From: Greg Kroah-Hartman Date: Mon, 20 Jul 2020 11:37:02 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.4.231~29 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b4f31a6366d84a0ec6cd65ee2e940d436ab1f624;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: alsa-hda-realtek-change-to-suitable-link-model-for-asus-platform.patch alsa-hda-realtek-enable-speaker-for-asus-ux533-and-ux534.patch alsa-line6-perform-sanity-check-for-each-urb-creation.patch alsa-line6-sync-the-pending-work-cancel-at-disconnection.patch alsa-usb-audio-fix-race-against-the-error-recovery-urb-submission.patch hid-magicmouse-do-not-set-up-autorepeat.patch hid-quirks-always-poll-obins-anne-pro-2-keyboard.patch hid-quirks-ignore-simply-automated-upb-pim.patch usb-c67x00-fix-use-after-free-in-c67x00_giveback_urb.patch usb-chipidea-core-add-wakeup-support-for-extcon.patch usb-dwc2-fix-shutdown-callback-in-platform.patch usb-gadget-function-fix-missing-spinlock-in-f_uac1_legacy.patch usb-serial-ch341-add-new-product-id-for-ch340.patch usb-serial-cypress_m8-enable-simply-automated-upb-pim.patch usb-serial-iuu_phoenix-fix-memory-corruption.patch usb-serial-option-add-gosuncn-gm500-series.patch usb-serial-option-add-quectel-eg95-lte-modem.patch virt-vbox-fix-guest-capabilities-mask-check.patch virt-vbox-fix-vbgl_ioctl_vmmdev_request_big-and-_log-req-numbers-to-match-upstream.patch --- diff --git a/queue-4.19/alsa-hda-realtek-change-to-suitable-link-model-for-asus-platform.patch b/queue-4.19/alsa-hda-realtek-change-to-suitable-link-model-for-asus-platform.patch new file mode 100644 index 00000000000..08dfa3ac9f6 --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-change-to-suitable-link-model-for-asus-platform.patch @@ -0,0 +1,42 @@ +From ef9ddb9dc4f8b1da3b975918cd1fd98ec055b918 Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Fri, 10 Jul 2020 15:31:11 +0800 +Subject: ALSA: hda/realtek - change to suitable link model for ASUS platform + +From: Kailang Yang + +commit ef9ddb9dc4f8b1da3b975918cd1fd98ec055b918 upstream. + +ASUS platform couldn't need to use Headset Mode model. +It changes to the suitable model. + +Signed-off-by: Kailang Yang +Cc: +Link: https://lore.kernel.org/r/d05bcff170784ec7bb35023407148161@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6701,7 +6701,7 @@ static const struct hda_fixup alc269_fix + { } + }, + .chained = true, +- .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC ++ .chain_id = ALC269_FIXUP_HEADSET_MIC + }, + [ALC294_FIXUP_ASUS_HEADSET_MIC] = { + .type = HDA_FIXUP_PINS, +@@ -6710,7 +6710,7 @@ static const struct hda_fixup alc269_fix + { } + }, + .chained = true, +- .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC ++ .chain_id = ALC269_FIXUP_HEADSET_MIC + }, + [ALC294_FIXUP_ASUS_SPK] = { + .type = HDA_FIXUP_VERBS, diff --git a/queue-4.19/alsa-hda-realtek-enable-speaker-for-asus-ux533-and-ux534.patch b/queue-4.19/alsa-hda-realtek-enable-speaker-for-asus-ux533-and-ux534.patch new file mode 100644 index 00000000000..08c1809765c --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-enable-speaker-for-asus-ux533-and-ux534.patch @@ -0,0 +1,35 @@ +From 473fbe13fd6f9082e413aea37e624ecbce5463cc Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Thu, 16 Jul 2020 14:42:33 +0800 +Subject: ALSA: hda/realtek - Enable Speaker for ASUS UX533 and UX534 + +From: Kailang Yang + +commit 473fbe13fd6f9082e413aea37e624ecbce5463cc upstream. + +ASUS UX533 and UX534 speaker still can't output. +End User feedback speaker didn't have output. +Add this COEF value will enable it. + +Fixes: 4e051106730d ("ALSA: hda/realtek: Enable audio jacks of ASUS UX533FD with ALC294") +Cc: +Signed-off-by: Kailang Yang +Link: https://lore.kernel.org/r/80334402a93b48e385f8f4841b59ae09@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6718,6 +6718,8 @@ static const struct hda_fixup alc269_fix + /* Set EAPD high */ + { 0x20, AC_VERB_SET_COEF_INDEX, 0x40 }, + { 0x20, AC_VERB_SET_PROC_COEF, 0x8800 }, ++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x0f }, ++ { 0x20, AC_VERB_SET_PROC_COEF, 0x7774 }, + { } + }, + .chained = true, diff --git a/queue-4.19/alsa-line6-perform-sanity-check-for-each-urb-creation.patch b/queue-4.19/alsa-line6-perform-sanity-check-for-each-urb-creation.patch new file mode 100644 index 00000000000..22c9cc442ed --- /dev/null +++ b/queue-4.19/alsa-line6-perform-sanity-check-for-each-urb-creation.patch @@ -0,0 +1,49 @@ +From 6e8a914ad619042c5f25a4feb663357c4170fd8d Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 10 Jul 2020 15:33:51 +0200 +Subject: ALSA: line6: Perform sanity check for each URB creation + +From: Takashi Iwai + +commit 6e8a914ad619042c5f25a4feb663357c4170fd8d upstream. + +LINE6 drivers create stream URBs with a fixed pipe without checking +its validity, and this may lead to a kernel WARNING at the submission +when a malformed USB descriptor is passed. + +For avoiding the kernel warning, perform the similar sanity checks for +each pipe type at creating a URB. + +Reported-by: syzbot+c190f6858a04ea7fbc52@syzkaller.appspotmail.com +Cc: +Link: https://lore.kernel.org/r/s5hv9iv4hq8.wl-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/line6/capture.c | 2 ++ + sound/usb/line6/playback.c | 2 ++ + 2 files changed, 4 insertions(+) + +--- a/sound/usb/line6/capture.c ++++ b/sound/usb/line6/capture.c +@@ -291,6 +291,8 @@ int line6_create_audio_in_urbs(struct sn + urb->interval = LINE6_ISO_INTERVAL; + urb->error_count = 0; + urb->complete = audio_in_callback; ++ if (usb_urb_ep_type_check(urb)) ++ return -EINVAL; + } + + return 0; +--- a/sound/usb/line6/playback.c ++++ b/sound/usb/line6/playback.c +@@ -436,6 +436,8 @@ int line6_create_audio_out_urbs(struct s + urb->interval = LINE6_ISO_INTERVAL; + urb->error_count = 0; + urb->complete = audio_out_callback; ++ if (usb_urb_ep_type_check(urb)) ++ return -EINVAL; + } + + return 0; diff --git a/queue-4.19/alsa-line6-sync-the-pending-work-cancel-at-disconnection.patch b/queue-4.19/alsa-line6-sync-the-pending-work-cancel-at-disconnection.patch new file mode 100644 index 00000000000..29eacb16dc2 --- /dev/null +++ b/queue-4.19/alsa-line6-sync-the-pending-work-cancel-at-disconnection.patch @@ -0,0 +1,36 @@ +From 68359a1ad8447c99732ebeab8c169bfed543667a Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 10 Jul 2020 15:59:59 +0200 +Subject: ALSA: line6: Sync the pending work cancel at disconnection + +From: Takashi Iwai + +commit 68359a1ad8447c99732ebeab8c169bfed543667a upstream. + +Recently syzkaller reported a UAF in LINE6 driver, and it's likely +because we call cancel_delayed_work() at the disconnect callback +instead of cancel_delayed_work_sync(). Let's use the correct one +instead. + +Reported-by: syzbot+145012a46658ac00fc9e@syzkaller.appspotmail.com +Suggested-by: Alan Stern +Cc: +Link: https://lore.kernel.org/r/s5hlfjr4gio.wl-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/line6/driver.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/usb/line6/driver.c ++++ b/sound/usb/line6/driver.c +@@ -835,7 +835,7 @@ void line6_disconnect(struct usb_interfa + if (WARN_ON(usbdev != line6->usbdev)) + return; + +- cancel_delayed_work(&line6->startup_work); ++ cancel_delayed_work_sync(&line6->startup_work); + + if (line6->urb_listen != NULL) + line6_stop_listen(line6); diff --git a/queue-4.19/alsa-usb-audio-fix-race-against-the-error-recovery-urb-submission.patch b/queue-4.19/alsa-usb-audio-fix-race-against-the-error-recovery-urb-submission.patch new file mode 100644 index 00000000000..0deafc6f754 --- /dev/null +++ b/queue-4.19/alsa-usb-audio-fix-race-against-the-error-recovery-urb-submission.patch @@ -0,0 +1,90 @@ +From 9b7e5208a941e2e491a83eb5fa83d889e888fa2f Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 10 Jul 2020 18:06:56 +0200 +Subject: ALSA: usb-audio: Fix race against the error recovery URB submission + +From: Takashi Iwai + +commit 9b7e5208a941e2e491a83eb5fa83d889e888fa2f upstream. + +USB MIDI driver has an error recovery mechanism to resubmit the URB in +the delayed timer handler, and this may race with the standard start / +stop operations. Although both start and stop operations themselves +don't race with each other due to the umidi->mutex protection, but +this isn't applied to the timer handler. + +For fixing this potential race, the following changes are applied: + +- Since the timer handler can't use the mutex, we apply the + umidi->disc_lock protection at each input stream URB submission; + this also needs to change the GFP flag to GFP_ATOMIC +- Add a check of the URB refcount and skip if already submitted +- Move the timer cancel call at disconnection to the beginning of the + procedure; this assures the in-flight timer handler is gone properly + before killing all pending URBs + +Reported-by: syzbot+0f4ecfe6a2c322c81728@syzkaller.appspotmail.com +Reported-by: syzbot+5f1d24c49c1d2c427497@syzkaller.appspotmail.com +Cc: +Link: https://lore.kernel.org/r/20200710160656.16819-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/midi.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/sound/usb/midi.c ++++ b/sound/usb/midi.c +@@ -1500,6 +1500,8 @@ void snd_usbmidi_disconnect(struct list_ + spin_unlock_irq(&umidi->disc_lock); + up_write(&umidi->disc_rwsem); + ++ del_timer_sync(&umidi->error_timer); ++ + for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) { + struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i]; + if (ep->out) +@@ -1526,7 +1528,6 @@ void snd_usbmidi_disconnect(struct list_ + ep->in = NULL; + } + } +- del_timer_sync(&umidi->error_timer); + } + EXPORT_SYMBOL(snd_usbmidi_disconnect); + +@@ -2283,16 +2284,22 @@ void snd_usbmidi_input_stop(struct list_ + } + EXPORT_SYMBOL(snd_usbmidi_input_stop); + +-static void snd_usbmidi_input_start_ep(struct snd_usb_midi_in_endpoint *ep) ++static void snd_usbmidi_input_start_ep(struct snd_usb_midi *umidi, ++ struct snd_usb_midi_in_endpoint *ep) + { + unsigned int i; ++ unsigned long flags; + + if (!ep) + return; + for (i = 0; i < INPUT_URBS; ++i) { + struct urb *urb = ep->urbs[i]; +- urb->dev = ep->umidi->dev; +- snd_usbmidi_submit_urb(urb, GFP_KERNEL); ++ spin_lock_irqsave(&umidi->disc_lock, flags); ++ if (!atomic_read(&urb->use_count)) { ++ urb->dev = ep->umidi->dev; ++ snd_usbmidi_submit_urb(urb, GFP_ATOMIC); ++ } ++ spin_unlock_irqrestore(&umidi->disc_lock, flags); + } + } + +@@ -2308,7 +2315,7 @@ void snd_usbmidi_input_start(struct list + if (umidi->input_running || !umidi->opened[1]) + return; + for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) +- snd_usbmidi_input_start_ep(umidi->endpoints[i].in); ++ snd_usbmidi_input_start_ep(umidi, umidi->endpoints[i].in); + umidi->input_running = 1; + } + EXPORT_SYMBOL(snd_usbmidi_input_start); diff --git a/queue-4.19/hid-magicmouse-do-not-set-up-autorepeat.patch b/queue-4.19/hid-magicmouse-do-not-set-up-autorepeat.patch new file mode 100644 index 00000000000..7fc6e7503ec --- /dev/null +++ b/queue-4.19/hid-magicmouse-do-not-set-up-autorepeat.patch @@ -0,0 +1,39 @@ +From 6363d2065cd399cf9d6dc9d08c437f8658831100 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Sun, 24 May 2020 16:51:34 -0700 +Subject: HID: magicmouse: do not set up autorepeat + +From: Dmitry Torokhov + +commit 6363d2065cd399cf9d6dc9d08c437f8658831100 upstream. + +Neither the trackpad, nor the mouse want input core to generate autorepeat +events for their buttons, so let's reset the bit (as hid-input sets it for +these devices based on the usage vendor code). + +Cc: stable@vger.kernel.org +Reported-by: Yariv +Tested-by: Yariv +Signed-off-by: Dmitry Torokhov +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-magicmouse.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/hid/hid-magicmouse.c ++++ b/drivers/hid/hid-magicmouse.c +@@ -452,6 +452,12 @@ static int magicmouse_setup_input(struct + __set_bit(MSC_RAW, input->mscbit); + } + ++ /* ++ * hid-input may mark device as using autorepeat, but neither ++ * the trackpad, nor the mouse actually want it. ++ */ ++ __clear_bit(EV_REP, input->evbit); ++ + return 0; + } + diff --git a/queue-4.19/hid-quirks-always-poll-obins-anne-pro-2-keyboard.patch b/queue-4.19/hid-quirks-always-poll-obins-anne-pro-2-keyboard.patch new file mode 100644 index 00000000000..52a89381b7a --- /dev/null +++ b/queue-4.19/hid-quirks-always-poll-obins-anne-pro-2-keyboard.patch @@ -0,0 +1,50 @@ +From ca28aff0e1dc7dce9e12a7fd9276b7118ce5e73a Mon Sep 17 00:00:00 2001 +From: Sebastian Parschauer +Date: Tue, 9 Jun 2020 12:00:53 +0200 +Subject: HID: quirks: Always poll Obins Anne Pro 2 keyboard + +From: Sebastian Parschauer + +commit ca28aff0e1dc7dce9e12a7fd9276b7118ce5e73a upstream. + +The Obins Anne Pro 2 keyboard (04d9:a293) disconnects after a few +minutes of inactivity when using it wired and typing does not result +in any input events any more. This is a common firmware flaw. So add +the ALWAYS_POLL quirk for this device. + +GitHub user Dietrich Moerman (dietrichm) tested the quirk and +requested my help in my project +https://github.com/sriemer/fix-linux-mouse issue 22 to provide +this patch. + +Link: https://www.reddit.com/r/AnnePro/comments/gruzcb/anne_pro_2_linux_cant_type_after_inactivity/ +Signed-off-by: Sebastian Parschauer +Cc: stable@vger.kernel.org # v4.16+ +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -609,6 +609,7 @@ + #define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081 0xa081 + #define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A0C2 0xa0c2 + #define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096 0xa096 ++#define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A293 0xa293 + + #define USB_VENDOR_ID_IMATION 0x0718 + #define USB_DEVICE_ID_DISC_STAKKA 0xd000 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -90,6 +90,7 @@ static const struct hid_device_id hid_qu + { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING), HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096), HID_QUIRK_NO_INIT_REPORTS }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A293), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL }, diff --git a/queue-4.19/hid-quirks-ignore-simply-automated-upb-pim.patch b/queue-4.19/hid-quirks-ignore-simply-automated-upb-pim.patch new file mode 100644 index 00000000000..0dc323fd148 --- /dev/null +++ b/queue-4.19/hid-quirks-ignore-simply-automated-upb-pim.patch @@ -0,0 +1,44 @@ +From 1ee1369b46de1083238fced60ff718f59de4b8aa Mon Sep 17 00:00:00 2001 +From: James Hilliard +Date: Tue, 23 Jun 2020 13:24:15 -0600 +Subject: HID: quirks: Ignore Simply Automated UPB PIM + +From: James Hilliard + +commit 1ee1369b46de1083238fced60ff718f59de4b8aa upstream. + +As this is a cypress HID->COM RS232 style device that is handled +by the cypress_M8 driver we also need to add it to the ignore list +in hid-quirks. + +Cc: stable +Signed-off-by: James Hilliard +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-ids.h | 2 ++ + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 3 insertions(+) + +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -973,6 +973,8 @@ + #define USB_DEVICE_ID_ROCCAT_RYOS_MK_PRO 0x3232 + #define USB_DEVICE_ID_ROCCAT_SAVU 0x2d5a + ++#define USB_VENDOR_ID_SAI 0x17dd ++ + #define USB_VENDOR_ID_SAITEK 0x06a3 + #define USB_DEVICE_ID_SAITEK_RUMBLEPAD 0xff17 + #define USB_DEVICE_ID_SAITEK_PS1000 0x0621 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -876,6 +876,7 @@ static const struct hid_device_id hid_ig + { HID_USB_DEVICE(USB_VENDOR_ID_PETZL, USB_DEVICE_ID_PETZL_HEADLAMP) }, + { HID_USB_DEVICE(USB_VENDOR_ID_PHILIPS, USB_DEVICE_ID_PHILIPS_IEEE802154_DONGLE) }, + { HID_USB_DEVICE(USB_VENDOR_ID_POWERCOM, USB_DEVICE_ID_POWERCOM_UPS) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_SAI, USB_DEVICE_ID_CYPRESS_HIDCOM) }, + #if IS_ENABLED(CONFIG_MOUSE_SYNAPTICS_USB) + { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_TP) }, + { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_INT_TP) }, diff --git a/queue-4.19/series b/queue-4.19/series index 50e327aeba1..6a211d49bf5 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -81,3 +81,22 @@ mtd-rawnand-oxnas-keep-track-of-registered-devices.patch mtd-rawnand-oxnas-unregister-all-devices-on-error.patch mtd-rawnand-oxnas-release-all-devices-in-the-_remove-path.patch slimbus-core-fix-mismatch-in-of_node_get-put.patch +hid-magicmouse-do-not-set-up-autorepeat.patch +hid-quirks-always-poll-obins-anne-pro-2-keyboard.patch +hid-quirks-ignore-simply-automated-upb-pim.patch +alsa-line6-perform-sanity-check-for-each-urb-creation.patch +alsa-line6-sync-the-pending-work-cancel-at-disconnection.patch +alsa-usb-audio-fix-race-against-the-error-recovery-urb-submission.patch +alsa-hda-realtek-change-to-suitable-link-model-for-asus-platform.patch +alsa-hda-realtek-enable-speaker-for-asus-ux533-and-ux534.patch +usb-c67x00-fix-use-after-free-in-c67x00_giveback_urb.patch +usb-dwc2-fix-shutdown-callback-in-platform.patch +usb-chipidea-core-add-wakeup-support-for-extcon.patch +usb-gadget-function-fix-missing-spinlock-in-f_uac1_legacy.patch +usb-serial-iuu_phoenix-fix-memory-corruption.patch +usb-serial-cypress_m8-enable-simply-automated-upb-pim.patch +usb-serial-ch341-add-new-product-id-for-ch340.patch +usb-serial-option-add-gosuncn-gm500-series.patch +usb-serial-option-add-quectel-eg95-lte-modem.patch +virt-vbox-fix-vbgl_ioctl_vmmdev_request_big-and-_log-req-numbers-to-match-upstream.patch +virt-vbox-fix-guest-capabilities-mask-check.patch diff --git a/queue-4.19/usb-c67x00-fix-use-after-free-in-c67x00_giveback_urb.patch b/queue-4.19/usb-c67x00-fix-use-after-free-in-c67x00_giveback_urb.patch new file mode 100644 index 00000000000..23c7744b0ed --- /dev/null +++ b/queue-4.19/usb-c67x00-fix-use-after-free-in-c67x00_giveback_urb.patch @@ -0,0 +1,55 @@ +From 211f08347355cba1f769bbf3355816a12b3ddd55 Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Wed, 8 Jul 2020 06:12:43 -0700 +Subject: USB: c67x00: fix use after free in c67x00_giveback_urb + +From: Tom Rix + +commit 211f08347355cba1f769bbf3355816a12b3ddd55 upstream. + +clang static analysis flags this error + +c67x00-sched.c:489:55: warning: Use of memory after it is freed [unix.Malloc] + usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status); + ^~~~~~~~~~~~ +Problem happens in this block of code + + c67x00_release_urb(c67x00, urb); + usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb); + spin_unlock(&c67x00->lock); + usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status); + +In the call to c67x00_release_urb has this freeing of urbp + + urbp = urb->hcpriv; + urb->hcpriv = NULL; + list_del(&urbp->hep_node); + kfree(urbp); + +And so urbp is freed before usb_hcd_giveback_urb uses it as its 3rd +parameter. + +Since all is required is the status, pass the status directly as is +done in c64x00_urb_dequeue + +Fixes: e9b29ffc519b ("USB: add Cypress c67x00 OTG controller HCD driver") +Signed-off-by: Tom Rix +Cc: stable +Link: https://lore.kernel.org/r/20200708131243.24336-1-trix@redhat.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/c67x00/c67x00-sched.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/c67x00/c67x00-sched.c ++++ b/drivers/usb/c67x00/c67x00-sched.c +@@ -486,7 +486,7 @@ c67x00_giveback_urb(struct c67x00_hcd *c + c67x00_release_urb(c67x00, urb); + usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb); + spin_unlock(&c67x00->lock); +- usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status); ++ usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, status); + spin_lock(&c67x00->lock); + } + diff --git a/queue-4.19/usb-chipidea-core-add-wakeup-support-for-extcon.patch b/queue-4.19/usb-chipidea-core-add-wakeup-support-for-extcon.patch new file mode 100644 index 00000000000..51a7367e1d0 --- /dev/null +++ b/queue-4.19/usb-chipidea-core-add-wakeup-support-for-extcon.patch @@ -0,0 +1,67 @@ +From 876d4e1e8298ad1f94d9e9392fc90486755437b4 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Tue, 7 Jul 2020 14:06:01 +0800 +Subject: usb: chipidea: core: add wakeup support for extcon + +From: Peter Chen + +commit 876d4e1e8298ad1f94d9e9392fc90486755437b4 upstream. + +If wakeup event occurred by extcon event, it needs to call +ci_irq again since the first ci_irq calling at extcon notifier +only wakes up controller, but do noop for event handling, +it causes the extcon use case can't work well from low power mode. + +Cc: +Fixes: 3ecb3e09b042 ("usb: chipidea: Use extcon framework for VBUS and ID detect") +Reported-by: Philippe Schenker +Tested-by: Philippe Schenker +Signed-off-by: Peter Chen +Link: https://lore.kernel.org/r/20200707060601.31907-2-peter.chen@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/chipidea/core.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +--- a/drivers/usb/chipidea/core.c ++++ b/drivers/usb/chipidea/core.c +@@ -1154,6 +1154,29 @@ static void ci_controller_suspend(struct + enable_irq(ci->irq); + } + ++/* ++ * Handle the wakeup interrupt triggered by extcon connector ++ * We need to call ci_irq again for extcon since the first ++ * interrupt (wakeup int) only let the controller be out of ++ * low power mode, but not handle any interrupts. ++ */ ++static void ci_extcon_wakeup_int(struct ci_hdrc *ci) ++{ ++ struct ci_hdrc_cable *cable_id, *cable_vbus; ++ u32 otgsc = hw_read_otgsc(ci, ~0); ++ ++ cable_id = &ci->platdata->id_extcon; ++ cable_vbus = &ci->platdata->vbus_extcon; ++ ++ if (!IS_ERR(cable_id->edev) && ci->is_otg && ++ (otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS)) ++ ci_irq(ci->irq, ci); ++ ++ if (!IS_ERR(cable_vbus->edev) && ci->is_otg && ++ (otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS)) ++ ci_irq(ci->irq, ci); ++} ++ + static int ci_controller_resume(struct device *dev) + { + struct ci_hdrc *ci = dev_get_drvdata(dev); +@@ -1186,6 +1209,7 @@ static int ci_controller_resume(struct d + enable_irq(ci->irq); + if (ci_otg_is_fsm_mode(ci)) + ci_otg_fsm_wakeup_by_srp(ci); ++ ci_extcon_wakeup_int(ci); + } + + return 0; diff --git a/queue-4.19/usb-dwc2-fix-shutdown-callback-in-platform.patch b/queue-4.19/usb-dwc2-fix-shutdown-callback-in-platform.patch new file mode 100644 index 00000000000..bb6966c59a5 --- /dev/null +++ b/queue-4.19/usb-dwc2-fix-shutdown-callback-in-platform.patch @@ -0,0 +1,40 @@ +From 4fdf228cdf6925af45a2066d403821e0977bfddb Mon Sep 17 00:00:00 2001 +From: Minas Harutyunyan +Date: Sat, 30 May 2020 11:41:50 +0400 +Subject: usb: dwc2: Fix shutdown callback in platform + +From: Minas Harutyunyan + +commit 4fdf228cdf6925af45a2066d403821e0977bfddb upstream. + +To avoid lot of interrupts from dwc2 core, which can be asserted in +specific conditions need to disable interrupts on HW level instead of +disable IRQs on Kernel level, because of IRQ can be shared between +drivers. + +Cc: stable@vger.kernel.org +Fixes: a40a00318c7fc ("usb: dwc2: add shutdown callback to platform variant") +Tested-by: Frank Mori Hess +Reviewed-by: Alan Stern +Reviewed-by: Doug Anderson +Reviewed-by: Frank Mori Hess +Signed-off-by: Minas Harutyunyan +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc2/platform.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc2/platform.c ++++ b/drivers/usb/dwc2/platform.c +@@ -349,7 +349,8 @@ static void dwc2_driver_shutdown(struct + { + struct dwc2_hsotg *hsotg = platform_get_drvdata(dev); + +- disable_irq(hsotg->irq); ++ dwc2_disable_global_interrupts(hsotg); ++ synchronize_irq(hsotg->irq); + } + + /** diff --git a/queue-4.19/usb-gadget-function-fix-missing-spinlock-in-f_uac1_legacy.patch b/queue-4.19/usb-gadget-function-fix-missing-spinlock-in-f_uac1_legacy.patch new file mode 100644 index 00000000000..f6ba01b350a --- /dev/null +++ b/queue-4.19/usb-gadget-function-fix-missing-spinlock-in-f_uac1_legacy.patch @@ -0,0 +1,36 @@ +From 8778eb0927ddcd3f431805c37b78fa56481aeed9 Mon Sep 17 00:00:00 2001 +From: Zhang Qiang +Date: Mon, 6 Jul 2020 13:14:55 +0800 +Subject: usb: gadget: function: fix missing spinlock in f_uac1_legacy + +From: Zhang Qiang + +commit 8778eb0927ddcd3f431805c37b78fa56481aeed9 upstream. + +Add a missing spinlock protection for play_queue, because +the play_queue may be destroyed when the "playback_work" +work func and "f_audio_out_ep_complete" callback func +operate this paly_queue at the same time. + +Fixes: c6994e6f067cf ("USB: gadget: add USB Audio Gadget driver") +Cc: stable +Signed-off-by: Zhang Qiang +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_uac1_legacy.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/gadget/function/f_uac1_legacy.c ++++ b/drivers/usb/gadget/function/f_uac1_legacy.c +@@ -336,7 +336,9 @@ static int f_audio_out_ep_complete(struc + + /* Copy buffer is full, add it to the play_queue */ + if (audio_buf_size - copy_buf->actual < req->actual) { ++ spin_lock_irq(&audio->lock); + list_add_tail(©_buf->list, &audio->play_queue); ++ spin_unlock_irq(&audio->lock); + schedule_work(&audio->playback_work); + copy_buf = f_audio_buffer_alloc(audio_buf_size); + if (IS_ERR(copy_buf)) diff --git a/queue-4.19/usb-serial-ch341-add-new-product-id-for-ch340.patch b/queue-4.19/usb-serial-ch341-add-new-product-id-for-ch340.patch new file mode 100644 index 00000000000..2cd234a6cb3 --- /dev/null +++ b/queue-4.19/usb-serial-ch341-add-new-product-id-for-ch340.patch @@ -0,0 +1,38 @@ +From 5d0136f8e79f8287e6a36780601f0ce797cf11c2 Mon Sep 17 00:00:00 2001 +From: Igor Moura +Date: Tue, 23 Jun 2020 05:11:11 -0300 +Subject: USB: serial: ch341: add new Product ID for CH340 + +From: Igor Moura + +commit 5d0136f8e79f8287e6a36780601f0ce797cf11c2 upstream. + +Add PID for CH340 that's found on some ESP8266 dev boards made by +LilyGO. The specific device that contains such serial converter can be +seen here: https://github.com/LilyGO/LILYGO-T-OI. + +Apparently, it's a regular CH340, but I've confirmed with others that +also bought this board that the PID found on this device (0x7522) +differs from other devices with the "same" converter (0x7523). +Simply adding its PID to the driver and rebuilding it made it work +as expected. + +Signed-off-by: Igor Moura +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ch341.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/ch341.c ++++ b/drivers/usb/serial/ch341.c +@@ -81,6 +81,7 @@ + + static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x4348, 0x5523) }, ++ { USB_DEVICE(0x1a86, 0x7522) }, + { USB_DEVICE(0x1a86, 0x7523) }, + { USB_DEVICE(0x1a86, 0x5523) }, + { }, diff --git a/queue-4.19/usb-serial-cypress_m8-enable-simply-automated-upb-pim.patch b/queue-4.19/usb-serial-cypress_m8-enable-simply-automated-upb-pim.patch new file mode 100644 index 00000000000..05c3abd4286 --- /dev/null +++ b/queue-4.19/usb-serial-cypress_m8-enable-simply-automated-upb-pim.patch @@ -0,0 +1,75 @@ +From 5c45d04c5081c1830d674f4d22d4400ea2083afe Mon Sep 17 00:00:00 2001 +From: James Hilliard +Date: Tue, 16 Jun 2020 16:04:03 -0600 +Subject: USB: serial: cypress_m8: enable Simply Automated UPB PIM + +From: James Hilliard + +commit 5c45d04c5081c1830d674f4d22d4400ea2083afe upstream. + +This is a UPB (Universal Powerline Bus) PIM (Powerline Interface Module) +which allows for controlling multiple UPB compatible devices from Linux +using the standard serial interface. + +Based on vendor application source code there are two different models +of USB based PIM devices in addition to a number of RS232 based PIM's. + +The vendor UPB application source contains the following USB ID's: + + #define USB_PCS_VENDOR_ID 0x04b4 + #define USB_PCS_PIM_PRODUCT_ID 0x5500 + + #define USB_SAI_VENDOR_ID 0x17dd + #define USB_SAI_PIM_PRODUCT_ID 0x5500 + +The first set of ID's correspond to the PIM variant sold by Powerline +Control Systems while the second corresponds to the Simply Automated +Incorporated PIM. As the product ID for both of these match the default +cypress HID->COM RS232 product ID it assumed that they both use an +internal variant of this HID->COM RS232 converter hardware. However +as the vendor ID for the Simply Automated variant is different we need +to also add it to the cypress_M8 driver so that it is properly +detected. + +Signed-off-by: James Hilliard +Link: https://lore.kernel.org/r/20200616220403.1807003-1-james.hilliard1@gmail.com +Cc: stable@vger.kernel.org +[ johan: amend VID define entry ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cypress_m8.c | 2 ++ + drivers/usb/serial/cypress_m8.h | 3 +++ + 2 files changed, 5 insertions(+) + +--- a/drivers/usb/serial/cypress_m8.c ++++ b/drivers/usb/serial/cypress_m8.c +@@ -59,6 +59,7 @@ static const struct usb_device_id id_tab + + static const struct usb_device_id id_table_cyphidcomrs232[] = { + { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) }, ++ { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) }, + { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) }, + { USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) }, + { } /* Terminating entry */ +@@ -73,6 +74,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB) }, + { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB_LT20) }, + { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) }, ++ { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) }, + { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) }, + { USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) }, + { USB_DEVICE(VENDOR_ID_DAZZLE, PRODUCT_ID_CA42) }, +--- a/drivers/usb/serial/cypress_m8.h ++++ b/drivers/usb/serial/cypress_m8.h +@@ -25,6 +25,9 @@ + #define VENDOR_ID_CYPRESS 0x04b4 + #define PRODUCT_ID_CYPHIDCOM 0x5500 + ++/* Simply Automated HID->COM UPB PIM (using Cypress PID 0x5500) */ ++#define VENDOR_ID_SAI 0x17dd ++ + /* FRWD Dongle - a GPS sports watch */ + #define VENDOR_ID_FRWD 0x6737 + #define PRODUCT_ID_CYPHIDCOM_FRWD 0x0001 diff --git a/queue-4.19/usb-serial-iuu_phoenix-fix-memory-corruption.patch b/queue-4.19/usb-serial-iuu_phoenix-fix-memory-corruption.patch new file mode 100644 index 00000000000..cbf17f9e734 --- /dev/null +++ b/queue-4.19/usb-serial-iuu_phoenix-fix-memory-corruption.patch @@ -0,0 +1,43 @@ +From e7b931bee739e8a77ae216e613d3b99342b6dec0 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 15 Jul 2020 11:02:45 +0200 +Subject: USB: serial: iuu_phoenix: fix memory corruption + +From: Johan Hovold + +commit e7b931bee739e8a77ae216e613d3b99342b6dec0 upstream. + +The driver would happily overwrite its write buffer with user data in +256 byte increments due to a removed buffer-space sanity check. + +Fixes: 5fcf62b0f1f2 ("tty: iuu_phoenix: fix locking.") +Cc: stable # 2.6.31 +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/iuu_phoenix.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/usb/serial/iuu_phoenix.c ++++ b/drivers/usb/serial/iuu_phoenix.c +@@ -697,14 +697,16 @@ static int iuu_uart_write(struct tty_str + struct iuu_private *priv = usb_get_serial_port_data(port); + unsigned long flags; + +- if (count > 256) +- return -ENOMEM; +- + spin_lock_irqsave(&priv->lock, flags); + ++ count = min(count, 256 - priv->writelen); ++ if (count == 0) ++ goto out; ++ + /* fill the buffer */ + memcpy(priv->writebuf + priv->writelen, buf, count); + priv->writelen += count; ++out: + spin_unlock_irqrestore(&priv->lock, flags); + + return count; diff --git a/queue-4.19/usb-serial-option-add-gosuncn-gm500-series.patch b/queue-4.19/usb-serial-option-add-gosuncn-gm500-series.patch new file mode 100644 index 00000000000..9693ef3727f --- /dev/null +++ b/queue-4.19/usb-serial-option-add-gosuncn-gm500-series.patch @@ -0,0 +1,80 @@ +From 08d4ef5cc9203a113702f24725f6cf4db476c958 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= +Date: Tue, 23 Jun 2020 00:13:59 +0200 +Subject: USB: serial: option: add GosunCn GM500 series +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jörgen Storvist + +commit 08d4ef5cc9203a113702f24725f6cf4db476c958 upstream. + +Add USB IDs for GosunCn GM500 series cellular modules. + +RNDIS config: +usb-devices +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 12 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=305a ProdID=1404 Rev=03.18 +S: Manufacturer=Android +S: Product=Android +S: SerialNumber= +C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host +I: If#=0x1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host +I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option + +MBIM config: +usb-devices +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=305a ProdID=1405 Rev=03.18 +S: Manufacturer=Android +S: Product=Android +S: SerialNumber= +C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#=0x4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim + +ECM config: +usb-devices +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=305a ProdID=1406 Rev=03.18 +S: Manufacturer=Android +S: Product=Android +S: SerialNumber= +C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether +I: If#=0x4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether + +Signed-off-by: Jörgen Storvist +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2028,6 +2028,9 @@ static const struct usb_device_id option + .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ + .driver_info = RSVD(6) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ ++ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ ++ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); diff --git a/queue-4.19/usb-serial-option-add-quectel-eg95-lte-modem.patch b/queue-4.19/usb-serial-option-add-quectel-eg95-lte-modem.patch new file mode 100644 index 00000000000..426f838ce33 --- /dev/null +++ b/queue-4.19/usb-serial-option-add-quectel-eg95-lte-modem.patch @@ -0,0 +1,51 @@ +From da6902e5b6dbca9081e3d377f9802d4fd0c5ea59 Mon Sep 17 00:00:00 2001 +From: AceLan Kao +Date: Tue, 7 Jul 2020 16:15:53 +0800 +Subject: USB: serial: option: add Quectel EG95 LTE modem + +From: AceLan Kao + +commit da6902e5b6dbca9081e3d377f9802d4fd0c5ea59 upstream. + +Add support for Quectel Wireless Solutions Co., Ltd. EG95 LTE modem + +T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 5 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0195 Rev=03.18 +S: Manufacturer=Android +S: Product=Android +C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) + +Signed-off-by: AceLan Kao +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -245,6 +245,7 @@ static void option_instat_callback(struc + /* These Quectel products use Quectel's vendor ID */ + #define QUECTEL_PRODUCT_EC21 0x0121 + #define QUECTEL_PRODUCT_EC25 0x0125 ++#define QUECTEL_PRODUCT_EG95 0x0195 + #define QUECTEL_PRODUCT_BG96 0x0296 + #define QUECTEL_PRODUCT_EP06 0x0306 + #define QUECTEL_PRODUCT_EM12 0x0512 +@@ -1097,6 +1098,8 @@ static const struct usb_device_id option + .driver_info = RSVD(4) }, + { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25), + .driver_info = RSVD(4) }, ++ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95), ++ .driver_info = RSVD(4) }, + { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96), + .driver_info = RSVD(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff), diff --git a/queue-4.19/virt-vbox-fix-guest-capabilities-mask-check.patch b/queue-4.19/virt-vbox-fix-guest-capabilities-mask-check.patch new file mode 100644 index 00000000000..253a6e2651f --- /dev/null +++ b/queue-4.19/virt-vbox-fix-guest-capabilities-mask-check.patch @@ -0,0 +1,47 @@ +From 59d1d2e8e1e7c50d2657d5e4812b53f71f507968 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 9 Jul 2020 14:08:52 +0200 +Subject: virt: vbox: Fix guest capabilities mask check + +From: Hans de Goede + +commit 59d1d2e8e1e7c50d2657d5e4812b53f71f507968 upstream. + +Check the passed in capabilities against VMMDEV_GUEST_CAPABILITIES_MASK +instead of against VMMDEV_EVENT_VALID_EVENT_MASK. +This tightens the allowed mask from 0x7ff to 0x7. + +Fixes: 0ba002bc4393 ("virt: Add vboxguest driver for Virtual Box Guest integration") +Cc: stable@vger.kernel.org +Acked-by: Arnd Bergmann +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20200709120858.63928-3-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/virt/vboxguest/vboxguest_core.c | 2 +- + drivers/virt/vboxguest/vmmdev.h | 2 ++ + 2 files changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/virt/vboxguest/vboxguest_core.c ++++ b/drivers/virt/vboxguest/vboxguest_core.c +@@ -1408,7 +1408,7 @@ static int vbg_ioctl_change_guest_capabi + or_mask = caps->u.in.or_mask; + not_mask = caps->u.in.not_mask; + +- if ((or_mask | not_mask) & ~VMMDEV_EVENT_VALID_EVENT_MASK) ++ if ((or_mask | not_mask) & ~VMMDEV_GUEST_CAPABILITIES_MASK) + return -EINVAL; + + ret = vbg_set_session_capabilities(gdev, session, or_mask, not_mask, +--- a/drivers/virt/vboxguest/vmmdev.h ++++ b/drivers/virt/vboxguest/vmmdev.h +@@ -206,6 +206,8 @@ VMMDEV_ASSERT_SIZE(vmmdev_mask, 24 + 8); + * not. + */ + #define VMMDEV_GUEST_SUPPORTS_GRAPHICS BIT(2) ++/* The mask of valid capabilities, for sanity checking. */ ++#define VMMDEV_GUEST_CAPABILITIES_MASK 0x00000007U + + /** struct vmmdev_hypervisorinfo - Hypervisor info structure. */ + struct vmmdev_hypervisorinfo { diff --git a/queue-4.19/virt-vbox-fix-vbgl_ioctl_vmmdev_request_big-and-_log-req-numbers-to-match-upstream.patch b/queue-4.19/virt-vbox-fix-vbgl_ioctl_vmmdev_request_big-and-_log-req-numbers-to-match-upstream.patch new file mode 100644 index 00000000000..e7417bb6f4e --- /dev/null +++ b/queue-4.19/virt-vbox-fix-vbgl_ioctl_vmmdev_request_big-and-_log-req-numbers-to-match-upstream.patch @@ -0,0 +1,119 @@ +From f794db6841e5480208f0c3a3ac1df445a96b079e Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 9 Jul 2020 14:08:51 +0200 +Subject: virt: vbox: Fix VBGL_IOCTL_VMMDEV_REQUEST_BIG and _LOG req numbers to match upstream + +From: Hans de Goede + +commit f794db6841e5480208f0c3a3ac1df445a96b079e upstream. + +Until this commit the mainline kernel version (this version) of the +vboxguest module contained a bug where it defined +VBGL_IOCTL_VMMDEV_REQUEST_BIG and VBGL_IOCTL_LOG using +_IOC(_IOC_READ | _IOC_WRITE, 'V', ...) instead of +_IO(V, ...) as the out of tree VirtualBox upstream version does. + +Since the VirtualBox userspace bits are always built against VirtualBox +upstream's headers, this means that so far the mainline kernel version +of the vboxguest module has been failing these 2 ioctls with -ENOTTY. +I guess that VBGL_IOCTL_VMMDEV_REQUEST_BIG is never used causing us to +not hit that one and sofar the vboxguest driver has failed to actually +log any log messages passed it through VBGL_IOCTL_LOG. + +This commit changes the VBGL_IOCTL_VMMDEV_REQUEST_BIG and VBGL_IOCTL_LOG +defines to match the out of tree VirtualBox upstream vboxguest version, +while keeping compatibility with the old wrong request defines so as +to not break the kernel ABI in case someone has been using the old +request defines. + +Fixes: f6ddd094f579 ("virt: Add vboxguest driver for Virtual Box Guest integration UAPI") +Cc: stable@vger.kernel.org +Acked-by: Arnd Bergmann +Reviewed-by: Arnd Bergmann +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20200709120858.63928-2-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/virt/vboxguest/vboxguest_core.c | 4 +++- + drivers/virt/vboxguest/vboxguest_core.h | 15 +++++++++++++++ + drivers/virt/vboxguest/vboxguest_linux.c | 3 ++- + include/uapi/linux/vboxguest.h | 4 ++-- + 4 files changed, 22 insertions(+), 4 deletions(-) + +--- a/drivers/virt/vboxguest/vboxguest_core.c ++++ b/drivers/virt/vboxguest/vboxguest_core.c +@@ -1482,7 +1482,8 @@ int vbg_core_ioctl(struct vbg_session *s + + /* For VMMDEV_REQUEST hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT */ + if (req_no_size == VBG_IOCTL_VMMDEV_REQUEST(0) || +- req == VBG_IOCTL_VMMDEV_REQUEST_BIG) ++ req == VBG_IOCTL_VMMDEV_REQUEST_BIG || ++ req == VBG_IOCTL_VMMDEV_REQUEST_BIG_ALT) + return vbg_ioctl_vmmrequest(gdev, session, data); + + if (hdr->type != VBG_IOCTL_HDR_TYPE_DEFAULT) +@@ -1520,6 +1521,7 @@ int vbg_core_ioctl(struct vbg_session *s + case VBG_IOCTL_HGCM_CALL(0): + return vbg_ioctl_hgcm_call(gdev, session, f32bit, data); + case VBG_IOCTL_LOG(0): ++ case VBG_IOCTL_LOG_ALT(0): + return vbg_ioctl_log(data); + } + +--- a/drivers/virt/vboxguest/vboxguest_core.h ++++ b/drivers/virt/vboxguest/vboxguest_core.h +@@ -15,6 +15,21 @@ + #include + #include "vmmdev.h" + ++/* ++ * The mainline kernel version (this version) of the vboxguest module ++ * contained a bug where it defined VBGL_IOCTL_VMMDEV_REQUEST_BIG and ++ * VBGL_IOCTL_LOG using _IOC(_IOC_READ | _IOC_WRITE, 'V', ...) instead ++ * of _IO(V, ...) as the out of tree VirtualBox upstream version does. ++ * ++ * These _ALT definitions keep compatibility with the wrong defines the ++ * mainline kernel version used for a while. ++ * Note the VirtualBox userspace bits have always been built against ++ * VirtualBox upstream's headers, so this is likely not necessary. But ++ * we must never break our ABI so we keep these around to be 100% sure. ++ */ ++#define VBG_IOCTL_VMMDEV_REQUEST_BIG_ALT _IOC(_IOC_READ | _IOC_WRITE, 'V', 3, 0) ++#define VBG_IOCTL_LOG_ALT(s) _IOC(_IOC_READ | _IOC_WRITE, 'V', 9, s) ++ + struct vbg_session; + + /** VBox guest memory balloon. */ +--- a/drivers/virt/vboxguest/vboxguest_linux.c ++++ b/drivers/virt/vboxguest/vboxguest_linux.c +@@ -112,7 +112,8 @@ static long vbg_misc_device_ioctl(struct + * the need for a bounce-buffer and another copy later on. + */ + is_vmmdev_req = (req & ~IOCSIZE_MASK) == VBG_IOCTL_VMMDEV_REQUEST(0) || +- req == VBG_IOCTL_VMMDEV_REQUEST_BIG; ++ req == VBG_IOCTL_VMMDEV_REQUEST_BIG || ++ req == VBG_IOCTL_VMMDEV_REQUEST_BIG_ALT; + + if (is_vmmdev_req) + buf = vbg_req_alloc(size, VBG_IOCTL_HDR_TYPE_DEFAULT); +--- a/include/uapi/linux/vboxguest.h ++++ b/include/uapi/linux/vboxguest.h +@@ -103,7 +103,7 @@ VMMDEV_ASSERT_SIZE(vbg_ioctl_driver_vers + + + /* IOCTL to perform a VMM Device request larger then 1KB. */ +-#define VBG_IOCTL_VMMDEV_REQUEST_BIG _IOC(_IOC_READ | _IOC_WRITE, 'V', 3, 0) ++#define VBG_IOCTL_VMMDEV_REQUEST_BIG _IO('V', 3) + + + /** VBG_IOCTL_HGCM_CONNECT data structure. */ +@@ -198,7 +198,7 @@ struct vbg_ioctl_log { + } u; + }; + +-#define VBG_IOCTL_LOG(s) _IOC(_IOC_READ | _IOC_WRITE, 'V', 9, s) ++#define VBG_IOCTL_LOG(s) _IO('V', 9) + + + /** VBG_IOCTL_WAIT_FOR_EVENTS data structure. */