From: Greg Kroah-Hartman Date: Sat, 30 Mar 2019 19:36:13 +0000 (+0100) Subject: 5.0-stable patches X-Git-Tag: v3.18.138~41 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fc08f4e8196fcbdb34c31ed9c265ba3180d66a9c;p=thirdparty%2Fkernel%2Fstable-queue.git 5.0-stable patches added patches: acpi-cppc-fix-guaranteed-performance-handling.patch serial-max310x-fix-to-avoid-potential-null-pointer-dereference.patch serial-mvebu-uart-fix-to-avoid-a-potential-null-pointer-dereference.patch serial-sh-sci-fix-setting-scscr_tie-while-transferring-data.patch staging-comedi-ni_mio_common-fix-divide-by-zero-for-dio-cmdtest.patch staging-erofs-fix-error-handling-when-failed-to-read-compresssed-data.patch staging-erofs-fix-to-handle-error-path-of-erofs_vmap.patch staging-erofs-keep-corrupted-fs-from-crashing-kernel-in-erofs_readdir.patch staging-olpc_dcon_xo_1-add-missing-const-qualifier.patch staging-speakup_soft-fix-alternate-speech-with-other-synths.patch staging-vt6655-fix-interrupt-race-condition-on-device-start-up.patch staging-vt6655-remove-vif-check-from-vnt_interrupt.patch tty-atmel_serial-fix-a-potential-null-pointer-dereference.patch tty-mxs-auart-fix-a-potential-null-pointer-dereference.patch tty-serial-atmel-add-is_half_duplex-helper.patch tty-serial-atmel-rs485-hd-w-dma-enable-rx-after-tx-is-stopped.patch tty-serial-qcom_geni_serial-initialize-baud-in-qcom_geni_console_setup.patch usb-serial-cp210x-add-new-device-id.patch usb-serial-ftdi_sio-add-additional-novatech-products.patch usb-serial-mos7720-fix-mos_parport-refcount-imbalance-on-error-path.patch usb-serial-option-add-olicard-600.patch usb-serial-option-add-support-for-quectel-em12.patch usb-serial-option-set-driver_info-for-sim5218-and-compatibles.patch --- diff --git a/queue-5.0/acpi-cppc-fix-guaranteed-performance-handling.patch b/queue-5.0/acpi-cppc-fix-guaranteed-performance-handling.patch new file mode 100644 index 00000000000..7a9d110d5ec --- /dev/null +++ b/queue-5.0/acpi-cppc-fix-guaranteed-performance-handling.patch @@ -0,0 +1,47 @@ +From edef1ef134180149694b86386277076f566d165c Mon Sep 17 00:00:00 2001 +From: Srinivas Pandruvada +Date: Mon, 25 Mar 2019 09:04:39 -0700 +Subject: ACPI / CPPC: Fix guaranteed performance handling + +From: Srinivas Pandruvada + +commit edef1ef134180149694b86386277076f566d165c upstream. + +As per the ACPI specification, "Guaranteed Performance Register" is +a "Buffer" field and it cannot be "Integer", so treat the "Integer" +type for "Guaranteed Performance Register" field as invalid and +ignore its value in that case. + +Also save one cpc_read() call when "Guaranteed Performance Register" +is not present, which means a register defined as: +"Register(SystemMemory, 0, 0, 0, 0)". + +Fixes: 29523f095397 ("ACPI / CPPC: Add support for guaranteed performance") +Suggested-by: Rafael J. Wysocki +Signed-off-by: Srinivas Pandruvada +Cc: 4.20+ # 4.20+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/cppc_acpi.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -1108,8 +1108,13 @@ int cppc_get_perf_caps(int cpunum, struc + cpc_read(cpunum, nominal_reg, &nom); + perf_caps->nominal_perf = nom; + +- cpc_read(cpunum, guaranteed_reg, &guaranteed); +- perf_caps->guaranteed_perf = guaranteed; ++ if (guaranteed_reg->type != ACPI_TYPE_BUFFER || ++ IS_NULL_REG(&guaranteed_reg->cpc_entry.reg)) { ++ perf_caps->guaranteed_perf = 0; ++ } else { ++ cpc_read(cpunum, guaranteed_reg, &guaranteed); ++ perf_caps->guaranteed_perf = guaranteed; ++ } + + cpc_read(cpunum, lowest_non_linear_reg, &min_nonlinear); + perf_caps->lowest_nonlinear_perf = min_nonlinear; diff --git a/queue-5.0/serial-max310x-fix-to-avoid-potential-null-pointer-dereference.patch b/queue-5.0/serial-max310x-fix-to-avoid-potential-null-pointer-dereference.patch new file mode 100644 index 00000000000..378bea57131 --- /dev/null +++ b/queue-5.0/serial-max310x-fix-to-avoid-potential-null-pointer-dereference.patch @@ -0,0 +1,31 @@ +From 3a10e3dd52e80b9a97a3346020024d17b2c272d6 Mon Sep 17 00:00:00 2001 +From: Aditya Pakki +Date: Mon, 18 Mar 2019 18:44:14 -0500 +Subject: serial: max310x: Fix to avoid potential NULL pointer dereference + +From: Aditya Pakki + +commit 3a10e3dd52e80b9a97a3346020024d17b2c272d6 upstream. + +of_match_device can return a NULL pointer when matching device is not +found. This patch avoids a scenario causing NULL pointer derefernce. + +Signed-off-by: Aditya Pakki +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/max310x.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -1416,6 +1416,8 @@ static int max310x_spi_probe(struct spi_ + if (spi->dev.of_node) { + const struct of_device_id *of_id = + of_match_device(max310x_dt_ids, &spi->dev); ++ if (!of_id) ++ return -ENODEV; + + devtype = (struct max310x_devtype *)of_id->data; + } else { diff --git a/queue-5.0/serial-mvebu-uart-fix-to-avoid-a-potential-null-pointer-dereference.patch b/queue-5.0/serial-mvebu-uart-fix-to-avoid-a-potential-null-pointer-dereference.patch new file mode 100644 index 00000000000..644dc05fe81 --- /dev/null +++ b/queue-5.0/serial-mvebu-uart-fix-to-avoid-a-potential-null-pointer-dereference.patch @@ -0,0 +1,32 @@ +From 32f47179833b63de72427131169809065db6745e Mon Sep 17 00:00:00 2001 +From: Aditya Pakki +Date: Mon, 18 Mar 2019 18:50:56 -0500 +Subject: serial: mvebu-uart: Fix to avoid a potential NULL pointer dereference + +From: Aditya Pakki + +commit 32f47179833b63de72427131169809065db6745e upstream. + +of_match_device on failure to find a matching device can return a NULL +pointer. The patch checks for such a scenrio and passes the error upstream. + +Signed-off-by: Aditya Pakki +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/mvebu-uart.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/tty/serial/mvebu-uart.c ++++ b/drivers/tty/serial/mvebu-uart.c +@@ -810,6 +810,9 @@ static int mvebu_uart_probe(struct platf + return -EINVAL; + } + ++ if (!match) ++ return -ENODEV; ++ + /* Assume that all UART ports have a DT alias or none has */ + id = of_alias_get_id(pdev->dev.of_node, "serial"); + if (!pdev->dev.of_node || id < 0) diff --git a/queue-5.0/serial-sh-sci-fix-setting-scscr_tie-while-transferring-data.patch b/queue-5.0/serial-sh-sci-fix-setting-scscr_tie-while-transferring-data.patch new file mode 100644 index 00000000000..b7723b25a3e --- /dev/null +++ b/queue-5.0/serial-sh-sci-fix-setting-scscr_tie-while-transferring-data.patch @@ -0,0 +1,46 @@ +From 93bcefd4c6bad4c69dbc4edcd3fbf774b24d930d Mon Sep 17 00:00:00 2001 +From: Hoan Nguyen An +Date: Mon, 18 Mar 2019 18:26:32 +0900 +Subject: serial: sh-sci: Fix setting SCSCR_TIE while transferring data + +From: Hoan Nguyen An + +commit 93bcefd4c6bad4c69dbc4edcd3fbf774b24d930d upstream. + +We disable transmission interrupt (clear SCSCR_TIE) after all data has been transmitted +(if uart_circ_empty(xmit)). While transmitting, if the data is still in the tty buffer, +re-enable the SCSCR_TIE bit, which was done at sci_start_tx(). +This is unnecessary processing, wasting CPU operation if the data transmission length is large. +And further, transmit end, FIFO empty bits disabling have also been performed in the step above. + +Signed-off-by: Hoan Nguyen An +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/sh-sci.c | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -838,19 +838,9 @@ static void sci_transmit_chars(struct ua + + if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) + uart_write_wakeup(port); +- if (uart_circ_empty(xmit)) { ++ if (uart_circ_empty(xmit)) + sci_stop_tx(port); +- } else { +- ctrl = serial_port_in(port, SCSCR); + +- if (port->type != PORT_SCI) { +- serial_port_in(port, SCxSR); /* Dummy read */ +- sci_clear_SCxSR(port, SCxSR_TDxE_CLEAR(port)); +- } +- +- ctrl |= SCSCR_TIE; +- serial_port_out(port, SCSCR, ctrl); +- } + } + + /* On SH3, SCIF may read end-of-break as a space->mark char */ diff --git a/queue-5.0/series b/queue-5.0/series index d96e6fd681f..370261a6306 100644 --- a/queue-5.0/series +++ b/queue-5.0/series @@ -74,3 +74,26 @@ scsi-sd-quiesce-warning-if-device-does-not-report-optimal-i-o-size.patch scsi-zfcp-fix-rport-unblock-if-deleted-scsi-devices-on-scsi_host.patch scsi-zfcp-fix-scsi_eh-host-reset-with-port_forced-erp-for-non-npiv-fcp-devices.patch drm-rockchip-vop-reset-scale-mode-when-win-is-disabled.patch +tty-serial-atmel-add-is_half_duplex-helper.patch +tty-serial-atmel-rs485-hd-w-dma-enable-rx-after-tx-is-stopped.patch +tty-mxs-auart-fix-a-potential-null-pointer-dereference.patch +tty-atmel_serial-fix-a-potential-null-pointer-dereference.patch +tty-serial-qcom_geni_serial-initialize-baud-in-qcom_geni_console_setup.patch +staging-comedi-ni_mio_common-fix-divide-by-zero-for-dio-cmdtest.patch +staging-olpc_dcon_xo_1-add-missing-const-qualifier.patch +staging-speakup_soft-fix-alternate-speech-with-other-synths.patch +staging-vt6655-remove-vif-check-from-vnt_interrupt.patch +staging-vt6655-fix-interrupt-race-condition-on-device-start-up.patch +staging-erofs-fix-to-handle-error-path-of-erofs_vmap.patch +staging-erofs-fix-error-handling-when-failed-to-read-compresssed-data.patch +staging-erofs-keep-corrupted-fs-from-crashing-kernel-in-erofs_readdir.patch +serial-max310x-fix-to-avoid-potential-null-pointer-dereference.patch +serial-mvebu-uart-fix-to-avoid-a-potential-null-pointer-dereference.patch +serial-sh-sci-fix-setting-scscr_tie-while-transferring-data.patch +usb-serial-cp210x-add-new-device-id.patch +usb-serial-ftdi_sio-add-additional-novatech-products.patch +usb-serial-mos7720-fix-mos_parport-refcount-imbalance-on-error-path.patch +usb-serial-option-set-driver_info-for-sim5218-and-compatibles.patch +usb-serial-option-add-support-for-quectel-em12.patch +usb-serial-option-add-olicard-600.patch +acpi-cppc-fix-guaranteed-performance-handling.patch diff --git a/queue-5.0/staging-comedi-ni_mio_common-fix-divide-by-zero-for-dio-cmdtest.patch b/queue-5.0/staging-comedi-ni_mio_common-fix-divide-by-zero-for-dio-cmdtest.patch new file mode 100644 index 00000000000..13c2e954068 --- /dev/null +++ b/queue-5.0/staging-comedi-ni_mio_common-fix-divide-by-zero-for-dio-cmdtest.patch @@ -0,0 +1,153 @@ +From bafd9c64056cd034a1174dcadb65cd3b294ff8f6 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Mon, 4 Mar 2019 14:33:54 +0000 +Subject: staging: comedi: ni_mio_common: Fix divide-by-zero for DIO cmdtest + +From: Ian Abbott + +commit bafd9c64056cd034a1174dcadb65cd3b294ff8f6 upstream. + +`ni_cdio_cmdtest()` validates Comedi asynchronous commands for the DIO +subdevice (subdevice 2) of supported National Instruments M-series +cards. It is called when handling the `COMEDI_CMD` and `COMEDI_CMDTEST` +ioctls for this subdevice. There are two causes for a possible +divide-by-zero error when validating that the `stop_arg` member of the +passed-in command is not too large. + +The first cause for the divide-by-zero is that calls to +`comedi_bytes_per_scan()` are only valid once the command has been +copied to `s->async->cmd`, but that copy is only done for the +`COMEDI_CMD` ioctl. For the `COMEDI_CMDTEST` ioctl, it will use +whatever was left there by the previous `COMEDI_CMD` ioctl, if any. +(This is very likely, as it is usual for the application to use +`COMEDI_CMDTEST` before `COMEDI_CMD`.) If there has been no previous, +valid `COMEDI_CMD` for this subdevice, then `comedi_bytes_per_scan()` +will return 0, so the subsequent division in `ni_cdio_cmdtest()` of +`s->async->prealloc_bufsz / comedi_bytes_per_scan(s)` will be a +divide-by-zero error. To fix this error, call a new function +`comedi_bytes_per_scan_cmd(s, cmd)`, based on the existing +`comedi_bytes_per_scan(s)` but using a specified `struct comedi_cmd` for +its calculations. (Also refactor `comedi_bytes_per_scan()` to call the +new function.) + +Once the first cause for the divide-by-zero has been fixed, the second +cause is that `comedi_bytes_per_scan_cmd()` can legitimately return 0 if +the `scan_end_arg` member of the `struct comedi_cmd` being tested is 0. +Fix it by only performing the division (and validating that `stop_arg` +is no more than the maximum value) if `comedi_bytes_per_scan_cmd()` +returns a non-zero value. + +The problem was reported on the COMEDI mailing list here: +https://groups.google.com/forum/#!topic/comedi_list/4t9WlHzMhKM + +Reported-by: Ivan Vasilyev +Tested-by: Ivan Vasilyev +Fixes: f164cbf98fa8 ("staging: comedi: ni_mio_common: add finite regeneration to dio output") +Cc: # 4.6+ +Cc: Spencer E. Olson +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/comedi/comedidev.h | 2 + + drivers/staging/comedi/drivers.c | 33 +++++++++++++++++++++---- + drivers/staging/comedi/drivers/ni_mio_common.c | 10 +++++-- + 3 files changed, 38 insertions(+), 7 deletions(-) + +--- a/drivers/staging/comedi/comedidev.h ++++ b/drivers/staging/comedi/comedidev.h +@@ -1001,6 +1001,8 @@ int comedi_dio_insn_config(struct comedi + unsigned int mask); + unsigned int comedi_dio_update_state(struct comedi_subdevice *s, + unsigned int *data); ++unsigned int comedi_bytes_per_scan_cmd(struct comedi_subdevice *s, ++ struct comedi_cmd *cmd); + unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s); + unsigned int comedi_nscans_left(struct comedi_subdevice *s, + unsigned int nscans); +--- a/drivers/staging/comedi/drivers.c ++++ b/drivers/staging/comedi/drivers.c +@@ -394,11 +394,13 @@ unsigned int comedi_dio_update_state(str + EXPORT_SYMBOL_GPL(comedi_dio_update_state); + + /** +- * comedi_bytes_per_scan() - Get length of asynchronous command "scan" in bytes ++ * comedi_bytes_per_scan_cmd() - Get length of asynchronous command "scan" in ++ * bytes + * @s: COMEDI subdevice. ++ * @cmd: COMEDI command. + * + * Determines the overall scan length according to the subdevice type and the +- * number of channels in the scan. ++ * number of channels in the scan for the specified command. + * + * For digital input, output or input/output subdevices, samples for + * multiple channels are assumed to be packed into one or more unsigned +@@ -408,9 +410,9 @@ EXPORT_SYMBOL_GPL(comedi_dio_update_stat + * + * Returns the overall scan length in bytes. + */ +-unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s) ++unsigned int comedi_bytes_per_scan_cmd(struct comedi_subdevice *s, ++ struct comedi_cmd *cmd) + { +- struct comedi_cmd *cmd = &s->async->cmd; + unsigned int num_samples; + unsigned int bits_per_sample; + +@@ -427,6 +429,29 @@ unsigned int comedi_bytes_per_scan(struc + } + return comedi_samples_to_bytes(s, num_samples); + } ++EXPORT_SYMBOL_GPL(comedi_bytes_per_scan_cmd); ++ ++/** ++ * comedi_bytes_per_scan() - Get length of asynchronous command "scan" in bytes ++ * @s: COMEDI subdevice. ++ * ++ * Determines the overall scan length according to the subdevice type and the ++ * number of channels in the scan for the current command. ++ * ++ * For digital input, output or input/output subdevices, samples for ++ * multiple channels are assumed to be packed into one or more unsigned ++ * short or unsigned int values according to the subdevice's %SDF_LSAMPL ++ * flag. For other types of subdevice, samples are assumed to occupy a ++ * whole unsigned short or unsigned int according to the %SDF_LSAMPL flag. ++ * ++ * Returns the overall scan length in bytes. ++ */ ++unsigned int comedi_bytes_per_scan(struct comedi_subdevice *s) ++{ ++ struct comedi_cmd *cmd = &s->async->cmd; ++ ++ return comedi_bytes_per_scan_cmd(s, cmd); ++} + EXPORT_SYMBOL_GPL(comedi_bytes_per_scan); + + static unsigned int __comedi_nscans_left(struct comedi_subdevice *s, +--- a/drivers/staging/comedi/drivers/ni_mio_common.c ++++ b/drivers/staging/comedi/drivers/ni_mio_common.c +@@ -3545,6 +3545,7 @@ static int ni_cdio_cmdtest(struct comedi + struct comedi_subdevice *s, struct comedi_cmd *cmd) + { + struct ni_private *devpriv = dev->private; ++ unsigned int bytes_per_scan; + int err = 0; + + /* Step 1 : check if triggers are trivially valid */ +@@ -3579,9 +3580,12 @@ static int ni_cdio_cmdtest(struct comedi + err |= comedi_check_trigger_arg_is(&cmd->convert_arg, 0); + err |= comedi_check_trigger_arg_is(&cmd->scan_end_arg, + cmd->chanlist_len); +- err |= comedi_check_trigger_arg_max(&cmd->stop_arg, +- s->async->prealloc_bufsz / +- comedi_bytes_per_scan(s)); ++ bytes_per_scan = comedi_bytes_per_scan_cmd(s, cmd); ++ if (bytes_per_scan) { ++ err |= comedi_check_trigger_arg_max(&cmd->stop_arg, ++ s->async->prealloc_bufsz / ++ bytes_per_scan); ++ } + + if (err) + return 3; diff --git a/queue-5.0/staging-erofs-fix-error-handling-when-failed-to-read-compresssed-data.patch b/queue-5.0/staging-erofs-fix-error-handling-when-failed-to-read-compresssed-data.patch new file mode 100644 index 00000000000..19b24c49cfb --- /dev/null +++ b/queue-5.0/staging-erofs-fix-error-handling-when-failed-to-read-compresssed-data.patch @@ -0,0 +1,103 @@ +From b6391ac73400eff38377a4a7364bd3df5efb5178 Mon Sep 17 00:00:00 2001 +From: Gao Xiang +Date: Mon, 25 Mar 2019 11:40:07 +0800 +Subject: staging: erofs: fix error handling when failed to read compresssed data + +From: Gao Xiang + +commit b6391ac73400eff38377a4a7364bd3df5efb5178 upstream. + +Complete read error handling paths for all three kinds of +compressed pages: + + 1) For cache-managed pages, PG_uptodate will be checked since + read_endio will unlock and SetPageUptodate for these pages; + + 2) For inplaced pages, read_endio cannot SetPageUptodate directly + since it should be used to mark the final decompressed data, + PG_error will be set with page locked for IO error instead; + + 3) For staging pages, PG_error is used, which is similar to + what we do for inplaced pages. + +Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support") +Cc: # 4.19+ +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/erofs/unzip_vle.c | 41 +++++++++++++++++++++++++------------- + 1 file changed, 28 insertions(+), 13 deletions(-) + +--- a/drivers/staging/erofs/unzip_vle.c ++++ b/drivers/staging/erofs/unzip_vle.c +@@ -977,6 +977,7 @@ repeat: + overlapped = false; + compressed_pages = grp->compressed_pages; + ++ err = 0; + for (i = 0; i < clusterpages; ++i) { + unsigned int pagenr; + +@@ -986,26 +987,39 @@ repeat: + DBG_BUGON(!page); + DBG_BUGON(!page->mapping); + +- if (z_erofs_is_stagingpage(page)) +- continue; ++ if (!z_erofs_is_stagingpage(page)) { + #ifdef EROFS_FS_HAS_MANAGED_CACHE +- if (page->mapping == MNGD_MAPPING(sbi)) { +- DBG_BUGON(!PageUptodate(page)); +- continue; +- } ++ if (page->mapping == MNGD_MAPPING(sbi)) { ++ if (unlikely(!PageUptodate(page))) ++ err = -EIO; ++ continue; ++ } + #endif + +- /* only non-head page could be reused as a compressed page */ +- pagenr = z_erofs_onlinepage_index(page); ++ /* ++ * only if non-head page can be selected ++ * for inplace decompression ++ */ ++ pagenr = z_erofs_onlinepage_index(page); ++ ++ DBG_BUGON(pagenr >= nr_pages); ++ DBG_BUGON(pages[pagenr]); ++ ++sparsemem_pages; ++ pages[pagenr] = page; + +- DBG_BUGON(pagenr >= nr_pages); +- DBG_BUGON(pages[pagenr]); +- ++sparsemem_pages; +- pages[pagenr] = page; ++ overlapped = true; ++ } + +- overlapped = true; ++ /* PG_error needs checking for inplaced and staging pages */ ++ if (unlikely(PageError(page))) { ++ DBG_BUGON(PageUptodate(page)); ++ err = -EIO; ++ } + } + ++ if (unlikely(err)) ++ goto out; ++ + llen = (nr_pages << PAGE_SHIFT) - work->pageofs; + + if (z_erofs_vle_workgrp_fmt(grp) == Z_EROFS_VLE_WORKGRP_FMT_PLAIN) { +@@ -1203,6 +1217,7 @@ repeat: + if (page->mapping == mc) { + WRITE_ONCE(grp->compressed_pages[nr], page); + ++ ClearPageError(page); + if (!PagePrivate(page)) { + /* + * impossible to be !PagePrivate(page) for diff --git a/queue-5.0/staging-erofs-fix-to-handle-error-path-of-erofs_vmap.patch b/queue-5.0/staging-erofs-fix-to-handle-error-path-of-erofs_vmap.patch new file mode 100644 index 00000000000..5b5835bbded --- /dev/null +++ b/queue-5.0/staging-erofs-fix-to-handle-error-path-of-erofs_vmap.patch @@ -0,0 +1,57 @@ +From 8bce6dcede65139a087ff240127e3f3c01363eed Mon Sep 17 00:00:00 2001 +From: Chao Yu +Date: Mon, 11 Mar 2019 23:10:10 +0800 +Subject: staging: erofs: fix to handle error path of erofs_vmap() + +From: Chao Yu + +commit 8bce6dcede65139a087ff240127e3f3c01363eed upstream. + +erofs_vmap() wrapped vmap() and vm_map_ram() to return virtual +continuous memory, but both of them can failed due to a lot of +reason, previously, erofs_vmap()'s callers didn't handle them, +which can potentially cause NULL pointer access, fix it. + +Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support") +Fixes: 0d40d6e399c1 ("staging: erofs: add a generic z_erofs VLE decompressor") +Cc: # 4.19+ +Signed-off-by: Gao Xiang +Signed-off-by: Chao Yu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/erofs/unzip_vle.c | 4 ++++ + drivers/staging/erofs/unzip_vle_lz4.c | 7 +++++-- + 2 files changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/staging/erofs/unzip_vle.c ++++ b/drivers/staging/erofs/unzip_vle.c +@@ -1034,6 +1034,10 @@ repeat: + + skip_allocpage: + vout = erofs_vmap(pages, nr_pages); ++ if (!vout) { ++ err = -ENOMEM; ++ goto out; ++ } + + err = z_erofs_vle_unzip_vmap(compressed_pages, + clusterpages, vout, llen, work->pageofs, overlapped); +--- a/drivers/staging/erofs/unzip_vle_lz4.c ++++ b/drivers/staging/erofs/unzip_vle_lz4.c +@@ -136,10 +136,13 @@ int z_erofs_vle_unzip_fast_percpu(struct + + nr_pages = DIV_ROUND_UP(outlen + pageofs, PAGE_SIZE); + +- if (clusterpages == 1) ++ if (clusterpages == 1) { + vin = kmap_atomic(compressed_pages[0]); +- else ++ } else { + vin = erofs_vmap(compressed_pages, clusterpages); ++ if (!vin) ++ return -ENOMEM; ++ } + + preempt_disable(); + vout = erofs_pcpubuf[smp_processor_id()].data; diff --git a/queue-5.0/staging-erofs-keep-corrupted-fs-from-crashing-kernel-in-erofs_readdir.patch b/queue-5.0/staging-erofs-keep-corrupted-fs-from-crashing-kernel-in-erofs_readdir.patch new file mode 100644 index 00000000000..9e76484350a --- /dev/null +++ b/queue-5.0/staging-erofs-keep-corrupted-fs-from-crashing-kernel-in-erofs_readdir.patch @@ -0,0 +1,99 @@ +From 33bac912840fe64dbc15556302537dc6a17cac63 Mon Sep 17 00:00:00 2001 +From: Gao Xiang +Date: Fri, 29 Mar 2019 04:14:58 +0800 +Subject: staging: erofs: keep corrupted fs from crashing kernel in erofs_readdir() + +From: Gao Xiang + +commit 33bac912840fe64dbc15556302537dc6a17cac63 upstream. + +After commit 419d6efc50e9, kernel cannot be crashed in the namei +path. However, corrupted nameoff can do harm in the process of +readdir for scenerios without dm-verity as well. Fix it now. + +Fixes: 3aa8ec716e52 ("staging: erofs: add directory operations") +Cc: # 4.19+ +Signed-off-by: Gao Xiang +Reviewed-by: Chao Yu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/erofs/dir.c | 45 ++++++++++++++++++++++++-------------------- + 1 file changed, 25 insertions(+), 20 deletions(-) + +--- a/drivers/staging/erofs/dir.c ++++ b/drivers/staging/erofs/dir.c +@@ -23,6 +23,21 @@ static const unsigned char erofs_filetyp + [EROFS_FT_SYMLINK] = DT_LNK, + }; + ++static void debug_one_dentry(unsigned char d_type, const char *de_name, ++ unsigned int de_namelen) ++{ ++#ifdef CONFIG_EROFS_FS_DEBUG ++ /* since the on-disk name could not have the trailing '\0' */ ++ unsigned char dbg_namebuf[EROFS_NAME_LEN + 1]; ++ ++ memcpy(dbg_namebuf, de_name, de_namelen); ++ dbg_namebuf[de_namelen] = '\0'; ++ ++ debugln("found dirent %s de_len %u d_type %d", dbg_namebuf, ++ de_namelen, d_type); ++#endif ++} ++ + static int erofs_fill_dentries(struct dir_context *ctx, + void *dentry_blk, unsigned int *ofs, + unsigned int nameoff, unsigned int maxsize) +@@ -33,14 +48,10 @@ static int erofs_fill_dentries(struct di + de = dentry_blk + *ofs; + while (de < end) { + const char *de_name; +- int de_namelen; ++ unsigned int de_namelen; + unsigned char d_type; +-#ifdef CONFIG_EROFS_FS_DEBUG +- unsigned int dbg_namelen; +- unsigned char dbg_namebuf[EROFS_NAME_LEN]; +-#endif + +- if (unlikely(de->file_type < EROFS_FT_MAX)) ++ if (de->file_type < EROFS_FT_MAX) + d_type = erofs_filetype_table[de->file_type]; + else + d_type = DT_UNKNOWN; +@@ -48,26 +59,20 @@ static int erofs_fill_dentries(struct di + nameoff = le16_to_cpu(de->nameoff); + de_name = (char *)dentry_blk + nameoff; + +- de_namelen = unlikely(de + 1 >= end) ? +- /* last directory entry */ +- strnlen(de_name, maxsize - nameoff) : +- le16_to_cpu(de[1].nameoff) - nameoff; ++ /* the last dirent in the block? */ ++ if (de + 1 >= end) ++ de_namelen = strnlen(de_name, maxsize - nameoff); ++ else ++ de_namelen = le16_to_cpu(de[1].nameoff) - nameoff; + + /* a corrupted entry is found */ +- if (unlikely(de_namelen < 0)) { ++ if (unlikely(nameoff + de_namelen > maxsize || ++ de_namelen > EROFS_NAME_LEN)) { + DBG_BUGON(1); + return -EIO; + } + +-#ifdef CONFIG_EROFS_FS_DEBUG +- dbg_namelen = min(EROFS_NAME_LEN - 1, de_namelen); +- memcpy(dbg_namebuf, de_name, dbg_namelen); +- dbg_namebuf[dbg_namelen] = '\0'; +- +- debugln("%s, found de_name %s de_len %d d_type %d", __func__, +- dbg_namebuf, de_namelen, d_type); +-#endif +- ++ debug_one_dentry(d_type, de_name, de_namelen); + if (!dir_emit(ctx, de_name, de_namelen, + le64_to_cpu(de->nid), d_type)) + /* stopped by some reason */ diff --git a/queue-5.0/staging-olpc_dcon_xo_1-add-missing-const-qualifier.patch b/queue-5.0/staging-olpc_dcon_xo_1-add-missing-const-qualifier.patch new file mode 100644 index 00000000000..9ba26970800 --- /dev/null +++ b/queue-5.0/staging-olpc_dcon_xo_1-add-missing-const-qualifier.patch @@ -0,0 +1,37 @@ +From ae0a6d2017f733781dcc938a471ccc2d05f9bee6 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 4 Mar 2019 20:42:33 +0100 +Subject: staging: olpc_dcon_xo_1: add missing 'const' qualifier + +From: Arnd Bergmann + +commit ae0a6d2017f733781dcc938a471ccc2d05f9bee6 upstream. + +gcc noticed a mismatch between the type qualifiers after a recent +cleanup: + +drivers/staging/olpc_dcon/olpc_dcon_xo_1.c: In function 'dcon_init_xo_1': +drivers/staging/olpc_dcon/olpc_dcon_xo_1.c:48:26: error: initialization discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers] + +Add the 'const' keyword that should have been there all along. + +Fixes: 2159fb372929 ("staging: olpc_dcon: olpc_dcon_xo_1.c: Switch to the gpio descriptor interface") +Signed-off-by: Arnd Bergmann +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/olpc_dcon/olpc_dcon_xo_1.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c ++++ b/drivers/staging/olpc_dcon/olpc_dcon_xo_1.c +@@ -45,7 +45,7 @@ static int dcon_init_xo_1(struct dcon_pr + { + unsigned char lob; + int ret, i; +- struct dcon_gpio *pin = &gpios_asis[0]; ++ const struct dcon_gpio *pin = &gpios_asis[0]; + + for (i = 0; i < ARRAY_SIZE(gpios_asis); i++) { + gpios[i] = devm_gpiod_get(&dcon->client->dev, pin[i].name, diff --git a/queue-5.0/staging-speakup_soft-fix-alternate-speech-with-other-synths.patch b/queue-5.0/staging-speakup_soft-fix-alternate-speech-with-other-synths.patch new file mode 100644 index 00000000000..82fc7280f62 --- /dev/null +++ b/queue-5.0/staging-speakup_soft-fix-alternate-speech-with-other-synths.patch @@ -0,0 +1,92 @@ +From 45ac7b31bc6c4af885cc5b5d6c534c15bcbe7643 Mon Sep 17 00:00:00 2001 +From: Samuel Thibault +Date: Thu, 7 Mar 2019 23:06:57 +0100 +Subject: staging: speakup_soft: Fix alternate speech with other synths + +From: Samuel Thibault + +commit 45ac7b31bc6c4af885cc5b5d6c534c15bcbe7643 upstream. + +When switching from speakup_soft to another synth, speakup_soft would +keep calling synth_buffer_getc() from softsynthx_read. + +Let's thus make synth.c export the knowledge of the current synth, so +that speakup_soft can determine whether it should be running. + +speakup_soft also needs to set itself alive, otherwise the switch would +let it remain silent. + +Signed-off-by: Samuel Thibault +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/speakup/speakup_soft.c | 16 +++++++++++----- + drivers/staging/speakup/spk_priv.h | 1 + + drivers/staging/speakup/synth.c | 6 ++++++ + 3 files changed, 18 insertions(+), 5 deletions(-) + +--- a/drivers/staging/speakup/speakup_soft.c ++++ b/drivers/staging/speakup/speakup_soft.c +@@ -208,12 +208,15 @@ static ssize_t softsynthx_read(struct fi + return -EINVAL; + + spin_lock_irqsave(&speakup_info.spinlock, flags); ++ synth_soft.alive = 1; + while (1) { + prepare_to_wait(&speakup_event, &wait, TASK_INTERRUPTIBLE); +- if (!unicode) +- synth_buffer_skip_nonlatin1(); +- if (!synth_buffer_empty() || speakup_info.flushing) +- break; ++ if (synth_current() == &synth_soft) { ++ if (!unicode) ++ synth_buffer_skip_nonlatin1(); ++ if (!synth_buffer_empty() || speakup_info.flushing) ++ break; ++ } + spin_unlock_irqrestore(&speakup_info.spinlock, flags); + if (fp->f_flags & O_NONBLOCK) { + finish_wait(&speakup_event, &wait); +@@ -233,6 +236,8 @@ static ssize_t softsynthx_read(struct fi + + /* Keep 3 bytes available for a 16bit UTF-8-encoded character */ + while (chars_sent <= count - bytes_per_ch) { ++ if (synth_current() != &synth_soft) ++ break; + if (speakup_info.flushing) { + speakup_info.flushing = 0; + ch = '\x18'; +@@ -329,7 +334,8 @@ static __poll_t softsynth_poll(struct fi + poll_wait(fp, &speakup_event, wait); + + spin_lock_irqsave(&speakup_info.spinlock, flags); +- if (!synth_buffer_empty() || speakup_info.flushing) ++ if (synth_current() == &synth_soft && ++ (!synth_buffer_empty() || speakup_info.flushing)) + ret = EPOLLIN | EPOLLRDNORM; + spin_unlock_irqrestore(&speakup_info.spinlock, flags); + return ret; +--- a/drivers/staging/speakup/spk_priv.h ++++ b/drivers/staging/speakup/spk_priv.h +@@ -74,6 +74,7 @@ int synth_request_region(unsigned long s + int synth_release_region(unsigned long start, unsigned long n); + int synth_add(struct spk_synth *in_synth); + void synth_remove(struct spk_synth *in_synth); ++struct spk_synth *synth_current(void); + + extern struct speakup_info_t speakup_info; + +--- a/drivers/staging/speakup/synth.c ++++ b/drivers/staging/speakup/synth.c +@@ -481,4 +481,10 @@ void synth_remove(struct spk_synth *in_s + } + EXPORT_SYMBOL_GPL(synth_remove); + ++struct spk_synth *synth_current(void) ++{ ++ return synth; ++} ++EXPORT_SYMBOL_GPL(synth_current); ++ + short spk_punc_masks[] = { 0, SOME, MOST, PUNC, PUNC | B_SYM }; diff --git a/queue-5.0/staging-vt6655-fix-interrupt-race-condition-on-device-start-up.patch b/queue-5.0/staging-vt6655-fix-interrupt-race-condition-on-device-start-up.patch new file mode 100644 index 00000000000..e1ad55f06de --- /dev/null +++ b/queue-5.0/staging-vt6655-fix-interrupt-race-condition-on-device-start-up.patch @@ -0,0 +1,65 @@ +From 3b9c2f2e0e99bb67c96abcb659b3465efe3bee1f Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Sun, 24 Mar 2019 18:53:49 +0000 +Subject: staging: vt6655: Fix interrupt race condition on device start up. + +From: Malcolm Priestley + +commit 3b9c2f2e0e99bb67c96abcb659b3465efe3bee1f upstream. + +It appears on some slower systems that the driver can find its way +out of the workqueue while the interrupt is disabled by continuous polling +by it. + +Move MACvIntEnable to vnt_interrupt_work so that it is always enabled +on all routes out of vnt_interrupt_process. + +Move MACvIntDisable so that the device doesn't keep polling the system +while the workqueue is being processed. + +Signed-off-by: Malcolm Priestley +CC: stable@vger.kernel.org # v4.2+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6655/device_main.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/staging/vt6655/device_main.c ++++ b/drivers/staging/vt6655/device_main.c +@@ -1033,8 +1033,6 @@ static void vnt_interrupt_process(struct + return; + } + +- MACvIntDisable(priv->PortOffset); +- + spin_lock_irqsave(&priv->lock, flags); + + /* Read low level stats */ +@@ -1122,8 +1120,6 @@ static void vnt_interrupt_process(struct + } + + spin_unlock_irqrestore(&priv->lock, flags); +- +- MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE); + } + + static void vnt_interrupt_work(struct work_struct *work) +@@ -1133,6 +1129,8 @@ static void vnt_interrupt_work(struct wo + + if (priv->vif) + vnt_interrupt_process(priv); ++ ++ MACvIntEnable(priv->PortOffset, IMR_MASK_VALUE); + } + + static irqreturn_t vnt_interrupt(int irq, void *arg) +@@ -1141,6 +1139,8 @@ static irqreturn_t vnt_interrupt(int irq + + schedule_work(&priv->interrupt_work); + ++ MACvIntDisable(priv->PortOffset); ++ + return IRQ_HANDLED; + } + diff --git a/queue-5.0/staging-vt6655-remove-vif-check-from-vnt_interrupt.patch b/queue-5.0/staging-vt6655-remove-vif-check-from-vnt_interrupt.patch new file mode 100644 index 00000000000..588bcdaf595 --- /dev/null +++ b/queue-5.0/staging-vt6655-remove-vif-check-from-vnt_interrupt.patch @@ -0,0 +1,34 @@ +From cc26358f89c3e493b54766b1ca56cfc6b14db78a Mon Sep 17 00:00:00 2001 +From: Malcolm Priestley +Date: Wed, 27 Mar 2019 18:45:26 +0000 +Subject: staging: vt6655: Remove vif check from vnt_interrupt + +From: Malcolm Priestley + +commit cc26358f89c3e493b54766b1ca56cfc6b14db78a upstream. + +A check for vif is made in vnt_interrupt_work. + +There is a small chance of leaving interrupt disabled while vif +is NULL and the work hasn't been scheduled. + +Signed-off-by: Malcolm Priestley +CC: stable@vger.kernel.org # v4.2+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/vt6655/device_main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/staging/vt6655/device_main.c ++++ b/drivers/staging/vt6655/device_main.c +@@ -1139,8 +1139,7 @@ static irqreturn_t vnt_interrupt(int irq + { + struct vnt_private *priv = arg; + +- if (priv->vif) +- schedule_work(&priv->interrupt_work); ++ schedule_work(&priv->interrupt_work); + + return IRQ_HANDLED; + } diff --git a/queue-5.0/tty-atmel_serial-fix-a-potential-null-pointer-dereference.patch b/queue-5.0/tty-atmel_serial-fix-a-potential-null-pointer-dereference.patch new file mode 100644 index 00000000000..e197687c5af --- /dev/null +++ b/queue-5.0/tty-atmel_serial-fix-a-potential-null-pointer-dereference.patch @@ -0,0 +1,35 @@ +From c85be041065c0be8bc48eda4c45e0319caf1d0e5 Mon Sep 17 00:00:00 2001 +From: Kangjie Lu +Date: Fri, 15 Mar 2019 12:16:06 -0500 +Subject: tty: atmel_serial: fix a potential NULL pointer dereference + +From: Kangjie Lu + +commit c85be041065c0be8bc48eda4c45e0319caf1d0e5 upstream. + +In case dmaengine_prep_dma_cyclic fails, the fix returns a proper +error code to avoid NULL pointer dereference. + +Signed-off-by: Kangjie Lu +Fixes: 34df42f59a60 ("serial: at91: add rx dma support") +Acked-by: Richard Genoud +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/atmel_serial.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -1297,6 +1297,10 @@ static int atmel_prepare_rx_dma(struct u + sg_dma_len(&atmel_port->sg_rx)/2, + DMA_DEV_TO_MEM, + DMA_PREP_INTERRUPT); ++ if (!desc) { ++ dev_err(port->dev, "Preparing DMA cyclic failed\n"); ++ goto chan_err; ++ } + desc->callback = atmel_complete_rx_dma; + desc->callback_param = port; + atmel_port->desc_rx = desc; diff --git a/queue-5.0/tty-mxs-auart-fix-a-potential-null-pointer-dereference.patch b/queue-5.0/tty-mxs-auart-fix-a-potential-null-pointer-dereference.patch new file mode 100644 index 00000000000..1fe28a5a0ff --- /dev/null +++ b/queue-5.0/tty-mxs-auart-fix-a-potential-null-pointer-dereference.patch @@ -0,0 +1,34 @@ +From 6734330654dac550f12e932996b868c6d0dcb421 Mon Sep 17 00:00:00 2001 +From: Kangjie Lu +Date: Thu, 14 Mar 2019 02:21:51 -0500 +Subject: tty: mxs-auart: fix a potential NULL pointer dereference + +From: Kangjie Lu + +commit 6734330654dac550f12e932996b868c6d0dcb421 upstream. + +In case ioremap fails, the fix returns -ENOMEM to avoid NULL +pointer dereferences. +Multiple places use port.membase. + +Signed-off-by: Kangjie Lu +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/mxs-auart.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/tty/serial/mxs-auart.c ++++ b/drivers/tty/serial/mxs-auart.c +@@ -1686,6 +1686,10 @@ static int mxs_auart_probe(struct platfo + + s->port.mapbase = r->start; + s->port.membase = ioremap(r->start, resource_size(r)); ++ if (!s->port.membase) { ++ ret = -ENOMEM; ++ goto out_disable_clks; ++ } + s->port.ops = &mxs_auart_ops; + s->port.iotype = UPIO_MEM; + s->port.fifosize = MXS_AUART_FIFO_SIZE; diff --git a/queue-5.0/tty-serial-atmel-add-is_half_duplex-helper.patch b/queue-5.0/tty-serial-atmel-add-is_half_duplex-helper.patch new file mode 100644 index 00000000000..b54f7b856dd --- /dev/null +++ b/queue-5.0/tty-serial-atmel-add-is_half_duplex-helper.patch @@ -0,0 +1,84 @@ +From f3040983132bf3477acd45d2452a906e67c2fec9 Mon Sep 17 00:00:00 2001 +From: Razvan Stefanescu +Date: Tue, 19 Mar 2019 15:20:34 +0200 +Subject: tty/serial: atmel: Add is_half_duplex helper + +From: Razvan Stefanescu + +commit f3040983132bf3477acd45d2452a906e67c2fec9 upstream. + +Use a helper function to check that a port needs to use half duplex +communication, replacing several occurrences of multi-line bit checking. + +Fixes: b389f173aaa1 ("tty/serial: atmel: RS485 half duplex w/DMA: enable RX after TX is done") +Cc: stable +Signed-off-by: Razvan Stefanescu +Acked-by: Richard Genoud +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/atmel_serial.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -231,6 +231,13 @@ static inline void atmel_uart_write_char + __raw_writeb(value, port->membase + ATMEL_US_THR); + } + ++static inline int atmel_uart_is_half_duplex(struct uart_port *port) ++{ ++ return ((port->rs485.flags & SER_RS485_ENABLED) && ++ !(port->rs485.flags & SER_RS485_RX_DURING_TX)) || ++ (port->iso7816.flags & SER_ISO7816_ENABLED); ++} ++ + #ifdef CONFIG_SERIAL_ATMEL_PDC + static bool atmel_use_pdc_rx(struct uart_port *port) + { +@@ -608,10 +615,9 @@ static void atmel_stop_tx(struct uart_po + /* Disable interrupts */ + atmel_uart_writel(port, ATMEL_US_IDR, atmel_port->tx_done_mask); + +- if (((port->rs485.flags & SER_RS485_ENABLED) && +- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) || +- port->iso7816.flags & SER_ISO7816_ENABLED) ++ if (atmel_uart_is_half_duplex(port)) + atmel_start_rx(port); ++ + } + + /* +@@ -628,9 +634,7 @@ static void atmel_start_tx(struct uart_p + return; + + if (atmel_use_pdc_tx(port) || atmel_use_dma_tx(port)) +- if (((port->rs485.flags & SER_RS485_ENABLED) && +- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) || +- port->iso7816.flags & SER_ISO7816_ENABLED) ++ if (atmel_uart_is_half_duplex(port)) + atmel_stop_rx(port); + + if (atmel_use_pdc_tx(port)) +@@ -928,9 +932,7 @@ static void atmel_complete_tx_dma(void * + */ + if (!uart_circ_empty(xmit)) + atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx); +- else if (((port->rs485.flags & SER_RS485_ENABLED) && +- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) || +- port->iso7816.flags & SER_ISO7816_ENABLED) { ++ else if (atmel_uart_is_half_duplex(port)) { + /* DMA done, stop TX, start RX for RS485 */ + atmel_start_rx(port); + } +@@ -1508,9 +1510,7 @@ static void atmel_tx_pdc(struct uart_por + atmel_uart_writel(port, ATMEL_US_IER, + atmel_port->tx_done_mask); + } else { +- if (((port->rs485.flags & SER_RS485_ENABLED) && +- !(port->rs485.flags & SER_RS485_RX_DURING_TX)) || +- port->iso7816.flags & SER_ISO7816_ENABLED) { ++ if (atmel_uart_is_half_duplex(port)) { + /* DMA done, stop TX, start RX for RS485 */ + atmel_start_rx(port); + } diff --git a/queue-5.0/tty-serial-atmel-rs485-hd-w-dma-enable-rx-after-tx-is-stopped.patch b/queue-5.0/tty-serial-atmel-rs485-hd-w-dma-enable-rx-after-tx-is-stopped.patch new file mode 100644 index 00000000000..b091eb7286d --- /dev/null +++ b/queue-5.0/tty-serial-atmel-rs485-hd-w-dma-enable-rx-after-tx-is-stopped.patch @@ -0,0 +1,79 @@ +From 69646d7a3689fbe1a65ae90397d22ac3f1b8d40f Mon Sep 17 00:00:00 2001 +From: Razvan Stefanescu +Date: Tue, 19 Mar 2019 15:20:35 +0200 +Subject: tty/serial: atmel: RS485 HD w/DMA: enable RX after TX is stopped + +From: Razvan Stefanescu + +commit 69646d7a3689fbe1a65ae90397d22ac3f1b8d40f upstream. + +In half-duplex operation, RX should be started after TX completes. + +If DMA is used, there is a case when the DMA transfer completes but the +TX FIFO is not emptied, so the RX cannot be restarted just yet. + +Use a boolean variable to store this state and rearm TX interrupt mask +to be signaled again that the transfer finished. In interrupt transmit +handler this variable is used to start RX. A warning message is generated +if RX is activated before TX fifo is cleared. + +Fixes: b389f173aaa1 ("tty/serial: atmel: RS485 half duplex w/DMA: enable +RX after TX is done") +Signed-off-by: Razvan Stefanescu +Acked-by: Richard Genoud +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/atmel_serial.c | 24 +++++++++++++++++++++--- + 1 file changed, 21 insertions(+), 3 deletions(-) + +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -166,6 +166,8 @@ struct atmel_uart_port { + unsigned int pending_status; + spinlock_t lock_suspended; + ++ bool hd_start_rx; /* can start RX during half-duplex operation */ ++ + /* ISO7816 */ + unsigned int fidi_min; + unsigned int fidi_max; +@@ -933,8 +935,13 @@ static void atmel_complete_tx_dma(void * + if (!uart_circ_empty(xmit)) + atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx); + else if (atmel_uart_is_half_duplex(port)) { +- /* DMA done, stop TX, start RX for RS485 */ +- atmel_start_rx(port); ++ /* ++ * DMA done, re-enable TXEMPTY and signal that we can stop ++ * TX and start RX for RS485 ++ */ ++ atmel_port->hd_start_rx = true; ++ atmel_uart_writel(port, ATMEL_US_IER, ++ atmel_port->tx_done_mask); + } + + spin_unlock_irqrestore(&port->lock, flags); +@@ -1378,9 +1385,20 @@ atmel_handle_transmit(struct uart_port * + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); + + if (pending & atmel_port->tx_done_mask) { +- /* Either PDC or interrupt transmission */ + atmel_uart_writel(port, ATMEL_US_IDR, + atmel_port->tx_done_mask); ++ ++ /* Start RX if flag was set and FIFO is empty */ ++ if (atmel_port->hd_start_rx) { ++ if (!(atmel_uart_readl(port, ATMEL_US_CSR) ++ & ATMEL_US_TXEMPTY)) ++ dev_warn(port->dev, "Should start RX, but TX fifo is not empty\n"); ++ ++ atmel_port->hd_start_rx = false; ++ atmel_start_rx(port); ++ return; ++ } ++ + atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx); + } + } diff --git a/queue-5.0/tty-serial-qcom_geni_serial-initialize-baud-in-qcom_geni_console_setup.patch b/queue-5.0/tty-serial-qcom_geni_serial-initialize-baud-in-qcom_geni_console_setup.patch new file mode 100644 index 00000000000..31e2aa2c022 --- /dev/null +++ b/queue-5.0/tty-serial-qcom_geni_serial-initialize-baud-in-qcom_geni_console_setup.patch @@ -0,0 +1,40 @@ +From c5cbc78acf693f5605d4a85b1327fa7933daf092 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Fri, 8 Mar 2019 11:37:44 -0700 +Subject: tty: serial: qcom_geni_serial: Initialize baud in qcom_geni_console_setup + +From: Nathan Chancellor + +commit c5cbc78acf693f5605d4a85b1327fa7933daf092 upstream. + +When building with -Wsometimes-uninitialized, Clang warns: + +drivers/tty/serial/qcom_geni_serial.c:1079:6: warning: variable 'baud' +is used uninitialized whenever 'if' condition is false +[-Wsometimes-uninitialized] + +It's not wrong; when options is NULL, baud has no default value. Use +9600 as that is a sane default. + +Link: https://github.com/ClangBuiltLinux/linux/issues/395 +Suggested-by: Greg Kroah-Hartman +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/qcom_geni_serial.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/qcom_geni_serial.c ++++ b/drivers/tty/serial/qcom_geni_serial.c +@@ -1117,7 +1117,7 @@ static int __init qcom_geni_console_setu + { + struct uart_port *uport; + struct qcom_geni_serial_port *port; +- int baud; ++ int baud = 9600; + int bits = 8; + int parity = 'n'; + int flow = 'n'; diff --git a/queue-5.0/usb-serial-cp210x-add-new-device-id.patch b/queue-5.0/usb-serial-cp210x-add-new-device-id.patch new file mode 100644 index 00000000000..7d14d8dd0b5 --- /dev/null +++ b/queue-5.0/usb-serial-cp210x-add-new-device-id.patch @@ -0,0 +1,33 @@ +From a595ecdd5f60b2d93863cebb07eec7f935839b54 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Wed, 27 Mar 2019 10:11:14 +0900 +Subject: USB: serial: cp210x: add new device id + +From: Greg Kroah-Hartman + +commit a595ecdd5f60b2d93863cebb07eec7f935839b54 upstream. + +Lorenz Messtechnik has a device that is controlled by the cp210x driver, +so add the device id to the driver. The device id was provided by +Silicon-Labs for the devices from this vendor. + +Reported-by: Uli +Signed-off-by: Greg Kroah-Hartman +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -80,6 +80,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x10C4, 0x804E) }, /* Software Bisque Paramount ME build-in converter */ + { USB_DEVICE(0x10C4, 0x8053) }, /* Enfora EDG1228 */ + { USB_DEVICE(0x10C4, 0x8054) }, /* Enfora GSM2228 */ ++ { USB_DEVICE(0x10C4, 0x8056) }, /* Lorenz Messtechnik devices */ + { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */ + { USB_DEVICE(0x10C4, 0x806F) }, /* IMS USB to RS422 Converter Cable */ + { USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */ diff --git a/queue-5.0/usb-serial-ftdi_sio-add-additional-novatech-products.patch b/queue-5.0/usb-serial-ftdi_sio-add-additional-novatech-products.patch new file mode 100644 index 00000000000..be9cdf67eb5 --- /dev/null +++ b/queue-5.0/usb-serial-ftdi_sio-add-additional-novatech-products.patch @@ -0,0 +1,46 @@ +From 422c2537ba9d42320f8ab6573940269f87095320 Mon Sep 17 00:00:00 2001 +From: George McCollister +Date: Tue, 5 Mar 2019 16:05:03 -0600 +Subject: USB: serial: ftdi_sio: add additional NovaTech products + +From: George McCollister + +commit 422c2537ba9d42320f8ab6573940269f87095320 upstream. + +Add PIDs for the NovaTech OrionLX+ and Orion I/O so they can be +automatically detected. + +Signed-off-by: George McCollister +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/ftdi_sio.c | 2 ++ + drivers/usb/serial/ftdi_sio_ids.h | 4 +++- + 2 files changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -609,6 +609,8 @@ static const struct usb_device_id id_tab + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, ++ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) }, +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -567,7 +567,9 @@ + /* + * NovaTech product ids (FTDI_VID) + */ +-#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */ ++#define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */ ++#define FTDI_NT_ORIONLX_PLUS_PID 0x7c91 /* OrionLX+ Substation Automation Platform */ ++#define FTDI_NT_ORION_IO_PID 0x7c92 /* Orion I/O */ + + /* + * Synapse Wireless product ids (FTDI_VID) diff --git a/queue-5.0/usb-serial-mos7720-fix-mos_parport-refcount-imbalance-on-error-path.patch b/queue-5.0/usb-serial-mos7720-fix-mos_parport-refcount-imbalance-on-error-path.patch new file mode 100644 index 00000000000..142abeb9d97 --- /dev/null +++ b/queue-5.0/usb-serial-mos7720-fix-mos_parport-refcount-imbalance-on-error-path.patch @@ -0,0 +1,47 @@ +From 2908b076f5198d231de62713cb2b633a3a4b95ac Mon Sep 17 00:00:00 2001 +From: Lin Yi +Date: Wed, 20 Mar 2019 19:04:56 +0800 +Subject: USB: serial: mos7720: fix mos_parport refcount imbalance on error path + +From: Lin Yi + +commit 2908b076f5198d231de62713cb2b633a3a4b95ac upstream. + +The write_parport_reg_nonblock() helper takes a reference to the struct +mos_parport, but failed to release it in a couple of error paths after +allocation failures, leading to a memory leak. + +Johan said that move the kref_get() and mos_parport assignment to the +end of urbtrack initialisation is a better way, so move it. and +mos_parport do not used until urbtrack initialisation. + +Signed-off-by: Lin Yi +Fixes: b69578df7e98 ("USB: usbserial: mos7720: add support for parallel port on moschip 7715") +Cc: stable # 2.6.35 +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/mos7720.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -366,8 +366,6 @@ static int write_parport_reg_nonblock(st + if (!urbtrack) + return -ENOMEM; + +- kref_get(&mos_parport->ref_count); +- urbtrack->mos_parport = mos_parport; + urbtrack->urb = usb_alloc_urb(0, GFP_ATOMIC); + if (!urbtrack->urb) { + kfree(urbtrack); +@@ -388,6 +386,8 @@ static int write_parport_reg_nonblock(st + usb_sndctrlpipe(usbdev, 0), + (unsigned char *)urbtrack->setup, + NULL, 0, async_complete, urbtrack); ++ kref_get(&mos_parport->ref_count); ++ urbtrack->mos_parport = mos_parport; + kref_init(&urbtrack->ref_count); + INIT_LIST_HEAD(&urbtrack->urblist_entry); + diff --git a/queue-5.0/usb-serial-option-add-olicard-600.patch b/queue-5.0/usb-serial-option-add-olicard-600.patch new file mode 100644 index 00000000000..6282b23915b --- /dev/null +++ b/queue-5.0/usb-serial-option-add-olicard-600.patch @@ -0,0 +1,74 @@ +From 84f3b43f7378b98b7e3096d5499de75183d4347c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= +Date: Wed, 27 Mar 2019 15:25:32 +0100 +Subject: USB: serial: option: add Olicard 600 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bjørn Mork + +commit 84f3b43f7378b98b7e3096d5499de75183d4347c upstream. + +This is a Qualcomm based device with a QMI function on interface 4. +It is mode switched from 2020:2030 using a standard eject message. + +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2020 ProdID=2031 Rev= 2.32 +S: Manufacturer=Mobile Connect +S: Product=Mobile Connect +S: SerialNumber=0123456789ABCDEF +C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) +E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us + +Cc: stable@vger.kernel.org +Signed-off-by: Bjørn Mork +[ johan: use tabs to align comments in adjacent lines ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1945,10 +1945,12 @@ static const struct usb_device_id option + .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */ + .driver_info = RSVD(4) }, +- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ +- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ +- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ +- { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ ++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ ++ .driver_info = RSVD(4) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ + { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, + { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, + { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) }, diff --git a/queue-5.0/usb-serial-option-add-support-for-quectel-em12.patch b/queue-5.0/usb-serial-option-add-support-for-quectel-em12.patch new file mode 100644 index 00000000000..730876eeb99 --- /dev/null +++ b/queue-5.0/usb-serial-option-add-support-for-quectel-em12.patch @@ -0,0 +1,42 @@ +From d1252f0237238b912c3e7a51bf237acf34c97983 Mon Sep 17 00:00:00 2001 +From: Kristian Evensen +Date: Sat, 2 Mar 2019 13:35:53 +0100 +Subject: USB: serial: option: add support for Quectel EM12 + +From: Kristian Evensen + +commit d1252f0237238b912c3e7a51bf237acf34c97983 upstream. + +The Quectel EM12 is a Cat. 12 LTE modem. It behaves in the exactly the +same way as the EP06 (including the dynamic configuration behavior), so +the same checks on reserved interfaces, etc. are needed. + +Signed-off-by: Kristian Evensen +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -246,6 +246,7 @@ static void option_instat_callback(struc + #define QUECTEL_PRODUCT_EC25 0x0125 + #define QUECTEL_PRODUCT_BG96 0x0296 + #define QUECTEL_PRODUCT_EP06 0x0306 ++#define QUECTEL_PRODUCT_EM12 0x0512 + + #define CMOTECH_VENDOR_ID 0x16d8 + #define CMOTECH_PRODUCT_6001 0x6001 +@@ -1088,6 +1089,9 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0xff, 0xff), ++ .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003), diff --git a/queue-5.0/usb-serial-option-set-driver_info-for-sim5218-and-compatibles.patch b/queue-5.0/usb-serial-option-set-driver_info-for-sim5218-and-compatibles.patch new file mode 100644 index 00000000000..55d13c2087a --- /dev/null +++ b/queue-5.0/usb-serial-option-set-driver_info-for-sim5218-and-compatibles.patch @@ -0,0 +1,36 @@ +From f8df5c2c3e2df5ffaf9fb5503da93d477a8c7db4 Mon Sep 17 00:00:00 2001 +From: Mans Rullgard +Date: Tue, 26 Feb 2019 17:07:10 +0000 +Subject: USB: serial: option: set driver_info for SIM5218 and compatibles + +From: Mans Rullgard + +commit f8df5c2c3e2df5ffaf9fb5503da93d477a8c7db4 upstream. + +The SIMCom SIM5218 and compatible devices have 5 USB interfaces, only 4 +of which are serial ports. The fifth is a network interface supported +by the qmi-wwan driver. Furthermore, the serial ports do not support +modem control signals. Add driver_info flags to reflect this. + +Signed-off-by: Mans Rullgard +Fixes: ec0cd94d881c ("usb: option: add SIMCom SIM5218") +Cc: stable # 3.2 +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1066,7 +1066,8 @@ static const struct usb_device_id option + .driver_info = RSVD(3) }, + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */ +- { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */ ++ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000), /* SIMCom SIM5218 */ ++ .driver_info = NCTRL(0) | NCTRL(1) | NCTRL(2) | NCTRL(3) | RSVD(4) }, + /* Quectel products using Qualcomm vendor ID */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)}, + { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20),