From dcab792f09e6e287ab7fcaf657981cb6723874da Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 11 Nov 2024 13:06:21 +0100 Subject: [PATCH] 5.15-stable patches added patches: fs-proc-fix-compile-warning-about-variable-vmcore_mmap_ops.patch irqchip-gic-v3-force-propagation-of-the-active-state-with-a-read-back.patch ocfs2-remove-entry-once-instead-of-null-ptr-dereference-in-ocfs2_xa_remove.patch ucounts-fix-counter-leak-in-inc_rlimit_get_ucounts.patch udf-allocate-name-buffer-in-directory-iterator-on-heap.patch usb-dwc3-fix-fault-at-system-suspend-if-device-was-already-runtime-suspended.patch usb-musb-sunxi-fix-accessing-an-released-usb-phy.patch usb-serial-io_edgeport-fix-use-after-free-in-debug-printk.patch usb-serial-option-add-fibocom-fg132-0x0112-composition.patch usb-serial-option-add-quectel-rg650v.patch usb-serial-qcserial-add-support-for-sierra-wireless-em86xx.patch usb-typec-fix-potential-out-of-bounds-in-ucsi_ccg_update_set_new_cam_cmd.patch --- ...rning-about-variable-vmcore_mmap_ops.patch | 58 ++++++++++++ ...of-the-active-state-with-a-read-back.patch | 57 ++++++++++++ ...l-ptr-dereference-in-ocfs2_xa_remove.patch | 91 +++++++++++++++++++ queue-5.15/series | 12 +++ ...unter-leak-in-inc_rlimit_get_ucounts.patch | 51 +++++++++++ ...buffer-in-directory-iterator-on-heap.patch | 90 ++++++++++++++++++ ...device-was-already-runtime-suspended.patch | 69 ++++++++++++++ ...xi-fix-accessing-an-released-usb-phy.patch | 50 ++++++++++ ...t-fix-use-after-free-in-debug-printk.patch | 49 ++++++++++ ...add-fibocom-fg132-0x0112-composition.patch | 53 +++++++++++ ...usb-serial-option-add-quectel-rg650v.patch | 68 ++++++++++++++ ...d-support-for-sierra-wireless-em86xx.patch | 70 ++++++++++++++ ...s-in-ucsi_ccg_update_set_new_cam_cmd.patch | 41 +++++++++ 13 files changed, 759 insertions(+) create mode 100644 queue-5.15/fs-proc-fix-compile-warning-about-variable-vmcore_mmap_ops.patch create mode 100644 queue-5.15/irqchip-gic-v3-force-propagation-of-the-active-state-with-a-read-back.patch create mode 100644 queue-5.15/ocfs2-remove-entry-once-instead-of-null-ptr-dereference-in-ocfs2_xa_remove.patch create mode 100644 queue-5.15/ucounts-fix-counter-leak-in-inc_rlimit_get_ucounts.patch create mode 100644 queue-5.15/udf-allocate-name-buffer-in-directory-iterator-on-heap.patch create mode 100644 queue-5.15/usb-dwc3-fix-fault-at-system-suspend-if-device-was-already-runtime-suspended.patch create mode 100644 queue-5.15/usb-musb-sunxi-fix-accessing-an-released-usb-phy.patch create mode 100644 queue-5.15/usb-serial-io_edgeport-fix-use-after-free-in-debug-printk.patch create mode 100644 queue-5.15/usb-serial-option-add-fibocom-fg132-0x0112-composition.patch create mode 100644 queue-5.15/usb-serial-option-add-quectel-rg650v.patch create mode 100644 queue-5.15/usb-serial-qcserial-add-support-for-sierra-wireless-em86xx.patch create mode 100644 queue-5.15/usb-typec-fix-potential-out-of-bounds-in-ucsi_ccg_update_set_new_cam_cmd.patch diff --git a/queue-5.15/fs-proc-fix-compile-warning-about-variable-vmcore_mmap_ops.patch b/queue-5.15/fs-proc-fix-compile-warning-about-variable-vmcore_mmap_ops.patch new file mode 100644 index 00000000000..ca5af7de156 --- /dev/null +++ b/queue-5.15/fs-proc-fix-compile-warning-about-variable-vmcore_mmap_ops.patch @@ -0,0 +1,58 @@ +From b8ee299855f08539e04d6c1a6acb3dc9e5423c00 Mon Sep 17 00:00:00 2001 +From: Qi Xi +Date: Fri, 1 Nov 2024 11:48:03 +0800 +Subject: fs/proc: fix compile warning about variable 'vmcore_mmap_ops' + +From: Qi Xi + +commit b8ee299855f08539e04d6c1a6acb3dc9e5423c00 upstream. + +When build with !CONFIG_MMU, the variable 'vmcore_mmap_ops' +is defined but not used: + +>> fs/proc/vmcore.c:458:42: warning: unused variable 'vmcore_mmap_ops' + 458 | static const struct vm_operations_struct vmcore_mmap_ops = { + +Fix this by only defining it when CONFIG_MMU is enabled. + +Link: https://lkml.kernel.org/r/20241101034803.9298-1-xiqi2@huawei.com +Fixes: 9cb218131de1 ("vmcore: introduce remap_oldmem_pfn_range()") +Signed-off-by: Qi Xi +Reported-by: kernel test robot +Closes: https://lore.kernel.org/lkml/202410301936.GcE8yUos-lkp@intel.com/ +Cc: Baoquan He +Cc: Dave Young +Cc: Michael Holzheu +Cc: Vivek Goyal +Cc: Wang ShaoBo +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/proc/vmcore.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/fs/proc/vmcore.c ++++ b/fs/proc/vmcore.c +@@ -446,10 +446,6 @@ static vm_fault_t mmap_vmcore_fault(stru + #endif + } + +-static const struct vm_operations_struct vmcore_mmap_ops = { +- .fault = mmap_vmcore_fault, +-}; +- + /** + * vmcore_alloc_buf - allocate buffer in vmalloc memory + * @sizez: size of buffer +@@ -477,6 +473,11 @@ static inline char *vmcore_alloc_buf(siz + * virtually contiguous user-space in ELF layout. + */ + #ifdef CONFIG_MMU ++ ++static const struct vm_operations_struct vmcore_mmap_ops = { ++ .fault = mmap_vmcore_fault, ++}; ++ + /* + * remap_oldmem_pfn_checked - do remap_oldmem_pfn_range replacing all pages + * reported as not being ram with the zero page. diff --git a/queue-5.15/irqchip-gic-v3-force-propagation-of-the-active-state-with-a-read-back.patch b/queue-5.15/irqchip-gic-v3-force-propagation-of-the-active-state-with-a-read-back.patch new file mode 100644 index 00000000000..66ec87d4353 --- /dev/null +++ b/queue-5.15/irqchip-gic-v3-force-propagation-of-the-active-state-with-a-read-back.patch @@ -0,0 +1,57 @@ +From 464cb98f1c07298c4c10e714ae0c36338d18d316 Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Wed, 6 Nov 2024 08:44:18 +0000 +Subject: irqchip/gic-v3: Force propagation of the active state with a read-back + +From: Marc Zyngier + +commit 464cb98f1c07298c4c10e714ae0c36338d18d316 upstream. + +Christoffer reports that on some implementations, writing to +GICR_ISACTIVER0 (and similar GICD registers) can race badly with a guest +issuing a deactivation of that interrupt via the system register interface. + +There are multiple reasons to this: + + - this uses an early write-acknoledgement memory type (nGnRE), meaning + that the write may only have made it as far as some interconnect + by the time the store is considered "done" + + - the GIC itself is allowed to buffer the write until it decides to + take it into account (as long as it is in finite time) + +The effects are that the activation may not have taken effect by the time +the kernel enters the guest, forcing an immediate exit, or that a guest +deactivation occurs before the interrupt is active, doing nothing. + +In order to guarantee that the write to the ISACTIVER register has taken +effect, read back from it, forcing the interconnect to propagate the write, +and the GIC to process the write before returning the read. + +Reported-by: Christoffer Dall +Signed-off-by: Marc Zyngier +Signed-off-by: Thomas Gleixner +Acked-by: Christoffer Dall +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/all/20241106084418.3794612-1-maz@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/irqchip/irq-gic-v3.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -429,6 +429,13 @@ static int gic_irq_set_irqchip_state(str + } + + gic_poke_irq(d, reg); ++ ++ /* ++ * Force read-back to guarantee that the active state has taken ++ * effect, and won't race with a guest-driven deactivation. ++ */ ++ if (reg == GICD_ISACTIVER) ++ gic_peek_irq(d, reg); + return 0; + } + diff --git a/queue-5.15/ocfs2-remove-entry-once-instead-of-null-ptr-dereference-in-ocfs2_xa_remove.patch b/queue-5.15/ocfs2-remove-entry-once-instead-of-null-ptr-dereference-in-ocfs2_xa_remove.patch new file mode 100644 index 00000000000..90361c870c1 --- /dev/null +++ b/queue-5.15/ocfs2-remove-entry-once-instead-of-null-ptr-dereference-in-ocfs2_xa_remove.patch @@ -0,0 +1,91 @@ +From 0b63c0e01fba40e3992bc627272ec7b618ccaef7 Mon Sep 17 00:00:00 2001 +From: Andrew Kanner +Date: Sun, 3 Nov 2024 20:38:45 +0100 +Subject: ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() + +From: Andrew Kanner + +commit 0b63c0e01fba40e3992bc627272ec7b618ccaef7 upstream. + +Syzkaller is able to provoke null-ptr-dereference in ocfs2_xa_remove(): + +[ 57.319872] (a.out,1161,7):ocfs2_xa_remove:2028 ERROR: status = -12 +[ 57.320420] (a.out,1161,7):ocfs2_xa_cleanup_value_truncate:1999 ERROR: Partial truncate while removing xattr overlay.upper. Leaking 1 clusters and removing the entry +[ 57.321727] BUG: kernel NULL pointer dereference, address: 0000000000000004 +[...] +[ 57.325727] RIP: 0010:ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 +[...] +[ 57.331328] Call Trace: +[ 57.331477] +[...] +[ 57.333511] ? do_user_addr_fault+0x3e5/0x740 +[ 57.333778] ? exc_page_fault+0x70/0x170 +[ 57.334016] ? asm_exc_page_fault+0x2b/0x30 +[ 57.334263] ? __pfx_ocfs2_xa_block_wipe_namevalue+0x10/0x10 +[ 57.334596] ? ocfs2_xa_block_wipe_namevalue+0x2a/0xc0 +[ 57.334913] ocfs2_xa_remove_entry+0x23/0xc0 +[ 57.335164] ocfs2_xa_set+0x704/0xcf0 +[ 57.335381] ? _raw_spin_unlock+0x1a/0x40 +[ 57.335620] ? ocfs2_inode_cache_unlock+0x16/0x20 +[ 57.335915] ? trace_preempt_on+0x1e/0x70 +[ 57.336153] ? start_this_handle+0x16c/0x500 +[ 57.336410] ? preempt_count_sub+0x50/0x80 +[ 57.336656] ? _raw_read_unlock+0x20/0x40 +[ 57.336906] ? start_this_handle+0x16c/0x500 +[ 57.337162] ocfs2_xattr_block_set+0xa6/0x1e0 +[ 57.337424] __ocfs2_xattr_set_handle+0x1fd/0x5d0 +[ 57.337706] ? ocfs2_start_trans+0x13d/0x290 +[ 57.337971] ocfs2_xattr_set+0xb13/0xfb0 +[ 57.338207] ? dput+0x46/0x1c0 +[ 57.338393] ocfs2_xattr_trusted_set+0x28/0x30 +[ 57.338665] ? ocfs2_xattr_trusted_set+0x28/0x30 +[ 57.338948] __vfs_removexattr+0x92/0xc0 +[ 57.339182] __vfs_removexattr_locked+0xd5/0x190 +[ 57.339456] ? preempt_count_sub+0x50/0x80 +[ 57.339705] vfs_removexattr+0x5f/0x100 +[...] + +Reproducer uses faultinject facility to fail ocfs2_xa_remove() -> +ocfs2_xa_value_truncate() with -ENOMEM. + +In this case the comment mentions that we can return 0 if +ocfs2_xa_cleanup_value_truncate() is going to wipe the entry +anyway. But the following 'rc' check is wrong and execution flow do +'ocfs2_xa_remove_entry(loc);' twice: +* 1st: in ocfs2_xa_cleanup_value_truncate(); +* 2nd: returning back to ocfs2_xa_remove() instead of going to 'out'. + +Fix this by skipping the 2nd removal of the same entry and making +syzkaller repro happy. + +Link: https://lkml.kernel.org/r/20241103193845.2940988-1-andrew.kanner@gmail.com +Fixes: 399ff3a748cf ("ocfs2: Handle errors while setting external xattr values.") +Signed-off-by: Andrew Kanner +Reported-by: syzbot+386ce9e60fa1b18aac5b@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/671e13ab.050a0220.2b8c0f.01d0.GAE@google.com/T/ +Tested-by: syzbot+386ce9e60fa1b18aac5b@syzkaller.appspotmail.com +Reviewed-by: Joseph Qi +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Jun Piao +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/ocfs2/xattr.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/fs/ocfs2/xattr.c ++++ b/fs/ocfs2/xattr.c +@@ -2040,8 +2040,7 @@ static int ocfs2_xa_remove(struct ocfs2_ + rc = 0; + ocfs2_xa_cleanup_value_truncate(loc, "removing", + orig_clusters); +- if (rc) +- goto out; ++ goto out; + } + } + diff --git a/queue-5.15/series b/queue-5.15/series index 70c1d725d1d..484dce2b8c0 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -57,3 +57,15 @@ net-bridge-xmit-make-sure-we-have-at-least-eth-header-len-bytes.patch ice-add-a-per-vf-limit-on-number-of-fdir-filters.patch net-do-not-delay-dst_entries_add-in-dst_release.patch media-uvcvideo-skip-parsing-frames-of-type-uvc_vs_undefined-in-uvc_parse_format.patch +fs-proc-fix-compile-warning-about-variable-vmcore_mmap_ops.patch +usb-musb-sunxi-fix-accessing-an-released-usb-phy.patch +usb-dwc3-fix-fault-at-system-suspend-if-device-was-already-runtime-suspended.patch +usb-typec-fix-potential-out-of-bounds-in-ucsi_ccg_update_set_new_cam_cmd.patch +usb-serial-io_edgeport-fix-use-after-free-in-debug-printk.patch +usb-serial-qcserial-add-support-for-sierra-wireless-em86xx.patch +usb-serial-option-add-fibocom-fg132-0x0112-composition.patch +usb-serial-option-add-quectel-rg650v.patch +irqchip-gic-v3-force-propagation-of-the-active-state-with-a-read-back.patch +ocfs2-remove-entry-once-instead-of-null-ptr-dereference-in-ocfs2_xa_remove.patch +ucounts-fix-counter-leak-in-inc_rlimit_get_ucounts.patch +udf-allocate-name-buffer-in-directory-iterator-on-heap.patch diff --git a/queue-5.15/ucounts-fix-counter-leak-in-inc_rlimit_get_ucounts.patch b/queue-5.15/ucounts-fix-counter-leak-in-inc_rlimit_get_ucounts.patch new file mode 100644 index 00000000000..5c6bbbed35c --- /dev/null +++ b/queue-5.15/ucounts-fix-counter-leak-in-inc_rlimit_get_ucounts.patch @@ -0,0 +1,51 @@ +From 432dc0654c612457285a5dcf9bb13968ac6f0804 Mon Sep 17 00:00:00 2001 +From: Andrei Vagin +Date: Fri, 1 Nov 2024 19:19:40 +0000 +Subject: ucounts: fix counter leak in inc_rlimit_get_ucounts() + +From: Andrei Vagin + +commit 432dc0654c612457285a5dcf9bb13968ac6f0804 upstream. + +The inc_rlimit_get_ucounts() increments the specified rlimit counter and +then checks its limit. If the value exceeds the limit, the function +returns an error without decrementing the counter. + +Link: https://lkml.kernel.org/r/20241101191940.3211128-1-roman.gushchin@linux.dev +Fixes: 15bc01effefe ("ucounts: Fix signal ucount refcounting") +Signed-off-by: Andrei Vagin +Co-developed-by: Roman Gushchin +Signed-off-by: Roman Gushchin +Tested-by: Roman Gushchin +Acked-by: Alexey Gladkov +Cc: Kees Cook +Cc: Andrei Vagin +Cc: "Eric W. Biederman" +Cc: Alexey Gladkov +Cc: Oleg Nesterov +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + kernel/ucount.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/kernel/ucount.c ++++ b/kernel/ucount.c +@@ -315,7 +315,7 @@ long inc_rlimit_get_ucounts(struct ucoun + for (iter = ucounts; iter; iter = iter->ns->ucounts) { + long new = atomic_long_add_return(1, &iter->ucount[type]); + if (new < 0 || new > max) +- goto unwind; ++ goto dec_unwind; + if (iter == ucounts) + ret = new; + max = READ_ONCE(iter->ns->ucount_max[type]); +@@ -332,7 +332,6 @@ long inc_rlimit_get_ucounts(struct ucoun + dec_unwind: + dec = atomic_long_add_return(-1, &iter->ucount[type]); + WARN_ON_ONCE(dec < 0); +-unwind: + do_dec_rlimit_put_ucounts(ucounts, iter, type); + return 0; + } diff --git a/queue-5.15/udf-allocate-name-buffer-in-directory-iterator-on-heap.patch b/queue-5.15/udf-allocate-name-buffer-in-directory-iterator-on-heap.patch new file mode 100644 index 00000000000..aecbb0f3951 --- /dev/null +++ b/queue-5.15/udf-allocate-name-buffer-in-directory-iterator-on-heap.patch @@ -0,0 +1,90 @@ +From 0aba4860b0d0216a1a300484ff536171894d49d8 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Tue, 20 Dec 2022 12:38:45 +0100 +Subject: udf: Allocate name buffer in directory iterator on heap + +From: Jan Kara + +commit 0aba4860b0d0216a1a300484ff536171894d49d8 upstream. + +Currently we allocate name buffer in directory iterators (struct +udf_fileident_iter) on stack. These structures are relatively large +(some 360 bytes on 64-bit architectures). For udf_rename() which needs +to keep three of these structures in parallel the stack usage becomes +rather heavy - 1536 bytes in total. Allocate the name buffer in the +iterator from heap to avoid excessive stack usage. + +Link: https://lore.kernel.org/all/202212200558.lK9x1KW0-lkp@intel.com +Reported-by: kernel test robot +Signed-off-by: Jan Kara +Cc: Hauke Mehrtens +Signed-off-by: Greg Kroah-Hartman +--- + fs/udf/directory.c | 25 ++++++++++++++++--------- + fs/udf/udfdecl.h | 2 +- + 2 files changed, 17 insertions(+), 10 deletions(-) + +--- a/fs/udf/directory.c ++++ b/fs/udf/directory.c +@@ -248,9 +248,14 @@ int udf_fiiter_init(struct udf_fileident + iter->elen = 0; + iter->epos.bh = NULL; + iter->name = NULL; +- +- if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) +- return udf_copy_fi(iter); ++ iter->namebuf = kmalloc(UDF_NAME_LEN_CS0, GFP_KERNEL); ++ if (!iter->namebuf) ++ return -ENOMEM; ++ ++ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { ++ err = udf_copy_fi(iter); ++ goto out; ++ } + + if (inode_bmap(dir, iter->pos >> dir->i_blkbits, &iter->epos, + &iter->eloc, &iter->elen, &iter->loffset) != +@@ -260,17 +265,17 @@ int udf_fiiter_init(struct udf_fileident + udf_err(dir->i_sb, + "position %llu not allocated in directory (ino %lu)\n", + (unsigned long long)pos, dir->i_ino); +- return -EFSCORRUPTED; ++ err = -EFSCORRUPTED; ++ goto out; + } + err = udf_fiiter_load_bhs(iter); + if (err < 0) +- return err; ++ goto out; + err = udf_copy_fi(iter); +- if (err < 0) { ++out: ++ if (err < 0) + udf_fiiter_release(iter); +- return err; +- } +- return 0; ++ return err; + } + + int udf_fiiter_advance(struct udf_fileident_iter *iter) +@@ -307,6 +312,8 @@ void udf_fiiter_release(struct udf_filei + brelse(iter->bh[0]); + brelse(iter->bh[1]); + iter->bh[0] = iter->bh[1] = NULL; ++ kfree(iter->namebuf); ++ iter->namebuf = NULL; + } + + static void udf_copy_to_bufs(void *buf1, int len1, void *buf2, int len2, +--- a/fs/udf/udfdecl.h ++++ b/fs/udf/udfdecl.h +@@ -99,7 +99,7 @@ struct udf_fileident_iter { + struct extent_position epos; /* Position after the above extent */ + struct fileIdentDesc fi; /* Copied directory entry */ + uint8_t *name; /* Pointer to entry name */ +- uint8_t namebuf[UDF_NAME_LEN_CS0]; /* Storage for entry name in case ++ uint8_t *namebuf; /* Storage for entry name in case + * the name is split between two blocks + */ + }; diff --git a/queue-5.15/usb-dwc3-fix-fault-at-system-suspend-if-device-was-already-runtime-suspended.patch b/queue-5.15/usb-dwc3-fix-fault-at-system-suspend-if-device-was-already-runtime-suspended.patch new file mode 100644 index 00000000000..3cbd9774550 --- /dev/null +++ b/queue-5.15/usb-dwc3-fix-fault-at-system-suspend-if-device-was-already-runtime-suspended.patch @@ -0,0 +1,69 @@ +From 9cfb31e4c89d200d8ab7cb1e0bb9e6e8d621ca0b Mon Sep 17 00:00:00 2001 +From: Roger Quadros +Date: Mon, 4 Nov 2024 16:00:11 +0200 +Subject: usb: dwc3: fix fault at system suspend if device was already runtime suspended + +From: Roger Quadros + +commit 9cfb31e4c89d200d8ab7cb1e0bb9e6e8d621ca0b upstream. + +If the device was already runtime suspended then during system suspend +we cannot access the device registers else it will crash. + +Also we cannot access any registers after dwc3_core_exit() on some +platforms so move the dwc3_enable_susphy() call to the top. + +Cc: stable@vger.kernel.org # v5.15+ +Reported-by: William McVicker +Closes: https://lore.kernel.org/all/ZyVfcUuPq56R2m1Y@google.com +Fixes: 705e3ce37bcc ("usb: dwc3: core: Fix system suspend on TI AM62 platforms") +Signed-off-by: Roger Quadros +Acked-by: Thinh Nguyen +Tested-by: Will McVicker +Link: https://lore.kernel.org/r/20241104-am62-lpm-usb-fix-v1-1-e93df73a4f0d@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 25 ++++++++++++------------- + 1 file changed, 12 insertions(+), 13 deletions(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1796,10 +1796,18 @@ static int dwc3_suspend_common(struct dw + { + u32 reg; + +- dwc->susphy_state = (dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0)) & +- DWC3_GUSB2PHYCFG_SUSPHY) || +- (dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0)) & +- DWC3_GUSB3PIPECTL_SUSPHY); ++ if (!pm_runtime_suspended(dwc->dev) && !PMSG_IS_AUTO(msg)) { ++ dwc->susphy_state = (dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0)) & ++ DWC3_GUSB2PHYCFG_SUSPHY) || ++ (dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0)) & ++ DWC3_GUSB3PIPECTL_SUSPHY); ++ /* ++ * TI AM62 platform requires SUSPHY to be ++ * enabled for system suspend to work. ++ */ ++ if (!dwc->susphy_state) ++ dwc3_enable_susphy(dwc, true); ++ } + + switch (dwc->current_dr_role) { + case DWC3_GCTL_PRTCAP_DEVICE: +@@ -1848,15 +1856,6 @@ static int dwc3_suspend_common(struct dw + break; + } + +- if (!PMSG_IS_AUTO(msg)) { +- /* +- * TI AM62 platform requires SUSPHY to be +- * enabled for system suspend to work. +- */ +- if (!dwc->susphy_state) +- dwc3_enable_susphy(dwc, true); +- } +- + return 0; + } + diff --git a/queue-5.15/usb-musb-sunxi-fix-accessing-an-released-usb-phy.patch b/queue-5.15/usb-musb-sunxi-fix-accessing-an-released-usb-phy.patch new file mode 100644 index 00000000000..faa49623368 --- /dev/null +++ b/queue-5.15/usb-musb-sunxi-fix-accessing-an-released-usb-phy.patch @@ -0,0 +1,50 @@ +From 498dbd9aea205db9da674994b74c7bf8e18448bd Mon Sep 17 00:00:00 2001 +From: Zijun Hu +Date: Tue, 29 Oct 2024 23:13:38 +0800 +Subject: usb: musb: sunxi: Fix accessing an released usb phy + +From: Zijun Hu + +commit 498dbd9aea205db9da674994b74c7bf8e18448bd upstream. + +Commit 6ed05c68cbca ("usb: musb: sunxi: Explicitly release USB PHY on +exit") will cause that usb phy @glue->xceiv is accessed after released. + +1) register platform driver @sunxi_musb_driver +// get the usb phy @glue->xceiv +sunxi_musb_probe() -> devm_usb_get_phy(). + +2) register and unregister platform driver @musb_driver +musb_probe() -> sunxi_musb_init() +use the phy here +//the phy is released here +musb_remove() -> sunxi_musb_exit() -> devm_usb_put_phy() + +3) register @musb_driver again +musb_probe() -> sunxi_musb_init() +use the phy here but the phy has been released at 2). +... + +Fixed by reverting the commit, namely, removing devm_usb_put_phy() +from sunxi_musb_exit(). + +Fixes: 6ed05c68cbca ("usb: musb: sunxi: Explicitly release USB PHY on exit") +Cc: stable@vger.kernel.org +Signed-off-by: Zijun Hu +Link: https://lore.kernel.org/r/20241029-sunxi_fix-v1-1-9431ed2ab826@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/musb/sunxi.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/usb/musb/sunxi.c ++++ b/drivers/usb/musb/sunxi.c +@@ -286,8 +286,6 @@ static int sunxi_musb_exit(struct musb * + if (test_bit(SUNXI_MUSB_FL_HAS_SRAM, &glue->flags)) + sunxi_sram_release(musb->controller->parent); + +- devm_usb_put_phy(glue->dev, glue->xceiv); +- + return 0; + } + diff --git a/queue-5.15/usb-serial-io_edgeport-fix-use-after-free-in-debug-printk.patch b/queue-5.15/usb-serial-io_edgeport-fix-use-after-free-in-debug-printk.patch new file mode 100644 index 00000000000..298f71a9e57 --- /dev/null +++ b/queue-5.15/usb-serial-io_edgeport-fix-use-after-free-in-debug-printk.patch @@ -0,0 +1,49 @@ +From 37bb5628379295c1254c113a407cab03a0f4d0b4 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 31 Oct 2024 12:48:30 +0300 +Subject: USB: serial: io_edgeport: fix use after free in debug printk + +From: Dan Carpenter + +commit 37bb5628379295c1254c113a407cab03a0f4d0b4 upstream. + +The "dev_dbg(&urb->dev->dev, ..." which happens after usb_free_urb(urb) +is a use after free of the "urb" pointer. Store the "dev" pointer at the +start of the function to avoid this issue. + +Fixes: 984f68683298 ("USB: serial: io_edgeport.c: remove dbg() usage") +Cc: stable@vger.kernel.org +Signed-off-by: Dan Carpenter +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/io_edgeport.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/serial/io_edgeport.c ++++ b/drivers/usb/serial/io_edgeport.c +@@ -770,11 +770,12 @@ static void edge_bulk_out_data_callback( + static void edge_bulk_out_cmd_callback(struct urb *urb) + { + struct edgeport_port *edge_port = urb->context; ++ struct device *dev = &urb->dev->dev; + int status = urb->status; + + atomic_dec(&CmdUrbs); +- dev_dbg(&urb->dev->dev, "%s - FREE URB %p (outstanding %d)\n", +- __func__, urb, atomic_read(&CmdUrbs)); ++ dev_dbg(dev, "%s - FREE URB %p (outstanding %d)\n", __func__, urb, ++ atomic_read(&CmdUrbs)); + + + /* clean up the transfer buffer */ +@@ -784,8 +785,7 @@ static void edge_bulk_out_cmd_callback(s + usb_free_urb(urb); + + if (status) { +- dev_dbg(&urb->dev->dev, +- "%s - nonzero write bulk status received: %d\n", ++ dev_dbg(dev, "%s - nonzero write bulk status received: %d\n", + __func__, status); + return; + } diff --git a/queue-5.15/usb-serial-option-add-fibocom-fg132-0x0112-composition.patch b/queue-5.15/usb-serial-option-add-fibocom-fg132-0x0112-composition.patch new file mode 100644 index 00000000000..665899a15e6 --- /dev/null +++ b/queue-5.15/usb-serial-option-add-fibocom-fg132-0x0112-composition.patch @@ -0,0 +1,53 @@ +From 393c74ccbd847bacf18865a01b422586fc7341cf Mon Sep 17 00:00:00 2001 +From: Reinhard Speyerer +Date: Fri, 18 Oct 2024 23:07:06 +0200 +Subject: USB: serial: option: add Fibocom FG132 0x0112 composition + +From: Reinhard Speyerer + +commit 393c74ccbd847bacf18865a01b422586fc7341cf upstream. + +Add Fibocom FG132 0x0112 composition: + +T: Bus=03 Lev=02 Prnt=06 Port=01 Cnt=02 Dev#= 10 Spd=12 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2cb7 ProdID=0112 Rev= 5.15 +S: Manufacturer=Fibocom Wireless Inc. +S: Product=Fibocom Module +S: SerialNumber=xxxxxxxx +C:* #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=86(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms + +Signed-off-by: Reinhard Speyerer +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2320,6 +2320,9 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0111, 0xff) }, /* Fibocom FM160 (MBIM mode) */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x0112, 0xff, 0xff, 0x30) }, /* Fibocom FG132 Diag */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x0112, 0xff, 0xff, 0x40) }, /* Fibocom FG132 AT */ ++ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x0112, 0xff, 0, 0) }, /* Fibocom FG132 NMEA */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0115, 0xff), /* Fibocom FM135 (laptop MBIM) */ + .driver_info = RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ diff --git a/queue-5.15/usb-serial-option-add-quectel-rg650v.patch b/queue-5.15/usb-serial-option-add-quectel-rg650v.patch new file mode 100644 index 00000000000..057ea549513 --- /dev/null +++ b/queue-5.15/usb-serial-option-add-quectel-rg650v.patch @@ -0,0 +1,68 @@ +From 3b05949ba39f305b585452d0e177470607842165 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Beno=C3=AEt=20Monin?= +Date: Thu, 24 Oct 2024 17:09:19 +0200 +Subject: USB: serial: option: add Quectel RG650V +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Benoît Monin + +commit 3b05949ba39f305b585452d0e177470607842165 upstream. + +Add support for Quectel RG650V which is based on Qualcomm SDX65 chip. +The composition is DIAG / NMEA / AT / AT / QMI. + +T: Bus=02 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=2c7c ProdID=0122 Rev=05.15 +S: Manufacturer=Quectel +S: Product=RG650V-EU +S: SerialNumber=xxxxxxx +C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=9ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=9ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=9ms + +Signed-off-by: Benoît Monin +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -251,6 +251,7 @@ static void option_instat_callback(struc + #define QUECTEL_VENDOR_ID 0x2c7c + /* These Quectel products use Quectel's vendor ID */ + #define QUECTEL_PRODUCT_EC21 0x0121 ++#define QUECTEL_PRODUCT_RG650V 0x0122 + #define QUECTEL_PRODUCT_EM061K_LTA 0x0123 + #define QUECTEL_PRODUCT_EM061K_LMS 0x0124 + #define QUECTEL_PRODUCT_EC25 0x0125 +@@ -1273,6 +1274,8 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG912Y, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG916Q, 0xff, 0x00, 0x00) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG650V, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RG650V, 0xff, 0, 0) }, + + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, diff --git a/queue-5.15/usb-serial-qcserial-add-support-for-sierra-wireless-em86xx.patch b/queue-5.15/usb-serial-qcserial-add-support-for-sierra-wireless-em86xx.patch new file mode 100644 index 00000000000..86803037417 --- /dev/null +++ b/queue-5.15/usb-serial-qcserial-add-support-for-sierra-wireless-em86xx.patch @@ -0,0 +1,70 @@ +From 25eb47eed52979c2f5eee3f37e6c67714e02c49c Mon Sep 17 00:00:00 2001 +From: Jack Wu +Date: Wed, 6 Nov 2024 18:50:29 +0800 +Subject: USB: serial: qcserial: add support for Sierra Wireless EM86xx + +From: Jack Wu + +commit 25eb47eed52979c2f5eee3f37e6c67714e02c49c upstream. + +Add support for Sierra Wireless EM86xx with USB-id 0x1199:0x90e5 and +0x1199:0x90e4. + +0x1199:0x90e5 +T: Bus=03 Lev=01 Prnt=01 Port=05 Cnt=01 Dev#= 14 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=1199 ProdID=90e5 Rev= 5.15 +S: Manufacturer=Sierra Wireless, Incorporated +S: Product=Semtech EM8695 Mobile Broadband Adapter +S: SerialNumber=004403161882339 +C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA +A: FirstIf#=12 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=qcserial +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=qcserial +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I:* If#=12 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#=13 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#=13 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +0x1199:0x90e4 +T: Bus=03 Lev=01 Prnt=01 Port=05 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1199 ProdID=90e4 Rev= 0.00 +S: Manufacturer=Sierra Wireless, Incorporated +S: SerialNumber=004403161882339 +C:* #Ifs= 1 Cfg#= 1 Atr=a0 MxPwr= 2mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=10 Driver=qcserial +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Jack Wu +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/qcserial.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -166,6 +166,8 @@ static const struct usb_device_id id_tab + {DEVICE_SWI(0x1199, 0x9090)}, /* Sierra Wireless EM7565 QDL */ + {DEVICE_SWI(0x1199, 0x9091)}, /* Sierra Wireless EM7565 */ + {DEVICE_SWI(0x1199, 0x90d2)}, /* Sierra Wireless EM9191 QDL */ ++ {DEVICE_SWI(0x1199, 0x90e4)}, /* Sierra Wireless EM86xx QDL*/ ++ {DEVICE_SWI(0x1199, 0x90e5)}, /* Sierra Wireless EM86xx */ + {DEVICE_SWI(0x1199, 0xc080)}, /* Sierra Wireless EM7590 QDL */ + {DEVICE_SWI(0x1199, 0xc081)}, /* Sierra Wireless EM7590 */ + {DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */ diff --git a/queue-5.15/usb-typec-fix-potential-out-of-bounds-in-ucsi_ccg_update_set_new_cam_cmd.patch b/queue-5.15/usb-typec-fix-potential-out-of-bounds-in-ucsi_ccg_update_set_new_cam_cmd.patch new file mode 100644 index 00000000000..3cb70491491 --- /dev/null +++ b/queue-5.15/usb-typec-fix-potential-out-of-bounds-in-ucsi_ccg_update_set_new_cam_cmd.patch @@ -0,0 +1,41 @@ +From 7dd08a0b4193087976db6b3ee7807de7e8316f96 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 4 Nov 2024 20:16:42 +0300 +Subject: usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() + +From: Dan Carpenter + +commit 7dd08a0b4193087976db6b3ee7807de7e8316f96 upstream. + +The "*cmd" variable can be controlled by the user via debugfs. That means +"new_cam" can be as high as 255 while the size of the uc->updated[] array +is UCSI_MAX_ALTMODES (30). + +The call tree is: +ucsi_cmd() // val comes from simple_attr_write_xsigned() +-> ucsi_send_command() + -> ucsi_send_command_common() + -> ucsi_run_command() // calls ucsi->ops->sync_control() + -> ucsi_ccg_sync_control() + +Fixes: 170a6726d0e2 ("usb: typec: ucsi: add support for separate DP altmode devices") +Cc: stable +Signed-off-by: Dan Carpenter +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/325102b3-eaa8-4918-a947-22aca1146586@stanley.mountain +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi_ccg.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/typec/ucsi/ucsi_ccg.c ++++ b/drivers/usb/typec/ucsi/ucsi_ccg.c +@@ -436,6 +436,8 @@ static void ucsi_ccg_update_set_new_cam_ + + port = uc->orig; + new_cam = UCSI_SET_NEW_CAM_GET_AM(*cmd); ++ if (new_cam >= ARRAY_SIZE(uc->updated)) ++ return; + new_port = &uc->updated[new_cam]; + cam = new_port->linked_idx; + enter_new_mode = UCSI_SET_NEW_CAM_ENTER(*cmd); -- 2.47.2