From: Greg Kroah-Hartman Date: Wed, 1 Mar 2023 16:13:19 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v4.19.275~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1cd8f3ac2c33647b913979f744e1fae63d3c9a94;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: usb-core-don-t-hold-device-lock-while-reading-the-descriptors-sysfs-file.patch usb-gadget-u_serial-add-null-pointer-check-in-gserial_resume.patch usb-serial-option-add-support-for-vw-skoda-carstick-lte.patch --- diff --git a/queue-5.10/series b/queue-5.10/series index b6aef9167ac..ea49b555d66 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -14,3 +14,6 @@ scripts-tags.sh-invoke-realpath-via-xargs.patch scripts-tags.sh-fix-incompatibility-with-pcre2.patch drm-virtio-fix-null-vs-is_err-checking-in-virtio_gpu_object_shmem_init.patch drm-virtio-correct-drm_gem_shmem_get_sg_table-error-handling.patch +usb-serial-option-add-support-for-vw-skoda-carstick-lte.patch +usb-gadget-u_serial-add-null-pointer-check-in-gserial_resume.patch +usb-core-don-t-hold-device-lock-while-reading-the-descriptors-sysfs-file.patch diff --git a/queue-5.10/usb-core-don-t-hold-device-lock-while-reading-the-descriptors-sysfs-file.patch b/queue-5.10/usb-core-don-t-hold-device-lock-while-reading-the-descriptors-sysfs-file.patch new file mode 100644 index 00000000000..f302107e9e9 --- /dev/null +++ b/queue-5.10/usb-core-don-t-hold-device-lock-while-reading-the-descriptors-sysfs-file.patch @@ -0,0 +1,72 @@ +From 45bf39f8df7f05efb83b302c65ae3b9bc92b7065 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 31 Jan 2023 15:49:04 -0500 +Subject: USB: core: Don't hold device lock while reading the "descriptors" sysfs file + +From: Alan Stern + +commit 45bf39f8df7f05efb83b302c65ae3b9bc92b7065 upstream. + +Ever since commit 83e83ecb79a8 ("usb: core: get config and string +descriptors for unauthorized devices") was merged in 2013, there has +been no mechanism for reallocating the rawdescriptors buffers in +struct usb_device after the initial enumeration. Before that commit, +the buffers would be deallocated when a device was deauthorized and +reallocated when it was authorized and enumerated. + +This means that the locking in the read_descriptors() routine is not +needed, since the buffers it reads will never be reallocated while the +routine is running. This locking can interfere with user programs +trying to read a hub's descriptors via sysfs while new child devices +of the hub are being initialized, since the hub is locked during this +procedure. + +Since the locking in read_descriptors() hasn't been needed for over +nine years, we can remove it. + +Reported-and-tested-by: Troels Liebe Bentsen +Signed-off-by: Alan Stern +CC: stable@vger.kernel.org +Link: https://lore.kernel.org/r/Y9l+wDTRbuZABzsE@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/hub.c | 5 ++--- + drivers/usb/core/sysfs.c | 5 ----- + 2 files changed, 2 insertions(+), 8 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2380,9 +2380,8 @@ static int usb_enumerate_device_otg(stru + * usb_enumerate_device - Read device configs/intfs/otg (usbcore-internal) + * @udev: newly addressed device (in ADDRESS state) + * +- * This is only called by usb_new_device() and usb_authorize_device() +- * and FIXME -- all comments that apply to them apply here wrt to +- * environment. ++ * This is only called by usb_new_device() -- all comments that apply there ++ * apply here wrt to environment. + * + * If the device is WUSB and not authorized, we don't attempt to read + * the string descriptors, as they will be errored out by the device +--- a/drivers/usb/core/sysfs.c ++++ b/drivers/usb/core/sysfs.c +@@ -889,11 +889,7 @@ read_descriptors(struct file *filp, stru + size_t srclen, n; + int cfgno; + void *src; +- int retval; + +- retval = usb_lock_device_interruptible(udev); +- if (retval < 0) +- return -EINTR; + /* The binary attribute begins with the device descriptor. + * Following that are the raw descriptor entries for all the + * configurations (config plus subsidiary descriptors). +@@ -918,7 +914,6 @@ read_descriptors(struct file *filp, stru + off -= srclen; + } + } +- usb_unlock_device(udev); + return count - nleft; + } + diff --git a/queue-5.10/usb-gadget-u_serial-add-null-pointer-check-in-gserial_resume.patch b/queue-5.10/usb-gadget-u_serial-add-null-pointer-check-in-gserial_resume.patch new file mode 100644 index 00000000000..952c0e6003b --- /dev/null +++ b/queue-5.10/usb-gadget-u_serial-add-null-pointer-check-in-gserial_resume.patch @@ -0,0 +1,84 @@ +From 5ec63fdbca604568890c577753c6f66c5b3ef0b5 Mon Sep 17 00:00:00 2001 +From: Prashanth K +Date: Mon, 13 Feb 2023 23:00:38 +0530 +Subject: usb: gadget: u_serial: Add null pointer check in gserial_resume + +From: Prashanth K + +commit 5ec63fdbca604568890c577753c6f66c5b3ef0b5 upstream. + +Consider a case where gserial_disconnect has already cleared +gser->ioport. And if a wakeup interrupt triggers afterwards, +gserial_resume gets called, which will lead to accessing of +gser->ioport and thus causing null pointer dereference.Add +a null pointer check to prevent this. + +Added a static spinlock to prevent gser->ioport from becoming +null after the newly added check. + +Fixes: aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume callbacks") +Cc: stable +Signed-off-by: Prashanth K +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/1676309438-14922-1-git-send-email-quic_prashk@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/u_serial.c | 23 +++++++++++++++++++---- + 1 file changed, 19 insertions(+), 4 deletions(-) + +--- a/drivers/usb/gadget/function/u_serial.c ++++ b/drivers/usb/gadget/function/u_serial.c +@@ -81,6 +81,9 @@ + #define WRITE_BUF_SIZE 8192 /* TX only */ + #define GS_CONSOLE_BUF_SIZE 8192 + ++/* Prevents race conditions while accessing gser->ioport */ ++static DEFINE_SPINLOCK(serial_port_lock); ++ + /* console info */ + struct gs_console { + struct console console; +@@ -1376,8 +1379,10 @@ void gserial_disconnect(struct gserial * + if (!port) + return; + ++ spin_lock_irqsave(&serial_port_lock, flags); ++ + /* tell the TTY glue not to do I/O here any more */ +- spin_lock_irqsave(&port->port_lock, flags); ++ spin_lock(&port->port_lock); + + gs_console_disconnect(port); + +@@ -1392,7 +1397,8 @@ void gserial_disconnect(struct gserial * + tty_hangup(port->port.tty); + } + port->suspended = false; +- spin_unlock_irqrestore(&port->port_lock, flags); ++ spin_unlock(&port->port_lock); ++ spin_unlock_irqrestore(&serial_port_lock, flags); + + /* disable endpoints, aborting down any active I/O */ + usb_ep_disable(gser->out); +@@ -1426,10 +1432,19 @@ EXPORT_SYMBOL_GPL(gserial_suspend); + + void gserial_resume(struct gserial *gser) + { +- struct gs_port *port = gser->ioport; ++ struct gs_port *port; + unsigned long flags; + +- spin_lock_irqsave(&port->port_lock, flags); ++ spin_lock_irqsave(&serial_port_lock, flags); ++ port = gser->ioport; ++ ++ if (!port) { ++ spin_unlock_irqrestore(&serial_port_lock, flags); ++ return; ++ } ++ ++ spin_lock(&port->port_lock); ++ spin_unlock(&serial_port_lock); + port->suspended = false; + if (!port->start_delayed) { + spin_unlock_irqrestore(&port->port_lock, flags); diff --git a/queue-5.10/usb-serial-option-add-support-for-vw-skoda-carstick-lte.patch b/queue-5.10/usb-serial-option-add-support-for-vw-skoda-carstick-lte.patch new file mode 100644 index 00000000000..34fd48d0f1e --- /dev/null +++ b/queue-5.10/usb-serial-option-add-support-for-vw-skoda-carstick-lte.patch @@ -0,0 +1,52 @@ +From 617c331d91077f896111044628c096802551dc66 Mon Sep 17 00:00:00 2001 +From: Florian Zumbiehl +Date: Mon, 6 Feb 2023 02:04:28 +0100 +Subject: USB: serial: option: add support for VW/Skoda "Carstick LTE" + +From: Florian Zumbiehl + +commit 617c331d91077f896111044628c096802551dc66 upstream. + +Add support for VW/Skoda "Carstick LTE" + +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1c9e ProdID=7605 Rev=02.00 +S: Manufacturer=USB Modem +S: Product=USB Modem +C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) + +The stick has AT command interfaces on interfaces 1, 2, and 3, and does PPP +on interface 3. + +Signed-off-by: Florian Zumbiehl +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -402,6 +402,8 @@ static void option_instat_callback(struc + #define LONGCHEER_VENDOR_ID 0x1c9e + + /* 4G Systems products */ ++/* This one was sold as the VW and Skoda "Carstick LTE" */ ++#define FOUR_G_SYSTEMS_PRODUCT_CARSTICK_LTE 0x7605 + /* This is the 4G XS Stick W14 a.k.a. Mobilcom Debitel Surf-Stick * + * It seems to contain a Qualcomm QSC6240/6290 chipset */ + #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603 +@@ -1976,6 +1978,8 @@ static const struct usb_device_id option + .driver_info = RSVD(2) }, + { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) }, + { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) }, ++ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_CARSTICK_LTE), ++ .driver_info = RSVD(0) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14), + .driver_info = NCTRL(0) | NCTRL(1) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W100),