From: Greg Kroah-Hartman Date: Wed, 9 Dec 2020 07:53:31 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v5.9.14~51 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=47f66f3c21667fe7f8c535777ff601ea77f2aa0c;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: alsa-hda-generic-add-option-to-enforce-preferred_dacs-pairs.patch alsa-hda-realtek-add-mute-led-quirk-to-yet-another-hp-x360-model.patch alsa-hda-realtek-add-new-codec-supported-for-alc897.patch alsa-hda-realtek-enable-headset-of-asus-ux482eg-b9400cea-with-alc294.patch tty-fix-pgrp-locking-in-tiocspgrp.patch tty-fix-session-locking.patch usb-gadget-f_fs-use-local-copy-of-descriptors-for-userspace-copy.patch usb-serial-ch341-add-new-product-id-for-ch341a.patch usb-serial-ch341-sort-device-id-entries.patch usb-serial-kl5kusb105-fix-memleak-on-open.patch usb-serial-option-add-fibocom-nl668-variants.patch usb-serial-option-add-support-for-thales-cinterion-exs82.patch usb-serial-option-fix-quectel-bg96-matching.patch --- diff --git a/queue-4.19/alsa-hda-generic-add-option-to-enforce-preferred_dacs-pairs.patch b/queue-4.19/alsa-hda-generic-add-option-to-enforce-preferred_dacs-pairs.patch new file mode 100644 index 00000000000..779b678d0e9 --- /dev/null +++ b/queue-4.19/alsa-hda-generic-add-option-to-enforce-preferred_dacs-pairs.patch @@ -0,0 +1,70 @@ +From 242d990c158d5b1dabd166516e21992baef5f26a Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 27 Nov 2020 15:11:03 +0100 +Subject: ALSA: hda/generic: Add option to enforce preferred_dacs pairs + +From: Takashi Iwai + +commit 242d990c158d5b1dabd166516e21992baef5f26a upstream. + +The generic parser accepts the preferred_dacs[] pairs as a hint for +assigning a DAC to each pin, but this hint doesn't work always +effectively. Currently it's merely a secondary choice after the trial +with the path index failed. This made sometimes it difficult to +assign DACs without mimicking the connection list and/or the badness +table. + +This patch adds a new flag, obey_preferred_dacs, that changes the +behavior of the parser. As its name stands, the parser obeys the +given preferred_dacs[] pairs by skipping the path index matching and +giving a high penalty if no DAC is assigned by the pairs. This mode +will help for assigning the fixed DACs forcibly from the codec +driver. + +Cc: +Link: https://lore.kernel.org/r/20201127141104.11041-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_generic.c | 12 ++++++++---- + sound/pci/hda/hda_generic.h | 1 + + 2 files changed, 9 insertions(+), 4 deletions(-) + +--- a/sound/pci/hda/hda_generic.c ++++ b/sound/pci/hda/hda_generic.c +@@ -1376,16 +1376,20 @@ static int try_assign_dacs(struct hda_co + struct nid_path *path; + hda_nid_t pin = pins[i]; + +- path = snd_hda_get_path_from_idx(codec, path_idx[i]); +- if (path) { +- badness += assign_out_path_ctls(codec, path); +- continue; ++ if (!spec->obey_preferred_dacs) { ++ path = snd_hda_get_path_from_idx(codec, path_idx[i]); ++ if (path) { ++ badness += assign_out_path_ctls(codec, path); ++ continue; ++ } + } + + dacs[i] = get_preferred_dac(codec, pin); + if (dacs[i]) { + if (is_dac_already_used(codec, dacs[i])) + badness += bad->shared_primary; ++ } else if (spec->obey_preferred_dacs) { ++ badness += BAD_NO_PRIMARY_DAC; + } + + if (!dacs[i]) +--- a/sound/pci/hda/hda_generic.h ++++ b/sound/pci/hda/hda_generic.h +@@ -240,6 +240,7 @@ struct hda_gen_spec { + unsigned int power_down_unused:1; /* power down unused widgets */ + unsigned int dac_min_mute:1; /* minimal = mute for DACs */ + unsigned int suppress_vmaster:1; /* don't create vmaster kctls */ ++ unsigned int obey_preferred_dacs:1; /* obey preferred_dacs assignment */ + + /* other internal flags */ + unsigned int no_analog:1; /* digital I/O only */ diff --git a/queue-4.19/alsa-hda-realtek-add-mute-led-quirk-to-yet-another-hp-x360-model.patch b/queue-4.19/alsa-hda-realtek-add-mute-led-quirk-to-yet-another-hp-x360-model.patch new file mode 100644 index 00000000000..0e7cc1a573c --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-add-mute-led-quirk-to-yet-another-hp-x360-model.patch @@ -0,0 +1,41 @@ +From aeedad2504997be262c98f6e3228173225a8d868 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sat, 28 Nov 2020 10:00:15 +0100 +Subject: ALSA: hda/realtek: Add mute LED quirk to yet another HP x360 model + +From: Takashi Iwai + +commit aeedad2504997be262c98f6e3228173225a8d868 upstream. + +HP Spectre x360 Convertible 15" version (SSID 103c:827f) needs the +same quirk to make the mute LED working like other models. + System Information + Manufacturer: HP + Product Name: HP Spectre x360 Convertible 15-bl1XX + + Sound Codec: + Codec: Realtek ALC295 + Vendor Id: 0x10ec0295 + Subsystem Id: 0x103c827f + Revision Id: 0x100002 + +Reported-by: +Cc: +Link: https://lore.kernel.org/r/20201128090015.7743-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7068,6 +7068,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x103c, 0x820d, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3), + SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC), + SND_PCI_QUIRK(0x103c, 0x827e, "HP x360", ALC295_FIXUP_HP_X360), ++ SND_PCI_QUIRK(0x103c, 0x827f, "HP x360", ALC269_FIXUP_HP_MUTE_LED_MIC3), + SND_PCI_QUIRK(0x103c, 0x82bf, "HP G3 mini", ALC221_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x82c0, "HP G3 mini premium", ALC221_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x83b9, "HP Spectre x360", ALC269_FIXUP_HP_MUTE_LED_MIC3), diff --git a/queue-4.19/alsa-hda-realtek-add-new-codec-supported-for-alc897.patch b/queue-4.19/alsa-hda-realtek-add-new-codec-supported-for-alc897.patch new file mode 100644 index 00000000000..2dac2bd6adf --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-add-new-codec-supported-for-alc897.patch @@ -0,0 +1,39 @@ +From e5782a5d5054bf1e03cb7fbd87035037c2a22698 Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Fri, 27 Nov 2020 14:39:23 +0800 +Subject: ALSA: hda/realtek - Add new codec supported for ALC897 + +From: Kailang Yang + +commit e5782a5d5054bf1e03cb7fbd87035037c2a22698 upstream. + +Enable new codec supported for ALC897. + +Signed-off-by: Kailang Yang +Cc: +Link: https://lore.kernel.org/r/3b00520f304842aab8291eb8d9191bd8@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -439,6 +439,7 @@ static void alc_fill_eapd_coef(struct hd + alc_update_coef_idx(codec, 0x7, 1<<5, 0); + break; + case 0x10ec0892: ++ case 0x10ec0897: + alc_update_coef_idx(codec, 0x7, 1<<5, 0); + break; + case 0x10ec0899: +@@ -9166,6 +9167,7 @@ static const struct hda_device_id snd_hd + HDA_CODEC_ENTRY(0x10ec0888, "ALC888", patch_alc882), + HDA_CODEC_ENTRY(0x10ec0889, "ALC889", patch_alc882), + HDA_CODEC_ENTRY(0x10ec0892, "ALC892", patch_alc662), ++ HDA_CODEC_ENTRY(0x10ec0897, "ALC897", patch_alc662), + HDA_CODEC_ENTRY(0x10ec0899, "ALC898", patch_alc882), + HDA_CODEC_ENTRY(0x10ec0900, "ALC1150", patch_alc882), + HDA_CODEC_ENTRY(0x10ec0b00, "ALCS1200A", patch_alc882), diff --git a/queue-4.19/alsa-hda-realtek-enable-headset-of-asus-ux482eg-b9400cea-with-alc294.patch b/queue-4.19/alsa-hda-realtek-enable-headset-of-asus-ux482eg-b9400cea-with-alc294.patch new file mode 100644 index 00000000000..3edf7b28a10 --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-enable-headset-of-asus-ux482eg-b9400cea-with-alc294.patch @@ -0,0 +1,34 @@ +From eeacd80fcb29b769ea915cd06b7dd35e0bf0bc25 Mon Sep 17 00:00:00 2001 +From: Jian-Hong Pan +Date: Tue, 24 Nov 2020 17:20:25 +0800 +Subject: ALSA: hda/realtek: Enable headset of ASUS UX482EG & B9400CEA with ALC294 + +From: Jian-Hong Pan + +commit eeacd80fcb29b769ea915cd06b7dd35e0bf0bc25 upstream. + +Some laptops like ASUS UX482EG & B9400CEA's headset audio does not work +until the quirk ALC294_FIXUP_ASUS_HPE is applied. + +Signed-off-by: Jian-Hong Pan +Cc: +Link: https://lore.kernel.org/r/20201124092024.179540-1-jhp@endlessos.org +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7778,6 +7778,9 @@ static const struct snd_hda_pin_quirk al + SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC292_STANDARD_PINS, + {0x13, 0x90a60140}), ++ SND_HDA_PIN_QUIRK(0x10ec0294, 0x1043, "ASUS", ALC294_FIXUP_ASUS_HPE, ++ {0x17, 0x90170110}, ++ {0x21, 0x04211020}), + SND_HDA_PIN_QUIRK(0x10ec0294, 0x1043, "ASUS", ALC294_FIXUP_ASUS_MIC, + {0x14, 0x90170110}, + {0x1b, 0x90a70130}, diff --git a/queue-4.19/series b/queue-4.19/series index abcd1ea02a8..8887ac6cb13 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -1,2 +1,15 @@ pinctrl-baytrail-replace-warn-with-dev_info_once-whe.patch pinctrl-baytrail-fix-pin-being-driven-low-for-a-whil.patch +usb-gadget-f_fs-use-local-copy-of-descriptors-for-userspace-copy.patch +usb-serial-kl5kusb105-fix-memleak-on-open.patch +usb-serial-ch341-add-new-product-id-for-ch341a.patch +usb-serial-ch341-sort-device-id-entries.patch +usb-serial-option-add-fibocom-nl668-variants.patch +usb-serial-option-add-support-for-thales-cinterion-exs82.patch +usb-serial-option-fix-quectel-bg96-matching.patch +tty-fix-pgrp-locking-in-tiocspgrp.patch +tty-fix-session-locking.patch +alsa-hda-realtek-add-mute-led-quirk-to-yet-another-hp-x360-model.patch +alsa-hda-realtek-enable-headset-of-asus-ux482eg-b9400cea-with-alc294.patch +alsa-hda-realtek-add-new-codec-supported-for-alc897.patch +alsa-hda-generic-add-option-to-enforce-preferred_dacs-pairs.patch diff --git a/queue-4.19/tty-fix-pgrp-locking-in-tiocspgrp.patch b/queue-4.19/tty-fix-pgrp-locking-in-tiocspgrp.patch new file mode 100644 index 00000000000..5dcdba8219f --- /dev/null +++ b/queue-4.19/tty-fix-pgrp-locking-in-tiocspgrp.patch @@ -0,0 +1,43 @@ +From 54ffccbf053b5b6ca4f6e45094b942fab92a25fc Mon Sep 17 00:00:00 2001 +From: Jann Horn +Date: Thu, 3 Dec 2020 02:25:04 +0100 +Subject: tty: Fix ->pgrp locking in tiocspgrp() + +From: Jann Horn + +commit 54ffccbf053b5b6ca4f6e45094b942fab92a25fc upstream. + +tiocspgrp() takes two tty_struct pointers: One to the tty that userspace +passed to ioctl() (`tty`) and one to the TTY being changed (`real_tty`). +These pointers are different when ioctl() is called with a master fd. + +To properly lock real_tty->pgrp, we must take real_tty->ctrl_lock. + +This bug makes it possible for racing ioctl(TIOCSPGRP, ...) calls on +both sides of a PTY pair to corrupt the refcount of `struct pid`, +leading to use-after-free errors. + +Fixes: 47f86834bbd4 ("redo locking of tty->pgrp") +CC: stable@kernel.org +Signed-off-by: Jann Horn +Reviewed-by: Jiri Slaby +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/tty_jobctrl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/tty/tty_jobctrl.c ++++ b/drivers/tty/tty_jobctrl.c +@@ -494,10 +494,10 @@ static int tiocspgrp(struct tty_struct * + if (session_of_pgrp(pgrp) != task_session(current)) + goto out_unlock; + retval = 0; +- spin_lock_irq(&tty->ctrl_lock); ++ spin_lock_irq(&real_tty->ctrl_lock); + put_pid(real_tty->pgrp); + real_tty->pgrp = get_pid(pgrp); +- spin_unlock_irq(&tty->ctrl_lock); ++ spin_unlock_irq(&real_tty->ctrl_lock); + out_unlock: + rcu_read_unlock(); + return retval; diff --git a/queue-4.19/tty-fix-session-locking.patch b/queue-4.19/tty-fix-session-locking.patch new file mode 100644 index 00000000000..7463a91aa01 --- /dev/null +++ b/queue-4.19/tty-fix-session-locking.patch @@ -0,0 +1,198 @@ +From c8bcd9c5be24fb9e6132e97da5a35e55a83e36b9 Mon Sep 17 00:00:00 2001 +From: Jann Horn +Date: Thu, 3 Dec 2020 02:25:05 +0100 +Subject: tty: Fix ->session locking + +From: Jann Horn + +commit c8bcd9c5be24fb9e6132e97da5a35e55a83e36b9 upstream. + +Currently, locking of ->session is very inconsistent; most places +protect it using the legacy tty mutex, but disassociate_ctty(), +__do_SAK(), tiocspgrp() and tiocgsid() don't. +Two of the writers hold the ctrl_lock (because they already need it for +->pgrp), but __proc_set_tty() doesn't do that yet. + +On a PREEMPT=y system, an unprivileged user can theoretically abuse +this broken locking to read 4 bytes of freed memory via TIOCGSID if +tiocgsid() is preempted long enough at the right point. (Other things +might also go wrong, especially if root-only ioctls are involved; I'm +not sure about that.) + +Change the locking on ->session such that: + + - tty_lock() is held by all writers: By making disassociate_ctty() + hold it. This should be fine because the same lock can already be + taken through the call to tty_vhangup_session(). + The tricky part is that we need to shorten the area covered by + siglock to be able to take tty_lock() without ugly retry logic; as + far as I can tell, this should be fine, since nothing in the + signal_struct is touched in the `if (tty)` branch. + - ctrl_lock is held by all writers: By changing __proc_set_tty() to + hold the lock a little longer. + - All readers that aren't holding tty_lock() hold ctrl_lock: By + adding locking to tiocgsid() and __do_SAK(), and expanding the area + covered by ctrl_lock in tiocspgrp(). + +Cc: stable@kernel.org +Signed-off-by: Jann Horn +Reviewed-by: Jiri Slaby +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/tty_io.c | 7 ++++++- + drivers/tty/tty_jobctrl.c | 44 +++++++++++++++++++++++++++++++------------- + include/linux/tty.h | 4 ++++ + 3 files changed, 41 insertions(+), 14 deletions(-) + +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -2747,10 +2747,14 @@ void __do_SAK(struct tty_struct *tty) + struct task_struct *g, *p; + struct pid *session; + int i; ++ unsigned long flags; + + if (!tty) + return; +- session = tty->session; ++ ++ spin_lock_irqsave(&tty->ctrl_lock, flags); ++ session = get_pid(tty->session); ++ spin_unlock_irqrestore(&tty->ctrl_lock, flags); + + tty_ldisc_flush(tty); + +@@ -2782,6 +2786,7 @@ void __do_SAK(struct tty_struct *tty) + task_unlock(p); + } while_each_thread(g, p); + read_unlock(&tasklist_lock); ++ put_pid(session); + #endif + } + +--- a/drivers/tty/tty_jobctrl.c ++++ b/drivers/tty/tty_jobctrl.c +@@ -103,8 +103,8 @@ static void __proc_set_tty(struct tty_st + put_pid(tty->session); + put_pid(tty->pgrp); + tty->pgrp = get_pid(task_pgrp(current)); +- spin_unlock_irqrestore(&tty->ctrl_lock, flags); + tty->session = get_pid(task_session(current)); ++ spin_unlock_irqrestore(&tty->ctrl_lock, flags); + if (current->signal->tty) { + tty_debug(tty, "current tty %s not NULL!!\n", + current->signal->tty->name); +@@ -293,20 +293,23 @@ void disassociate_ctty(int on_exit) + spin_lock_irq(¤t->sighand->siglock); + put_pid(current->signal->tty_old_pgrp); + current->signal->tty_old_pgrp = NULL; +- + tty = tty_kref_get(current->signal->tty); ++ spin_unlock_irq(¤t->sighand->siglock); ++ + if (tty) { + unsigned long flags; ++ ++ tty_lock(tty); + spin_lock_irqsave(&tty->ctrl_lock, flags); + put_pid(tty->session); + put_pid(tty->pgrp); + tty->session = NULL; + tty->pgrp = NULL; + spin_unlock_irqrestore(&tty->ctrl_lock, flags); ++ tty_unlock(tty); + tty_kref_put(tty); + } + +- spin_unlock_irq(¤t->sighand->siglock); + /* Now clear signal->tty under the lock */ + read_lock(&tasklist_lock); + session_clear_tty(task_session(current)); +@@ -477,14 +480,19 @@ static int tiocspgrp(struct tty_struct * + return -ENOTTY; + if (retval) + return retval; +- if (!current->signal->tty || +- (current->signal->tty != real_tty) || +- (real_tty->session != task_session(current))) +- return -ENOTTY; ++ + if (get_user(pgrp_nr, p)) + return -EFAULT; + if (pgrp_nr < 0) + return -EINVAL; ++ ++ spin_lock_irq(&real_tty->ctrl_lock); ++ if (!current->signal->tty || ++ (current->signal->tty != real_tty) || ++ (real_tty->session != task_session(current))) { ++ retval = -ENOTTY; ++ goto out_unlock_ctrl; ++ } + rcu_read_lock(); + pgrp = find_vpid(pgrp_nr); + retval = -ESRCH; +@@ -494,12 +502,12 @@ static int tiocspgrp(struct tty_struct * + if (session_of_pgrp(pgrp) != task_session(current)) + goto out_unlock; + retval = 0; +- spin_lock_irq(&real_tty->ctrl_lock); + put_pid(real_tty->pgrp); + real_tty->pgrp = get_pid(pgrp); +- spin_unlock_irq(&real_tty->ctrl_lock); + out_unlock: + rcu_read_unlock(); ++out_unlock_ctrl: ++ spin_unlock_irq(&real_tty->ctrl_lock); + return retval; + } + +@@ -511,20 +519,30 @@ out_unlock: + * + * Obtain the session id of the tty. If there is no session + * return an error. +- * +- * Locking: none. Reference to current->signal->tty is safe. + */ + static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p) + { ++ unsigned long flags; ++ pid_t sid; ++ + /* + * (tty == real_tty) is a cheap way of + * testing if the tty is NOT a master pty. + */ + if (tty == real_tty && current->signal->tty != real_tty) + return -ENOTTY; ++ ++ spin_lock_irqsave(&real_tty->ctrl_lock, flags); + if (!real_tty->session) +- return -ENOTTY; +- return put_user(pid_vnr(real_tty->session), p); ++ goto err; ++ sid = pid_vnr(real_tty->session); ++ spin_unlock_irqrestore(&real_tty->ctrl_lock, flags); ++ ++ return put_user(sid, p); ++ ++err: ++ spin_unlock_irqrestore(&real_tty->ctrl_lock, flags); ++ return -ENOTTY; + } + + /* +--- a/include/linux/tty.h ++++ b/include/linux/tty.h +@@ -306,6 +306,10 @@ struct tty_struct { + struct termiox *termiox; /* May be NULL for unsupported */ + char name[64]; + struct pid *pgrp; /* Protected by ctrl lock */ ++ /* ++ * Writes protected by both ctrl lock and legacy mutex, readers must use ++ * at least one of them. ++ */ + struct pid *session; + unsigned long flags; + int count; diff --git a/queue-4.19/usb-gadget-f_fs-use-local-copy-of-descriptors-for-userspace-copy.patch b/queue-4.19/usb-gadget-f_fs-use-local-copy-of-descriptors-for-userspace-copy.patch new file mode 100644 index 00000000000..6541d650965 --- /dev/null +++ b/queue-4.19/usb-gadget-f_fs-use-local-copy-of-descriptors-for-userspace-copy.patch @@ -0,0 +1,51 @@ +From a4b98a7512f18534ce33a7e98e49115af59ffa00 Mon Sep 17 00:00:00 2001 +From: Vamsi Krishna Samavedam +Date: Mon, 30 Nov 2020 12:34:53 -0800 +Subject: usb: gadget: f_fs: Use local copy of descriptors for userspace copy + +From: Vamsi Krishna Samavedam + +commit a4b98a7512f18534ce33a7e98e49115af59ffa00 upstream. + +The function may be unbound causing the ffs_ep and its descriptors +to be freed while userspace is in the middle of an ioctl requesting +the same descriptors. Avoid dangling pointer reference by first +making a local copy of desctiptors before releasing the spinlock. + +Fixes: c559a3534109 ("usb: gadget: f_fs: add ioctl returning ep descriptor") +Reviewed-by: Peter Chen +Signed-off-by: Vamsi Krishna Samavedam +Signed-off-by: Jack Pham +Cc: stable +Link: https://lore.kernel.org/r/20201130203453.28154-1-jackp@codeaurora.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_fs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1243,7 +1243,7 @@ static long ffs_epfile_ioctl(struct file + case FUNCTIONFS_ENDPOINT_DESC: + { + int desc_idx; +- struct usb_endpoint_descriptor *desc; ++ struct usb_endpoint_descriptor desc1, *desc; + + switch (epfile->ffs->gadget->speed) { + case USB_SPEED_SUPER: +@@ -1255,10 +1255,12 @@ static long ffs_epfile_ioctl(struct file + default: + desc_idx = 0; + } ++ + desc = epfile->ep->descs[desc_idx]; ++ memcpy(&desc1, desc, desc->bLength); + + spin_unlock_irq(&epfile->ffs->eps_lock); +- ret = copy_to_user((void __user *)value, desc, desc->bLength); ++ ret = copy_to_user((void __user *)value, &desc1, desc1.bLength); + if (ret) + ret = -EFAULT; + return ret; diff --git a/queue-4.19/usb-serial-ch341-add-new-product-id-for-ch341a.patch b/queue-4.19/usb-serial-ch341-add-new-product-id-for-ch341a.patch new file mode 100644 index 00000000000..71654c8f81f --- /dev/null +++ b/queue-4.19/usb-serial-ch341-add-new-product-id-for-ch341a.patch @@ -0,0 +1,35 @@ +From 46ee4abb10a07bd8f8ce910ee6b4ae6a947d7f63 Mon Sep 17 00:00:00 2001 +From: Jan-Niklas Burfeind +Date: Thu, 3 Dec 2020 04:03:59 +0100 +Subject: USB: serial: ch341: add new Product ID for CH341A + +From: Jan-Niklas Burfeind + +commit 46ee4abb10a07bd8f8ce910ee6b4ae6a947d7f63 upstream. + +Add PID for CH340 that's found on a ch341 based Programmer made by keeyees. +The specific device that contains the serial converter is described +here: http://www.keeyees.com/a/Products/ej/36.html + +The driver works flawlessly as soon as the new PID (0x5512) is added to +it. + +Signed-off-by: Jan-Niklas Burfeind +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ch341.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/ch341.c ++++ b/drivers/usb/serial/ch341.c +@@ -83,6 +83,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x4348, 0x5523) }, + { USB_DEVICE(0x1a86, 0x7522) }, + { USB_DEVICE(0x1a86, 0x7523) }, ++ { USB_DEVICE(0x1a86, 0x5512) }, + { USB_DEVICE(0x1a86, 0x5523) }, + { }, + }; diff --git a/queue-4.19/usb-serial-ch341-sort-device-id-entries.patch b/queue-4.19/usb-serial-ch341-sort-device-id-entries.patch new file mode 100644 index 00000000000..be4840822fb --- /dev/null +++ b/queue-4.19/usb-serial-ch341-sort-device-id-entries.patch @@ -0,0 +1,38 @@ +From bf193bfc12dbc3754fc8a6e0e1e3702f1af2f772 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 3 Dec 2020 10:11:59 +0100 +Subject: USB: serial: ch341: sort device-id entries + +From: Johan Hovold + +commit bf193bfc12dbc3754fc8a6e0e1e3702f1af2f772 upstream. + +Keep the device-id entries sorted to make it easier to add new ones in +the right spot. + +Reviewed-by: Greg Kroah-Hartman +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ch341.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/usb/serial/ch341.c ++++ b/drivers/usb/serial/ch341.c +@@ -80,11 +80,11 @@ + #define CH341_LCR_CS5 0x00 + + static const struct usb_device_id id_table[] = { +- { USB_DEVICE(0x4348, 0x5523) }, +- { USB_DEVICE(0x1a86, 0x7522) }, +- { USB_DEVICE(0x1a86, 0x7523) }, + { USB_DEVICE(0x1a86, 0x5512) }, + { USB_DEVICE(0x1a86, 0x5523) }, ++ { USB_DEVICE(0x1a86, 0x7522) }, ++ { USB_DEVICE(0x1a86, 0x7523) }, ++ { USB_DEVICE(0x4348, 0x5523) }, + { }, + }; + MODULE_DEVICE_TABLE(usb, id_table); diff --git a/queue-4.19/usb-serial-kl5kusb105-fix-memleak-on-open.patch b/queue-4.19/usb-serial-kl5kusb105-fix-memleak-on-open.patch new file mode 100644 index 00000000000..2d9360cc0ac --- /dev/null +++ b/queue-4.19/usb-serial-kl5kusb105-fix-memleak-on-open.patch @@ -0,0 +1,48 @@ +From 3f203f057edfcf6bd02c6b942799262bfcf31f73 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 4 Dec 2020 09:55:19 +0100 +Subject: USB: serial: kl5kusb105: fix memleak on open + +From: Johan Hovold + +commit 3f203f057edfcf6bd02c6b942799262bfcf31f73 upstream. + +Fix memory leak of control-message transfer buffer on successful open(). + +Fixes: 6774d5f53271 ("USB: serial: kl5kusb105: fix open error path") +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/kl5kusb105.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +--- a/drivers/usb/serial/kl5kusb105.c ++++ b/drivers/usb/serial/kl5kusb105.c +@@ -276,12 +276,12 @@ static int klsi_105_open(struct tty_str + priv->cfg.unknown2 = cfg->unknown2; + spin_unlock_irqrestore(&priv->lock, flags); + ++ kfree(cfg); ++ + /* READ_ON and urb submission */ + rc = usb_serial_generic_open(tty, port); +- if (rc) { +- retval = rc; +- goto err_free_cfg; +- } ++ if (rc) ++ return rc; + + rc = usb_control_msg(port->serial->dev, + usb_sndctrlpipe(port->serial->dev, 0), +@@ -324,8 +324,6 @@ err_disable_read: + KLSI_TIMEOUT); + err_generic_close: + usb_serial_generic_close(port); +-err_free_cfg: +- kfree(cfg); + + return retval; + } diff --git a/queue-4.19/usb-serial-option-add-fibocom-nl668-variants.patch b/queue-4.19/usb-serial-option-add-fibocom-nl668-variants.patch new file mode 100644 index 00000000000..676837aab8a --- /dev/null +++ b/queue-4.19/usb-serial-option-add-fibocom-nl668-variants.patch @@ -0,0 +1,57 @@ +From 5e4d659b10fde14403adb2e215df4a3168fe8465 Mon Sep 17 00:00:00 2001 +From: Vincent Palatin +Date: Fri, 20 Nov 2020 10:28:28 +0100 +Subject: USB: serial: option: add Fibocom NL668 variants + +From: Vincent Palatin + +commit 5e4d659b10fde14403adb2e215df4a3168fe8465 upstream. + +Update the USB serial option driver support for the Fibocom NL668 Cat.4 +LTE modules as there are actually several different variants. +Got clarifications from Fibocom, there are distinct products: +- VID:PID 1508:1001, NL668 for IOT (no MBIM interface) +- VID:PID 2cb7:01a0, NL668-AM and NL652-EU are laptop M.2 cards (with + MBIM interfaces for Windows/Linux/Chrome OS), respectively for Americas + and Europe. + +usb-devices output for the laptop M.2 cards: +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2cb7 ProdID=01a0 Rev=03.18 +S: Manufacturer=Fibocom Wireless Inc. +S: Product=Fibocom NL652-EU Modem +S: SerialNumber=0123456789ABCDEF +C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) + +Signed-off-by: Vincent Palatin +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2046,12 +2046,13 @@ static const struct usb_device_id option + .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, + { USB_DEVICE(0x0489, 0xe0b5), /* Foxconn T77W968 ESIM */ + .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, +- { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 */ ++ { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ + .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, + { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */ + .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ + .driver_info = RSVD(6) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ diff --git a/queue-4.19/usb-serial-option-add-support-for-thales-cinterion-exs82.patch b/queue-4.19/usb-serial-option-add-support-for-thales-cinterion-exs82.patch new file mode 100644 index 00000000000..f2f465a0bdc --- /dev/null +++ b/queue-4.19/usb-serial-option-add-support-for-thales-cinterion-exs82.patch @@ -0,0 +1,322 @@ +From 6d6556c04ebaeaf4e7fa8b791c97e2a7c41b38a3 Mon Sep 17 00:00:00 2001 +From: Giacinto Cifelli +Date: Wed, 25 Nov 2020 15:53:04 +0100 +Subject: USB: serial: option: add support for Thales Cinterion EXS82 + +From: Giacinto Cifelli + +commit 6d6556c04ebaeaf4e7fa8b791c97e2a7c41b38a3 upstream. + +There is a single option port in this modem, and it is used as debug port. + +lsusb -v for this device: + +Bus 001 Device 002: ID 1e2d:006c +Device Descriptor: + bLength 18 + bDescriptorType 1 + bcdUSB 2.00 + bDeviceClass 239 Miscellaneous Device + bDeviceSubClass 2 ? + bDeviceProtocol 1 Interface Association + bMaxPacketSize0 64 + idVendor 0x1e2d + idProduct 0x006c + bcdDevice 0.00 + iManufacturer 4 + iProduct 3 + iSerial 5 + bNumConfigurations 1 + Configuration Descriptor: + bLength 9 + bDescriptorType 2 + wTotalLength 243 + bNumInterfaces 7 + bConfigurationValue 1 + iConfiguration 2 + bmAttributes 0xe0 + Self Powered + Remote Wakeup + MaxPower 500mA + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 0 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 255 Vendor Specific Subclass + bInterfaceProtocol 255 Vendor Specific Protocol + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x81 EP 1 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x01 EP 1 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Interface Association: + bLength 8 + bDescriptorType 11 + bFirstInterface 1 + bInterfaceCount 2 + bFunctionClass 2 Communications + bFunctionSubClass 2 Abstract (modem) + bFunctionProtocol 1 AT-commands (v.25ter) + iFunction 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 1 + bAlternateSetting 0 + bNumEndpoints 1 + bInterfaceClass 2 Communications + bInterfaceSubClass 2 Abstract (modem) + bInterfaceProtocol 1 AT-commands (v.25ter) + iInterface 0 + CDC Header: + bcdCDC 1.10 + CDC ACM: + bmCapabilities 0x02 + line coding and serial state + CDC Call Management: + bmCapabilities 0x03 + call management + use DataInterface + bDataInterface 2 + CDC Union: + bMasterInterface 1 + bSlaveInterface 2 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x82 EP 2 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 5 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 2 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 Unused + bInterfaceProtocol 0 + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x83 EP 3 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x02 EP 2 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Interface Association: + bLength 8 + bDescriptorType 11 + bFirstInterface 3 + bInterfaceCount 2 + bFunctionClass 2 Communications + bFunctionSubClass 2 Abstract (modem) + bFunctionProtocol 1 AT-commands (v.25ter) + iFunction 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 3 + bAlternateSetting 0 + bNumEndpoints 1 + bInterfaceClass 2 Communications + bInterfaceSubClass 2 Abstract (modem) + bInterfaceProtocol 1 AT-commands (v.25ter) + iInterface 0 + CDC Header: + bcdCDC 1.10 + CDC ACM: + bmCapabilities 0x02 + line coding and serial state + CDC Call Management: + bmCapabilities 0x03 + call management + use DataInterface + bDataInterface 4 + CDC Union: + bMasterInterface 3 + bSlaveInterface 4 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x84 EP 4 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 5 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 4 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 Unused + bInterfaceProtocol 0 + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x85 EP 5 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x03 EP 3 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Interface Association: + bLength 8 + bDescriptorType 11 + bFirstInterface 5 + bInterfaceCount 2 + bFunctionClass 2 Communications + bFunctionSubClass 2 Abstract (modem) + bFunctionProtocol 1 AT-commands (v.25ter) + iFunction 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 5 + bAlternateSetting 0 + bNumEndpoints 1 + bInterfaceClass 2 Communications + bInterfaceSubClass 6 Ethernet Networking + bInterfaceProtocol 0 + iInterface 0 + CDC Header: + bcdCDC 1.10 + CDC Ethernet: + iMacAddress 1 (??) + bmEthernetStatistics 0x00000000 + wMaxSegmentSize 16384 + wNumberMCFilters 0x0001 + bNumberPowerFilters 0 + CDC Union: + bMasterInterface 5 + bSlaveInterface 6 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x86 EP 6 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 5 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 6 + bAlternateSetting 0 + bNumEndpoints 0 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 Unused + bInterfaceProtocol 0 + iInterface 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 6 + bAlternateSetting 1 + bNumEndpoints 2 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 Unused + bInterfaceProtocol 0 + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x87 EP 7 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x04 EP 4 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + +Signed-off-by: Giacinto Cifelli +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -419,6 +419,7 @@ static void option_instat_callback(struc + #define CINTERION_PRODUCT_PH8 0x0053 + #define CINTERION_PRODUCT_AHXX 0x0055 + #define CINTERION_PRODUCT_PLXX 0x0060 ++#define CINTERION_PRODUCT_EXS82 0x006c + #define CINTERION_PRODUCT_PH8_2RMNET 0x0082 + #define CINTERION_PRODUCT_PH8_AUDIO 0x0083 + #define CINTERION_PRODUCT_AHXX_2RMNET 0x0084 +@@ -1902,6 +1903,7 @@ static const struct usb_device_id option + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_AUDIO, 0xff) }, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_CLS8, 0xff), + .driver_info = RSVD(0) | RSVD(4) }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EXS82, 0xff) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) }, diff --git a/queue-4.19/usb-serial-option-fix-quectel-bg96-matching.patch b/queue-4.19/usb-serial-option-fix-quectel-bg96-matching.patch new file mode 100644 index 00000000000..b5c77f65745 --- /dev/null +++ b/queue-4.19/usb-serial-option-fix-quectel-bg96-matching.patch @@ -0,0 +1,270 @@ +From c98fff7332dbd6e028969f8c2bda3d7bc7a024d8 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= +Date: Tue, 1 Dec 2020 11:03:18 +0100 +Subject: USB: serial: option: fix Quectel BG96 matching +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bjørn Mork + +commit c98fff7332dbd6e028969f8c2bda3d7bc7a024d8 upstream. + +This is a partial revert of commit 2bb70f0a4b23 ("USB: serial: +option: support dynamic Quectel USB compositions") + +The Quectel BG96 is different from most other modern Quectel modems, +having serial functions with 3 endpoints using ff/ff/ff and ff/fe/ff +class/subclass/protocol. Including it in the change to accommodate +dynamic function mapping was incorrect. + +Revert to interface number matching for the BG96, assuming static +layout of the RMNET function on interface 4. This restores support +for the serial functions on interfaces 2 and 3. + +Full lsusb output for the BG96: + +Bus 002 Device 003: ID 2c7c:0296 +Device Descriptor: + bLength 18 + bDescriptorType 1 + bcdUSB 2.00 + bDeviceClass 0 (Defined at Interface level) + bDeviceSubClass 0 + bDeviceProtocol 0 + bMaxPacketSize0 64 + idVendor 0x2c7c + idProduct 0x0296 + bcdDevice 0.00 + iManufacturer 3 Qualcomm, Incorporated + iProduct 2 Qualcomm CDMA Technologies MSM + iSerial 4 d1098243 + bNumConfigurations 1 + Configuration Descriptor: + bLength 9 + bDescriptorType 2 + wTotalLength 145 + bNumInterfaces 5 + bConfigurationValue 1 + iConfiguration 1 Qualcomm Configuration + bmAttributes 0xe0 + Self Powered + Remote Wakeup + MaxPower 500mA + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 0 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 255 Vendor Specific Subclass + bInterfaceProtocol 255 Vendor Specific Protocol + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x81 EP 1 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x01 EP 1 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 1 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 255 Vendor Specific Subclass + bInterfaceProtocol 255 Vendor Specific Protocol + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x82 EP 2 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x02 EP 2 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 2 + bAlternateSetting 0 + bNumEndpoints 3 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 255 Vendor Specific Subclass + bInterfaceProtocol 255 Vendor Specific Protocol + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x83 EP 3 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 5 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x84 EP 4 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x03 EP 3 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 3 + bAlternateSetting 0 + bNumEndpoints 3 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 254 + bInterfaceProtocol 255 + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x85 EP 5 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 5 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x86 EP 6 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x04 EP 4 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 4 + bAlternateSetting 0 + bNumEndpoints 3 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 255 Vendor Specific Subclass + bInterfaceProtocol 255 Vendor Specific Protocol + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x87 EP 7 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 5 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x88 EP 8 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x05 EP 5 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 +Device Qualifier (for other device speed): + bLength 10 + bDescriptorType 6 + bcdUSB 2.00 + bDeviceClass 0 (Defined at Interface level) + bDeviceSubClass 0 + bDeviceProtocol 0 + bMaxPacketSize0 64 + bNumConfigurations 1 +Device Status: 0x0000 + (Bus Powered) + +Cc: Sebastian Sjoholm +Fixes: 2bb70f0a4b23 ("USB: serial: option: support dynamic Quectel USB compositions") +Signed-off-by: Bjørn Mork +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1106,9 +1106,8 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0xff, 0xff), + .driver_info = NUMEP2 }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95, 0xff, 0, 0) }, +- { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96, 0xff, 0xff, 0xff), +- .driver_info = NUMEP2 }, +- { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96, 0xff, 0, 0) }, ++ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96), ++ .driver_info = RSVD(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) },