From: Greg Kroah-Hartman Date: Mon, 20 Jul 2020 11:40:09 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.4.231~26 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cbefd7f72764322b9ac2b620189e08f8a8a51f0d;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: alsa-line6-perform-sanity-check-for-each-urb-creation.patch alsa-usb-audio-fix-race-against-the-error-recovery-urb-submission.patch hid-magicmouse-do-not-set-up-autorepeat.patch usb-c67x00-fix-use-after-free-in-c67x00_giveback_urb.patch usb-chipidea-core-add-wakeup-support-for-extcon.patch usb-dwc2-fix-shutdown-callback-in-platform.patch usb-gadget-function-fix-missing-spinlock-in-f_uac1_legacy.patch usb-serial-ch341-add-new-product-id-for-ch340.patch usb-serial-cypress_m8-enable-simply-automated-upb-pim.patch usb-serial-iuu_phoenix-fix-memory-corruption.patch usb-serial-option-add-gosuncn-gm500-series.patch usb-serial-option-add-quectel-eg95-lte-modem.patch --- diff --git a/queue-4.14/alsa-line6-perform-sanity-check-for-each-urb-creation.patch b/queue-4.14/alsa-line6-perform-sanity-check-for-each-urb-creation.patch new file mode 100644 index 00000000000..22c9cc442ed --- /dev/null +++ b/queue-4.14/alsa-line6-perform-sanity-check-for-each-urb-creation.patch @@ -0,0 +1,49 @@ +From 6e8a914ad619042c5f25a4feb663357c4170fd8d Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 10 Jul 2020 15:33:51 +0200 +Subject: ALSA: line6: Perform sanity check for each URB creation + +From: Takashi Iwai + +commit 6e8a914ad619042c5f25a4feb663357c4170fd8d upstream. + +LINE6 drivers create stream URBs with a fixed pipe without checking +its validity, and this may lead to a kernel WARNING at the submission +when a malformed USB descriptor is passed. + +For avoiding the kernel warning, perform the similar sanity checks for +each pipe type at creating a URB. + +Reported-by: syzbot+c190f6858a04ea7fbc52@syzkaller.appspotmail.com +Cc: +Link: https://lore.kernel.org/r/s5hv9iv4hq8.wl-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/line6/capture.c | 2 ++ + sound/usb/line6/playback.c | 2 ++ + 2 files changed, 4 insertions(+) + +--- a/sound/usb/line6/capture.c ++++ b/sound/usb/line6/capture.c +@@ -291,6 +291,8 @@ int line6_create_audio_in_urbs(struct sn + urb->interval = LINE6_ISO_INTERVAL; + urb->error_count = 0; + urb->complete = audio_in_callback; ++ if (usb_urb_ep_type_check(urb)) ++ return -EINVAL; + } + + return 0; +--- a/sound/usb/line6/playback.c ++++ b/sound/usb/line6/playback.c +@@ -436,6 +436,8 @@ int line6_create_audio_out_urbs(struct s + urb->interval = LINE6_ISO_INTERVAL; + urb->error_count = 0; + urb->complete = audio_out_callback; ++ if (usb_urb_ep_type_check(urb)) ++ return -EINVAL; + } + + return 0; diff --git a/queue-4.14/alsa-usb-audio-fix-race-against-the-error-recovery-urb-submission.patch b/queue-4.14/alsa-usb-audio-fix-race-against-the-error-recovery-urb-submission.patch new file mode 100644 index 00000000000..257aa84940f --- /dev/null +++ b/queue-4.14/alsa-usb-audio-fix-race-against-the-error-recovery-urb-submission.patch @@ -0,0 +1,90 @@ +From 9b7e5208a941e2e491a83eb5fa83d889e888fa2f Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 10 Jul 2020 18:06:56 +0200 +Subject: ALSA: usb-audio: Fix race against the error recovery URB submission + +From: Takashi Iwai + +commit 9b7e5208a941e2e491a83eb5fa83d889e888fa2f upstream. + +USB MIDI driver has an error recovery mechanism to resubmit the URB in +the delayed timer handler, and this may race with the standard start / +stop operations. Although both start and stop operations themselves +don't race with each other due to the umidi->mutex protection, but +this isn't applied to the timer handler. + +For fixing this potential race, the following changes are applied: + +- Since the timer handler can't use the mutex, we apply the + umidi->disc_lock protection at each input stream URB submission; + this also needs to change the GFP flag to GFP_ATOMIC +- Add a check of the URB refcount and skip if already submitted +- Move the timer cancel call at disconnection to the beginning of the + procedure; this assures the in-flight timer handler is gone properly + before killing all pending URBs + +Reported-by: syzbot+0f4ecfe6a2c322c81728@syzkaller.appspotmail.com +Reported-by: syzbot+5f1d24c49c1d2c427497@syzkaller.appspotmail.com +Cc: +Link: https://lore.kernel.org/r/20200710160656.16819-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/midi.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/sound/usb/midi.c ++++ b/sound/usb/midi.c +@@ -1477,6 +1477,8 @@ void snd_usbmidi_disconnect(struct list_ + spin_unlock_irq(&umidi->disc_lock); + up_write(&umidi->disc_rwsem); + ++ del_timer_sync(&umidi->error_timer); ++ + for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) { + struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i]; + if (ep->out) +@@ -1503,7 +1505,6 @@ void snd_usbmidi_disconnect(struct list_ + ep->in = NULL; + } + } +- del_timer_sync(&umidi->error_timer); + } + EXPORT_SYMBOL(snd_usbmidi_disconnect); + +@@ -2260,16 +2261,22 @@ void snd_usbmidi_input_stop(struct list_ + } + EXPORT_SYMBOL(snd_usbmidi_input_stop); + +-static void snd_usbmidi_input_start_ep(struct snd_usb_midi_in_endpoint *ep) ++static void snd_usbmidi_input_start_ep(struct snd_usb_midi *umidi, ++ struct snd_usb_midi_in_endpoint *ep) + { + unsigned int i; ++ unsigned long flags; + + if (!ep) + return; + for (i = 0; i < INPUT_URBS; ++i) { + struct urb *urb = ep->urbs[i]; +- urb->dev = ep->umidi->dev; +- snd_usbmidi_submit_urb(urb, GFP_KERNEL); ++ spin_lock_irqsave(&umidi->disc_lock, flags); ++ if (!atomic_read(&urb->use_count)) { ++ urb->dev = ep->umidi->dev; ++ snd_usbmidi_submit_urb(urb, GFP_ATOMIC); ++ } ++ spin_unlock_irqrestore(&umidi->disc_lock, flags); + } + } + +@@ -2285,7 +2292,7 @@ void snd_usbmidi_input_start(struct list + if (umidi->input_running || !umidi->opened[1]) + return; + for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) +- snd_usbmidi_input_start_ep(umidi->endpoints[i].in); ++ snd_usbmidi_input_start_ep(umidi, umidi->endpoints[i].in); + umidi->input_running = 1; + } + EXPORT_SYMBOL(snd_usbmidi_input_start); diff --git a/queue-4.14/hid-magicmouse-do-not-set-up-autorepeat.patch b/queue-4.14/hid-magicmouse-do-not-set-up-autorepeat.patch new file mode 100644 index 00000000000..e23060b70b0 --- /dev/null +++ b/queue-4.14/hid-magicmouse-do-not-set-up-autorepeat.patch @@ -0,0 +1,39 @@ +From 6363d2065cd399cf9d6dc9d08c437f8658831100 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Sun, 24 May 2020 16:51:34 -0700 +Subject: HID: magicmouse: do not set up autorepeat + +From: Dmitry Torokhov + +commit 6363d2065cd399cf9d6dc9d08c437f8658831100 upstream. + +Neither the trackpad, nor the mouse want input core to generate autorepeat +events for their buttons, so let's reset the bit (as hid-input sets it for +these devices based on the usage vendor code). + +Cc: stable@vger.kernel.org +Reported-by: Yariv +Tested-by: Yariv +Signed-off-by: Dmitry Torokhov +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-magicmouse.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/hid/hid-magicmouse.c ++++ b/drivers/hid/hid-magicmouse.c +@@ -451,6 +451,12 @@ static int magicmouse_setup_input(struct + __set_bit(MSC_RAW, input->mscbit); + } + ++ /* ++ * hid-input may mark device as using autorepeat, but neither ++ * the trackpad, nor the mouse actually want it. ++ */ ++ __clear_bit(EV_REP, input->evbit); ++ + return 0; + } + diff --git a/queue-4.14/series b/queue-4.14/series index 4c258fcc0dc..a1dd8184afd 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -92,3 +92,15 @@ mtd-rawnand-brcmnand-fix-cs0-layout.patch mtd-rawnand-oxnas-keep-track-of-registered-devices.patch mtd-rawnand-oxnas-unregister-all-devices-on-error.patch mtd-rawnand-oxnas-release-all-devices-in-the-_remove-path.patch +hid-magicmouse-do-not-set-up-autorepeat.patch +alsa-line6-perform-sanity-check-for-each-urb-creation.patch +alsa-usb-audio-fix-race-against-the-error-recovery-urb-submission.patch +usb-c67x00-fix-use-after-free-in-c67x00_giveback_urb.patch +usb-dwc2-fix-shutdown-callback-in-platform.patch +usb-chipidea-core-add-wakeup-support-for-extcon.patch +usb-gadget-function-fix-missing-spinlock-in-f_uac1_legacy.patch +usb-serial-iuu_phoenix-fix-memory-corruption.patch +usb-serial-cypress_m8-enable-simply-automated-upb-pim.patch +usb-serial-ch341-add-new-product-id-for-ch340.patch +usb-serial-option-add-gosuncn-gm500-series.patch +usb-serial-option-add-quectel-eg95-lte-modem.patch diff --git a/queue-4.14/usb-c67x00-fix-use-after-free-in-c67x00_giveback_urb.patch b/queue-4.14/usb-c67x00-fix-use-after-free-in-c67x00_giveback_urb.patch new file mode 100644 index 00000000000..518f3a1513f --- /dev/null +++ b/queue-4.14/usb-c67x00-fix-use-after-free-in-c67x00_giveback_urb.patch @@ -0,0 +1,55 @@ +From 211f08347355cba1f769bbf3355816a12b3ddd55 Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Wed, 8 Jul 2020 06:12:43 -0700 +Subject: USB: c67x00: fix use after free in c67x00_giveback_urb + +From: Tom Rix + +commit 211f08347355cba1f769bbf3355816a12b3ddd55 upstream. + +clang static analysis flags this error + +c67x00-sched.c:489:55: warning: Use of memory after it is freed [unix.Malloc] + usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status); + ^~~~~~~~~~~~ +Problem happens in this block of code + + c67x00_release_urb(c67x00, urb); + usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb); + spin_unlock(&c67x00->lock); + usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status); + +In the call to c67x00_release_urb has this freeing of urbp + + urbp = urb->hcpriv; + urb->hcpriv = NULL; + list_del(&urbp->hep_node); + kfree(urbp); + +And so urbp is freed before usb_hcd_giveback_urb uses it as its 3rd +parameter. + +Since all is required is the status, pass the status directly as is +done in c64x00_urb_dequeue + +Fixes: e9b29ffc519b ("USB: add Cypress c67x00 OTG controller HCD driver") +Signed-off-by: Tom Rix +Cc: stable +Link: https://lore.kernel.org/r/20200708131243.24336-1-trix@redhat.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/c67x00/c67x00-sched.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/c67x00/c67x00-sched.c ++++ b/drivers/usb/c67x00/c67x00-sched.c +@@ -500,7 +500,7 @@ c67x00_giveback_urb(struct c67x00_hcd *c + c67x00_release_urb(c67x00, urb); + usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb); + spin_unlock(&c67x00->lock); +- usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status); ++ usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, status); + spin_lock(&c67x00->lock); + } + diff --git a/queue-4.14/usb-chipidea-core-add-wakeup-support-for-extcon.patch b/queue-4.14/usb-chipidea-core-add-wakeup-support-for-extcon.patch new file mode 100644 index 00000000000..fd16a4cb662 --- /dev/null +++ b/queue-4.14/usb-chipidea-core-add-wakeup-support-for-extcon.patch @@ -0,0 +1,67 @@ +From 876d4e1e8298ad1f94d9e9392fc90486755437b4 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Tue, 7 Jul 2020 14:06:01 +0800 +Subject: usb: chipidea: core: add wakeup support for extcon + +From: Peter Chen + +commit 876d4e1e8298ad1f94d9e9392fc90486755437b4 upstream. + +If wakeup event occurred by extcon event, it needs to call +ci_irq again since the first ci_irq calling at extcon notifier +only wakes up controller, but do noop for event handling, +it causes the extcon use case can't work well from low power mode. + +Cc: +Fixes: 3ecb3e09b042 ("usb: chipidea: Use extcon framework for VBUS and ID detect") +Reported-by: Philippe Schenker +Tested-by: Philippe Schenker +Signed-off-by: Peter Chen +Link: https://lore.kernel.org/r/20200707060601.31907-2-peter.chen@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/chipidea/core.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +--- a/drivers/usb/chipidea/core.c ++++ b/drivers/usb/chipidea/core.c +@@ -1159,6 +1159,29 @@ static void ci_controller_suspend(struct + enable_irq(ci->irq); + } + ++/* ++ * Handle the wakeup interrupt triggered by extcon connector ++ * We need to call ci_irq again for extcon since the first ++ * interrupt (wakeup int) only let the controller be out of ++ * low power mode, but not handle any interrupts. ++ */ ++static void ci_extcon_wakeup_int(struct ci_hdrc *ci) ++{ ++ struct ci_hdrc_cable *cable_id, *cable_vbus; ++ u32 otgsc = hw_read_otgsc(ci, ~0); ++ ++ cable_id = &ci->platdata->id_extcon; ++ cable_vbus = &ci->platdata->vbus_extcon; ++ ++ if (!IS_ERR(cable_id->edev) && ci->is_otg && ++ (otgsc & OTGSC_IDIE) && (otgsc & OTGSC_IDIS)) ++ ci_irq(ci->irq, ci); ++ ++ if (!IS_ERR(cable_vbus->edev) && ci->is_otg && ++ (otgsc & OTGSC_BSVIE) && (otgsc & OTGSC_BSVIS)) ++ ci_irq(ci->irq, ci); ++} ++ + static int ci_controller_resume(struct device *dev) + { + struct ci_hdrc *ci = dev_get_drvdata(dev); +@@ -1191,6 +1214,7 @@ static int ci_controller_resume(struct d + enable_irq(ci->irq); + if (ci_otg_is_fsm_mode(ci)) + ci_otg_fsm_wakeup_by_srp(ci); ++ ci_extcon_wakeup_int(ci); + } + + return 0; diff --git a/queue-4.14/usb-dwc2-fix-shutdown-callback-in-platform.patch b/queue-4.14/usb-dwc2-fix-shutdown-callback-in-platform.patch new file mode 100644 index 00000000000..f5ee86e1cde --- /dev/null +++ b/queue-4.14/usb-dwc2-fix-shutdown-callback-in-platform.patch @@ -0,0 +1,40 @@ +From 4fdf228cdf6925af45a2066d403821e0977bfddb Mon Sep 17 00:00:00 2001 +From: Minas Harutyunyan +Date: Sat, 30 May 2020 11:41:50 +0400 +Subject: usb: dwc2: Fix shutdown callback in platform + +From: Minas Harutyunyan + +commit 4fdf228cdf6925af45a2066d403821e0977bfddb upstream. + +To avoid lot of interrupts from dwc2 core, which can be asserted in +specific conditions need to disable interrupts on HW level instead of +disable IRQs on Kernel level, because of IRQ can be shared between +drivers. + +Cc: stable@vger.kernel.org +Fixes: a40a00318c7fc ("usb: dwc2: add shutdown callback to platform variant") +Tested-by: Frank Mori Hess +Reviewed-by: Alan Stern +Reviewed-by: Doug Anderson +Reviewed-by: Frank Mori Hess +Signed-off-by: Minas Harutyunyan +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc2/platform.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc2/platform.c ++++ b/drivers/usb/dwc2/platform.c +@@ -338,7 +338,8 @@ static void dwc2_driver_shutdown(struct + { + struct dwc2_hsotg *hsotg = platform_get_drvdata(dev); + +- disable_irq(hsotg->irq); ++ dwc2_disable_global_interrupts(hsotg); ++ synchronize_irq(hsotg->irq); + } + + /** diff --git a/queue-4.14/usb-gadget-function-fix-missing-spinlock-in-f_uac1_legacy.patch b/queue-4.14/usb-gadget-function-fix-missing-spinlock-in-f_uac1_legacy.patch new file mode 100644 index 00000000000..b14a1289ae7 --- /dev/null +++ b/queue-4.14/usb-gadget-function-fix-missing-spinlock-in-f_uac1_legacy.patch @@ -0,0 +1,36 @@ +From 8778eb0927ddcd3f431805c37b78fa56481aeed9 Mon Sep 17 00:00:00 2001 +From: Zhang Qiang +Date: Mon, 6 Jul 2020 13:14:55 +0800 +Subject: usb: gadget: function: fix missing spinlock in f_uac1_legacy + +From: Zhang Qiang + +commit 8778eb0927ddcd3f431805c37b78fa56481aeed9 upstream. + +Add a missing spinlock protection for play_queue, because +the play_queue may be destroyed when the "playback_work" +work func and "f_audio_out_ep_complete" callback func +operate this paly_queue at the same time. + +Fixes: c6994e6f067cf ("USB: gadget: add USB Audio Gadget driver") +Cc: stable +Signed-off-by: Zhang Qiang +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_uac1_legacy.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/gadget/function/f_uac1_legacy.c ++++ b/drivers/usb/gadget/function/f_uac1_legacy.c +@@ -339,7 +339,9 @@ static int f_audio_out_ep_complete(struc + + /* Copy buffer is full, add it to the play_queue */ + if (audio_buf_size - copy_buf->actual < req->actual) { ++ spin_lock_irq(&audio->lock); + list_add_tail(©_buf->list, &audio->play_queue); ++ spin_unlock_irq(&audio->lock); + schedule_work(&audio->playback_work); + copy_buf = f_audio_buffer_alloc(audio_buf_size); + if (IS_ERR(copy_buf)) diff --git a/queue-4.14/usb-serial-ch341-add-new-product-id-for-ch340.patch b/queue-4.14/usb-serial-ch341-add-new-product-id-for-ch340.patch new file mode 100644 index 00000000000..b186bc68fff --- /dev/null +++ b/queue-4.14/usb-serial-ch341-add-new-product-id-for-ch340.patch @@ -0,0 +1,38 @@ +From 5d0136f8e79f8287e6a36780601f0ce797cf11c2 Mon Sep 17 00:00:00 2001 +From: Igor Moura +Date: Tue, 23 Jun 2020 05:11:11 -0300 +Subject: USB: serial: ch341: add new Product ID for CH340 + +From: Igor Moura + +commit 5d0136f8e79f8287e6a36780601f0ce797cf11c2 upstream. + +Add PID for CH340 that's found on some ESP8266 dev boards made by +LilyGO. The specific device that contains such serial converter can be +seen here: https://github.com/LilyGO/LILYGO-T-OI. + +Apparently, it's a regular CH340, but I've confirmed with others that +also bought this board that the PID found on this device (0x7522) +differs from other devices with the "same" converter (0x7523). +Simply adding its PID to the driver and rebuilding it made it work +as expected. + +Signed-off-by: Igor Moura +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ch341.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/ch341.c ++++ b/drivers/usb/serial/ch341.c +@@ -84,6 +84,7 @@ + + static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x4348, 0x5523) }, ++ { USB_DEVICE(0x1a86, 0x7522) }, + { USB_DEVICE(0x1a86, 0x7523) }, + { USB_DEVICE(0x1a86, 0x5523) }, + { }, diff --git a/queue-4.14/usb-serial-cypress_m8-enable-simply-automated-upb-pim.patch b/queue-4.14/usb-serial-cypress_m8-enable-simply-automated-upb-pim.patch new file mode 100644 index 00000000000..d073bce4543 --- /dev/null +++ b/queue-4.14/usb-serial-cypress_m8-enable-simply-automated-upb-pim.patch @@ -0,0 +1,75 @@ +From 5c45d04c5081c1830d674f4d22d4400ea2083afe Mon Sep 17 00:00:00 2001 +From: James Hilliard +Date: Tue, 16 Jun 2020 16:04:03 -0600 +Subject: USB: serial: cypress_m8: enable Simply Automated UPB PIM + +From: James Hilliard + +commit 5c45d04c5081c1830d674f4d22d4400ea2083afe upstream. + +This is a UPB (Universal Powerline Bus) PIM (Powerline Interface Module) +which allows for controlling multiple UPB compatible devices from Linux +using the standard serial interface. + +Based on vendor application source code there are two different models +of USB based PIM devices in addition to a number of RS232 based PIM's. + +The vendor UPB application source contains the following USB ID's: + + #define USB_PCS_VENDOR_ID 0x04b4 + #define USB_PCS_PIM_PRODUCT_ID 0x5500 + + #define USB_SAI_VENDOR_ID 0x17dd + #define USB_SAI_PIM_PRODUCT_ID 0x5500 + +The first set of ID's correspond to the PIM variant sold by Powerline +Control Systems while the second corresponds to the Simply Automated +Incorporated PIM. As the product ID for both of these match the default +cypress HID->COM RS232 product ID it assumed that they both use an +internal variant of this HID->COM RS232 converter hardware. However +as the vendor ID for the Simply Automated variant is different we need +to also add it to the cypress_M8 driver so that it is properly +detected. + +Signed-off-by: James Hilliard +Link: https://lore.kernel.org/r/20200616220403.1807003-1-james.hilliard1@gmail.com +Cc: stable@vger.kernel.org +[ johan: amend VID define entry ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cypress_m8.c | 2 ++ + drivers/usb/serial/cypress_m8.h | 3 +++ + 2 files changed, 5 insertions(+) + +--- a/drivers/usb/serial/cypress_m8.c ++++ b/drivers/usb/serial/cypress_m8.c +@@ -63,6 +63,7 @@ static const struct usb_device_id id_tab + + static const struct usb_device_id id_table_cyphidcomrs232[] = { + { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) }, ++ { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) }, + { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) }, + { USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) }, + { } /* Terminating entry */ +@@ -77,6 +78,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB) }, + { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB_LT20) }, + { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) }, ++ { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) }, + { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) }, + { USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) }, + { USB_DEVICE(VENDOR_ID_DAZZLE, PRODUCT_ID_CA42) }, +--- a/drivers/usb/serial/cypress_m8.h ++++ b/drivers/usb/serial/cypress_m8.h +@@ -25,6 +25,9 @@ + #define VENDOR_ID_CYPRESS 0x04b4 + #define PRODUCT_ID_CYPHIDCOM 0x5500 + ++/* Simply Automated HID->COM UPB PIM (using Cypress PID 0x5500) */ ++#define VENDOR_ID_SAI 0x17dd ++ + /* FRWD Dongle - a GPS sports watch */ + #define VENDOR_ID_FRWD 0x6737 + #define PRODUCT_ID_CYPHIDCOM_FRWD 0x0001 diff --git a/queue-4.14/usb-serial-iuu_phoenix-fix-memory-corruption.patch b/queue-4.14/usb-serial-iuu_phoenix-fix-memory-corruption.patch new file mode 100644 index 00000000000..4415f99338b --- /dev/null +++ b/queue-4.14/usb-serial-iuu_phoenix-fix-memory-corruption.patch @@ -0,0 +1,43 @@ +From e7b931bee739e8a77ae216e613d3b99342b6dec0 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 15 Jul 2020 11:02:45 +0200 +Subject: USB: serial: iuu_phoenix: fix memory corruption + +From: Johan Hovold + +commit e7b931bee739e8a77ae216e613d3b99342b6dec0 upstream. + +The driver would happily overwrite its write buffer with user data in +256 byte increments due to a removed buffer-space sanity check. + +Fixes: 5fcf62b0f1f2 ("tty: iuu_phoenix: fix locking.") +Cc: stable # 2.6.31 +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/iuu_phoenix.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/usb/serial/iuu_phoenix.c ++++ b/drivers/usb/serial/iuu_phoenix.c +@@ -704,14 +704,16 @@ static int iuu_uart_write(struct tty_str + struct iuu_private *priv = usb_get_serial_port_data(port); + unsigned long flags; + +- if (count > 256) +- return -ENOMEM; +- + spin_lock_irqsave(&priv->lock, flags); + ++ count = min(count, 256 - priv->writelen); ++ if (count == 0) ++ goto out; ++ + /* fill the buffer */ + memcpy(priv->writebuf + priv->writelen, buf, count); + priv->writelen += count; ++out: + spin_unlock_irqrestore(&priv->lock, flags); + + return count; diff --git a/queue-4.14/usb-serial-option-add-gosuncn-gm500-series.patch b/queue-4.14/usb-serial-option-add-gosuncn-gm500-series.patch new file mode 100644 index 00000000000..8a7435a6b1e --- /dev/null +++ b/queue-4.14/usb-serial-option-add-gosuncn-gm500-series.patch @@ -0,0 +1,80 @@ +From 08d4ef5cc9203a113702f24725f6cf4db476c958 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= +Date: Tue, 23 Jun 2020 00:13:59 +0200 +Subject: USB: serial: option: add GosunCn GM500 series +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jörgen Storvist + +commit 08d4ef5cc9203a113702f24725f6cf4db476c958 upstream. + +Add USB IDs for GosunCn GM500 series cellular modules. + +RNDIS config: +usb-devices +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 12 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=305a ProdID=1404 Rev=03.18 +S: Manufacturer=Android +S: Product=Android +S: SerialNumber= +C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host +I: If#=0x1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host +I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option + +MBIM config: +usb-devices +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=305a ProdID=1405 Rev=03.18 +S: Manufacturer=Android +S: Product=Android +S: SerialNumber= +C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#=0x4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim + +ECM config: +usb-devices +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=305a ProdID=1406 Rev=03.18 +S: Manufacturer=Android +S: Product=Android +S: SerialNumber= +C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I: If#=0x3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether +I: If#=0x4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether + +Signed-off-by: Jörgen Storvist +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2030,6 +2030,9 @@ static const struct usb_device_id option + .driver_info = RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ + .driver_info = RSVD(6) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ ++ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ ++ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); diff --git a/queue-4.14/usb-serial-option-add-quectel-eg95-lte-modem.patch b/queue-4.14/usb-serial-option-add-quectel-eg95-lte-modem.patch new file mode 100644 index 00000000000..4c21323c5b6 --- /dev/null +++ b/queue-4.14/usb-serial-option-add-quectel-eg95-lte-modem.patch @@ -0,0 +1,51 @@ +From da6902e5b6dbca9081e3d377f9802d4fd0c5ea59 Mon Sep 17 00:00:00 2001 +From: AceLan Kao +Date: Tue, 7 Jul 2020 16:15:53 +0800 +Subject: USB: serial: option: add Quectel EG95 LTE modem + +From: AceLan Kao + +commit da6902e5b6dbca9081e3d377f9802d4fd0c5ea59 upstream. + +Add support for Quectel Wireless Solutions Co., Ltd. EG95 LTE modem + +T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 5 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0195 Rev=03.18 +S: Manufacturer=Android +S: Product=Android +C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) + +Signed-off-by: AceLan Kao +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -248,6 +248,7 @@ static void option_instat_callback(struc + /* These Quectel products use Quectel's vendor ID */ + #define QUECTEL_PRODUCT_EC21 0x0121 + #define QUECTEL_PRODUCT_EC25 0x0125 ++#define QUECTEL_PRODUCT_EG95 0x0195 + #define QUECTEL_PRODUCT_BG96 0x0296 + #define QUECTEL_PRODUCT_EP06 0x0306 + #define QUECTEL_PRODUCT_EM12 0x0512 +@@ -1100,6 +1101,8 @@ static const struct usb_device_id option + .driver_info = RSVD(4) }, + { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25), + .driver_info = RSVD(4) }, ++ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95), ++ .driver_info = RSVD(4) }, + { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96), + .driver_info = RSVD(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff),