From ccec1dfb60ba8963dbe1291ddab7d626b043702f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 15 Dec 2019 10:36:46 +0100 Subject: [PATCH] 4.4-stable patches added patches: iio-humidity-hdc100x-fix-iio_humidityrelative-channel-reporting.patch staging-gigaset-add-endpoint-type-sanity-check.patch staging-gigaset-fix-general-protection-fault-on-probe.patch staging-gigaset-fix-illegal-free-on-probe-errors.patch staging-rtl8188eu-fix-interface-sanity-check.patch staging-rtl8712-fix-interface-sanity-check.patch usb-adutux-fix-interface-sanity-check.patch usb-atm-ueagle-atm-add-missing-endpoint-check.patch usb-idmouse-fix-interface-sanity-checks.patch usb-serial-io_edgeport-fix-epic-endpoint-lookup.patch xhci-increase-sts_halt-timeout-in-xhci_suspend.patch --- ...o_humidityrelative-channel-reporting.patch | 34 +++++++ queue-4.4/series | 11 +++ ...gaset-add-endpoint-type-sanity-check.patch | 51 +++++++++++ ...ix-general-protection-fault-on-probe.patch | 40 +++++++++ ...set-fix-illegal-free-on-probe-errors.patch | 47 ++++++++++ ...rtl8188eu-fix-interface-sanity-check.patch | 36 ++++++++ ...g-rtl8712-fix-interface-sanity-check.patch | 36 ++++++++ ...sb-adutux-fix-interface-sanity-check.patch | 36 ++++++++ ...eagle-atm-add-missing-endpoint-check.patch | 90 +++++++++++++++++++ ...-idmouse-fix-interface-sanity-checks.patch | 36 ++++++++ ...io_edgeport-fix-epic-endpoint-lookup.patch | 50 +++++++++++ ...ase-sts_halt-timeout-in-xhci_suspend.patch | 43 +++++++++ 12 files changed, 510 insertions(+) create mode 100644 queue-4.4/iio-humidity-hdc100x-fix-iio_humidityrelative-channel-reporting.patch create mode 100644 queue-4.4/staging-gigaset-add-endpoint-type-sanity-check.patch create mode 100644 queue-4.4/staging-gigaset-fix-general-protection-fault-on-probe.patch create mode 100644 queue-4.4/staging-gigaset-fix-illegal-free-on-probe-errors.patch create mode 100644 queue-4.4/staging-rtl8188eu-fix-interface-sanity-check.patch create mode 100644 queue-4.4/staging-rtl8712-fix-interface-sanity-check.patch create mode 100644 queue-4.4/usb-adutux-fix-interface-sanity-check.patch create mode 100644 queue-4.4/usb-atm-ueagle-atm-add-missing-endpoint-check.patch create mode 100644 queue-4.4/usb-idmouse-fix-interface-sanity-checks.patch create mode 100644 queue-4.4/usb-serial-io_edgeport-fix-epic-endpoint-lookup.patch create mode 100644 queue-4.4/xhci-increase-sts_halt-timeout-in-xhci_suspend.patch diff --git a/queue-4.4/iio-humidity-hdc100x-fix-iio_humidityrelative-channel-reporting.patch b/queue-4.4/iio-humidity-hdc100x-fix-iio_humidityrelative-channel-reporting.patch new file mode 100644 index 00000000000..0cfff2cf026 --- /dev/null +++ b/queue-4.4/iio-humidity-hdc100x-fix-iio_humidityrelative-channel-reporting.patch @@ -0,0 +1,34 @@ +From 342a6928bd5017edbdae376042d8ad6af3d3b943 Mon Sep 17 00:00:00 2001 +From: Chris Lesiak +Date: Thu, 21 Nov 2019 20:39:42 +0000 +Subject: iio: humidity: hdc100x: fix IIO_HUMIDITYRELATIVE channel reporting + +From: Chris Lesiak + +commit 342a6928bd5017edbdae376042d8ad6af3d3b943 upstream. + +The IIO_HUMIDITYRELATIVE channel was being incorrectly reported back +as percent when it should have been milli percent. This is via an +incorrect scale value being returned to userspace. + +Signed-off-by: Chris Lesiak +Acked-by: Matt Ranostay +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/humidity/hdc100x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/humidity/hdc100x.c ++++ b/drivers/iio/humidity/hdc100x.c +@@ -215,7 +215,7 @@ static int hdc100x_read_raw(struct iio_d + *val2 = 65536; + return IIO_VAL_FRACTIONAL; + } else { +- *val = 100; ++ *val = 100000; + *val2 = 65536; + return IIO_VAL_FRACTIONAL; + } diff --git a/queue-4.4/series b/queue-4.4/series index 9c3cd892c2a..c12113e2e27 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -81,3 +81,14 @@ proc-fix-coredump-vs-read-proc-stat-race.patch fs-proc-array.c-allow-reporting-eip-esp-for-all-coredumping-threads.patch usb-gadget-configfs-fix-missing-spin_lock_init.patch usb-allow-usb-device-to-be-warm-reset-in-suspended-state.patch +staging-rtl8188eu-fix-interface-sanity-check.patch +staging-rtl8712-fix-interface-sanity-check.patch +staging-gigaset-fix-general-protection-fault-on-probe.patch +staging-gigaset-fix-illegal-free-on-probe-errors.patch +staging-gigaset-add-endpoint-type-sanity-check.patch +xhci-increase-sts_halt-timeout-in-xhci_suspend.patch +iio-humidity-hdc100x-fix-iio_humidityrelative-channel-reporting.patch +usb-atm-ueagle-atm-add-missing-endpoint-check.patch +usb-idmouse-fix-interface-sanity-checks.patch +usb-serial-io_edgeport-fix-epic-endpoint-lookup.patch +usb-adutux-fix-interface-sanity-check.patch diff --git a/queue-4.4/staging-gigaset-add-endpoint-type-sanity-check.patch b/queue-4.4/staging-gigaset-add-endpoint-type-sanity-check.patch new file mode 100644 index 00000000000..7f94c0bd481 --- /dev/null +++ b/queue-4.4/staging-gigaset-add-endpoint-type-sanity-check.patch @@ -0,0 +1,51 @@ +From ed9ed5a89acba51b82bdff61144d4e4a4245ec8a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 2 Dec 2019 09:56:10 +0100 +Subject: staging: gigaset: add endpoint-type sanity check + +From: Johan Hovold + +commit ed9ed5a89acba51b82bdff61144d4e4a4245ec8a upstream. + +Add missing endpoint-type sanity checks to probe. + +This specifically prevents a warning in USB core on URB submission when +fuzzing USB descriptors. + +Signed-off-by: Johan Hovold +Cc: stable +Link: https://lore.kernel.org/r/20191202085610.12719-4-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/isdn/gigaset/usb-gigaset.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/isdn/gigaset/usb-gigaset.c ++++ b/drivers/isdn/gigaset/usb-gigaset.c +@@ -708,6 +708,12 @@ static int gigaset_probe(struct usb_inte + + endpoint = &hostif->endpoint[0].desc; + ++ if (!usb_endpoint_is_bulk_out(endpoint)) { ++ dev_err(&interface->dev, "missing bulk-out endpoint\n"); ++ retval = -ENODEV; ++ goto error; ++ } ++ + buffer_size = le16_to_cpu(endpoint->wMaxPacketSize); + ucs->bulk_out_size = buffer_size; + ucs->bulk_out_epnum = usb_endpoint_num(endpoint); +@@ -727,6 +733,12 @@ static int gigaset_probe(struct usb_inte + + endpoint = &hostif->endpoint[1].desc; + ++ if (!usb_endpoint_is_int_in(endpoint)) { ++ dev_err(&interface->dev, "missing int-in endpoint\n"); ++ retval = -ENODEV; ++ goto error; ++ } ++ + ucs->busy = 0; + + ucs->read_urb = usb_alloc_urb(0, GFP_KERNEL); diff --git a/queue-4.4/staging-gigaset-fix-general-protection-fault-on-probe.patch b/queue-4.4/staging-gigaset-fix-general-protection-fault-on-probe.patch new file mode 100644 index 00000000000..8af6f38c70b --- /dev/null +++ b/queue-4.4/staging-gigaset-fix-general-protection-fault-on-probe.patch @@ -0,0 +1,40 @@ +From 53f35a39c3860baac1e5ca80bf052751cfb24a99 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 2 Dec 2019 09:56:08 +0100 +Subject: staging: gigaset: fix general protection fault on probe + +From: Johan Hovold + +commit 53f35a39c3860baac1e5ca80bf052751cfb24a99 upstream. + +Fix a general protection fault when accessing the endpoint descriptors +which could be triggered by a malicious device due to missing sanity +checks on the number of endpoints. + +Reported-by: syzbot+35b1c403a14f5c89eba7@syzkaller.appspotmail.com +Fixes: 07dc1f9f2f80 ("[PATCH] isdn4linux: Siemens Gigaset drivers - M105 USB DECT adapter") +Cc: stable # 2.6.17 +Cc: Hansjoerg Lipp +Cc: Tilman Schmidt +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20191202085610.12719-2-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/isdn/gigaset/usb-gigaset.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/isdn/gigaset/usb-gigaset.c ++++ b/drivers/isdn/gigaset/usb-gigaset.c +@@ -688,6 +688,11 @@ static int gigaset_probe(struct usb_inte + return -ENODEV; + } + ++ if (hostif->desc.bNumEndpoints < 2) { ++ dev_err(&interface->dev, "missing endpoints\n"); ++ return -ENODEV; ++ } ++ + dev_info(&udev->dev, "%s: Device matched ... !\n", __func__); + + /* allocate memory for our device state and initialize it */ diff --git a/queue-4.4/staging-gigaset-fix-illegal-free-on-probe-errors.patch b/queue-4.4/staging-gigaset-fix-illegal-free-on-probe-errors.patch new file mode 100644 index 00000000000..030fd44c9ff --- /dev/null +++ b/queue-4.4/staging-gigaset-fix-illegal-free-on-probe-errors.patch @@ -0,0 +1,47 @@ +From 84f60ca7b326ed8c08582417493982fe2573a9ad Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 2 Dec 2019 09:56:09 +0100 +Subject: staging: gigaset: fix illegal free on probe errors + +From: Johan Hovold + +commit 84f60ca7b326ed8c08582417493982fe2573a9ad upstream. + +The driver failed to initialise its receive-buffer pointer, something +which could lead to an illegal free on late probe errors. + +Fix this by making sure to clear all driver data at allocation. + +Fixes: 2032e2c2309d ("usb_gigaset: code cleanup") +Cc: stable # 2.6.33 +Cc: Tilman Schmidt +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20191202085610.12719-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/isdn/gigaset/usb-gigaset.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/drivers/isdn/gigaset/usb-gigaset.c ++++ b/drivers/isdn/gigaset/usb-gigaset.c +@@ -574,8 +574,7 @@ static int gigaset_initcshw(struct cards + { + struct usb_cardstate *ucs; + +- cs->hw.usb = ucs = +- kmalloc(sizeof(struct usb_cardstate), GFP_KERNEL); ++ cs->hw.usb = ucs = kzalloc(sizeof(struct usb_cardstate), GFP_KERNEL); + if (!ucs) { + pr_err("out of memory\n"); + return -ENOMEM; +@@ -587,9 +586,6 @@ static int gigaset_initcshw(struct cards + ucs->bchars[3] = 0; + ucs->bchars[4] = 0x11; + ucs->bchars[5] = 0x13; +- ucs->bulk_out_buffer = NULL; +- ucs->bulk_out_urb = NULL; +- ucs->read_urb = NULL; + tasklet_init(&cs->write_tasklet, + gigaset_modem_fill, (unsigned long) cs); + diff --git a/queue-4.4/staging-rtl8188eu-fix-interface-sanity-check.patch b/queue-4.4/staging-rtl8188eu-fix-interface-sanity-check.patch new file mode 100644 index 00000000000..8dce5ea2373 --- /dev/null +++ b/queue-4.4/staging-rtl8188eu-fix-interface-sanity-check.patch @@ -0,0 +1,36 @@ +From 74ca34118a0e05793935d804ccffcedd6eb56596 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 10 Dec 2019 12:47:50 +0100 +Subject: staging: rtl8188eu: fix interface sanity check + +From: Johan Hovold + +commit 74ca34118a0e05793935d804ccffcedd6eb56596 upstream. + +Make sure to use the current alternate setting when verifying the +interface descriptors to avoid binding to an invalid interface. + +Failing to do so could cause the driver to misbehave or trigger a WARN() +in usb_submit_urb() that kernels with panic_on_warn set would choke on. + +Fixes: c2478d39076b ("staging: r8188eu: Add files for new driver - part 20") +Cc: stable # 3.12 +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20191210114751.5119-2-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rtl8188eu/os_dep/usb_intf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c ++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +@@ -82,7 +82,7 @@ static struct dvobj_priv *usb_dvobj_init + phost_conf = pusbd->actconfig; + pconf_desc = &phost_conf->desc; + +- phost_iface = &usb_intf->altsetting[0]; ++ phost_iface = usb_intf->cur_altsetting; + piface_desc = &phost_iface->desc; + + pdvobjpriv->NumInterfaces = pconf_desc->bNumInterfaces; diff --git a/queue-4.4/staging-rtl8712-fix-interface-sanity-check.patch b/queue-4.4/staging-rtl8712-fix-interface-sanity-check.patch new file mode 100644 index 00000000000..26255362370 --- /dev/null +++ b/queue-4.4/staging-rtl8712-fix-interface-sanity-check.patch @@ -0,0 +1,36 @@ +From c724f776f048538ecfdf53a52b7a522309f5c504 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 10 Dec 2019 12:47:51 +0100 +Subject: staging: rtl8712: fix interface sanity check + +From: Johan Hovold + +commit c724f776f048538ecfdf53a52b7a522309f5c504 upstream. + +Make sure to use the current alternate setting when verifying the +interface descriptors to avoid binding to an invalid interface. + +Failing to do so could cause the driver to misbehave or trigger a WARN() +in usb_submit_urb() that kernels with panic_on_warn set would choke on. + +Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel") +Cc: stable # 2.6.37 +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20191210114751.5119-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rtl8712/usb_intf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/rtl8712/usb_intf.c ++++ b/drivers/staging/rtl8712/usb_intf.c +@@ -263,7 +263,7 @@ static uint r8712_usb_dvobj_init(struct + + pdvobjpriv->padapter = padapter; + padapter->EepromAddressSize = 6; +- phost_iface = &pintf->altsetting[0]; ++ phost_iface = pintf->cur_altsetting; + piface_desc = &phost_iface->desc; + pdvobjpriv->nr_endpoint = piface_desc->bNumEndpoints; + if (pusbd->speed == USB_SPEED_HIGH) { diff --git a/queue-4.4/usb-adutux-fix-interface-sanity-check.patch b/queue-4.4/usb-adutux-fix-interface-sanity-check.patch new file mode 100644 index 00000000000..631b320908e --- /dev/null +++ b/queue-4.4/usb-adutux-fix-interface-sanity-check.patch @@ -0,0 +1,36 @@ +From 3c11c4bed02b202e278c0f5c319ae435d7fb9815 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 10 Dec 2019 12:25:59 +0100 +Subject: USB: adutux: fix interface sanity check + +From: Johan Hovold + +commit 3c11c4bed02b202e278c0f5c319ae435d7fb9815 upstream. + +Make sure to use the current alternate setting when verifying the +interface descriptors to avoid binding to an invalid interface. + +Failing to do so could cause the driver to misbehave or trigger a WARN() +in usb_submit_urb() that kernels with panic_on_warn set would choke on. + +Fixes: 03270634e242 ("USB: Add ADU support for Ontrak ADU devices") +Cc: stable # 2.6.19 +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20191210112601.3561-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/adutux.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/misc/adutux.c ++++ b/drivers/usb/misc/adutux.c +@@ -686,7 +686,7 @@ static int adu_probe(struct usb_interfac + init_waitqueue_head(&dev->read_wait); + init_waitqueue_head(&dev->write_wait); + +- iface_desc = &interface->altsetting[0]; ++ iface_desc = &interface->cur_altsetting[0]; + + /* set up the endpoint information */ + for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { diff --git a/queue-4.4/usb-atm-ueagle-atm-add-missing-endpoint-check.patch b/queue-4.4/usb-atm-ueagle-atm-add-missing-endpoint-check.patch new file mode 100644 index 00000000000..8eaeb3e475b --- /dev/null +++ b/queue-4.4/usb-atm-ueagle-atm-add-missing-endpoint-check.patch @@ -0,0 +1,90 @@ +From 09068c1ad53fb077bdac288869dec2435420bdc4 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 10 Dec 2019 12:25:58 +0100 +Subject: USB: atm: ueagle-atm: add missing endpoint check + +From: Johan Hovold + +commit 09068c1ad53fb077bdac288869dec2435420bdc4 upstream. + +Make sure that the interrupt interface has an endpoint before trying to +access its endpoint descriptors to avoid dereferencing a NULL pointer. + +The driver binds to the interrupt interface with interface number 0, but +must not assume that this interface or its current alternate setting are +the first entries in the corresponding configuration arrays. + +Fixes: b72458a80c75 ("[PATCH] USB: Eagle and ADI 930 usb adsl modem driver") +Cc: stable # 2.6.16 +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20191210112601.3561-2-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/atm/ueagle-atm.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +--- a/drivers/usb/atm/ueagle-atm.c ++++ b/drivers/usb/atm/ueagle-atm.c +@@ -2167,10 +2167,11 @@ resubmit: + /* + * Start the modem : init the data and start kernel thread + */ +-static int uea_boot(struct uea_softc *sc) ++static int uea_boot(struct uea_softc *sc, struct usb_interface *intf) + { +- int ret, size; + struct intr_pkt *intr; ++ int ret = -ENOMEM; ++ int size; + + uea_enters(INS_TO_USBDEV(sc)); + +@@ -2195,6 +2196,11 @@ static int uea_boot(struct uea_softc *sc + if (UEA_CHIP_VERSION(sc) == ADI930) + load_XILINX_firmware(sc); + ++ if (intf->cur_altsetting->desc.bNumEndpoints < 1) { ++ ret = -ENODEV; ++ goto err0; ++ } ++ + intr = kmalloc(size, GFP_KERNEL); + if (!intr) { + uea_err(INS_TO_USBDEV(sc), +@@ -2211,8 +2217,7 @@ static int uea_boot(struct uea_softc *sc + usb_fill_int_urb(sc->urb_int, sc->usb_dev, + usb_rcvintpipe(sc->usb_dev, UEA_INTR_PIPE), + intr, size, uea_intr, sc, +- sc->usb_dev->actconfig->interface[0]->altsetting[0]. +- endpoint[0].desc.bInterval); ++ intf->cur_altsetting->endpoint[0].desc.bInterval); + + ret = usb_submit_urb(sc->urb_int, GFP_KERNEL); + if (ret < 0) { +@@ -2227,6 +2232,7 @@ static int uea_boot(struct uea_softc *sc + sc->kthread = kthread_create(uea_kthread, sc, "ueagle-atm"); + if (IS_ERR(sc->kthread)) { + uea_err(INS_TO_USBDEV(sc), "failed to create thread\n"); ++ ret = PTR_ERR(sc->kthread); + goto err2; + } + +@@ -2241,7 +2247,7 @@ err1: + kfree(intr); + err0: + uea_leaves(INS_TO_USBDEV(sc)); +- return -ENOMEM; ++ return ret; + } + + /* +@@ -2604,7 +2610,7 @@ static int uea_bind(struct usbatm_data * + if (ret < 0) + goto error; + +- ret = uea_boot(sc); ++ ret = uea_boot(sc, intf); + if (ret < 0) + goto error_rm_grp; + diff --git a/queue-4.4/usb-idmouse-fix-interface-sanity-checks.patch b/queue-4.4/usb-idmouse-fix-interface-sanity-checks.patch new file mode 100644 index 00000000000..b23e0153538 --- /dev/null +++ b/queue-4.4/usb-idmouse-fix-interface-sanity-checks.patch @@ -0,0 +1,36 @@ +From 59920635b89d74b9207ea803d5e91498d39e8b69 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 10 Dec 2019 12:26:00 +0100 +Subject: USB: idmouse: fix interface sanity checks + +From: Johan Hovold + +commit 59920635b89d74b9207ea803d5e91498d39e8b69 upstream. + +Make sure to use the current alternate setting when verifying the +interface descriptors to avoid binding to an invalid interface. + +Failing to do so could cause the driver to misbehave or trigger a WARN() +in usb_submit_urb() that kernels with panic_on_warn set would choke on. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20191210112601.3561-4-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/idmouse.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/misc/idmouse.c ++++ b/drivers/usb/misc/idmouse.c +@@ -342,7 +342,7 @@ static int idmouse_probe(struct usb_inte + int result; + + /* check if we have gotten the data or the hid interface */ +- iface_desc = &interface->altsetting[0]; ++ iface_desc = interface->cur_altsetting; + if (iface_desc->desc.bInterfaceClass != 0x0A) + return -ENODEV; + diff --git a/queue-4.4/usb-serial-io_edgeport-fix-epic-endpoint-lookup.patch b/queue-4.4/usb-serial-io_edgeport-fix-epic-endpoint-lookup.patch new file mode 100644 index 00000000000..c1bfa47dec5 --- /dev/null +++ b/queue-4.4/usb-serial-io_edgeport-fix-epic-endpoint-lookup.patch @@ -0,0 +1,50 @@ +From 7c5a2df3367a2c4984f1300261345817d95b71f8 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 10 Dec 2019 12:26:01 +0100 +Subject: USB: serial: io_edgeport: fix epic endpoint lookup + +From: Johan Hovold + +commit 7c5a2df3367a2c4984f1300261345817d95b71f8 upstream. + +Make sure to use the current alternate setting when looking up the +endpoints on epic devices to avoid binding to an invalid interface. + +Failing to do so could cause the driver to misbehave or trigger a WARN() +in usb_submit_urb() that kernels with panic_on_warn set would choke on. + +Fixes: 6e8cf7751f9f ("USB: add EPIC support to the io_edgeport driver") +Cc: stable # 2.6.21 +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20191210112601.3561-5-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/io_edgeport.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/usb/serial/io_edgeport.c ++++ b/drivers/usb/serial/io_edgeport.c +@@ -2859,16 +2859,18 @@ static int edge_startup(struct usb_seria + response = 0; + + if (edge_serial->is_epic) { ++ struct usb_host_interface *alt; ++ ++ alt = serial->interface->cur_altsetting; ++ + /* EPIC thing, set up our interrupt polling now and our read + * urb, so that the device knows it really is connected. */ + interrupt_in_found = bulk_in_found = bulk_out_found = false; +- for (i = 0; i < serial->interface->altsetting[0] +- .desc.bNumEndpoints; ++i) { ++ for (i = 0; i < alt->desc.bNumEndpoints; ++i) { + struct usb_endpoint_descriptor *endpoint; + int buffer_size; + +- endpoint = &serial->interface->altsetting[0]. +- endpoint[i].desc; ++ endpoint = &alt->endpoint[i].desc; + buffer_size = usb_endpoint_maxp(endpoint); + if (!interrupt_in_found && + (usb_endpoint_is_int_in(endpoint))) { diff --git a/queue-4.4/xhci-increase-sts_halt-timeout-in-xhci_suspend.patch b/queue-4.4/xhci-increase-sts_halt-timeout-in-xhci_suspend.patch new file mode 100644 index 00000000000..42603e4c066 --- /dev/null +++ b/queue-4.4/xhci-increase-sts_halt-timeout-in-xhci_suspend.patch @@ -0,0 +1,43 @@ +From 7c67cf6658cec70d8a43229f2ce74ca1443dc95e Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Wed, 11 Dec 2019 16:20:05 +0200 +Subject: xhci: Increase STS_HALT timeout in xhci_suspend() + +From: Kai-Heng Feng + +commit 7c67cf6658cec70d8a43229f2ce74ca1443dc95e upstream. + +I've recently observed failed xHCI suspend attempt on AMD Raven Ridge +system: +kernel: xhci_hcd 0000:04:00.4: WARN: xHC CMD_RUN timeout +kernel: PM: suspend_common(): xhci_pci_suspend+0x0/0xd0 returns -110 +kernel: PM: pci_pm_suspend(): hcd_pci_suspend+0x0/0x30 returns -110 +kernel: PM: dpm_run_callback(): pci_pm_suspend+0x0/0x150 returns -110 +kernel: PM: Device 0000:04:00.4 failed to suspend async: error -110 + +Similar to commit ac343366846a ("xhci: Increase STS_SAVE timeout in +xhci_suspend()") we also need to increase the HALT timeout to make it be +able to suspend again. + +Cc: # 5.2+ +Fixes: f7fac17ca925 ("xhci: Convert xhci_handshake() to use readl_poll_timeout_atomic()") +Signed-off-by: Kai-Heng Feng +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20191211142007.8847-5-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -929,7 +929,7 @@ static bool xhci_pending_portevent(struc + int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup) + { + int rc = 0; +- unsigned int delay = XHCI_MAX_HALT_USEC; ++ unsigned int delay = XHCI_MAX_HALT_USEC * 2; + struct usb_hcd *hcd = xhci_to_hcd(xhci); + u32 command; + -- 2.47.3