@ -394,11 +394,13 @@ unsigned int comedi_dio_update_state(str
+ EXPORT_SYMBOL_GPL(comedi_dio_update_state);
+
+ /**
+- * comedi_bytes_per_scan() - Get length of asynchronous command "scan" in bytes
++ * comedi_bytes_per_scan_cmd() - Get length of asynchronous command "scan" in
++ * bytes
+ * @s: COMEDI subdevice.
++ * @cmd: COMEDI command.
+ *
+ * Determines the overall scan length according to the subdevice type and the
+- * number of channels in the scan.
++ * number of channels in the scan for the specified command.
+ *
+ * For digital input, output or input/output subdevices, samples for
+ * multiple channels are assumed to be packed into one or more unsigned
+@@ -408,9 +410,9 @@ EXPORT_SYMBOL_GPL(comedi_dio_update_stat
+ *
+ * Returns the overall scan length in bytes.
+ */
+-unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s)
++unsigned int comedi_bytes_per_scan_cmd(struct comedi_subdevice *s,
++ struct comedi_cmd *cmd)
+ {
+- struct comedi_cmd *cmd = &s->async->cmd;
+ unsigned int num_samples;
+ unsigned int bits_per_sample;
+
+@@ -427,6 +429,29 @@ unsigned int comedi_bytes_per_scan(struc
+ }
+ return comedi_samples_to_bytes(s, num_samples);
+ }
++EXPORT_SYMBOL_GPL(comedi_bytes_per_scan_cmd);
++
++/**
++ * comedi_bytes_per_scan() - Get length of asynchronous command "scan" in bytes
++ * @s: COMEDI subdevice.
++ *
++ * Determines the overall scan length according to the subdevice type and the
++ * number of channels in the scan for the current command.
++ *
++ * For digital input, output or input/output subdevices, samples for
++ * multiple channels are assumed to be packed into one or more unsigned
++ * short or unsigned int values according to the subdevice's %SDF_LSAMPL
++ * flag. For other types of subdevice, samples are assumed to occupy a
++ * whole unsigned short or unsigned int according to the %SDF_LSAMPL flag.
++ *
++ * Returns the overall scan length in bytes.
++ */
++unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s)
++{
++ struct comedi_cmd *cmd = &s->async->cmd;
++
++ return comedi_bytes_per_scan_cmd(s, cmd);
++}
+ EXPORT_SYMBOL_GPL(comedi_bytes_per_scan);
+
+ static unsigned int __comedi_nscans_left(struct comedi_subdevice *s,
+--- a/drivers/staging/comedi/drivers/ni_mio_common.c
++++ b/drivers/staging/comedi/drivers/ni_mio_common.c
+@@ -3545,6 +3545,7 @@ static int ni_cdio_cmdtest(struct comedi
+ struct comedi_subdevice *s, struct comedi_cmd *cmd)
+ {
+ struct ni_private *devpriv = dev->private;
++ unsigned int bytes_per_scan;
+ int err = 0;
+
+ /* Step 1 : check if triggers are trivially valid */
+@@ -3579,9 +3580,12 @@ static int ni_cdio_cmdtest(struct comedi
+ err |= comedi_check_trigger_arg_is(&cmd->convert_arg, 0);
+ err |= comedi_check_trigger_arg_is(&cmd->scan_end_arg,
+ cmd->chanlist_len);
+- err |= comedi_check_trigger_arg_max(&cmd->stop_arg,
+- s->async->prealloc_bufsz /
+- comedi_bytes_per_scan(s));
++ bytes_per_scan = comedi_bytes_per_scan_cmd(s, cmd);
++ if (bytes_per_scan) {
++ err |= comedi_check_trigger_arg_max(&cmd->stop_arg,
++ s->async->prealloc_bufsz /
++ bytes_per_scan);
++ }
+
+ if (err)
+ return 3;
--- /dev/null
+From b6391ac73400eff38377a4a7364bd3df5efb5178 Mon Sep 17 00:00:00 2001
+From: Gao Xiang <gaoxiang25@huawei.com>
+Date: Mon, 25 Mar 2019 11:40:07 +0800
+Subject: staging: erofs: fix error handling when failed to read compresssed data
+
+From: Gao Xiang <gaoxiang25@huawei.com>
+
+commit b6391ac73400eff38377a4a7364bd3df5efb5178 upstream.
+
+Complete read error handling paths for all three kinds of
+compressed pages:
+
+ 1) For cache-managed pages, PG_uptodate will be checked since
+ read_endio will unlock and SetPageUptodate for these pages;
+
+ 2) For inplaced pages, read_endio cannot SetPageUptodate directly
+ since it should be used to mark the final decompressed data,
+ PG_error will be set with page locked for IO error instead;
+
+ 3) For staging pages, PG_error is used, which is similar to
+ what we do for inplaced pages.
+
+Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
+Cc: <stable@vger.kernel.org> # 4.19+
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Gao Xiang <gaoxiang25@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/erofs/unzip_vle.c | 41 +++++++++++++++++++++++++-------------
+ 1 file changed, 28 insertions(+), 13 deletions(-)
+
+--- a/drivers/staging/erofs/unzip_vle.c
++++ b/drivers/staging/erofs/unzip_vle.c
+@@ -977,6 +977,7 @@ repeat:
+ overlapped = false;
+ compressed_pages = grp->compressed_pages;
+
++ err = 0;
+ for (i = 0; i < clusterpages; ++i) {
+ unsigned int pagenr;
+
+@@ -986,26 +987,39 @@ repeat:
+ DBG_BUGON(!page);
+ DBG_BUGON(!page->mapping);
+
+- if (z_erofs_is_stagingpage(page))
+- continue;
++ if (!z_erofs_is_stagingpage(page)) {
+ #ifdef EROFS_FS_HAS_MANAGED_CACHE
+- if (page->mapping == MNGD_MAPPING(sbi)) {
+- DBG_BUGON(!PageUptodate(page));
+- continue;
+- }
++ if (page->mapping == MNGD_MAPPING(sbi)) {
++ if (unlikely(!PageUptodate(page)))
++ err = -EIO;
++ continue;
++ }
+ #endif
+
+- /* only non-head page could be reused as a compressed page */
+- pagenr = z_erofs_onlinepage_index(page);
++ /*
++ * only if non-head page can be selected
++ * for inplace decompression
++ */
++ pagenr = z_erofs_onlinepage_index(page);
++
++ DBG_BUGON(pagenr >= nr_pages);
++ DBG_BUGON(pages[pagenr]);
++ ++sparsemem_pages;
++ pages[pagenr] = page;
+
+- DBG_BUGON(pagenr >= nr_pages);
+- DBG_BUGON(pages[pagenr]);
+- ++sparsemem_pages;
+- pages[pagenr] = page;
++ overlapped = true;
++ }
+
+- overlapped = true;
++ /* PG_error needs checking for inplaced and staging pages */
++ if (unlikely(PageError(page))) {
++ DBG_BUGON(PageUptodate(page));
++ err = -EIO;
++ }
+ }
+
++ if (unlikely(err))
++ goto out;
++
+ llen = (nr_pages << PAGE_SHIFT) - work->pageofs;
+
+ if (z_erofs_vle_workgrp_fmt(grp) == Z_EROFS_VLE_WORKGRP_FMT_PLAIN) {
+@@ -1203,6 +1217,7 @@ repeat:
+ if (page->mapping == mc) {
+ WRITE_ONCE(grp->compressed_pages[nr], page);
+
++ ClearPageError(page);
+ if (!PagePrivate(page)) {
+ /*
+ * impossible to be !PagePrivate(page) for
--- /dev/null
+From 8bce6dcede65139a087ff240127e3f3c01363eed Mon Sep 17 00:00:00 2001
+From: Chao Yu <yuchao0@huawei.com>
+Date: Mon, 11 Mar 2019 23:10:10 +0800
+Subject: staging: erofs: fix to handle error path of erofs_vmap()
+
+From: Chao Yu <yuchao0@huawei.com>
+
+commit 8bce6dcede65139a087ff240127e3f3c01363eed upstream.
+
+erofs_vmap() wrapped vmap() and vm_map_ram() to return virtual
+continuous memory, but both of them can failed due to a lot of
+reason, previously, erofs_vmap()'s callers didn't handle them,
+which can potentially cause NULL pointer access, fix it.
+
+Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
+Fixes: 0d40d6e399c1 ("staging: erofs: add a generic z_erofs VLE decompressor")
+Cc: <stable@vger.kernel.org> # 4.19+
+Signed-off-by: Gao Xiang <gaoxiang25@huawei.com>
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/erofs/unzip_vle.c | 4 ++++
+ drivers/staging/erofs/unzip_vle_lz4.c | 7 +++++--
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/erofs/unzip_vle.c
++++ b/drivers/staging/erofs/unzip_vle.c
+@@ -1034,6 +1034,10 @@ repeat:
+
+ skip_allocpage:
+ vout = erofs_vmap(pages, nr_pages);
++ if (!vout) {
++ err = -ENOMEM;
++ goto out;
++ }
+
+ err = z_erofs_vle_unzip_vmap(compressed_pages,
+ clusterpages, vout, llen, work->pageofs, overlapped);
+--- a/drivers/staging/erofs/unzip_vle_lz4.c
++++ b/drivers/staging/erofs/unzip_vle_lz4.c
+@@ -136,10 +136,13 @@ int z_erofs_vle_unzip_fast_percpu(struct
+
+ nr_pages = DIV_ROUND_UP(outlen + pageofs, PAGE_SIZE);
+
+- if (clusterpages == 1)
++ if (clusterpages == 1) {
+ vin = kmap_atomic(compressed_pages[0]);
+- else
++ } else {
+ vin = erofs_vmap(compressed_pages, clusterpages);
++ if (!vin)
++ return -ENOMEM;
++ }
+
+ preempt_disable();
+ vout = erofs_pcpubuf[smp_processor_id()].data;
--- /dev/null
+From 33bac912840fe64dbc15556302537dc6a17cac63 Mon Sep 17 00:00:00 2001
+From: Gao Xiang <gaoxiang25@huawei.com>
+Date: Fri, 29 Mar 2019 04:14:58 +0800
+Subject: staging: erofs: keep corrupted fs from crashing kernel in erofs_readdir()
+
+From: Gao Xiang <gaoxiang25@huawei.com>
+
+commit 33bac912840fe64dbc15556302537dc6a17cac63 upstream.
+
+After commit 419d6efc50e9, kernel cannot be crashed in the namei
+path. However, corrupted nameoff can do harm in the process of
+readdir for scenerios without dm-verity as well. Fix it now.
+
+Fixes: 3aa8ec716e52 ("staging: erofs: add directory operations")
+Cc: <stable@vger.kernel.org> # 4.19+
+Signed-off-by: Gao Xiang <gaoxiang25@huawei.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/erofs/dir.c | 45 ++++++++++++++++++++++++--------------------
+ 1 file changed, 25 insertions(+), 20 deletions(-)
+
+--- a/drivers/staging/erofs/dir.c
++++ b/drivers/staging/erofs/dir.c
+@@ -23,6 +23,21 @@ static const unsigned char erofs_filetyp
+ [EROFS_FT_SYMLINK] = DT_LNK,
+ };
+
++static void debug_one_dentry(unsigned char d_type, const char *de_name,
++ unsigned int de_namelen)
++{
++#ifdef CONFIG_EROFS_FS_DEBUG
++ /* since the on-disk name could not have the trailing '\0' */
++ unsigned char dbg_namebuf[EROFS_NAME_LEN + 1];
++
++ memcpy(dbg_namebuf, de_name, de_namelen);
++ dbg_namebuf[de_namelen] = '\0';
++
++ debugln("found dirent %s de_len %u d_type %d", dbg_namebuf,
++ de_namelen, d_type);
++#endif
++}
++
+ static int erofs_fill_dentries(struct dir_context *ctx,
+ void *dentry_blk, unsigned int *ofs,
+ unsigned int nameoff, unsigned int maxsize)
+@@ -33,14 +48,10 @@ static int erofs_fill_dentries(struct di
+ de = dentry_blk + *ofs;
+ while (de < end) {
+ const char *de_name;
+- int de_namelen;
++ unsigned int de_namelen;
+ unsigned char d_type;
+-#ifdef CONFIG_EROFS_FS_DEBUG
+- unsigned int dbg_namelen;
+- unsigned char dbg_namebuf[EROFS_NAME_LEN];
+-#endif
+
+- if (unlikely(de->file_type < EROFS_FT_MAX))
++ if (de->file_type < EROFS_FT_MAX)
+ d_type = erofs_filetype_table[de->file_type];
+ else
+ d_type = DT_UNKNOWN;
+@@ -48,26 +59,20 @@ static int erofs_fill_dentries(struct di
+ nameoff = le16_to_cpu(de->nameoff);
+ de_name = (char *)dentry_blk + nameoff;
+
+- de_namelen = unlikely(de + 1 >= end) ?
+- /* last directory entry */
+- strnlen(de_name, maxsize - nameoff) :
+- le16_to_cpu(de[1].nameoff) - nameoff;
++ /* the last dirent in the block? */
++ if (de + 1 >= end)
++ de_namelen = strnlen(de_name, maxsize - nameoff);
++ else
++ de_namelen = le16_to_cpu(de[1].nameoff) - nameoff;
+
+ /* a corrupted entry is found */
+- if (unlikely(de_namelen < 0)) {
++ if (unlikely(nameoff + de_namelen > maxsize ||
++ de_namelen > EROFS_NAME_LEN)) {
+ DBG_BUGON(1);
+ return -EIO;
+ }
+
+-#ifdef CONFIG_EROFS_FS_DEBUG
+- dbg_namelen = min(EROFS_NAME_LEN - 1, de_namelen);
+- memcpy(dbg_namebuf, de_name, dbg_namelen);
+- dbg_namebuf[dbg_namelen] = '\0';
+-
+- debugln("%s, found de_name %s de_len %d d_type %d", __func__,
+- dbg_namebuf, de_namelen, d_type);
+-#endif
+-
++ debug_one_dentry(d_type, de_name, de_namelen);
+ if (!dir_emit(ctx, de_name, de_namelen,
+ le64_to_cpu(de->nid), d_type))
+ /* stopped by some reason */
--- /dev/null
+From ae0a6d2017f733781dcc938a471ccc2d05f9bee6 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 4 Mar 2019 20:42:33 +0100
+Subject: staging: olpc_dcon_xo_1: add missing 'const' qualifier
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit ae0a6d2017f733781dcc938a471ccc2d05f9bee6 upstream.
+
+gcc noticed a mismatch between the type qualifiers after a recent
+cleanup:
+
+drivers/staging/olpc_dcon/olpc_dcon_xo_1.c: In function 'dcon_init_xo_1':
+drivers/staging/olpc_dcon/olpc_dcon_xo_1.c:48:26: error: initialization discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
+
+Add the 'const' keyword that should have been there all along.
+
+Fixes: 2159fb372929 ("staging: olpc_dcon: olpc_dcon_xo_1.c: Switch to the gpio descriptor interface")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/olpc_dcon/olpc_dcon_xo_1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c
++++ b/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c
+@@ -45,7 +45,7 @@ static int dcon_init_xo_1(struct dcon_pr
+ {
+ unsigned char lob;
+ int ret, i;
+- struct dcon_gpio *pin = &gpios_asis[0];
++ const struct dcon_gpio *pin = &gpios_asis[0];
+
+ for (i = 0; i < ARRAY_SIZE(gpios_asis); i++) {
+ gpios[i] = devm_gpiod_get(&dcon->client->dev, pin[i].name,
--- /dev/null
+From 45ac7b31bc6c4af885cc5b5d6c534c15bcbe7643 Mon Sep 17 00:00:00 2001
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Date: Thu, 7 Mar 2019 23:06:57 +0100
+Subject: staging: speakup_soft: Fix alternate speech with other synths
+
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+
+commit 45ac7b31bc6c4af885cc5b5d6c534c15bcbe7643 upstream.
+
+When switching from speakup_soft to another synth, speakup_soft would
+keep calling synth_buffer_getc() from softsynthx_read.
+
+Let's thus make synth.c export the knowledge of the current synth, so
+that speakup_soft can determine whether it should be running.
+
+speakup_soft also needs to set itself alive, otherwise the switch would
+let it remain silent.
+
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/speakup/speakup_soft.c | 16 +++++++++++-----
+ drivers/staging/speakup/spk_priv.h | 1 +
+ drivers/staging/speakup/synth.c | 6 ++++++
+ 3 files changed, 18 insertions(+), 5 deletions(-)
+
+--- a/drivers/staging/speakup/speakup_soft.c
++++ b/drivers/staging/speakup/speakup_soft.c
+@@ -208,12 +208,15 @@ static ssize_t softsynthx_read(struct fi
+ return -EINVAL;
+
+ spin_lock_irqsave(&speakup_info.spinlock, flags);
++ synth_soft.alive = 1;
+ while (1) {
+ prepare_to_wait(&speakup_event, &wait, TASK_INTERRUPTIBLE);
+- if (!unicode)
+- synth_buffer_skip_nonlatin1();
+- if (!synth_buffer_empty() || speakup_info.flushing)
+- break;
++ if (synth_current() == &synth_soft) {
++ if (!unicode)
++ synth_buffer_skip_nonlatin1();
++ if (!synth_buffer_empty() || speakup_info.flushing)
++ break;
++ }
+ spin_unlock_irqrestore(&speakup_info.spinlock, flags);
+ if (fp->f_flags & O_NONBLOCK) {
+ finish_wait(&speakup_event, &wait);
+@@ -233,6 +236,8 @@ static ssize_t softsynthx_read(struct fi
+
+ /* Keep 3 bytes available for a 16bit UTF-8-encoded character */
+ while (chars_sent <= count - bytes_per_ch) {
++ if (synth_current() != &synth_soft)
++ break;
+ if (speakup_info.flushing) {
+ speakup_info.flushing = 0;
+ ch = '\x18';
+@@ -329,7 +334,8 @@ static __poll_t softsynth_poll(struct fi
+ poll_wait(fp, &speakup_event, wait);
+
+ spin_lock_irqsave(&speakup_info.spinlock, flags);
+- if (!synth_buffer_empty() || speakup_info.flushing)
++ if (synth_current() == &synth_soft &&
++ (!synth_buffer_empty() || speakup_info.flushing))
+ ret = EPOLLIN | EPOLLRDNORM;
+ spin_unlock_irqrestore(&speakup_info.spinlock, flags);
+ return ret;
+--- a/drivers/staging/speakup/spk_priv.h
++++ b/drivers/staging/speakup/spk_priv.h
+@@ -74,6 +74,7 @@ int synth_request_region(unsigned long s
+ int synth_release_region(unsigned long start, unsigned long n);
+ int synth_add(struct spk_synth *in_synth);
+ void synth_remove(struct spk_synth *in_synth);
++struct spk_synth *synth_current(void);
+
+ extern struct speakup_info_t speakup_info;
+
+--- a/drivers/staging/speakup/synth.c
++++ b/drivers/staging/speakup/synth.c
+@@ -481,4 +481,10 @@ void synth_remove(struct spk_synth *in_s
+ }
+ EXPORT_SYMBOL_GPL(synth_remove);
+
++struct spk_synth *synth_current(void)
++{
++ return synth;
++}
++EXPORT_SYMBOL_GPL(synth_current);
++
+ short spk_punc_masks[] = { 0, SOME, MOST, PUNC, PUNC | B_SYM };
--- /dev/null
+From 3b9c2f2e0e99bb67c96abcb659b3465efe3bee1f Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Sun, 24 Mar 2019 18:53:49 +0000
+Subject: staging: vt6655: Fix interrupt race condition on device start up.
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 3b9c2f2e0e99bb67c96abcb659b3465efe3bee1f upstream.
+
+It appears on some slower systems that the driver can find its way
+out of the workqueue while the interrupt is disabled by continuous polling
+by it.
+
+Move MACvIntEnable to vnt_interrupt_work so that it is always enabled
+on all routes out of vnt_interrupt_process.
+
+Move MACvIntDisable so that the device doesn't keep polling the system
+while the workqueue is being processed.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+CC: stable@vger.kernel.org # v4.2+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6655/device_main.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/staging/vt6655/device_main.c
++++ b/drivers/staging/vt6655/device_main.c
+@@ -1033,8 +1033,6 @@ static void vnt_interrupt_process(struct
+ return;
+ }
+
+- MACvIntDisable(priv->PortOffset);
+-
+ spin_lock_irqsave(&priv->lock, flags);
+
+ /* Read low level stats */
+@@ -1122,8 +1120,6 @@ static void vnt_interrupt_process(struct
+ }
+
+ spin_unlock_irqrestore(&priv->lock, flags);
+-
+- MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE);
+ }
+
+ static void vnt_interrupt_work(struct work_struct *work)
+@@ -1133,6 +1129,8 @@ static void vnt_interrupt_work(struct wo
+
+ if (priv->vif)
+ vnt_interrupt_process(priv);
++
++ MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE);
+ }
+
+ static irqreturn_t vnt_interrupt(int irq, void *arg)
+@@ -1141,6 +1139,8 @@ static irqreturn_t vnt_interrupt(int irq
+
+ schedule_work(&priv->interrupt_work);
+
++ MACvIntDisable(priv->PortOffset);
++
+ return IRQ_HANDLED;
+ }
+
--- /dev/null
+From cc26358f89c3e493b54766b1ca56cfc6b14db78a Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Wed, 27 Mar 2019 18:45:26 +0000
+Subject: staging: vt6655: Remove vif check from vnt_interrupt
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit cc26358f89c3e493b54766b1ca56cfc6b14db78a upstream.
+
+A check for vif is made in vnt_interrupt_work.
+
+There is a small chance of leaving interrupt disabled while vif
+is NULL and the work hasn't been scheduled.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+CC: stable@vger.kernel.org # v4.2+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6655/device_main.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/staging/vt6655/device_main.c
++++ b/drivers/staging/vt6655/device_main.c
+@@ -1139,8 +1139,7 @@ static irqreturn_t vnt_interrupt(int irq
+ {
+ struct vnt_private *priv = arg;
+
+- if (priv->vif)
+- schedule_work(&priv->interrupt_work);
++ schedule_work(&priv->interrupt_work);
+
+ return IRQ_HANDLED;
+ }
--- /dev/null
+From c85be041065c0be8bc48eda4c45e0319caf1d0e5 Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kjlu@umn.edu>
+Date: Fri, 15 Mar 2019 12:16:06 -0500
+Subject: tty: atmel_serial: fix a potential NULL pointer dereference
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+commit c85be041065c0be8bc48eda4c45e0319caf1d0e5 upstream.
+
+In case dmaengine_prep_dma_cyclic fails, the fix returns a proper
+error code to avoid NULL pointer dereference.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Fixes: 34df42f59a60 ("serial: at91: add rx dma support")
+Acked-by: Richard Genoud <richard.genoud@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/atmel_serial.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -1297,6 +1297,10 @@ static int atmel_prepare_rx_dma(struct u
+ sg_dma_len(&atmel_port->sg_rx)/2,
+ DMA_DEV_TO_MEM,
+ DMA_PREP_INTERRUPT);
++ if (!desc) {
++ dev_err(port->dev, "Preparing DMA cyclic failed\n");
++ goto chan_err;
++ }
+ desc->callback = atmel_complete_rx_dma;
+ desc->callback_param = port;
+ atmel_port->desc_rx = desc;
--- /dev/null
+From 6734330654dac550f12e932996b868c6d0dcb421 Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kjlu@umn.edu>
+Date: Thu, 14 Mar 2019 02:21:51 -0500
+Subject: tty: mxs-auart: fix a potential NULL pointer dereference
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+commit 6734330654dac550f12e932996b868c6d0dcb421 upstream.
+
+In case ioremap fails, the fix returns -ENOMEM to avoid NULL
+pointer dereferences.
+Multiple places use port.membase.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/mxs-auart.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/tty/serial/mxs-auart.c
++++ b/drivers/tty/serial/mxs-auart.c
+@@ -1686,6 +1686,10 @@ static int mxs_auart_probe(struct platfo
+
+ s->port.mapbase = r->start;
+ s->port.membase = ioremap(r->start, resource_size(r));
++ if (!s->port.membase) {
++ ret = -ENOMEM;
++ goto out_disable_clks;
++ }
+ s->port.ops = &mxs_auart_ops;
+ s->port.iotype = UPIO_MEM;
+ s->port.fifosize = MXS_AUART_FIFO_SIZE;
--- /dev/null
+From f3040983132bf3477acd45d2452a906e67c2fec9 Mon Sep 17 00:00:00 2001
+From: Razvan Stefanescu <razvan.stefanescu@microchip.com>
+Date: Tue, 19 Mar 2019 15:20:34 +0200
+Subject: tty/serial: atmel: Add is_half_duplex helper
+
+From: Razvan Stefanescu <razvan.stefanescu@microchip.com>
+
+commit f3040983132bf3477acd45d2452a906e67c2fec9 upstream.
+
+Use a helper function to check that a port needs to use half duplex
+communication, replacing several occurrences of multi-line bit checking.
+
+Fixes: b389f173aaa1 ("tty/serial: atmel: RS485 half duplex w/DMA: enable RX after TX is done")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Razvan Stefanescu <razvan.stefanescu@microchip.com>
+Acked-by: Richard Genoud <richard.genoud@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/atmel_serial.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -231,6 +231,13 @@ static inline void atmel_uart_write_char
+ __raw_writeb(value, port->membase + ATMEL_US_THR);
+ }
+
++static inline int atmel_uart_is_half_duplex(struct uart_port *port)
++{
++ return ((port->rs485.flags & SER_RS485_ENABLED) &&
++ !(port->rs485.flags & SER_RS485_RX_DURING_TX)) ||
++ (port->iso7816.flags & SER_ISO7816_ENABLED);
++}
++
+ #ifdef CONFIG_SERIAL_ATMEL_PDC
+ static bool atmel_use_pdc_rx(struct uart_port *port)
+ {
+@@ -608,10 +615,9 @@ static void atmel_stop_tx(struct uart_po
+ /* Disable interrupts */
+ atmel_uart_writel(port, ATMEL_US_IDR, atmel_port->tx_done_mask);
+
+- if (((port->rs485.flags & SER_RS485_ENABLED) &&
+- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) ||
+- port->iso7816.flags & SER_ISO7816_ENABLED)
++ if (atmel_uart_is_half_duplex(port))
+ atmel_start_rx(port);
++
+ }
+
+ /*
+@@ -628,9 +634,7 @@ static void atmel_start_tx(struct uart_p
+ return;
+
+ if (atmel_use_pdc_tx(port) || atmel_use_dma_tx(port))
+- if (((port->rs485.flags & SER_RS485_ENABLED) &&
+- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) ||
+- port->iso7816.flags & SER_ISO7816_ENABLED)
++ if (atmel_uart_is_half_duplex(port))
+ atmel_stop_rx(port);
+
+ if (atmel_use_pdc_tx(port))
+@@ -928,9 +932,7 @@ static void atmel_complete_tx_dma(void *
+ */
+ if (!uart_circ_empty(xmit))
+ atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx);
+- else if (((port->rs485.flags & SER_RS485_ENABLED) &&
+- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) ||
+- port->iso7816.flags & SER_ISO7816_ENABLED) {
++ else if (atmel_uart_is_half_duplex(port)) {
+ /* DMA done, stop TX, start RX for RS485 */
+ atmel_start_rx(port);
+ }
+@@ -1508,9 +1510,7 @@ static void atmel_tx_pdc(struct uart_por
+ atmel_uart_writel(port, ATMEL_US_IER,
+ atmel_port->tx_done_mask);
+ } else {
+- if (((port->rs485.flags & SER_RS485_ENABLED) &&
+- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) ||
+- port->iso7816.flags & SER_ISO7816_ENABLED) {
++ if (atmel_uart_is_half_duplex(port)) {
+ /* DMA done, stop TX, start RX for RS485 */
+ atmel_start_rx(port);
+ }
--- /dev/null
+From 69646d7a3689fbe1a65ae90397d22ac3f1b8d40f Mon Sep 17 00:00:00 2001
+From: Razvan Stefanescu <razvan.stefanescu@microchip.com>
+Date: Tue, 19 Mar 2019 15:20:35 +0200
+Subject: tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped
+
+From: Razvan Stefanescu <razvan.stefanescu@microchip.com>
+
+commit 69646d7a3689fbe1a65ae90397d22ac3f1b8d40f upstream.
+
+In half-duplex operation, RX should be started after TX completes.
+
+If DMA is used, there is a case when the DMA transfer completes but the
+TX FIFO is not emptied, so the RX cannot be restarted just yet.
+
+Use a boolean variable to store this state and rearm TX interrupt mask
+to be signaled again that the transfer finished. In interrupt transmit
+handler this variable is used to start RX. A warning message is generated
+if RX is activated before TX fifo is cleared.
+
+Fixes: b389f173aaa1 ("tty/serial: atmel: RS485 half duplex w/DMA: enable
+RX after TX is done")
+Signed-off-by: Razvan Stefanescu <razvan.stefanescu@microchip.com>
+Acked-by: Richard Genoud <richard.genoud@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/atmel_serial.c | 24 +++++++++++++++++++++---
+ 1 file changed, 21 insertions(+), 3 deletions(-)
+
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -166,6 +166,8 @@ struct atmel_uart_port {
+ unsigned int pending_status;
+ spinlock_t lock_suspended;
+
++ bool hd_start_rx; /* can start RX during half-duplex operation */
++
+ /* ISO7816 */
+ unsigned int fidi_min;
+ unsigned int fidi_max;
+@@ -933,8 +935,13 @@ static void atmel_complete_tx_dma(void *
+ if (!uart_circ_empty(xmit))
+ atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx);
+ else if (atmel_uart_is_half_duplex(port)) {
+- /* DMA done, stop TX, start RX for RS485 */
+- atmel_start_rx(port);
++ /*
++ * DMA done, re-enable TXEMPTY and signal that we can stop
++ * TX and start RX for RS485
++ */
++ atmel_port->hd_start_rx = true;
++ atmel_uart_writel(port, ATMEL_US_IER,
++ atmel_port->tx_done_mask);
+ }
+
+ spin_unlock_irqrestore(&port->lock, flags);
+@@ -1378,9 +1385,20 @@ atmel_handle_transmit(struct uart_port *
+ struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
+
+ if (pending & atmel_port->tx_done_mask) {
+- /* Either PDC or interrupt transmission */
+ atmel_uart_writel(port, ATMEL_US_IDR,
+ atmel_port->tx_done_mask);
++
++ /* Start RX if flag was set and FIFO is empty */
++ if (atmel_port->hd_start_rx) {
++ if (!(atmel_uart_readl(port, ATMEL_US_CSR)
++ & ATMEL_US_TXEMPTY))
++ dev_warn(port->dev, "Should start RX, but TX fifo is not empty\n");
++
++ atmel_port->hd_start_rx = false;
++ atmel_start_rx(port);
++ return;
++ }
++
+ atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx);
+ }
+ }
--- /dev/null
+From c5cbc78acf693f5605d4a85b1327fa7933daf092 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Fri, 8 Mar 2019 11:37:44 -0700
+Subject: tty: serial: qcom_geni_serial: Initialize baud in qcom_geni_console_setup
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+commit c5cbc78acf693f5605d4a85b1327fa7933daf092 upstream.
+
+When building with -Wsometimes-uninitialized, Clang warns:
+
+drivers/tty/serial/qcom_geni_serial.c:1079:6: warning: variable 'baud'
+is used uninitialized whenever 'if' condition is false
+[-Wsometimes-uninitialized]
+
+It's not wrong; when options is NULL, baud has no default value. Use
+9600 as that is a sane default.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/395
+Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/qcom_geni_serial.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -1117,7 +1117,7 @@ static int __init qcom_geni_console_setu
+ {
+ struct uart_port *uport;
+ struct qcom_geni_serial_port *port;
+- int baud;
++ int baud = 9600;
+ int bits = 8;
+ int parity = 'n';
+ int flow = 'n';
--- /dev/null
+From a595ecdd5f60b2d93863cebb07eec7f935839b54 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Wed, 27 Mar 2019 10:11:14 +0900
+Subject: USB: serial: cp210x: add new device id
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit a595ecdd5f60b2d93863cebb07eec7f935839b54 upstream.
+
+Lorenz Messtechnik has a device that is controlled by the cp210x driver,
+so add the device id to the driver. The device id was provided by
+Silicon-Labs for the devices from this vendor.
+
+Reported-by: Uli <t9cpu@web.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/cp210x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -80,6 +80,7 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(0x10C4, 0x804E) }, /* Software Bisque Paramount ME build-in converter */
+ { USB_DEVICE(0x10C4, 0x8053) }, /* Enfora EDG1228 */
+ { USB_DEVICE(0x10C4, 0x8054) }, /* Enfora GSM2228 */
++ { USB_DEVICE(0x10C4, 0x8056) }, /* Lorenz Messtechnik devices */
+ { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */
+ { USB_DEVICE(0x10C4, 0x806F) }, /* IMS USB to RS422 Converter Cable */
+ { USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */
--- /dev/null
+From 422c2537ba9d42320f8ab6573940269f87095320 Mon Sep 17 00:00:00 2001
+From: George McCollister <george.mccollister@gmail.com>
+Date: Tue, 5 Mar 2019 16:05:03 -0600
+Subject: USB: serial: ftdi_sio: add additional NovaTech products
+
+From: George McCollister <george.mccollister@gmail.com>
+
+commit 422c2537ba9d42320f8ab6573940269f87095320 upstream.
+
+Add PIDs for the NovaTech OrionLX+ and Orion I/O so they can be
+automatically detected.
+
+Signed-off-by: George McCollister <george.mccollister@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 2 ++
+ drivers/usb/serial/ftdi_sio_ids.h | 4 +++-
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -609,6 +609,8 @@ static const struct usb_device_id id_tab
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -567,7 +567,9 @@
+ /*
+ * NovaTech product ids (FTDI_VID)
+ */
+-#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */
++#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */
++#define FTDI_NT_ORIONLX_PLUS_PID 0x7c91 /* OrionLX+ Substation Automation Platform */
++#define FTDI_NT_ORION_IO_PID 0x7c92 /* Orion I/O */
+
+ /*
+ * Synapse Wireless product ids (FTDI_VID)
--- /dev/null
+From 2908b076f5198d231de62713cb2b633a3a4b95ac Mon Sep 17 00:00:00 2001
+From: Lin Yi <teroincn@163.com>
+Date: Wed, 20 Mar 2019 19:04:56 +0800
+Subject: USB: serial: mos7720: fix mos_parport refcount imbalance on error path
+
+From: Lin Yi <teroincn@163.com>
+
+commit 2908b076f5198d231de62713cb2b633a3a4b95ac upstream.
+
+The write_parport_reg_nonblock() helper takes a reference to the struct
+mos_parport, but failed to release it in a couple of error paths after
+allocation failures, leading to a memory leak.
+
+Johan said that move the kref_get() and mos_parport assignment to the
+end of urbtrack initialisation is a better way, so move it. and
+mos_parport do not used until urbtrack initialisation.
+
+Signed-off-by: Lin Yi <teroincn@163.com>
+Fixes: b69578df7e98 ("USB: usbserial: mos7720: add support for parallel port on moschip 7715")
+Cc: stable <stable@vger.kernel.org> # 2.6.35
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/mos7720.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -366,8 +366,6 @@ static int write_parport_reg_nonblock(st
+ if (!urbtrack)
+ return -ENOMEM;
+
+- kref_get(&mos_parport->ref_count);
+- urbtrack->mos_parport = mos_parport;
+ urbtrack->urb = usb_alloc_urb(0, GFP_ATOMIC);
+ if (!urbtrack->urb) {
+ kfree(urbtrack);
+@@ -388,6 +386,8 @@ static int write_parport_reg_nonblock(st
+ usb_sndctrlpipe(usbdev, 0),
+ (unsigned char *)urbtrack->setup,
+ NULL, 0, async_complete, urbtrack);
++ kref_get(&mos_parport->ref_count);
++ urbtrack->mos_parport = mos_parport;
+ kref_init(&urbtrack->ref_count);
+ INIT_LIST_HEAD(&urbtrack->urblist_entry);
+
--- /dev/null
+From 84f3b43f7378b98b7e3096d5499de75183d4347c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Wed, 27 Mar 2019 15:25:32 +0100
+Subject: USB: serial: option: add Olicard 600
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit 84f3b43f7378b98b7e3096d5499de75183d4347c upstream.
+
+This is a Qualcomm based device with a QMI function on interface 4.
+It is mode switched from 2020:2030 using a standard eject message.
+
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=2020 ProdID=2031 Rev= 2.32
+S: Manufacturer=Mobile Connect
+S: Product=Mobile Connect
+S: SerialNumber=0123456789ABCDEF
+C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none)
+E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+[ johan: use tabs to align comments in adjacent lines ]
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1945,10 +1945,12 @@ static const struct usb_device_id option
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */
+ .driver_info = RSVD(4) },
+- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
+- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
+- { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */
++ .driver_info = RSVD(4) },
++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
+ { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
+ { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
+ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
--- /dev/null
+From d1252f0237238b912c3e7a51bf237acf34c97983 Mon Sep 17 00:00:00 2001
+From: Kristian Evensen <kristian.evensen@gmail.com>
+Date: Sat, 2 Mar 2019 13:35:53 +0100
+Subject: USB: serial: option: add support for Quectel EM12
+
+From: Kristian Evensen <kristian.evensen@gmail.com>
+
+commit d1252f0237238b912c3e7a51bf237acf34c97983 upstream.
+
+The Quectel EM12 is a Cat. 12 LTE modem. It behaves in the exactly the
+same way as the EP06 (including the dynamic configuration behavior), so
+the same checks on reserved interfaces, etc. are needed.
+
+Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -246,6 +246,7 @@ static void option_instat_callback(struc
+ #define QUECTEL_PRODUCT_EC25 0x0125
+ #define QUECTEL_PRODUCT_BG96 0x0296
+ #define QUECTEL_PRODUCT_EP06 0x0306
++#define QUECTEL_PRODUCT_EM12 0x0512
+
+ #define CMOTECH_VENDOR_ID 0x16d8
+ #define CMOTECH_PRODUCT_6001 0x6001
+@@ -1088,6 +1089,9 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0xff, 0xff),
++ .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 },
++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
+ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
--- /dev/null
+From f8df5c2c3e2df5ffaf9fb5503da93d477a8c7db4 Mon Sep 17 00:00:00 2001
+From: Mans Rullgard <mans@mansr.com>
+Date: Tue, 26 Feb 2019 17:07:10 +0000
+Subject: USB: serial: option: set driver_info for SIM5218 and compatibles
+
+From: Mans Rullgard <mans@mansr.com>
+
+commit f8df5c2c3e2df5ffaf9fb5503da93d477a8c7db4 upstream.
+
+The SIMCom SIM5218 and compatible devices have 5 USB interfaces, only 4
+of which are serial ports. The fifth is a network interface supported
+by the qmi-wwan driver. Furthermore, the serial ports do not support
+modem control signals. Add driver_info flags to reflect this.
+
+Signed-off-by: Mans Rullgard <mans@mansr.com>
+Fixes: ec0cd94d881c ("usb: option: add SIMCom SIM5218")
+Cc: stable <stable@vger.kernel.org> # 3.2
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1066,7 +1066,8 @@ static const struct usb_device_id option
+ .driver_info = RSVD(3) },
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
+- { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
++ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000), /* SIMCom SIM5218 */
++ .driver_info = NCTRL(0) | NCTRL(1) | NCTRL(2) | NCTRL(3) | RSVD(4) },
+ /* Quectel products using Qualcomm vendor ID */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)},
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20),
projects / thirdparty / kernel / stable-queue.git / commitdiff
