From 56ec9cb79fb8b9bea33b1e3015ae3a0110f1984f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 1 Mar 2021 11:37:30 +0100 Subject: [PATCH] 4.4-stable patches added patches: btrfs-fix-reloc-root-leak-with-0-ref-reloc-roots-on-recovery.patch drivers-misc-vmw_vmci-restrict-too-big-queue-size-in-qp_host_alloc_queue.patch keys-trusted-fix-migratable-1-failing.patch usb-dwc3-gadget-fix-dep-interval-for-fullspeed-interrupt.patch usb-dwc3-gadget-fix-setting-of-depcfg.binterval_m1.patch usb-serial-mos7720-fix-error-code-in-mos7720_write.patch usb-serial-mos7840-fix-error-code-in-mos7840_write.patch usb-serial-option-update-interface-mapping-for-zte-p685m.patch --- ...k-with-0-ref-reloc-roots-on-recovery.patch | 48 ++++++++++++ ...ig-queue-size-in-qp_host_alloc_queue.patch | 50 ++++++++++++ ...eys-trusted-fix-migratable-1-failing.patch | 46 +++++++++++ queue-4.4/series | 8 ++ ...dep-interval-for-fullspeed-interrupt.patch | 41 ++++++++++ ...t-fix-setting-of-depcfg.binterval_m1.patch | 43 ++++++++++ ...7720-fix-error-code-in-mos7720_write.patch | 35 +++++++++ ...7840-fix-error-code-in-mos7840_write.patch | 34 ++++++++ ...date-interface-mapping-for-zte-p685m.patch | 78 +++++++++++++++++++ 9 files changed, 383 insertions(+) create mode 100644 queue-4.4/btrfs-fix-reloc-root-leak-with-0-ref-reloc-roots-on-recovery.patch create mode 100644 queue-4.4/drivers-misc-vmw_vmci-restrict-too-big-queue-size-in-qp_host_alloc_queue.patch create mode 100644 queue-4.4/keys-trusted-fix-migratable-1-failing.patch create mode 100644 queue-4.4/usb-dwc3-gadget-fix-dep-interval-for-fullspeed-interrupt.patch create mode 100644 queue-4.4/usb-dwc3-gadget-fix-setting-of-depcfg.binterval_m1.patch create mode 100644 queue-4.4/usb-serial-mos7720-fix-error-code-in-mos7720_write.patch create mode 100644 queue-4.4/usb-serial-mos7840-fix-error-code-in-mos7840_write.patch create mode 100644 queue-4.4/usb-serial-option-update-interface-mapping-for-zte-p685m.patch diff --git a/queue-4.4/btrfs-fix-reloc-root-leak-with-0-ref-reloc-roots-on-recovery.patch b/queue-4.4/btrfs-fix-reloc-root-leak-with-0-ref-reloc-roots-on-recovery.patch new file mode 100644 index 00000000000..6dc56eec1ab --- /dev/null +++ b/queue-4.4/btrfs-fix-reloc-root-leak-with-0-ref-reloc-roots-on-recovery.patch @@ -0,0 +1,48 @@ +From c78a10aebb275c38d0cfccae129a803fe622e305 Mon Sep 17 00:00:00 2001 +From: Josef Bacik +Date: Thu, 14 Jan 2021 14:02:42 -0500 +Subject: btrfs: fix reloc root leak with 0 ref reloc roots on recovery + +From: Josef Bacik + +commit c78a10aebb275c38d0cfccae129a803fe622e305 upstream. + +When recovering a relocation, if we run into a reloc root that has 0 +refs we simply add it to the reloc_control->reloc_roots list, and then +clean it up later. The problem with this is __del_reloc_root() doesn't +do anything if the root isn't in the radix tree, which in this case it +won't be because we never call __add_reloc_root() on the reloc_root. + +This exit condition simply isn't correct really. During normal +operation we can remove ourselves from the rb tree and then we're meant +to clean up later at merge_reloc_roots() time, and this happens +correctly. During recovery we're depending on free_reloc_roots() to +drop our references, but we're short-circuiting. + +Fix this by continuing to check if we're on the list and dropping +ourselves from the reloc_control root list and dropping our reference +appropriately. Change the corresponding BUG_ON() to an ASSERT() that +does the correct thing if we aren't in the rb tree. + +CC: stable@vger.kernel.org # 4.4+ +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/relocation.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -1328,9 +1328,7 @@ static void __del_reloc_root(struct btrf + RB_CLEAR_NODE(&node->rb_node); + } + spin_unlock(&rc->reloc_root_tree.lock); +- if (!node) +- return; +- BUG_ON((struct btrfs_root *)node->data != root); ++ ASSERT(!node || (struct btrfs_root *)node->data == root); + } + + spin_lock(&root->fs_info->trans_lock); diff --git a/queue-4.4/drivers-misc-vmw_vmci-restrict-too-big-queue-size-in-qp_host_alloc_queue.patch b/queue-4.4/drivers-misc-vmw_vmci-restrict-too-big-queue-size-in-qp_host_alloc_queue.patch new file mode 100644 index 00000000000..4d0627065bc --- /dev/null +++ b/queue-4.4/drivers-misc-vmw_vmci-restrict-too-big-queue-size-in-qp_host_alloc_queue.patch @@ -0,0 +1,50 @@ +From 2fd10bcf0310b9525b2af9e1f7aa9ddd87c3772e Mon Sep 17 00:00:00 2001 +From: Sabyrzhan Tasbolatov +Date: Tue, 9 Feb 2021 16:26:12 +0600 +Subject: drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue + +From: Sabyrzhan Tasbolatov + +commit 2fd10bcf0310b9525b2af9e1f7aa9ddd87c3772e upstream. + +syzbot found WARNING in qp_broker_alloc[1] in qp_host_alloc_queue() +when num_pages is 0x100001, giving queue_size + queue_page_size +bigger than KMALLOC_MAX_SIZE for kzalloc(), resulting order >= MAX_ORDER +condition. + +queue_size + queue_page_size=0x8000d8, where KMALLOC_MAX_SIZE=0x400000. + +[1] +Call Trace: + alloc_pages include/linux/gfp.h:547 [inline] + kmalloc_order+0x40/0x130 mm/slab_common.c:837 + kmalloc_order_trace+0x15/0x70 mm/slab_common.c:853 + kmalloc_large include/linux/slab.h:481 [inline] + __kmalloc+0x257/0x330 mm/slub.c:3959 + kmalloc include/linux/slab.h:557 [inline] + kzalloc include/linux/slab.h:682 [inline] + qp_host_alloc_queue drivers/misc/vmw_vmci/vmci_queue_pair.c:540 [inline] + qp_broker_create drivers/misc/vmw_vmci/vmci_queue_pair.c:1351 [inline] + qp_broker_alloc+0x936/0x2740 drivers/misc/vmw_vmci/vmci_queue_pair.c:1739 + +Reported-by: syzbot+15ec7391f3d6a1a7cc7d@syzkaller.appspotmail.com +Signed-off-by: Sabyrzhan Tasbolatov +Link: https://lore.kernel.org/r/20210209102612.2112247-1-snovitoll@gmail.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/vmw_vmci/vmci_queue_pair.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c ++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c +@@ -639,6 +639,9 @@ static struct vmci_queue *qp_host_alloc_ + + queue_page_size = num_pages * sizeof(*queue->kernel_if->u.h.page); + ++ if (queue_size + queue_page_size > KMALLOC_MAX_SIZE) ++ return NULL; ++ + queue = kzalloc(queue_size + queue_page_size, GFP_KERNEL); + if (queue) { + queue->q_header = NULL; diff --git a/queue-4.4/keys-trusted-fix-migratable-1-failing.patch b/queue-4.4/keys-trusted-fix-migratable-1-failing.patch new file mode 100644 index 00000000000..3badb216596 --- /dev/null +++ b/queue-4.4/keys-trusted-fix-migratable-1-failing.patch @@ -0,0 +1,46 @@ +From 8da7520c80468c48f981f0b81fc1be6599e3b0ad Mon Sep 17 00:00:00 2001 +From: Jarkko Sakkinen +Date: Fri, 29 Jan 2021 01:56:20 +0200 +Subject: KEYS: trusted: Fix migratable=1 failing + +From: Jarkko Sakkinen + +commit 8da7520c80468c48f981f0b81fc1be6599e3b0ad upstream. + +Consider the following transcript: + +$ keyctl add trusted kmk "new 32 blobauth=helloworld keyhandle=80000000 migratable=1" @u +add_key: Invalid argument + +The documentation has the following description: + + migratable= 0|1 indicating permission to reseal to new PCR values, + default 1 (resealing allowed) + +The consequence is that "migratable=1" should succeed. Fix this by +allowing this condition to pass instead of return -EINVAL. + +[*] Documentation/security/keys/trusted-encrypted.rst + +Cc: stable@vger.kernel.org +Cc: "James E.J. Bottomley" +Cc: Mimi Zohar +Cc: David Howells +Fixes: d00a1c72f7f4 ("keys: add new trusted key-type") +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Greg Kroah-Hartman +--- + security/keys/trusted.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/security/keys/trusted.c ++++ b/security/keys/trusted.c +@@ -778,7 +778,7 @@ static int getoptions(char *c, struct tr + case Opt_migratable: + if (*args[0].from == '0') + pay->migratable = 0; +- else ++ else if (*args[0].from != '1') + return -EINVAL; + break; + case Opt_pcrlock: diff --git a/queue-4.4/series b/queue-4.4/series index e1d3f053633..934f0e288e8 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -64,3 +64,11 @@ blk-settings-align-max_sectors-on-logical_block_size-boundary.patch input-xpad-add-support-for-powera-enhanced-wired-controller-for-xbox-series-x-s.patch input-joydev-prevent-potential-read-overflow-in-ioctl.patch input-i8042-add-asus-zenbook-flip-to-noselftest-list.patch +usb-serial-option-update-interface-mapping-for-zte-p685m.patch +usb-serial-mos7840-fix-error-code-in-mos7840_write.patch +usb-serial-mos7720-fix-error-code-in-mos7720_write.patch +usb-dwc3-gadget-fix-setting-of-depcfg.binterval_m1.patch +usb-dwc3-gadget-fix-dep-interval-for-fullspeed-interrupt.patch +keys-trusted-fix-migratable-1-failing.patch +btrfs-fix-reloc-root-leak-with-0-ref-reloc-roots-on-recovery.patch +drivers-misc-vmw_vmci-restrict-too-big-queue-size-in-qp_host_alloc_queue.patch diff --git a/queue-4.4/usb-dwc3-gadget-fix-dep-interval-for-fullspeed-interrupt.patch b/queue-4.4/usb-dwc3-gadget-fix-dep-interval-for-fullspeed-interrupt.patch new file mode 100644 index 00000000000..fb96083a711 --- /dev/null +++ b/queue-4.4/usb-dwc3-gadget-fix-dep-interval-for-fullspeed-interrupt.patch @@ -0,0 +1,41 @@ +From 4b049f55ed95cd889bcdb3034fd75e1f01852b38 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Mon, 8 Feb 2021 13:53:16 -0800 +Subject: usb: dwc3: gadget: Fix dep->interval for fullspeed interrupt + +From: Thinh Nguyen + +commit 4b049f55ed95cd889bcdb3034fd75e1f01852b38 upstream. + +The dep->interval captures the number of frames/microframes per interval +from bInterval. Fullspeed interrupt endpoint bInterval is the number of +frames per interval and not 2^(bInterval - 1). So fix it here. This +change is only for debugging purpose and should not affect the interrupt +endpoint operation. + +Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") +Cc: +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/1263b563dedc4ab8b0fb854fba06ce4bc56bd495.1612820995.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -531,8 +531,13 @@ static int dwc3_gadget_set_ep_config(str + if (dwc->gadget.speed == USB_SPEED_FULL) + bInterval_m1 = 0; + ++ if (usb_endpoint_type(desc) == USB_ENDPOINT_XFER_INT && ++ dwc->gadget.speed == USB_SPEED_FULL) ++ dep->interval = desc->bInterval; ++ else ++ dep->interval = 1 << (desc->bInterval - 1); ++ + params.param1 |= DWC3_DEPCFG_BINTERVAL_M1(bInterval_m1); +- dep->interval = 1 << (desc->bInterval - 1); + } + + return dwc3_send_gadget_ep_cmd(dwc, dep->number, diff --git a/queue-4.4/usb-dwc3-gadget-fix-setting-of-depcfg.binterval_m1.patch b/queue-4.4/usb-dwc3-gadget-fix-setting-of-depcfg.binterval_m1.patch new file mode 100644 index 00000000000..55fc9714894 --- /dev/null +++ b/queue-4.4/usb-dwc3-gadget-fix-setting-of-depcfg.binterval_m1.patch @@ -0,0 +1,43 @@ +From a1679af85b2ae35a2b78ad04c18bb069c37330cc Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Mon, 8 Feb 2021 13:53:10 -0800 +Subject: usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1 + +From: Thinh Nguyen + +commit a1679af85b2ae35a2b78ad04c18bb069c37330cc upstream. + +Valid range for DEPCFG.bInterval_m1 is from 0 to 13, and it must be set +to 0 when the controller operates in full-speed. See the programming +guide for DEPCFG command section 3.2.2.1 (v3.30a). + +Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") +Cc: +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/3f57026f993c0ce71498dbb06e49b3a47c4d0265.1612820995.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -521,7 +521,17 @@ static int dwc3_gadget_set_ep_config(str + params.param0 |= DWC3_DEPCFG_FIFO_NUMBER(dep->number >> 1); + + if (desc->bInterval) { +- params.param1 |= DWC3_DEPCFG_BINTERVAL_M1(desc->bInterval - 1); ++ u8 bInterval_m1; ++ ++ /* ++ * Valid range for DEPCFG.bInterval_m1 is from 0 to 13, and it ++ * must be set to 0 when the controller operates in full-speed. ++ */ ++ bInterval_m1 = min_t(u8, desc->bInterval - 1, 13); ++ if (dwc->gadget.speed == USB_SPEED_FULL) ++ bInterval_m1 = 0; ++ ++ params.param1 |= DWC3_DEPCFG_BINTERVAL_M1(bInterval_m1); + dep->interval = 1 << (desc->bInterval - 1); + } + diff --git a/queue-4.4/usb-serial-mos7720-fix-error-code-in-mos7720_write.patch b/queue-4.4/usb-serial-mos7720-fix-error-code-in-mos7720_write.patch new file mode 100644 index 00000000000..ae2df5aad5d --- /dev/null +++ b/queue-4.4/usb-serial-mos7720-fix-error-code-in-mos7720_write.patch @@ -0,0 +1,35 @@ +From fea7372cbc40869876df0f045e367f6f97a1666c Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 28 Jan 2021 12:35:23 +0300 +Subject: USB: serial: mos7720: fix error code in mos7720_write() + +From: Dan Carpenter + +commit fea7372cbc40869876df0f045e367f6f97a1666c upstream. + +This code should return -ENOMEM if the kmalloc() fails but instead +it returns success. + +Signed-off-by: Dan Carpenter +Fixes: 0f64478cbc7a ("USB: add USB serial mos7720 driver") +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/mos7720.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -1239,8 +1239,10 @@ static int mos7720_write(struct tty_stru + if (urb->transfer_buffer == NULL) { + urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE, + GFP_ATOMIC); +- if (!urb->transfer_buffer) ++ if (!urb->transfer_buffer) { ++ bytes_sent = -ENOMEM; + goto exit; ++ } + } + transfer_size = min(count, URB_TRANSFER_BUFFER_SIZE); + diff --git a/queue-4.4/usb-serial-mos7840-fix-error-code-in-mos7840_write.patch b/queue-4.4/usb-serial-mos7840-fix-error-code-in-mos7840_write.patch new file mode 100644 index 00000000000..e877b8efe98 --- /dev/null +++ b/queue-4.4/usb-serial-mos7840-fix-error-code-in-mos7840_write.patch @@ -0,0 +1,34 @@ +From a70aa7dc60099bbdcbd6faca42a915d80f31161e Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 26 Jan 2021 13:26:54 +0300 +Subject: USB: serial: mos7840: fix error code in mos7840_write() + +From: Dan Carpenter + +commit a70aa7dc60099bbdcbd6faca42a915d80f31161e upstream. + +This should return -ENOMEM instead of 0 if the kmalloc() fails. + +Fixes: 3f5429746d91 ("USB: Moschip 7840 USB-Serial Driver") +Signed-off-by: Dan Carpenter +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/mos7840.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -1362,8 +1362,10 @@ static int mos7840_write(struct tty_stru + if (urb->transfer_buffer == NULL) { + urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE, + GFP_ATOMIC); +- if (!urb->transfer_buffer) ++ if (!urb->transfer_buffer) { ++ bytes_sent = -ENOMEM; + goto exit; ++ } + } + transfer_size = min(count, URB_TRANSFER_BUFFER_SIZE); + diff --git a/queue-4.4/usb-serial-option-update-interface-mapping-for-zte-p685m.patch b/queue-4.4/usb-serial-option-update-interface-mapping-for-zte-p685m.patch new file mode 100644 index 00000000000..b0ec597edda --- /dev/null +++ b/queue-4.4/usb-serial-option-update-interface-mapping-for-zte-p685m.patch @@ -0,0 +1,78 @@ +From 6420a569504e212d618d4a4736e2c59ed80a8478 Mon Sep 17 00:00:00 2001 +From: Lech Perczak +Date: Sun, 7 Feb 2021 01:54:43 +0100 +Subject: USB: serial: option: update interface mapping for ZTE P685M +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lech Perczak + +commit 6420a569504e212d618d4a4736e2c59ed80a8478 upstream. + +This patch prepares for qmi_wwan driver support for the device. +Previously "option" driver mapped itself to interfaces 0 and 3 (matching +ff/ff/ff), while interface 3 is in fact a QMI port. +Interfaces 1 and 2 (matching ff/00/00) expose AT commands, +and weren't supported previously at all. +Without this patch, a possible conflict would exist if device ID was +added to qmi_wwan driver for interface 3. + +Update and simplify device ID to match interfaces 0-2 directly, +to expose QCDM (0), PCUI (1), and modem (2) ports and avoid conflict +with QMI (3), and ADB (4). + +The modem is used inside ZTE MF283+ router and carriers identify it as +such. +Interface mapping is: +0: QCDM, 1: AT (PCUI), 2: AT (Modem), 3: QMI, 4: ADB + +T: Bus=02 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=19d2 ProdID=1275 Rev=f0.00 +S: Manufacturer=ZTE,Incorporated +S: Product=ZTE Technologies MSM +S: SerialNumber=P685M510ZTED0000CP&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&0 +C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=87(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Cc: Johan Hovold +Cc: Bjørn Mork +Signed-off-by: Lech Perczak +Link: https://lore.kernel.org/r/20210207005443.12936-1-lech.perczak@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1551,7 +1551,8 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1272, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1273, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1274, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1275, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE(ZTE_VENDOR_ID, 0x1275), /* ZTE P685M */ ++ .driver_info = RSVD(3) | RSVD(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1276, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1277, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1278, 0xff, 0xff, 0xff) }, -- 2.47.3