From: Greg Kroah-Hartman Date: Sat, 30 Mar 2019 19:48:06 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v3.18.138~36 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=9c08fa7528b18adeaf23cb844bfc185004d6955e;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: serial-max310x-fix-to-avoid-potential-null-pointer-dereference.patch serial-sh-sci-fix-setting-scscr_tie-while-transferring-data.patch staging-comedi-ni_mio_common-fix-divide-by-zero-for-dio-cmdtest.patch staging-vt6655-fix-interrupt-race-condition-on-device-start-up.patch staging-vt6655-remove-vif-check-from-vnt_interrupt.patch tty-atmel_serial-fix-a-potential-null-pointer-dereference.patch usb-serial-cp210x-add-new-device-id.patch usb-serial-ftdi_sio-add-additional-novatech-products.patch usb-serial-mos7720-fix-mos_parport-refcount-imbalance-on-error-path.patch usb-serial-option-add-olicard-600.patch usb-serial-option-set-driver_info-for-sim5218-and-compatibles.patch --- diff --git a/queue-4.9/serial-max310x-fix-to-avoid-potential-null-pointer-dereference.patch b/queue-4.9/serial-max310x-fix-to-avoid-potential-null-pointer-dereference.patch new file mode 100644 index 00000000000..e6a4ee13062 --- /dev/null +++ b/queue-4.9/serial-max310x-fix-to-avoid-potential-null-pointer-dereference.patch @@ -0,0 +1,31 @@ +From 3a10e3dd52e80b9a97a3346020024d17b2c272d6 Mon Sep 17 00:00:00 2001 +From: Aditya Pakki +Date: Mon, 18 Mar 2019 18:44:14 -0500 +Subject: serial: max310x: Fix to avoid potential NULL pointer dereference + +From: Aditya Pakki + +commit 3a10e3dd52e80b9a97a3346020024d17b2c272d6 upstream. + +of_match_device can return a NULL pointer when matching device is not +found. This patch avoids a scenario causing NULL pointer derefernce. + +Signed-off-by: Aditya Pakki +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/max310x.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -1323,6 +1323,8 @@ static int max310x_spi_probe(struct spi_ + if (spi->dev.of_node) { + const struct of_device_id *of_id = + of_match_device(max310x_dt_ids, &spi->dev); ++ if (!of_id) ++ return -ENODEV; + + devtype = (struct max310x_devtype *)of_id->data; + } else { diff --git a/queue-4.9/serial-sh-sci-fix-setting-scscr_tie-while-transferring-data.patch b/queue-4.9/serial-sh-sci-fix-setting-scscr_tie-while-transferring-data.patch new file mode 100644 index 00000000000..5ffd619ddfb --- /dev/null +++ b/queue-4.9/serial-sh-sci-fix-setting-scscr_tie-while-transferring-data.patch @@ -0,0 +1,46 @@ +From 93bcefd4c6bad4c69dbc4edcd3fbf774b24d930d Mon Sep 17 00:00:00 2001 +From: Hoan Nguyen An +Date: Mon, 18 Mar 2019 18:26:32 +0900 +Subject: serial: sh-sci: Fix setting SCSCR_TIE while transferring data + +From: Hoan Nguyen An + +commit 93bcefd4c6bad4c69dbc4edcd3fbf774b24d930d upstream. + +We disable transmission interrupt (clear SCSCR_TIE) after all data has been transmitted +(if uart_circ_empty(xmit)). While transmitting, if the data is still in the tty buffer, +re-enable the SCSCR_TIE bit, which was done at sci_start_tx(). +This is unnecessary processing, wasting CPU operation if the data transmission length is large. +And further, transmit end, FIFO empty bits disabling have also been performed in the step above. + +Signed-off-by: Hoan Nguyen An +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/sh-sci.c | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -834,19 +834,9 @@ static void sci_transmit_chars(struct ua + + if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) + uart_write_wakeup(port); +- if (uart_circ_empty(xmit)) { ++ if (uart_circ_empty(xmit)) + sci_stop_tx(port); +- } else { +- ctrl = serial_port_in(port, SCSCR); + +- if (port->type != PORT_SCI) { +- serial_port_in(port, SCxSR); /* Dummy read */ +- sci_clear_SCxSR(port, SCxSR_TDxE_CLEAR(port)); +- } +- +- ctrl |= SCSCR_TIE; +- serial_port_out(port, SCSCR, ctrl); +- } + } + + /* On SH3, SCIF may read end-of-break as a space->mark char */ diff --git a/queue-4.9/series b/queue-4.9/series index cdd8323c15f..38477eac26b 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -29,3 +29,14 @@ scsi-sd-fix-a-race-between-closing-an-sd-device-and-sd-i-o.patch scsi-sd-quiesce-warning-if-device-does-not-report-optimal-i-o-size.patch scsi-zfcp-fix-rport-unblock-if-deleted-scsi-devices-on-scsi_host.patch scsi-zfcp-fix-scsi_eh-host-reset-with-port_forced-erp-for-non-npiv-fcp-devices.patch +tty-atmel_serial-fix-a-potential-null-pointer-dereference.patch +staging-comedi-ni_mio_common-fix-divide-by-zero-for-dio-cmdtest.patch +staging-vt6655-remove-vif-check-from-vnt_interrupt.patch +staging-vt6655-fix-interrupt-race-condition-on-device-start-up.patch +serial-max310x-fix-to-avoid-potential-null-pointer-dereference.patch +serial-sh-sci-fix-setting-scscr_tie-while-transferring-data.patch +usb-serial-cp210x-add-new-device-id.patch +usb-serial-ftdi_sio-add-additional-novatech-products.patch +usb-serial-mos7720-fix-mos_parport-refcount-imbalance-on-error-path.patch +usb-serial-option-set-driver_info-for-sim5218-and-compatibles.patch +usb-serial-option-add-olicard-600.patch diff --git a/queue-4.9/staging-comedi-ni_mio_common-fix-divide-by-zero-for-dio-cmdtest.patch b/queue-4.9/staging-comedi-ni_mio_common-fix-divide-by-zero-for-dio-cmdtest.patch new file mode 100644 index 00000000000..ebeb883233e --- /dev/null +++ b/queue-4.9/staging-comedi-ni_mio_common-fix-divide-by-zero-for-dio-cmdtest.patch @@ -0,0 +1,153 @@ +From bafd9c64056cd034a1174dcadb65cd3b294ff8f6 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Mon, 4 Mar 2019 14:33:54 +0000 +Subject: staging: comedi: ni_mio_common: Fix divide-by-zero for DIO cmdtest + +From: Ian Abbott + +commit bafd9c64056cd034a1174dcadb65cd3b294ff8f6 upstream. + +`ni_cdio_cmdtest()` validates Comedi asynchronous commands for the DIO +subdevice (subdevice 2) of supported National Instruments M-series +cards. It is called when handling the `COMEDI_CMD` and `COMEDI_CMDTEST` +ioctls for this subdevice. There are two causes for a possible +divide-by-zero error when validating that the `stop_arg` member of the +passed-in command is not too large. + +The first cause for the divide-by-zero is that calls to +`comedi_bytes_per_scan()` are only valid once the command has been +copied to `s->async->cmd`, but that copy is only done for the +`COMEDI_CMD` ioctl. For the `COMEDI_CMDTEST` ioctl, it will use +whatever was left there by the previous `COMEDI_CMD` ioctl, if any. +(This is very likely, as it is usual for the application to use +`COMEDI_CMDTEST` before `COMEDI_CMD`.) If there has been no previous, +valid `COMEDI_CMD` for this subdevice, then `comedi_bytes_per_scan()` +will return 0, so the subsequent division in `ni_cdio_cmdtest()` of +`s->async->prealloc_bufsz / comedi_bytes_per_scan(s)` will be a +divide-by-zero error. To fix this error, call a new function +`comedi_bytes_per_scan_cmd(s, cmd)`, based on the existing +`comedi_bytes_per_scan(s)` but using a specified `struct comedi_cmd` for +its calculations. (Also refactor `comedi_bytes_per_scan()` to call the +new function.) + +Once the first cause for the divide-by-zero has been fixed, the second +cause is that `comedi_bytes_per_scan_cmd()` can legitimately return 0 if +the `scan_end_arg` member of the `struct comedi_cmd` being tested is 0. +Fix it by only performing the division (and validating that `stop_arg` +is no more than the maximum value) if `comedi_bytes_per_scan_cmd()` +returns a non-zero value. + +The problem was reported on the COMEDI mailing list here: +https://groups.google.com/forum/#!topic/comedi_list/4t9WlHzMhKM + +Reported-by: Ivan Vasilyev +Tested-by: Ivan Vasilyev +Fixes: f164cbf98fa8 ("staging: comedi: ni_mio_common: add finite regeneration to dio output") +Cc: # 4.6+ +Cc: Spencer E. Olson +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/comedidev.h | 2 + + drivers/staging/comedi/drivers.c | 33 +++++++++++++++++++++---- + drivers/staging/comedi/drivers/ni_mio_common.c | 10 +++++-- + 3 files changed, 38 insertions(+), 7 deletions(-) + +--- a/drivers/staging/comedi/comedidev.h ++++ b/drivers/staging/comedi/comedidev.h +@@ -984,6 +984,8 @@ int comedi_dio_insn_config(struct comedi + unsigned int mask); + unsigned int comedi_dio_update_state(struct comedi_subdevice *, + unsigned int *data); ++unsigned int comedi_bytes_per_scan_cmd(struct comedi_subdevice *s, ++ struct comedi_cmd *cmd); + unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s); + unsigned int comedi_nscans_left(struct comedi_subdevice *s, + unsigned int nscans); +--- a/drivers/staging/comedi/drivers.c ++++ b/drivers/staging/comedi/drivers.c +@@ -390,11 +390,13 @@ unsigned int comedi_dio_update_state(str + EXPORT_SYMBOL_GPL(comedi_dio_update_state); + + /** +- * comedi_bytes_per_scan() - Get length of asynchronous command "scan" in bytes ++ * comedi_bytes_per_scan_cmd() - Get length of asynchronous command "scan" in ++ * bytes + * @s: COMEDI subdevice. ++ * @cmd: COMEDI command. + * + * Determines the overall scan length according to the subdevice type and the +- * number of channels in the scan. ++ * number of channels in the scan for the specified command. + * + * For digital input, output or input/output subdevices, samples for + * multiple channels are assumed to be packed into one or more unsigned +@@ -404,9 +406,9 @@ EXPORT_SYMBOL_GPL(comedi_dio_update_stat + * + * Returns the overall scan length in bytes. + */ +-unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s) ++unsigned int comedi_bytes_per_scan_cmd(struct comedi_subdevice *s, ++ struct comedi_cmd *cmd) + { +- struct comedi_cmd *cmd = &s->async->cmd; + unsigned int num_samples; + unsigned int bits_per_sample; + +@@ -423,6 +425,29 @@ unsigned int comedi_bytes_per_scan(struc + } + return comedi_samples_to_bytes(s, num_samples); + } ++EXPORT_SYMBOL_GPL(comedi_bytes_per_scan_cmd); ++ ++/** ++ * comedi_bytes_per_scan() - Get length of asynchronous command "scan" in bytes ++ * @s: COMEDI subdevice. ++ * ++ * Determines the overall scan length according to the subdevice type and the ++ * number of channels in the scan for the current command. ++ * ++ * For digital input, output or input/output subdevices, samples for ++ * multiple channels are assumed to be packed into one or more unsigned ++ * short or unsigned int values according to the subdevice's %SDF_LSAMPL ++ * flag. For other types of subdevice, samples are assumed to occupy a ++ * whole unsigned short or unsigned int according to the %SDF_LSAMPL flag. ++ * ++ * Returns the overall scan length in bytes. ++ */ ++unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s) ++{ ++ struct comedi_cmd *cmd = &s->async->cmd; ++ ++ return comedi_bytes_per_scan_cmd(s, cmd); ++} + EXPORT_SYMBOL_GPL(comedi_bytes_per_scan); + + static unsigned int __comedi_nscans_left(struct comedi_subdevice *s, +--- a/drivers/staging/comedi/drivers/ni_mio_common.c ++++ b/drivers/staging/comedi/drivers/ni_mio_common.c +@@ -3477,6 +3477,7 @@ static int ni_cdio_check_chanlist(struct + static int ni_cdio_cmdtest(struct comedi_device *dev, + struct comedi_subdevice *s, struct comedi_cmd *cmd) + { ++ unsigned int bytes_per_scan; + int err = 0; + int tmp; + +@@ -3506,9 +3507,12 @@ static int ni_cdio_cmdtest(struct comedi + err |= comedi_check_trigger_arg_is(&cmd->convert_arg, 0); + err |= comedi_check_trigger_arg_is(&cmd->scan_end_arg, + cmd->chanlist_len); +- err |= comedi_check_trigger_arg_max(&cmd->stop_arg, +- s->async->prealloc_bufsz / +- comedi_bytes_per_scan(s)); ++ bytes_per_scan = comedi_bytes_per_scan_cmd(s, cmd); ++ if (bytes_per_scan) { ++ err |= comedi_check_trigger_arg_max(&cmd->stop_arg, ++ s->async->prealloc_bufsz / ++ bytes_per_scan); ++ } + + if (err) + return 3; diff --git a/queue-4.9/staging-vt6655-fix-interrupt-race-condition-on-device-start-up.patch b/queue-4.9/staging-vt6655-fix-interrupt-race-condition-on-device-start-up.patch new file mode 100644 index 00000000000..c4dc19f9a91 --- /dev/null +++ b/queue-4.9/staging-vt6655-fix-interrupt-race-condition-on-device-start-up.patch @@ -0,0 +1,65 @@ +From 3b9c2f2e0e99bb67c96abcb659b3465efe3bee1f Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sun, 24 Mar 2019 18:53:49 +0000 +Subject: staging: vt6655: Fix interrupt race condition on device start up. + +From: Malcolm Priestley + +commit 3b9c2f2e0e99bb67c96abcb659b3465efe3bee1f upstream. + +It appears on some slower systems that the driver can find its way +out of the workqueue while the interrupt is disabled by continuous polling +by it. + +Move MACvIntEnable to vnt_interrupt_work so that it is always enabled +on all routes out of vnt_interrupt_process. + +Move MACvIntDisable so that the device doesn't keep polling the system +while the workqueue is being processed. + +Signed-off-by: Malcolm Priestley +CC: stable@vger.kernel.org # v4.2+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6655/device_main.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/staging/vt6655/device_main.c ++++ b/drivers/staging/vt6655/device_main.c +@@ -977,8 +977,6 @@ static void vnt_interrupt_process(struct + return; + } + +- MACvIntDisable(priv->PortOffset); +- + spin_lock_irqsave(&priv->lock, flags); + + /* Read low level stats */ +@@ -1067,8 +1065,6 @@ static void vnt_interrupt_process(struct + } + + spin_unlock_irqrestore(&priv->lock, flags); +- +- MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE); + } + + static void vnt_interrupt_work(struct work_struct *work) +@@ -1078,6 +1074,8 @@ static void vnt_interrupt_work(struct wo + + if (priv->vif) + vnt_interrupt_process(priv); ++ ++ MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE); + } + + static irqreturn_t vnt_interrupt(int irq, void *arg) +@@ -1086,6 +1084,8 @@ static irqreturn_t vnt_interrupt(int irq + + schedule_work(&priv->interrupt_work); + ++ MACvIntDisable(priv->PortOffset); ++ + return IRQ_HANDLED; + } + diff --git a/queue-4.9/staging-vt6655-remove-vif-check-from-vnt_interrupt.patch b/queue-4.9/staging-vt6655-remove-vif-check-from-vnt_interrupt.patch new file mode 100644 index 00000000000..19a83189fdc --- /dev/null +++ b/queue-4.9/staging-vt6655-remove-vif-check-from-vnt_interrupt.patch @@ -0,0 +1,34 @@ +From cc26358f89c3e493b54766b1ca56cfc6b14db78a Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Wed, 27 Mar 2019 18:45:26 +0000 +Subject: staging: vt6655: Remove vif check from vnt_interrupt + +From: Malcolm Priestley + +commit cc26358f89c3e493b54766b1ca56cfc6b14db78a upstream. + +A check for vif is made in vnt_interrupt_work. + +There is a small chance of leaving interrupt disabled while vif +is NULL and the work hasn't been scheduled. + +Signed-off-by: Malcolm Priestley +CC: stable@vger.kernel.org # v4.2+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6655/device_main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/staging/vt6655/device_main.c ++++ b/drivers/staging/vt6655/device_main.c +@@ -1084,8 +1084,7 @@ static irqreturn_t vnt_interrupt(int irq + { + struct vnt_private *priv = arg; + +- if (priv->vif) +- schedule_work(&priv->interrupt_work); ++ schedule_work(&priv->interrupt_work); + + return IRQ_HANDLED; + } diff --git a/queue-4.9/tty-atmel_serial-fix-a-potential-null-pointer-dereference.patch b/queue-4.9/tty-atmel_serial-fix-a-potential-null-pointer-dereference.patch new file mode 100644 index 00000000000..55bf19d2c10 --- /dev/null +++ b/queue-4.9/tty-atmel_serial-fix-a-potential-null-pointer-dereference.patch @@ -0,0 +1,35 @@ +From c85be041065c0be8bc48eda4c45e0319caf1d0e5 Mon Sep 17 00:00:00 2001 +From: Kangjie Lu +Date: Fri, 15 Mar 2019 12:16:06 -0500 +Subject: tty: atmel_serial: fix a potential NULL pointer dereference + +From: Kangjie Lu + +commit c85be041065c0be8bc48eda4c45e0319caf1d0e5 upstream. + +In case dmaengine_prep_dma_cyclic fails, the fix returns a proper +error code to avoid NULL pointer dereference. + +Signed-off-by: Kangjie Lu +Fixes: 34df42f59a60 ("serial: at91: add rx dma support") +Acked-by: Richard Genoud +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/atmel_serial.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -1166,6 +1166,10 @@ static int atmel_prepare_rx_dma(struct u + sg_dma_len(&atmel_port->sg_rx)/2, + DMA_DEV_TO_MEM, + DMA_PREP_INTERRUPT); ++ if (!desc) { ++ dev_err(port->dev, "Preparing DMA cyclic failed\n"); ++ goto chan_err; ++ } + desc->callback = atmel_complete_rx_dma; + desc->callback_param = port; + atmel_port->desc_rx = desc; diff --git a/queue-4.9/usb-serial-cp210x-add-new-device-id.patch b/queue-4.9/usb-serial-cp210x-add-new-device-id.patch new file mode 100644 index 00000000000..cfd8ce9e8fb --- /dev/null +++ b/queue-4.9/usb-serial-cp210x-add-new-device-id.patch @@ -0,0 +1,33 @@ +From a595ecdd5f60b2d93863cebb07eec7f935839b54 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Wed, 27 Mar 2019 10:11:14 +0900 +Subject: USB: serial: cp210x: add new device id + +From: Greg Kroah-Hartman + +commit a595ecdd5f60b2d93863cebb07eec7f935839b54 upstream. + +Lorenz Messtechnik has a device that is controlled by the cp210x driver, +so add the device id to the driver. The device id was provided by +Silicon-Labs for the devices from this vendor. + +Reported-by: Uli +Signed-off-by: Greg Kroah-Hartman +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -77,6 +77,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x10C4, 0x804E) }, /* Software Bisque Paramount ME build-in converter */ + { USB_DEVICE(0x10C4, 0x8053) }, /* Enfora EDG1228 */ + { USB_DEVICE(0x10C4, 0x8054) }, /* Enfora GSM2228 */ ++ { USB_DEVICE(0x10C4, 0x8056) }, /* Lorenz Messtechnik devices */ + { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */ + { USB_DEVICE(0x10C4, 0x806F) }, /* IMS USB to RS422 Converter Cable */ + { USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */ diff --git a/queue-4.9/usb-serial-ftdi_sio-add-additional-novatech-products.patch b/queue-4.9/usb-serial-ftdi_sio-add-additional-novatech-products.patch new file mode 100644 index 00000000000..9aaa59cf35e --- /dev/null +++ b/queue-4.9/usb-serial-ftdi_sio-add-additional-novatech-products.patch @@ -0,0 +1,46 @@ +From 422c2537ba9d42320f8ab6573940269f87095320 Mon Sep 17 00:00:00 2001 +From: George McCollister +Date: Tue, 5 Mar 2019 16:05:03 -0600 +Subject: USB: serial: ftdi_sio: add additional NovaTech products + +From: George McCollister + +commit 422c2537ba9d42320f8ab6573940269f87095320 upstream. + +Add PIDs for the NovaTech OrionLX+ and Orion I/O so they can be +automatically detected. + +Signed-off-by: George McCollister +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 2 ++ + drivers/usb/serial/ftdi_sio_ids.h | 4 +++- + 2 files changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -604,6 +604,8 @@ static const struct usb_device_id id_tab + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, ++ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) }, +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -566,7 +566,9 @@ + /* + * NovaTech product ids (FTDI_VID) + */ +-#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */ ++#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */ ++#define FTDI_NT_ORIONLX_PLUS_PID 0x7c91 /* OrionLX+ Substation Automation Platform */ ++#define FTDI_NT_ORION_IO_PID 0x7c92 /* Orion I/O */ + + /* + * Synapse Wireless product ids (FTDI_VID) diff --git a/queue-4.9/usb-serial-mos7720-fix-mos_parport-refcount-imbalance-on-error-path.patch b/queue-4.9/usb-serial-mos7720-fix-mos_parport-refcount-imbalance-on-error-path.patch new file mode 100644 index 00000000000..f20059305ca --- /dev/null +++ b/queue-4.9/usb-serial-mos7720-fix-mos_parport-refcount-imbalance-on-error-path.patch @@ -0,0 +1,47 @@ +From 2908b076f5198d231de62713cb2b633a3a4b95ac Mon Sep 17 00:00:00 2001 +From: Lin Yi +Date: Wed, 20 Mar 2019 19:04:56 +0800 +Subject: USB: serial: mos7720: fix mos_parport refcount imbalance on error path + +From: Lin Yi + +commit 2908b076f5198d231de62713cb2b633a3a4b95ac upstream. + +The write_parport_reg_nonblock() helper takes a reference to the struct +mos_parport, but failed to release it in a couple of error paths after +allocation failures, leading to a memory leak. + +Johan said that move the kref_get() and mos_parport assignment to the +end of urbtrack initialisation is a better way, so move it. and +mos_parport do not used until urbtrack initialisation. + +Signed-off-by: Lin Yi +Fixes: b69578df7e98 ("USB: usbserial: mos7720: add support for parallel port on moschip 7715") +Cc: stable # 2.6.35 +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/mos7720.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -368,8 +368,6 @@ static int write_parport_reg_nonblock(st + if (!urbtrack) + return -ENOMEM; + +- kref_get(&mos_parport->ref_count); +- urbtrack->mos_parport = mos_parport; + urbtrack->urb = usb_alloc_urb(0, GFP_ATOMIC); + if (!urbtrack->urb) { + kfree(urbtrack); +@@ -390,6 +388,8 @@ static int write_parport_reg_nonblock(st + usb_sndctrlpipe(usbdev, 0), + (unsigned char *)urbtrack->setup, + NULL, 0, async_complete, urbtrack); ++ kref_get(&mos_parport->ref_count); ++ urbtrack->mos_parport = mos_parport; + kref_init(&urbtrack->ref_count); + INIT_LIST_HEAD(&urbtrack->urblist_entry); + diff --git a/queue-4.9/usb-serial-option-add-olicard-600.patch b/queue-4.9/usb-serial-option-add-olicard-600.patch new file mode 100644 index 00000000000..6e252114a97 --- /dev/null +++ b/queue-4.9/usb-serial-option-add-olicard-600.patch @@ -0,0 +1,74 @@ +From 84f3b43f7378b98b7e3096d5499de75183d4347c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= +Date: Wed, 27 Mar 2019 15:25:32 +0100 +Subject: USB: serial: option: add Olicard 600 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bjørn Mork + +commit 84f3b43f7378b98b7e3096d5499de75183d4347c upstream. + +This is a Qualcomm based device with a QMI function on interface 4. +It is mode switched from 2020:2030 using a standard eject message. + +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2020 ProdID=2031 Rev= 2.32 +S: Manufacturer=Mobile Connect +S: Product=Mobile Connect +S: SerialNumber=0123456789ABCDEF +C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) +E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us + +Cc: stable@vger.kernel.org +Signed-off-by: Bjørn Mork +[ johan: use tabs to align comments in adjacent lines ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1942,10 +1942,12 @@ static const struct usb_device_id option + .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */ + .driver_info = RSVD(4) }, +- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ +- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ +- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ +- { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ ++ .driver_info = RSVD(4) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ + { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, + { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, + { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) }, diff --git a/queue-4.9/usb-serial-option-set-driver_info-for-sim5218-and-compatibles.patch b/queue-4.9/usb-serial-option-set-driver_info-for-sim5218-and-compatibles.patch new file mode 100644 index 00000000000..55d13c2087a --- /dev/null +++ b/queue-4.9/usb-serial-option-set-driver_info-for-sim5218-and-compatibles.patch @@ -0,0 +1,36 @@ +From f8df5c2c3e2df5ffaf9fb5503da93d477a8c7db4 Mon Sep 17 00:00:00 2001 +From: Mans Rullgard +Date: Tue, 26 Feb 2019 17:07:10 +0000 +Subject: USB: serial: option: set driver_info for SIM5218 and compatibles + +From: Mans Rullgard + +commit f8df5c2c3e2df5ffaf9fb5503da93d477a8c7db4 upstream. + +The SIMCom SIM5218 and compatible devices have 5 USB interfaces, only 4 +of which are serial ports. The fifth is a network interface supported +by the qmi-wwan driver. Furthermore, the serial ports do not support +modem control signals. Add driver_info flags to reflect this. + +Signed-off-by: Mans Rullgard +Fixes: ec0cd94d881c ("usb: option: add SIMCom SIM5218") +Cc: stable # 3.2 +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1066,7 +1066,8 @@ static const struct usb_device_id option + .driver_info = RSVD(3) }, + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */ +- { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */ ++ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000), /* SIMCom SIM5218 */ ++ .driver_info = NCTRL(0) | NCTRL(1) | NCTRL(2) | NCTRL(3) | RSVD(4) }, + /* Quectel products using Qualcomm vendor ID */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)}, + { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20),