From: Greg Kroah-Hartman Date: Mon, 20 Jul 2020 11:39:55 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v4.4.231~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3b2a277b14f7d94cca4b9a7254380f01f10a3f7a;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: alsa-line6-perform-sanity-check-for-each-urb-creation.patch alsa-usb-audio-fix-race-against-the-error-recovery-urb-submission.patch hid-magicmouse-do-not-set-up-autorepeat.patch usb-c67x00-fix-use-after-free-in-c67x00_giveback_urb.patch usb-chipidea-core-add-wakeup-support-for-extcon.patch usb-core-add-a-helper-function-to-check-the-validity-of-ep-type-in-urb.patch usb-dwc2-fix-shutdown-callback-in-platform.patch usb-gadget-function-fix-missing-spinlock-in-f_uac1_legacy.patch usb-serial-ch341-add-new-product-id-for-ch340.patch usb-serial-cypress_m8-enable-simply-automated-upb-pim.patch usb-serial-iuu_phoenix-fix-memory-corruption.patch usb-serial-option-add-gosuncn-gm500-series.patch usb-serial-option-add-quectel-eg95-lte-modem.patch --- diff --git a/queue-4.9/alsa-line6-perform-sanity-check-for-each-urb-creation.patch b/queue-4.9/alsa-line6-perform-sanity-check-for-each-urb-creation.patch new file mode 100644 index 00000000000..22c9cc442ed --- /dev/null +++ b/queue-4.9/alsa-line6-perform-sanity-check-for-each-urb-creation.patch @@ -0,0 +1,49 @@ +From 6e8a914ad619042c5f25a4feb663357c4170fd8d Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 10 Jul 2020 15:33:51 +0200 +Subject: ALSA: line6: Perform sanity check for each URB creation + +From: Takashi Iwai + +commit 6e8a914ad619042c5f25a4feb663357c4170fd8d upstream. + +LINE6 drivers create stream URBs with a fixed pipe without checking +its validity, and this may lead to a kernel WARNING at the submission +when a malformed USB descriptor is passed. + +For avoiding the kernel warning, perform the similar sanity checks for +each pipe type at creating a URB. + +Reported-by: syzbot+c190f6858a04ea7fbc52@syzkaller.appspotmail.com +Cc: +Link: https://lore.kernel.org/r/s5hv9iv4hq8.wl-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/line6/capture.c | 2 ++ + sound/usb/line6/playback.c | 2 ++ + 2 files changed, 4 insertions(+) + +--- a/sound/usb/line6/capture.c ++++ b/sound/usb/line6/capture.c +@@ -291,6 +291,8 @@ int line6_create_audio_in_urbs(struct sn + urb->interval = LINE6_ISO_INTERVAL; + urb->error_count = 0; + urb->complete = audio_in_callback; ++ if (usb_urb_ep_type_check(urb)) ++ return -EINVAL; + } + + return 0; +--- a/sound/usb/line6/playback.c ++++ b/sound/usb/line6/playback.c +@@ -436,6 +436,8 @@ int line6_create_audio_out_urbs(struct s + urb->interval = LINE6_ISO_INTERVAL; + urb->error_count = 0; + urb->complete = audio_out_callback; ++ if (usb_urb_ep_type_check(urb)) ++ return -EINVAL; + } + + return 0; diff --git a/queue-4.9/alsa-usb-audio-fix-race-against-the-error-recovery-urb-submission.patch b/queue-4.9/alsa-usb-audio-fix-race-against-the-error-recovery-urb-submission.patch new file mode 100644 index 00000000000..257aa84940f --- /dev/null +++ b/queue-4.9/alsa-usb-audio-fix-race-against-the-error-recovery-urb-submission.patch @@ -0,0 +1,90 @@ +From 9b7e5208a941e2e491a83eb5fa83d889e888fa2f Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 10 Jul 2020 18:06:56 +0200 +Subject: ALSA: usb-audio: Fix race against the error recovery URB submission + +From: Takashi Iwai + +commit 9b7e5208a941e2e491a83eb5fa83d889e888fa2f upstream. + +USB MIDI driver has an error recovery mechanism to resubmit the URB in +the delayed timer handler, and this may race with the standard start / +stop operations. Although both start and stop operations themselves +don't race with each other due to the umidi->mutex protection, but +this isn't applied to the timer handler. + +For fixing this potential race, the following changes are applied: + +- Since the timer handler can't use the mutex, we apply the + umidi->disc_lock protection at each input stream URB submission; + this also needs to change the GFP flag to GFP_ATOMIC +- Add a check of the URB refcount and skip if already submitted +- Move the timer cancel call at disconnection to the beginning of the + procedure; this assures the in-flight timer handler is gone properly + before killing all pending URBs + +Reported-by: syzbot+0f4ecfe6a2c322c81728@syzkaller.appspotmail.com +Reported-by: syzbot+5f1d24c49c1d2c427497@syzkaller.appspotmail.com +Cc: +Link: https://lore.kernel.org/r/20200710160656.16819-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/midi.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/sound/usb/midi.c ++++ b/sound/usb/midi.c +@@ -1477,6 +1477,8 @@ void snd_usbmidi_disconnect(struct list_ + spin_unlock_irq(&umidi->disc_lock); + up_write(&umidi->disc_rwsem); + ++ del_timer_sync(&umidi->error_timer); ++ + for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) { + struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i]; + if (ep->out) +@@ -1503,7 +1505,6 @@ void snd_usbmidi_disconnect(struct list_ + ep->in = NULL; + } + } +- del_timer_sync(&umidi->error_timer); + } + EXPORT_SYMBOL(snd_usbmidi_disconnect); + +@@ -2260,16 +2261,22 @@ void snd_usbmidi_input_stop(struct list_ + } + EXPORT_SYMBOL(snd_usbmidi_input_stop); + +-static void snd_usbmidi_input_start_ep(struct snd_usb_midi_in_endpoint *ep) ++static void snd_usbmidi_input_start_ep(struct snd_usb_midi *umidi, ++ struct snd_usb_midi_in_endpoint *ep) + { + unsigned int i; ++ unsigned long flags; + + if (!ep) + return; + for (i = 0; i < INPUT_URBS; ++i) { + struct urb *urb = ep->urbs[i]; +- urb->dev = ep->umidi->dev; +- snd_usbmidi_submit_urb(urb, GFP_KERNEL); ++ spin_lock_irqsave(&umidi->disc_lock, flags); ++ if (!atomic_read(&urb->use_count)) { ++ urb->dev = ep->umidi->dev; ++ snd_usbmidi_submit_urb(urb, GFP_ATOMIC); ++ } ++ spin_unlock_irqrestore(&umidi->disc_lock, flags); + } + } + +@@ -2285,7 +2292,7 @@ void snd_usbmidi_input_start(struct list + if (umidi->input_running || !umidi->opened[1]) + return; + for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) +- snd_usbmidi_input_start_ep(umidi->endpoints[i].in); ++ snd_usbmidi_input_start_ep(umidi, umidi->endpoints[i].in); + umidi->input_running = 1; + } + EXPORT_SYMBOL(snd_usbmidi_input_start); diff --git a/queue-4.9/hid-magicmouse-do-not-set-up-autorepeat.patch b/queue-4.9/hid-magicmouse-do-not-set-up-autorepeat.patch new file mode 100644 index 00000000000..e23060b70b0 --- /dev/null +++ b/queue-4.9/hid-magicmouse-do-not-set-up-autorepeat.patch @@ -0,0 +1,39 @@ +From 6363d2065cd399cf9d6dc9d08c437f8658831100 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Sun, 24 May 2020 16:51:34 -0700 +Subject: HID: magicmouse: do not set up autorepeat + +From: Dmitry Torokhov + +commit 6363d2065cd399cf9d6dc9d08c437f8658831100 upstream. + +Neither the trackpad, nor the mouse want input core to generate autorepeat +events for their buttons, so let's reset the bit (as hid-input sets it for +these devices based on the usage vendor code). + +Cc: stable@vger.kernel.org +Reported-by: Yariv +Tested-by: Yariv +Signed-off-by: Dmitry Torokhov +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-magicmouse.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/hid/hid-magicmouse.c ++++ b/drivers/hid/hid-magicmouse.c +@@ -451,6 +451,12 @@ static int magicmouse_setup_input(struct + __set_bit(MSC_RAW, input->mscbit); + } + ++ /* ++ * hid-input may mark device as using autorepeat, but neither ++ * the trackpad, nor the mouse actually want it. ++ */ ++ __clear_bit(EV_REP, input->evbit); ++ + return 0; + } + diff --git a/queue-4.9/series b/queue-4.9/series index 67a7743b7e0..7c9a0604396 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -58,3 +58,16 @@ revert-thermal-mediatek-fix-register-index-error.patch arm-dts-socfpga-align-l2-cache-controller-nodename-w.patch perf-stat-zero-all-the-ena-and-run-array-slot-stats-for-interval-mode.patch mtd-rawnand-brcmnand-fix-cs0-layout.patch +hid-magicmouse-do-not-set-up-autorepeat.patch +usb-core-add-a-helper-function-to-check-the-validity-of-ep-type-in-urb.patch +alsa-line6-perform-sanity-check-for-each-urb-creation.patch +alsa-usb-audio-fix-race-against-the-error-recovery-urb-submission.patch +usb-c67x00-fix-use-after-free-in-c67x00_giveback_urb.patch +usb-dwc2-fix-shutdown-callback-in-platform.patch +usb-chipidea-core-add-wakeup-support-for-extcon.patch +usb-gadget-function-fix-missing-spinlock-in-f_uac1_legacy.patch +usb-serial-iuu_phoenix-fix-memory-corruption.patch +usb-serial-cypress_m8-enable-simply-automated-upb-pim.patch +usb-serial-ch341-add-new-product-id-for-ch340.patch +usb-serial-option-add-gosuncn-gm500-series.patch +usb-serial-option-add-quectel-eg95-lte-modem.patch diff --git a/queue-4.9/usb-c67x00-fix-use-after-free-in-c67x00_giveback_urb.patch b/queue-4.9/usb-c67x00-fix-use-after-free-in-c67x00_giveback_urb.patch new file mode 100644 index 00000000000..518f3a1513f --- /dev/null +++ b/queue-4.9/usb-c67x00-fix-use-after-free-in-c67x00_giveback_urb.patch @@ -0,0 +1,55 @@ +From 211f08347355cba1f769bbf3355816a12b3ddd55 Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Wed, 8 Jul 2020 06:12:43 -0700 +Subject: USB: c67x00: fix use after free in c67x00_giveback_urb + +From: Tom Rix + +commit 211f08347355cba1f769bbf3355816a12b3ddd55 upstream. + +clang static analysis flags this error + +c67x00-sched.c:489:55: warning: Use of memory after it is freed [unix.Malloc] + usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status); + ^~~~~~~~~~~~ +Problem happens in this block of code + + c67x00_release_urb(c67x00, urb); + usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb); + spin_unlock(&c67x00->lock); + usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status); + +In the call to c67x00_release_urb has this freeing of urbp + + urbp = urb->hcpriv; + urb->hcpriv = NULL; + list_del(&urbp->hep_node); + kfree(urbp); + +And so urbp is freed before usb_hcd_giveback_urb uses it as its 3rd +parameter. + +Since all is required is the status, pass the status directly as is +done in c64x00_urb_dequeue + +Fixes: e9b29ffc519b ("USB: add Cypress c67x00 OTG controller HCD driver") +Signed-off-by: Tom Rix +Cc: stable +Link: https://lore.kernel.org/r/20200708131243.24336-1-trix@redhat.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/c67x00/c67x00-sched.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/c67x00/c67x00-sched.c ++++ b/drivers/usb/c67x00/c67x00-sched.c +@@ -500,7 +500,7 @@ c67x00_giveback_urb(struct c67x00_hcd *c + c67x00_release_urb(c67x00, urb); + usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb); + spin_unlock(&c67x00->lock); +- usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status); ++ usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, status); + spin_lock(&c67x00->lock); + } + diff --git a/queue-4.9/usb-chipidea-core-add-wakeup-support-for-extcon.patch b/queue-4.9/usb-chipidea-core-add-wakeup-support-for-extcon.patch new file mode 100644 index 00000000000..1a7da911fdf --- /dev/null +++ b/queue-4.9/usb-chipidea-core-add-wakeup-support-for-extcon.patch @@ -0,0 +1,67 @@ +From 876d4e1e8298ad1f94d9e9392fc90486755437b4 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Tue, 7 Jul 2020 14:06:01 +0800 +Subject: usb: chipidea: core: add wakeup support for extcon + +From: Peter Chen + +commit 876d4e1e8298ad1f94d9e9392fc90486755437b4 upstream. + +If wakeup event occurred by extcon event, it needs to call +ci_irq again since the first ci_irq calling at extcon notifier +only wakes up controller, but do noop for event handling, +it causes the extcon use case can't work well from low power mode. + +Cc: +Fixes: 3ecb3e09b042 ("usb: chipidea: Use extcon framework for VBUS and ID detect") +Reported-by: Philippe Schenker +Tested-by: Philippe Schenker +Signed-off-by: Peter Chen +Link: https://lore.kernel.org/r/20200707060601.31907-2-peter.chen@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/chipidea/core.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +--- a/drivers/usb/chipidea/core.c ++++ b/drivers/usb/chipidea/core.c +@@ -1110,6 +1110,29 @@ static void ci_controller_suspend(struct + enable_irq(ci->irq); + } + ++/* ++ * Handle the wakeup interrupt triggered by extcon connector ++ * We need to call ci_irq again for extcon since the first ++ * interrupt (wakeup int) only let the controller be out of ++ * low power mode, but not handle any interrupts. ++ */ ++static void ci_extcon_wakeup_int(struct ci_hdrc *ci) ++{ ++ struct ci_hdrc_cable *cable_id, *cable_vbus; ++ u32 otgsc = hw_read_otgsc(ci, ~0); ++ ++ cable_id = &ci->platdata->id_extcon; ++ cable_vbus = &ci->platdata->vbus_extcon; ++ ++ if (!IS_ERR(cable_id->edev) && ci->is_otg && ++ (otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS)) ++ ci_irq(ci->irq, ci); ++ ++ if (!IS_ERR(cable_vbus->edev) && ci->is_otg && ++ (otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS)) ++ ci_irq(ci->irq, ci); ++} ++ + static int ci_controller_resume(struct device *dev) + { + struct ci_hdrc *ci = dev_get_drvdata(dev); +@@ -1136,6 +1159,7 @@ static int ci_controller_resume(struct d + enable_irq(ci->irq); + if (ci_otg_is_fsm_mode(ci)) + ci_otg_fsm_wakeup_by_srp(ci); ++ ci_extcon_wakeup_int(ci); + } + + return 0; diff --git a/queue-4.9/usb-core-add-a-helper-function-to-check-the-validity-of-ep-type-in-urb.patch b/queue-4.9/usb-core-add-a-helper-function-to-check-the-validity-of-ep-type-in-urb.patch new file mode 100644 index 00000000000..2004db9bc87 --- /dev/null +++ b/queue-4.9/usb-core-add-a-helper-function-to-check-the-validity-of-ep-type-in-urb.patch @@ -0,0 +1,93 @@ +From e901b9873876ca30a09253731bd3a6b00c44b5b0 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 4 Oct 2017 16:15:59 +0200 +Subject: usb: core: Add a helper function to check the validity of EP type in URB + +From: Takashi Iwai + +commit e901b9873876ca30a09253731bd3a6b00c44b5b0 upstream. + +This patch adds a new helper function to perform a sanity check of the +given URB to see whether it contains a valid endpoint. It's a light- +weight version of what usb_submit_urb() does, but without the kernel +warning followed by the stack trace, just returns an error code. + +Especially for a driver that doesn't parse the descriptor but fills +the URB with the fixed endpoint (e.g. some quirks for non-compliant +devices), this kind of check is preferable at the probe phase before +actually submitting the urb. + +Tested-by: Andrey Konovalov +Acked-by: Greg Kroah-Hartman +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/urb.c | 30 ++++++++++++++++++++++++++---- + include/linux/usb.h | 2 ++ + 2 files changed, 28 insertions(+), 4 deletions(-) + +--- a/drivers/usb/core/urb.c ++++ b/drivers/usb/core/urb.c +@@ -183,6 +183,31 @@ EXPORT_SYMBOL_GPL(usb_unanchor_urb); + + /*-------------------------------------------------------------------*/ + ++static const int pipetypes[4] = { ++ PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT ++}; ++ ++/** ++ * usb_urb_ep_type_check - sanity check of endpoint in the given urb ++ * @urb: urb to be checked ++ * ++ * This performs a light-weight sanity check for the endpoint in the ++ * given urb. It returns 0 if the urb contains a valid endpoint, otherwise ++ * a negative error code. ++ */ ++int usb_urb_ep_type_check(const struct urb *urb) ++{ ++ const struct usb_host_endpoint *ep; ++ ++ ep = usb_pipe_endpoint(urb->dev, urb->pipe); ++ if (!ep) ++ return -EINVAL; ++ if (usb_pipetype(urb->pipe) != pipetypes[usb_endpoint_type(&ep->desc)]) ++ return -EINVAL; ++ return 0; ++} ++EXPORT_SYMBOL_GPL(usb_urb_ep_type_check); ++ + /** + * usb_submit_urb - issue an asynchronous transfer request for an endpoint + * @urb: pointer to the urb describing the request +@@ -322,9 +347,6 @@ EXPORT_SYMBOL_GPL(usb_unanchor_urb); + */ + int usb_submit_urb(struct urb *urb, gfp_t mem_flags) + { +- static int pipetypes[4] = { +- PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT +- }; + int xfertype, max; + struct usb_device *dev; + struct usb_host_endpoint *ep; +@@ -443,7 +465,7 @@ int usb_submit_urb(struct urb *urb, gfp_ + */ + + /* Check that the pipe's type matches the endpoint's type */ +- if (usb_pipetype(urb->pipe) != pipetypes[xfertype]) ++ if (usb_urb_ep_type_check(urb)) + dev_WARN(&dev->dev, "BOGUS urb xfer, pipe %x != type %x\n", + usb_pipetype(urb->pipe), pipetypes[xfertype]); + +--- a/include/linux/usb.h ++++ b/include/linux/usb.h +@@ -1655,6 +1655,8 @@ static inline int usb_urb_dir_out(struct + return (urb->transfer_flags & URB_DIR_MASK) == URB_DIR_OUT; + } + ++int usb_urb_ep_type_check(const struct urb *urb); ++ + void *usb_alloc_coherent(struct usb_device *dev, size_t size, + gfp_t mem_flags, dma_addr_t *dma); + void usb_free_coherent(struct usb_device *dev, size_t size, diff --git a/queue-4.9/usb-dwc2-fix-shutdown-callback-in-platform.patch b/queue-4.9/usb-dwc2-fix-shutdown-callback-in-platform.patch new file mode 100644 index 00000000000..c8a8f9fa320 --- /dev/null +++ b/queue-4.9/usb-dwc2-fix-shutdown-callback-in-platform.patch @@ -0,0 +1,40 @@ +From 4fdf228cdf6925af45a2066d403821e0977bfddb Mon Sep 17 00:00:00 2001 +From: Minas Harutyunyan +Date: Sat, 30 May 2020 11:41:50 +0400 +Subject: usb: dwc2: Fix shutdown callback in platform + +From: Minas Harutyunyan + +commit 4fdf228cdf6925af45a2066d403821e0977bfddb upstream. + +To avoid lot of interrupts from dwc2 core, which can be asserted in +specific conditions need to disable interrupts on HW level instead of +disable IRQs on Kernel level, because of IRQ can be shared between +drivers. + +Cc: stable@vger.kernel.org +Fixes: a40a00318c7fc ("usb: dwc2: add shutdown callback to platform variant") +Tested-by: Frank Mori Hess +Reviewed-by: Alan Stern +Reviewed-by: Doug Anderson +Reviewed-by: Frank Mori Hess +Signed-off-by: Minas Harutyunyan +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc2/platform.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc2/platform.c ++++ b/drivers/usb/dwc2/platform.c +@@ -507,7 +507,8 @@ static void dwc2_driver_shutdown(struct + { + struct dwc2_hsotg *hsotg = platform_get_drvdata(dev); + +- disable_irq(hsotg->irq); ++ dwc2_disable_global_interrupts(hsotg); ++ synchronize_irq(hsotg->irq); + } + + static const struct of_device_id dwc2_of_match_table[] = { diff --git a/queue-4.9/usb-gadget-function-fix-missing-spinlock-in-f_uac1_legacy.patch b/queue-4.9/usb-gadget-function-fix-missing-spinlock-in-f_uac1_legacy.patch new file mode 100644 index 00000000000..608b4c19f64 --- /dev/null +++ b/queue-4.9/usb-gadget-function-fix-missing-spinlock-in-f_uac1_legacy.patch @@ -0,0 +1,36 @@ +From 8778eb0927ddcd3f431805c37b78fa56481aeed9 Mon Sep 17 00:00:00 2001 +From: Zhang Qiang +Date: Mon, 6 Jul 2020 13:14:55 +0800 +Subject: usb: gadget: function: fix missing spinlock in f_uac1_legacy + +From: Zhang Qiang + +commit 8778eb0927ddcd3f431805c37b78fa56481aeed9 upstream. + +Add a missing spinlock protection for play_queue, because +the play_queue may be destroyed when the "playback_work" +work func and "f_audio_out_ep_complete" callback func +operate this paly_queue at the same time. + +Fixes: c6994e6f067cf ("USB: gadget: add USB Audio Gadget driver") +Cc: stable +Signed-off-by: Zhang Qiang +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_uac1.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/gadget/function/f_uac1.c ++++ b/drivers/usb/gadget/function/f_uac1.c +@@ -336,7 +336,9 @@ static int f_audio_out_ep_complete(struc + + /* Copy buffer is full, add it to the play_queue */ + if (audio_buf_size - copy_buf->actual < req->actual) { ++ spin_lock_irq(&audio->lock); + list_add_tail(©_buf->list, &audio->play_queue); ++ spin_unlock_irq(&audio->lock); + schedule_work(&audio->playback_work); + copy_buf = f_audio_buffer_alloc(audio_buf_size); + if (IS_ERR(copy_buf)) diff --git a/queue-4.9/usb-serial-ch341-add-new-product-id-for-ch340.patch b/queue-4.9/usb-serial-ch341-add-new-product-id-for-ch340.patch new file mode 100644 index 00000000000..7c391138c6c --- /dev/null +++ b/queue-4.9/usb-serial-ch341-add-new-product-id-for-ch340.patch @@ -0,0 +1,38 @@ +From 5d0136f8e79f8287e6a36780601f0ce797cf11c2 Mon Sep 17 00:00:00 2001 +From: Igor Moura +Date: Tue, 23 Jun 2020 05:11:11 -0300 +Subject: USB: serial: ch341: add new Product ID for CH340 + +From: Igor Moura + +commit 5d0136f8e79f8287e6a36780601f0ce797cf11c2 upstream. + +Add PID for CH340 that's found on some ESP8266 dev boards made by +LilyGO. The specific device that contains such serial converter can be +seen here: https://github.com/LilyGO/LILYGO-T-OI. + +Apparently, it's a regular CH340, but I've confirmed with others that +also bought this board that the PID found on this device (0x7522) +differs from other devices with the "same" converter (0x7523). +Simply adding its PID to the driver and rebuilding it made it work +as expected. + +Signed-off-by: Igor Moura +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ch341.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/ch341.c ++++ b/drivers/usb/serial/ch341.c +@@ -71,6 +71,7 @@ + + static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x4348, 0x5523) }, ++ { USB_DEVICE(0x1a86, 0x7522) }, + { USB_DEVICE(0x1a86, 0x7523) }, + { USB_DEVICE(0x1a86, 0x5523) }, + { }, diff --git a/queue-4.9/usb-serial-cypress_m8-enable-simply-automated-upb-pim.patch b/queue-4.9/usb-serial-cypress_m8-enable-simply-automated-upb-pim.patch new file mode 100644 index 00000000000..372c881fa50 --- /dev/null +++ b/queue-4.9/usb-serial-cypress_m8-enable-simply-automated-upb-pim.patch @@ -0,0 +1,75 @@ +From 5c45d04c5081c1830d674f4d22d4400ea2083afe Mon Sep 17 00:00:00 2001 +From: James Hilliard +Date: Tue, 16 Jun 2020 16:04:03 -0600 +Subject: USB: serial: cypress_m8: enable Simply Automated UPB PIM + +From: James Hilliard + +commit 5c45d04c5081c1830d674f4d22d4400ea2083afe upstream. + +This is a UPB (Universal Powerline Bus) PIM (Powerline Interface Module) +which allows for controlling multiple UPB compatible devices from Linux +using the standard serial interface. + +Based on vendor application source code there are two different models +of USB based PIM devices in addition to a number of RS232 based PIM's. + +The vendor UPB application source contains the following USB ID's: + + #define USB_PCS_VENDOR_ID 0x04b4 + #define USB_PCS_PIM_PRODUCT_ID 0x5500 + + #define USB_SAI_VENDOR_ID 0x17dd + #define USB_SAI_PIM_PRODUCT_ID 0x5500 + +The first set of ID's correspond to the PIM variant sold by Powerline +Control Systems while the second corresponds to the Simply Automated +Incorporated PIM. As the product ID for both of these match the default +cypress HID->COM RS232 product ID it assumed that they both use an +internal variant of this HID->COM RS232 converter hardware. However +as the vendor ID for the Simply Automated variant is different we need +to also add it to the cypress_M8 driver so that it is properly +detected. + +Signed-off-by: James Hilliard +Link: https://lore.kernel.org/r/20200616220403.1807003-1-james.hilliard1@gmail.com +Cc: stable@vger.kernel.org +[ johan: amend VID define entry ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cypress_m8.c | 2 ++ + drivers/usb/serial/cypress_m8.h | 3 +++ + 2 files changed, 5 insertions(+) + +--- a/drivers/usb/serial/cypress_m8.c ++++ b/drivers/usb/serial/cypress_m8.c +@@ -63,6 +63,7 @@ static const struct usb_device_id id_tab + + static const struct usb_device_id id_table_cyphidcomrs232[] = { + { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) }, ++ { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) }, + { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) }, + { USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) }, + { } /* Terminating entry */ +@@ -77,6 +78,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB) }, + { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB_LT20) }, + { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) }, ++ { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) }, + { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) }, + { USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) }, + { USB_DEVICE(VENDOR_ID_DAZZLE, PRODUCT_ID_CA42) }, +--- a/drivers/usb/serial/cypress_m8.h ++++ b/drivers/usb/serial/cypress_m8.h +@@ -24,6 +24,9 @@ + #define VENDOR_ID_CYPRESS 0x04b4 + #define PRODUCT_ID_CYPHIDCOM 0x5500 + ++/* Simply Automated HID->COM UPB PIM (using Cypress PID 0x5500) */ ++#define VENDOR_ID_SAI 0x17dd ++ + /* FRWD Dongle - a GPS sports watch */ + #define VENDOR_ID_FRWD 0x6737 + #define PRODUCT_ID_CYPHIDCOM_FRWD 0x0001 diff --git a/queue-4.9/usb-serial-iuu_phoenix-fix-memory-corruption.patch b/queue-4.9/usb-serial-iuu_phoenix-fix-memory-corruption.patch new file mode 100644 index 00000000000..455c55beb72 --- /dev/null +++ b/queue-4.9/usb-serial-iuu_phoenix-fix-memory-corruption.patch @@ -0,0 +1,43 @@ +From e7b931bee739e8a77ae216e613d3b99342b6dec0 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 15 Jul 2020 11:02:45 +0200 +Subject: USB: serial: iuu_phoenix: fix memory corruption + +From: Johan Hovold + +commit e7b931bee739e8a77ae216e613d3b99342b6dec0 upstream. + +The driver would happily overwrite its write buffer with user data in +256 byte increments due to a removed buffer-space sanity check. + +Fixes: 5fcf62b0f1f2 ("tty: iuu_phoenix: fix locking.") +Cc: stable # 2.6.31 +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/iuu_phoenix.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/usb/serial/iuu_phoenix.c ++++ b/drivers/usb/serial/iuu_phoenix.c +@@ -717,14 +717,16 @@ static int iuu_uart_write(struct tty_str + struct iuu_private *priv = usb_get_serial_port_data(port); + unsigned long flags; + +- if (count > 256) +- return -ENOMEM; +- + spin_lock_irqsave(&priv->lock, flags); + ++ count = min(count, 256 - priv->writelen); ++ if (count == 0) ++ goto out; ++ + /* fill the buffer */ + memcpy(priv->writebuf + priv->writelen, buf, count); + priv->writelen += count; ++out: + spin_unlock_irqrestore(&priv->lock, flags); + + return count; diff --git a/queue-4.9/usb-serial-option-add-gosuncn-gm500-series.patch b/queue-4.9/usb-serial-option-add-gosuncn-gm500-series.patch new file mode 100644 index 00000000000..1af9c568120 --- /dev/null +++ b/queue-4.9/usb-serial-option-add-gosuncn-gm500-series.patch @@ -0,0 +1,80 @@ +From 08d4ef5cc9203a113702f24725f6cf4db476c958 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= +Date: Tue, 23 Jun 2020 00:13:59 +0200 +Subject: USB: serial: option: add GosunCn GM500 series +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jörgen Storvist + +commit 08d4ef5cc9203a113702f24725f6cf4db476c958 upstream. + +Add USB IDs for GosunCn GM500 series cellular modules. + +RNDIS config: +usb-devices +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 12 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=305a ProdID=1404 Rev=03.18 +S: Manufacturer=Android +S: Product=Android +S: SerialNumber= +C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host +I: If#=0x1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host +I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option + +MBIM config: +usb-devices +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=305a ProdID=1405 Rev=03.18 +S: Manufacturer=Android +S: Product=Android +S: SerialNumber= +C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#=0x4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim + +ECM config: +usb-devices +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=305a ProdID=1406 Rev=03.18 +S: Manufacturer=Android +S: Product=Android +S: SerialNumber= +C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether +I: If#=0x4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether + +Signed-off-by: Jörgen Storvist +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2019,6 +2019,9 @@ static const struct usb_device_id option + .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ + .driver_info = RSVD(6) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ ++ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ ++ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); diff --git a/queue-4.9/usb-serial-option-add-quectel-eg95-lte-modem.patch b/queue-4.9/usb-serial-option-add-quectel-eg95-lte-modem.patch new file mode 100644 index 00000000000..518c78b238b --- /dev/null +++ b/queue-4.9/usb-serial-option-add-quectel-eg95-lte-modem.patch @@ -0,0 +1,51 @@ +From da6902e5b6dbca9081e3d377f9802d4fd0c5ea59 Mon Sep 17 00:00:00 2001 +From: AceLan Kao +Date: Tue, 7 Jul 2020 16:15:53 +0800 +Subject: USB: serial: option: add Quectel EG95 LTE modem + +From: AceLan Kao + +commit da6902e5b6dbca9081e3d377f9802d4fd0c5ea59 upstream. + +Add support for Quectel Wireless Solutions Co., Ltd. EG95 LTE modem + +T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 5 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0195 Rev=03.18 +S: Manufacturer=Android +S: Product=Android +C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) + +Signed-off-by: AceLan Kao +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -248,6 +248,7 @@ static void option_instat_callback(struc + /* These Quectel products use Quectel's vendor ID */ + #define QUECTEL_PRODUCT_EC21 0x0121 + #define QUECTEL_PRODUCT_EC25 0x0125 ++#define QUECTEL_PRODUCT_EG95 0x0195 + #define QUECTEL_PRODUCT_BG96 0x0296 + #define QUECTEL_PRODUCT_EP06 0x0306 + +@@ -1095,6 +1096,8 @@ static const struct usb_device_id option + .driver_info = RSVD(4) }, + { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25), + .driver_info = RSVD(4) }, ++ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95), ++ .driver_info = RSVD(4) }, + { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96), + .driver_info = RSVD(4) }, + { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06),