From 176140cd755aa89a58aec9e0d5388429151b6977 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 31 Jan 2021 15:45:55 +0100 Subject: [PATCH] 4.14-stable patches added patches: arm-dts-imx6qdl-gw52xx-fix-duplicate-regulator-naming.patch net-usb-qmi_wwan-added-support-for-thales-cinterion-plsx3-modem-family.patch wext-fix-null-ptr-dereference-with-cfg80211-s-lack-of-commit.patch --- ...w52xx-fix-duplicate-regulator-naming.patch | 38 ++ ...-thales-cinterion-plsx3-modem-family.patch | 400 ++++++++++++++++++ queue-4.14/series | 3 + ...rence-with-cfg80211-s-lack-of-commit.patch | 50 +++ 4 files changed, 491 insertions(+) create mode 100644 queue-4.14/arm-dts-imx6qdl-gw52xx-fix-duplicate-regulator-naming.patch create mode 100644 queue-4.14/net-usb-qmi_wwan-added-support-for-thales-cinterion-plsx3-modem-family.patch create mode 100644 queue-4.14/wext-fix-null-ptr-dereference-with-cfg80211-s-lack-of-commit.patch diff --git a/queue-4.14/arm-dts-imx6qdl-gw52xx-fix-duplicate-regulator-naming.patch b/queue-4.14/arm-dts-imx6qdl-gw52xx-fix-duplicate-regulator-naming.patch new file mode 100644 index 00000000000..a7dfcacdc66 --- /dev/null +++ b/queue-4.14/arm-dts-imx6qdl-gw52xx-fix-duplicate-regulator-naming.patch @@ -0,0 +1,38 @@ +From 5a22747b76ca2384057d8e783265404439d31d7f Mon Sep 17 00:00:00 2001 +From: Koen Vandeputte +Date: Thu, 7 Jan 2021 10:19:06 +0100 +Subject: ARM: dts: imx6qdl-gw52xx: fix duplicate regulator naming + +From: Koen Vandeputte + +commit 5a22747b76ca2384057d8e783265404439d31d7f upstream. + +2 regulator descriptions carry identical naming. + +This leads to following boot warning: +[ 0.173138] debugfs: Directory 'vdd1p8' with parent 'regulator' already present! + +Fix this by renaming the one used for audio. + +Fixes: 5051bff33102 ("ARM: dts: imx: ventana: add LTC3676 PMIC support") +Signed-off-by: Tim Harvey +Signed-off-by: Koen Vandeputte +Cc: stable@vger.kernel.org # v4.11 +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/imx6qdl-gw52xx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi +@@ -278,7 +278,7 @@ + + /* VDD_AUD_1P8: Audio codec */ + reg_aud_1p8v: ldo3 { +- regulator-name = "vdd1p8"; ++ regulator-name = "vdd1p8a"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-boot-on; diff --git a/queue-4.14/net-usb-qmi_wwan-added-support-for-thales-cinterion-plsx3-modem-family.patch b/queue-4.14/net-usb-qmi_wwan-added-support-for-thales-cinterion-plsx3-modem-family.patch new file mode 100644 index 00000000000..5d67d3b0383 --- /dev/null +++ b/queue-4.14/net-usb-qmi_wwan-added-support-for-thales-cinterion-plsx3-modem-family.patch @@ -0,0 +1,400 @@ +From 7e0e63d09516e96994c879f07c5a3c3269d7015e Mon Sep 17 00:00:00 2001 +From: Giacinto Cifelli +Date: Wed, 20 Jan 2021 05:56:50 +0100 +Subject: net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem family +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Giacinto Cifelli + +commit 7e0e63d09516e96994c879f07c5a3c3269d7015e upstream. + +Bus 003 Device 009: ID 1e2d:006f +Device Descriptor: + bLength 18 + bDescriptorType 1 + bcdUSB 2.00 + bDeviceClass 239 Miscellaneous Device + bDeviceSubClass 2 ? + bDeviceProtocol 1 Interface Association + bMaxPacketSize0 64 + idVendor 0x1e2d + idProduct 0x006f + bcdDevice 0.00 + iManufacturer 3 Cinterion Wireless Modules + iProduct 2 PLSx3 + iSerial 4 fa3c1419 + bNumConfigurations 1 + Configuration Descriptor: + bLength 9 + bDescriptorType 2 + wTotalLength 303 + bNumInterfaces 9 + bConfigurationValue 1 + iConfiguration 1 Cinterion Configuration + bmAttributes 0xe0 + Self Powered + Remote Wakeup + MaxPower 500mA + Interface Association: + bLength 8 + bDescriptorType 11 + bFirstInterface 0 + bInterfaceCount 2 + bFunctionClass 2 Communications + bFunctionSubClass 2 Abstract (modem) + bFunctionProtocol 1 AT-commands (v.25ter) + iFunction 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 0 + bAlternateSetting 0 + bNumEndpoints 1 + bInterfaceClass 2 Communications + bInterfaceSubClass 2 Abstract (modem) + bInterfaceProtocol 1 AT-commands (v.25ter) + iInterface 0 + CDC Header: + bcdCDC 1.10 + CDC ACM: + bmCapabilities 0x02 + line coding and serial state + CDC Call Management: + bmCapabilities 0x03 + call management + use DataInterface + bDataInterface 1 + CDC Union: + bMasterInterface 0 + bSlaveInterface 1 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x81 EP 1 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 5 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 1 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 Unused + bInterfaceProtocol 0 + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x82 EP 2 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x01 EP 1 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Interface Association: + bLength 8 + bDescriptorType 11 + bFirstInterface 2 + bInterfaceCount 2 + bFunctionClass 2 Communications + bFunctionSubClass 2 Abstract (modem) + bFunctionProtocol 1 AT-commands (v.25ter) + iFunction 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 2 + bAlternateSetting 0 + bNumEndpoints 1 + bInterfaceClass 2 Communications + bInterfaceSubClass 2 Abstract (modem) + bInterfaceProtocol 1 AT-commands (v.25ter) + iInterface 0 + CDC Header: + bcdCDC 1.10 + CDC ACM: + bmCapabilities 0x02 + line coding and serial state + CDC Call Management: + bmCapabilities 0x03 + call management + use DataInterface + bDataInterface 3 + CDC Union: + bMasterInterface 2 + bSlaveInterface 3 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x83 EP 3 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 5 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 3 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 Unused + bInterfaceProtocol 0 + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x84 EP 4 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x02 EP 2 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Interface Association: + bLength 8 + bDescriptorType 11 + bFirstInterface 4 + bInterfaceCount 2 + bFunctionClass 2 Communications + bFunctionSubClass 2 Abstract (modem) + bFunctionProtocol 1 AT-commands (v.25ter) + iFunction 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 4 + bAlternateSetting 0 + bNumEndpoints 1 + bInterfaceClass 2 Communications + bInterfaceSubClass 2 Abstract (modem) + bInterfaceProtocol 1 AT-commands (v.25ter) + iInterface 0 + CDC Header: + bcdCDC 1.10 + CDC ACM: + bmCapabilities 0x02 + line coding and serial state + CDC Call Management: + bmCapabilities 0x03 + call management + use DataInterface + bDataInterface 5 + CDC Union: + bMasterInterface 4 + bSlaveInterface 5 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x85 EP 5 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 5 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 5 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 Unused + bInterfaceProtocol 0 + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x86 EP 6 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x03 EP 3 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Interface Association: + bLength 8 + bDescriptorType 11 + bFirstInterface 6 + bInterfaceCount 2 + bFunctionClass 2 Communications + bFunctionSubClass 2 Abstract (modem) + bFunctionProtocol 1 AT-commands (v.25ter) + iFunction 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 6 + bAlternateSetting 0 + bNumEndpoints 1 + bInterfaceClass 2 Communications + bInterfaceSubClass 2 Abstract (modem) + bInterfaceProtocol 1 AT-commands (v.25ter) + iInterface 0 + CDC Header: + bcdCDC 1.10 + CDC ACM: + bmCapabilities 0x02 + line coding and serial state + CDC Call Management: + bmCapabilities 0x03 + call management + use DataInterface + bDataInterface 7 + CDC Union: + bMasterInterface 6 + bSlaveInterface 7 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x87 EP 7 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 5 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 7 + bAlternateSetting 0 + bNumEndpoints 2 + bInterfaceClass 10 CDC Data + bInterfaceSubClass 0 Unused + bInterfaceProtocol 0 + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x88 EP 8 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x04 EP 4 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Interface Descriptor: + bLength 9 + bDescriptorType 4 + bInterfaceNumber 8 + bAlternateSetting 0 + bNumEndpoints 3 + bInterfaceClass 255 Vendor Specific Class + bInterfaceSubClass 255 Vendor Specific Subclass + bInterfaceProtocol 255 Vendor Specific Protocol + iInterface 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x89 EP 9 IN + bmAttributes 3 + Transfer Type Interrupt + Synch Type None + Usage Type Data + wMaxPacketSize 0x0040 1x 64 bytes + bInterval 5 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x8a EP 10 IN + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 + Endpoint Descriptor: + bLength 7 + bDescriptorType 5 + bEndpointAddress 0x05 EP 5 OUT + bmAttributes 2 + Transfer Type Bulk + Synch Type None + Usage Type Data + wMaxPacketSize 0x0200 1x 512 bytes + bInterval 0 +Device Qualifier (for other device speed): + bLength 10 + bDescriptorType 6 + bcdUSB 2.00 + bDeviceClass 239 Miscellaneous Device + bDeviceSubClass 2 ? + bDeviceProtocol 1 Interface Association + bMaxPacketSize0 64 + bNumConfigurations 1 +Device Status: 0x0000 + (Bus Powered) + +Cc: stable@vger.kernel.org +Signed-off-by: Giacinto Cifelli +Acked-by: Bjørn Mork +Link: https://lore.kernel.org/r/20210120045650.10855-1-gciofono@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1273,6 +1273,7 @@ static const struct usb_device_id produc + {QMI_FIXED_INTF(0x0b3c, 0xc00a, 6)}, /* Olivetti Olicard 160 */ + {QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)}, /* Olivetti Olicard 500 */ + {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)}, /* Cinterion PLxx */ ++ {QMI_QUIRK_SET_DTR(0x1e2d, 0x006f, 8)}, /* Cinterion PLS83/PLS63 */ + {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)}, /* Cinterion PHxx,PXxx */ + {QMI_FIXED_INTF(0x1e2d, 0x0063, 10)}, /* Cinterion ALASxx (1 RmNet) */ + {QMI_FIXED_INTF(0x1e2d, 0x0082, 4)}, /* Cinterion PHxx,PXxx (2 RmNet) */ diff --git a/queue-4.14/series b/queue-4.14/series index 7713a00c9d9..e4f1c720baf 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -1,2 +1,5 @@ nbd-freeze-the-queue-while-we-re-adding-connections.patch acpi-sysfs-prefer-compatible-modalias.patch +arm-dts-imx6qdl-gw52xx-fix-duplicate-regulator-naming.patch +wext-fix-null-ptr-dereference-with-cfg80211-s-lack-of-commit.patch +net-usb-qmi_wwan-added-support-for-thales-cinterion-plsx3-modem-family.patch diff --git a/queue-4.14/wext-fix-null-ptr-dereference-with-cfg80211-s-lack-of-commit.patch b/queue-4.14/wext-fix-null-ptr-dereference-with-cfg80211-s-lack-of-commit.patch new file mode 100644 index 00000000000..c403bdeebe0 --- /dev/null +++ b/queue-4.14/wext-fix-null-ptr-dereference-with-cfg80211-s-lack-of-commit.patch @@ -0,0 +1,50 @@ +From 5122565188bae59d507d90a9a9fd2fd6107f4439 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Thu, 21 Jan 2021 17:16:22 +0100 +Subject: wext: fix NULL-ptr-dereference with cfg80211's lack of commit() + +From: Johannes Berg + +commit 5122565188bae59d507d90a9a9fd2fd6107f4439 upstream. + +Since cfg80211 doesn't implement commit, we never really cared about +that code there (and it's configured out w/o CONFIG_WIRELESS_EXT). +After all, since it has no commit, it shouldn't return -EIWCOMMIT to +indicate commit is needed. + +However, EIWCOMMIT is actually an alias for EINPROGRESS, which _can_ +happen if e.g. we try to change the frequency but we're already in +the process of connecting to some network, and drivers could return +that value (or even cfg80211 itself might). + +This then causes us to crash because dev->wireless_handlers is NULL +but we try to check dev->wireless_handlers->standard[0]. + +Fix this by also checking dev->wireless_handlers. Also simplify the +code a little bit. + +Cc: stable@vger.kernel.org +Reported-by: syzbot+444248c79e117bc99f46@syzkaller.appspotmail.com +Reported-by: syzbot+8b2a88a09653d4084179@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/20210121171621.2076e4a37d5a.I5d9c72220fe7bb133fb718751da0180a57ecba4e@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/wext-core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/net/wireless/wext-core.c ++++ b/net/wireless/wext-core.c +@@ -898,8 +898,9 @@ out: + int call_commit_handler(struct net_device *dev) + { + #ifdef CONFIG_WIRELESS_EXT +- if ((netif_running(dev)) && +- (dev->wireless_handlers->standard[0] != NULL)) ++ if (netif_running(dev) && ++ dev->wireless_handlers && ++ dev->wireless_handlers->standard[0]) + /* Call the commit handler on the driver */ + return dev->wireless_handlers->standard[0](dev, NULL, + NULL, NULL); -- 2.47.3