From: Greg Kroah-Hartman Date: Mon, 31 Jul 2023 12:21:27 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v5.15.124~63 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=42d1ac9276a20ce77de8698d9ba2eadf62f5d76d;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: alsa-hda-realtek-support-asus-g713pv-laptop.patch alsa-hda-relatek-enable-mute-led-on-hp-250-g8.patch btrfs-check-for-commit-error-at-btrfs_attach_transaction_barrier.patch can-gs_usb-gs_can_close-add-missing-set-of-can-state-to-can_state_stopped.patch documentation-security-bugs.rst-clarify-cve-handling.patch documentation-security-bugs.rst-update-preferences-when-dealing-with-the-linux-distros-group.patch file-always-lock-position-for-fmode_atomic_pos.patch hwmon-nct7802-fix-for-temp6-peci1-processed-even-if-peci1-disabled.patch nfsd-remove-incorrect-check-in-nfsd4_validate_stateid.patch revert-usb-dwc3-core-enable-autoretry-feature-in-the-controller.patch revert-usb-gadget-tegra-xudc-fix-error-check-in-tegra_xudc_powerdomain_init.patch revert-usb-xhci-tegra-fix-error-check.patch serial-8250_dw-preserve-original-value-of-dlf-register.patch serial-qcom-geni-drop-bogus-runtime-pm-state-update.patch serial-sifive-fix-sifive_serial_console_setup-section.patch staging-ks7010-potential-buffer-overflow-in-ks_wlan_set_encode_ext.patch tpm_tis-explicitly-check-for-error-code.patch tty-n_gsm-fix-uaf-in-gsm_cleanup_mux.patch usb-dwc3-don-t-reset-device-side-if-dwc3-was-configured-as-host-only.patch usb-dwc3-pci-skip-byt-gpio-lookup-table-for-hardwired-phy.patch usb-gadget-fix-the-memory-leak-in-raw_gadget-driver.patch usb-ohci-at91-fix-the-unhandle-interrupt-when-resume.patch usb-quirks-add-quirk-for-focusrite-scarlett.patch usb-serial-option-add-quectel-ec200a-module-support.patch usb-serial-option-support-quectel-em060k_128.patch usb-serial-simple-add-kaufmann-rks-can-vcp.patch usb-serial-simple-sort-driver-entries.patch usb-xhci-mtk-set-the-dma-max_seg_size.patch --- diff --git a/queue-5.10/alsa-hda-realtek-support-asus-g713pv-laptop.patch b/queue-5.10/alsa-hda-realtek-support-asus-g713pv-laptop.patch new file mode 100644 index 00000000000..6f4e34377fd --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-support-asus-g713pv-laptop.patch @@ -0,0 +1,33 @@ +From 8019a4ab3d80c7af391a646cccff953753fc025f Mon Sep 17 00:00:00 2001 +From: Pavel Asyutchenko +Date: Thu, 27 Jul 2023 01:37:32 +0300 +Subject: ALSA: hda/realtek: Support ASUS G713PV laptop + +From: Pavel Asyutchenko + +commit 8019a4ab3d80c7af391a646cccff953753fc025f upstream. + +This laptop has CS35L41 amp connected via I2C. + +With this patch speakers begin to work if the +missing _DSD properties are added to ACPI tables. + +Signed-off-by: Pavel Asyutchenko +Cc: +Link: https://lore.kernel.org/r/20230726223732.20775-1-svenpavel@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9069,6 +9069,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x1c62, "ASUS GU603", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1c92, "ASUS ROG Strix G15", ALC285_FIXUP_ASUS_G533Z_PINS), + SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC), ++ SND_PCI_QUIRK(0x1043, 0x1d1f, "ASUS ROG Strix G17 2023 (G713PV)", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1d4e, "ASUS TM420", ALC256_FIXUP_ASUS_HPE), + SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502), diff --git a/queue-5.10/alsa-hda-relatek-enable-mute-led-on-hp-250-g8.patch b/queue-5.10/alsa-hda-relatek-enable-mute-led-on-hp-250-g8.patch new file mode 100644 index 00000000000..78bd7dbc0de --- /dev/null +++ b/queue-5.10/alsa-hda-relatek-enable-mute-led-on-hp-250-g8.patch @@ -0,0 +1,31 @@ +From d510acb610e6aa07a04b688236868b2a5fd60deb Mon Sep 17 00:00:00 2001 +From: Luka Guzenko +Date: Tue, 25 Jul 2023 13:15:09 +0200 +Subject: ALSA: hda/relatek: Enable Mute LED on HP 250 G8 + +From: Luka Guzenko + +commit d510acb610e6aa07a04b688236868b2a5fd60deb upstream. + +This HP Notebook used ALC236 codec with COEF 0x07 idx 1 controlling +the mute LED. Enable already existing quirk for this device. + +Signed-off-by: Luka Guzenko +Cc: +Link: https://lore.kernel.org/r/20230725111509.623773-1-l.guzenko@web.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9015,6 +9015,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x103c, 0x880d, "HP EliteBook 830 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8811, "HP Spectre x360 15-eb1xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1), + SND_PCI_QUIRK(0x103c, 0x8812, "HP Spectre x360 15-eb1xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1), ++ SND_PCI_QUIRK(0x103c, 0x881d, "HP 250 G8 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2), + SND_PCI_QUIRK(0x103c, 0x8846, "HP EliteBook 850 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8847, "HP EliteBook x360 830 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x884b, "HP EliteBook 840 Aero G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED), diff --git a/queue-5.10/btrfs-check-for-commit-error-at-btrfs_attach_transaction_barrier.patch b/queue-5.10/btrfs-check-for-commit-error-at-btrfs_attach_transaction_barrier.patch new file mode 100644 index 00000000000..da27efa53cb --- /dev/null +++ b/queue-5.10/btrfs-check-for-commit-error-at-btrfs_attach_transaction_barrier.patch @@ -0,0 +1,53 @@ +From b28ff3a7d7e97456fd86b68d24caa32e1cfa7064 Mon Sep 17 00:00:00 2001 +From: Filipe Manana +Date: Fri, 21 Jul 2023 10:49:21 +0100 +Subject: btrfs: check for commit error at btrfs_attach_transaction_barrier() + +From: Filipe Manana + +commit b28ff3a7d7e97456fd86b68d24caa32e1cfa7064 upstream. + +btrfs_attach_transaction_barrier() is used to get a handle pointing to the +current running transaction if the transaction has not started its commit +yet (its state is < TRANS_STATE_COMMIT_START). If the transaction commit +has started, then we wait for the transaction to commit and finish before +returning - however we completely ignore if the transaction was aborted +due to some error during its commit, we simply return ERR_PT(-ENOENT), +which makes the caller assume everything is fine and no errors happened. + +This could make an fsync return success (0) to user space when in fact we +had a transaction abort and the target inode changes were therefore not +persisted. + +Fix this by checking for the return value from btrfs_wait_for_commit(), +and if it returned an error, return it back to the caller. + +Fixes: d4edf39bd5db ("Btrfs: fix uncompleted transaction") +CC: stable@vger.kernel.org # 4.19+ +Reviewed-by: Qu Wenruo +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/transaction.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -821,8 +821,13 @@ btrfs_attach_transaction_barrier(struct + + trans = start_transaction(root, 0, TRANS_ATTACH, + BTRFS_RESERVE_NO_FLUSH, true); +- if (trans == ERR_PTR(-ENOENT)) +- btrfs_wait_for_commit(root->fs_info, 0); ++ if (trans == ERR_PTR(-ENOENT)) { ++ int ret; ++ ++ ret = btrfs_wait_for_commit(root->fs_info, 0); ++ if (ret) ++ return ERR_PTR(ret); ++ } + + return trans; + } diff --git a/queue-5.10/can-gs_usb-gs_can_close-add-missing-set-of-can-state-to-can_state_stopped.patch b/queue-5.10/can-gs_usb-gs_can_close-add-missing-set-of-can-state-to-can_state_stopped.patch new file mode 100644 index 00000000000..dff4594b5aa --- /dev/null +++ b/queue-5.10/can-gs_usb-gs_can_close-add-missing-set-of-can-state-to-can_state_stopped.patch @@ -0,0 +1,42 @@ +From f8a2da6ec2417cca169fa85a8ab15817bccbb109 Mon Sep 17 00:00:00 2001 +From: Marc Kleine-Budde +Date: Tue, 18 Jul 2023 11:43:54 +0200 +Subject: can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED + +From: Marc Kleine-Budde + +commit f8a2da6ec2417cca169fa85a8ab15817bccbb109 upstream. + +After an initial link up the CAN device is in ERROR-ACTIVE mode. Due +to a missing CAN_STATE_STOPPED in gs_can_close() it doesn't change to +STOPPED after a link down: + +| ip link set dev can0 up +| ip link set dev can0 down +| ip --details link show can0 +| 13: can0: mtu 16 qdisc pfifo_fast state DOWN mode DEFAULT group default qlen 10 +| link/can promiscuity 0 allmulti 0 minmtu 0 maxmtu 0 +| can state ERROR-ACTIVE restart-ms 1000 + +Add missing assignment of CAN_STATE_STOPPED in gs_can_close(). + +Cc: stable@vger.kernel.org +Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") +Link: https://lore.kernel.org/all/20230718-gs_usb-fix-can-state-v1-1-f19738ae2c23@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/can/usb/gs_usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/can/usb/gs_usb.c ++++ b/drivers/net/can/usb/gs_usb.c +@@ -732,6 +732,8 @@ static int gs_can_close(struct net_devic + usb_kill_anchored_urbs(&dev->tx_submitted); + atomic_set(&dev->active_tx_urbs, 0); + ++ dev->can.state = CAN_STATE_STOPPED; ++ + /* reset the device */ + rc = gs_cmd_reset(dev); + if (rc < 0) diff --git a/queue-5.10/documentation-security-bugs.rst-clarify-cve-handling.patch b/queue-5.10/documentation-security-bugs.rst-clarify-cve-handling.patch new file mode 100644 index 00000000000..6032de00b45 --- /dev/null +++ b/queue-5.10/documentation-security-bugs.rst-clarify-cve-handling.patch @@ -0,0 +1,42 @@ +From 3c1897ae4b6bc7cc586eda2feaa2cd68325ec29c Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Fri, 30 Jun 2023 09:14:21 +0200 +Subject: Documentation: security-bugs.rst: clarify CVE handling + +From: Greg Kroah-Hartman + +commit 3c1897ae4b6bc7cc586eda2feaa2cd68325ec29c upstream. + +The kernel security team does NOT assign CVEs, so document that properly +and provide the "if you want one, ask MITRE for it" response that we +give on a weekly basis in the document, so we don't have to constantly +say it to everyone who asks. + +Link: https://lore.kernel.org/r/2023063022-retouch-kerosene-7e4a@gregkh +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/admin-guide/security-bugs.rst | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +--- a/Documentation/admin-guide/security-bugs.rst ++++ b/Documentation/admin-guide/security-bugs.rst +@@ -79,13 +79,12 @@ not contribute to actually fixing any po + CVE assignment + -------------- + +-The security team does not normally assign CVEs, nor do we require them +-for reports or fixes, as this can needlessly complicate the process and +-may delay the bug handling. If a reporter wishes to have a CVE identifier +-assigned ahead of public disclosure, they will need to contact the private +-linux-distros list, described above. When such a CVE identifier is known +-before a patch is provided, it is desirable to mention it in the commit +-message if the reporter agrees. ++The security team does not assign CVEs, nor do we require them for ++reports or fixes, as this can needlessly complicate the process and may ++delay the bug handling. If a reporter wishes to have a CVE identifier ++assigned, they should find one by themselves, for example by contacting ++MITRE directly. However under no circumstances will a patch inclusion ++be delayed to wait for a CVE identifier to arrive. + + Non-disclosure agreements + ------------------------- diff --git a/queue-5.10/documentation-security-bugs.rst-update-preferences-when-dealing-with-the-linux-distros-group.patch b/queue-5.10/documentation-security-bugs.rst-update-preferences-when-dealing-with-the-linux-distros-group.patch new file mode 100644 index 00000000000..fc43d0d1d72 --- /dev/null +++ b/queue-5.10/documentation-security-bugs.rst-update-preferences-when-dealing-with-the-linux-distros-group.patch @@ -0,0 +1,56 @@ +From 4fee0915e649bd0cea56dece6d96f8f4643df33c Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Fri, 30 Jun 2023 09:14:20 +0200 +Subject: Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group + +From: Greg Kroah-Hartman + +commit 4fee0915e649bd0cea56dece6d96f8f4643df33c upstream. + +Because the linux-distros group forces reporters to release information +about reported bugs, and they impose arbitrary deadlines in having those +bugs fixed despite not actually being kernel developers, the kernel +security team recommends not interacting with them at all as this just +causes confusion and the early-release of reported security problems. + +Reviewed-by: Kees Cook +Link: https://lore.kernel.org/r/2023063020-throat-pantyhose-f110@gregkh +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/admin-guide/security-bugs.rst | 24 +++++++++++------------- + 1 file changed, 11 insertions(+), 13 deletions(-) + +--- a/Documentation/admin-guide/security-bugs.rst ++++ b/Documentation/admin-guide/security-bugs.rst +@@ -63,20 +63,18 @@ information submitted to the security li + of the report are treated confidentially even after the embargo has been + lifted, in perpetuity. + +-Coordination +------------- ++Coordination with other groups ++------------------------------ + +-Fixes for sensitive bugs, such as those that might lead to privilege +-escalations, may need to be coordinated with the private +- mailing list so that distribution vendors +-are well prepared to issue a fixed kernel upon public disclosure of the +-upstream fix. Distros will need some time to test the proposed patch and +-will generally request at least a few days of embargo, and vendor update +-publication prefers to happen Tuesday through Thursday. When appropriate, +-the security team can assist with this coordination, or the reporter can +-include linux-distros from the start. In this case, remember to prefix +-the email Subject line with "[vs]" as described in the linux-distros wiki: +- ++The kernel security team strongly recommends that reporters of potential ++security issues NEVER contact the "linux-distros" mailing list until ++AFTER discussing it with the kernel security team. Do not Cc: both ++lists at once. You may contact the linux-distros mailing list after a ++fix has been agreed on and you fully understand the requirements that ++doing so will impose on you and the kernel community. ++ ++The different lists have different goals and the linux-distros rules do ++not contribute to actually fixing any potential security problems. + + CVE assignment + -------------- diff --git a/queue-5.10/file-always-lock-position-for-fmode_atomic_pos.patch b/queue-5.10/file-always-lock-position-for-fmode_atomic_pos.patch new file mode 100644 index 00000000000..2e16b11ea76 --- /dev/null +++ b/queue-5.10/file-always-lock-position-for-fmode_atomic_pos.patch @@ -0,0 +1,57 @@ +From 20ea1e7d13c1b544fe67c4a8dc3943bb1ab33e6f Mon Sep 17 00:00:00 2001 +From: Christian Brauner +Date: Mon, 24 Jul 2023 17:00:49 +0200 +Subject: file: always lock position for FMODE_ATOMIC_POS + +From: Christian Brauner + +commit 20ea1e7d13c1b544fe67c4a8dc3943bb1ab33e6f upstream. + +The pidfd_getfd() system call allows a caller with ptrace_may_access() +abilities on another process to steal a file descriptor from this +process. This system call is used by debuggers, container runtimes, +system call supervisors, networking proxies etc. So while it is a +special interest system call it is used in common tools. + +That ability ends up breaking our long-time optimization in fdget_pos(), +which "knew" that if we had exclusive access to the file descriptor +nobody else could access it, and we didn't need the lock for the file +position. + +That check for file_count(file) was always fairly subtle - it depended +on __fdget() not incrementing the file count for single-threaded +processes and thus included that as part of the rule - but it did mean +that we didn't need to take the lock in all those traditional unix +process contexts. + +So it's sad to see this go, and I'd love to have some way to re-instate +the optimization. At the same time, the lock obviously isn't ever +contended in the case we optimized, so all we were optimizing away is +the atomics and the cacheline dirtying. Let's see if anybody even +notices that the optimization is gone. + +Link: https://lore.kernel.org/linux-fsdevel/20230724-vfs-fdget_pos-v1-1-a4abfd7103f3@kernel.org/ +Fixes: 8649c322f75c ("pid: Implement pidfd_getfd syscall") +Cc: stable@kernel.org +Signed-off-by: Christian Brauner +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + fs/file.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/fs/file.c ++++ b/fs/file.c +@@ -1013,10 +1013,8 @@ unsigned long __fdget_pos(unsigned int f + struct file *file = (struct file *)(v & ~3); + + if (file && (file->f_mode & FMODE_ATOMIC_POS)) { +- if (file_count(file) > 1) { +- v |= FDPUT_POS_UNLOCK; +- mutex_lock(&file->f_pos_lock); +- } ++ v |= FDPUT_POS_UNLOCK; ++ mutex_lock(&file->f_pos_lock); + } + return v; + } diff --git a/queue-5.10/hwmon-nct7802-fix-for-temp6-peci1-processed-even-if-peci1-disabled.patch b/queue-5.10/hwmon-nct7802-fix-for-temp6-peci1-processed-even-if-peci1-disabled.patch new file mode 100644 index 00000000000..212346a08ba --- /dev/null +++ b/queue-5.10/hwmon-nct7802-fix-for-temp6-peci1-processed-even-if-peci1-disabled.patch @@ -0,0 +1,34 @@ +From 54685abe660a59402344d5045ce08c43c6a5ac42 Mon Sep 17 00:00:00 2001 +From: Gilles Buloz +Date: Mon, 24 Jul 2023 08:04:44 +0000 +Subject: hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled + +From: Gilles Buloz + +commit 54685abe660a59402344d5045ce08c43c6a5ac42 upstream. + +Because of hex value 0x46 used instead of decimal 46, the temp6 +(PECI1) temperature is always declared visible and then displayed +even if disabled in the chip + +Signed-off-by: Gilles Buloz +Link: https://lore.kernel.org/r/DU0PR10MB62526435ADBC6A85243B90E08002A@DU0PR10MB6252.EURPRD10.PROD.OUTLOOK.COM +Fixes: fcdc5739dce03 ("hwmon: (nct7802) add temperature sensor type attribute") +Cc: stable@vger.kernel.org +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/nct7802.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/nct7802.c ++++ b/drivers/hwmon/nct7802.c +@@ -708,7 +708,7 @@ static umode_t nct7802_temp_is_visible(s + if (index >= 38 && index < 46 && !(reg & 0x01)) /* PECI 0 */ + return 0; + +- if (index >= 0x46 && (!(reg & 0x02))) /* PECI 1 */ ++ if (index >= 46 && !(reg & 0x02)) /* PECI 1 */ + return 0; + + return attr->mode; diff --git a/queue-5.10/nfsd-remove-incorrect-check-in-nfsd4_validate_stateid.patch b/queue-5.10/nfsd-remove-incorrect-check-in-nfsd4_validate_stateid.patch new file mode 100644 index 00000000000..a1d45a0f1ff --- /dev/null +++ b/queue-5.10/nfsd-remove-incorrect-check-in-nfsd4_validate_stateid.patch @@ -0,0 +1,38 @@ +From f75546f58a70da5cfdcec5a45ffc377885ccbee8 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Tue, 18 Jul 2023 08:38:37 -0400 +Subject: nfsd: Remove incorrect check in nfsd4_validate_stateid + +From: Trond Myklebust + +commit f75546f58a70da5cfdcec5a45ffc377885ccbee8 upstream. + +If the client is calling TEST_STATEID, then it is because some event +occurred that requires it to check all the stateids for validity and +call FREE_STATEID on the ones that have been revoked. In this case, +either the stateid exists in the list of stateids associated with that +nfs4_client, in which case it should be tested, or it does not. There +are no additional conditions to be considered. + +Reported-by: "Frank Ch. Eigler" +Fixes: 7df302f75ee2 ("NFSD: TEST_STATEID should not return NFS4ERR_STALE_STATEID") +Cc: stable@vger.kernel.org # v5.7+ +Signed-off-by: Trond Myklebust +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfsd/nfs4state.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -5656,8 +5656,6 @@ static __be32 nfsd4_validate_stateid(str + if (ZERO_STATEID(stateid) || ONE_STATEID(stateid) || + CLOSE_STATEID(stateid)) + return status; +- if (!same_clid(&stateid->si_opaque.so_clid, &cl->cl_clientid)) +- return status; + spin_lock(&cl->cl_lock); + s = find_stateid_locked(cl, stateid); + if (!s) diff --git a/queue-5.10/revert-usb-dwc3-core-enable-autoretry-feature-in-the-controller.patch b/queue-5.10/revert-usb-dwc3-core-enable-autoretry-feature-in-the-controller.patch new file mode 100644 index 00000000000..1b45469fa9f --- /dev/null +++ b/queue-5.10/revert-usb-dwc3-core-enable-autoretry-feature-in-the-controller.patch @@ -0,0 +1,98 @@ +From 734ae15ab95a18d3d425fc9cb38b7a627d786f08 Mon Sep 17 00:00:00 2001 +From: Jakub Vanek +Date: Fri, 14 Jul 2023 14:24:19 +0200 +Subject: Revert "usb: dwc3: core: Enable AutoRetry feature in the controller" + +From: Jakub Vanek + +commit 734ae15ab95a18d3d425fc9cb38b7a627d786f08 upstream. + +This reverts commit b138e23d3dff90c0494925b4c1874227b81bddf7. + +AutoRetry has been found to sometimes cause controller freezes when +communicating with buggy USB devices. + +This controller feature allows the controller in host mode to send +non-terminating/burst retry ACKs instead of terminating retry ACKs +to devices when a transaction error (CRC error or overflow) occurs. + +Unfortunately, if the USB device continues to respond with a CRC error, +the controller will not complete endpoint-related commands while it +keeps trying to auto-retry. [3] The xHCI driver will notice this once +it tries to abort the transfer using a Stop Endpoint command and +does not receive a completion in time. [1] +This situation is reported to dmesg: + +[sda] tag#29 uas_eh_abort_handler 0 uas-tag 1 inflight: CMD IN +[sda] tag#29 CDB: opcode=0x28 28 00 00 69 42 80 00 00 48 00 +xhci-hcd: xHCI host not responding to stop endpoint command +xhci-hcd: xHCI host controller not responding, assume dead +xhci-hcd: HC died; cleaning up + +Some users observed this problem on an Odroid HC2 with the JMS578 +USB3-to-SATA bridge. The issue can be triggered by starting +a read-heavy workload on an attached SSD. After a while, the host +controller would die and the SSD would disappear from the system. [1] + +Further analysis by Synopsys determined that controller revisions +other than the one in Odroid HC2 are also affected by this. +The recommended solution was to disable AutoRetry altogether. +This change does not have a noticeable performance impact. [2] + +Revert the enablement commit. This will keep the AutoRetry bit in +the default state configured during SoC design [2]. + +Fixes: b138e23d3dff ("usb: dwc3: core: Enable AutoRetry feature in the controller") +Link: https://lore.kernel.org/r/a21f34c04632d250cd0a78c7c6f4a1c9c7a43142.camel@gmail.com/ [1] +Link: https://lore.kernel.org/r/20230711214834.kyr6ulync32d4ktk@synopsys.com/ [2] +Link: https://lore.kernel.org/r/20230712225518.2smu7wse6djc7l5o@synopsys.com/ [3] +Cc: stable@vger.kernel.org +Cc: Mauro Ribeiro +Cc: Krzysztof Kozlowski +Suggested-by: Thinh Nguyen +Signed-off-by: Jakub Vanek +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/20230714122419.27741-1-linuxtardis@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 16 ---------------- + drivers/usb/dwc3/core.h | 3 --- + 2 files changed, 19 deletions(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1066,22 +1066,6 @@ static int dwc3_core_init(struct dwc3 *d + dwc3_writel(dwc->regs, DWC3_GUCTL1, reg); + } + +- if (dwc->dr_mode == USB_DR_MODE_HOST || +- dwc->dr_mode == USB_DR_MODE_OTG) { +- reg = dwc3_readl(dwc->regs, DWC3_GUCTL); +- +- /* +- * Enable Auto retry Feature to make the controller operating in +- * Host mode on seeing transaction errors(CRC errors or internal +- * overrun scenerios) on IN transfers to reply to the device +- * with a non-terminating retry ACK (i.e, an ACK transcation +- * packet with Retry=1 & Nump != 0) +- */ +- reg |= DWC3_GUCTL_HSTINAUTORETRY; +- +- dwc3_writel(dwc->regs, DWC3_GUCTL, reg); +- } +- + /* + * Must config both number of packets and max burst settings to enable + * RX and/or TX threshold. +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -249,9 +249,6 @@ + #define DWC3_GCTL_GBLHIBERNATIONEN BIT(1) + #define DWC3_GCTL_DSBLCLKGTNG BIT(0) + +-/* Global User Control Register */ +-#define DWC3_GUCTL_HSTINAUTORETRY BIT(14) +- + /* Global User Control 1 Register */ + #define DWC3_GUCTL1_PARKMODE_DISABLE_SS BIT(17) + #define DWC3_GUCTL1_TX_IPGAP_LINECHECK_DIS BIT(28) diff --git a/queue-5.10/revert-usb-gadget-tegra-xudc-fix-error-check-in-tegra_xudc_powerdomain_init.patch b/queue-5.10/revert-usb-gadget-tegra-xudc-fix-error-check-in-tegra_xudc_powerdomain_init.patch new file mode 100644 index 00000000000..333f47a8d1d --- /dev/null +++ b/queue-5.10/revert-usb-gadget-tegra-xudc-fix-error-check-in-tegra_xudc_powerdomain_init.patch @@ -0,0 +1,54 @@ +From a8291be6b5dd465c22af229483dbac543a91e24e Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 4 Jul 2023 17:09:09 +0300 +Subject: Revert "usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()" + +From: Dan Carpenter + +commit a8291be6b5dd465c22af229483dbac543a91e24e upstream. + +This reverts commit f08aa7c80dac27ee00fa6827f447597d2fba5465. + +The reverted commit was based on static analysis and a misunderstanding +of how PTR_ERR() and NULLs are supposed to work. When a function +returns both pointer errors and NULL then normally the NULL means +"continue operating without a feature because it was deliberately +turned off". The NULL should not be treated as a failure. If a driver +cannot work when that feature is disabled then the KConfig should +enforce that the function cannot return NULL. We should not need to +test for it. + +In this driver, the bug means that probe cannot succeed when CONFIG_PM +is disabled. + +Signed-off-by: Dan Carpenter +Fixes: f08aa7c80dac ("usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()") +Cc: stable +Link: https://lore.kernel.org/r/ZKQoBa84U/ykEh3C@moroto +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/tegra-xudc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/gadget/udc/tegra-xudc.c ++++ b/drivers/usb/gadget/udc/tegra-xudc.c +@@ -3693,15 +3693,15 @@ static int tegra_xudc_powerdomain_init(s + int err; + + xudc->genpd_dev_device = dev_pm_domain_attach_by_name(dev, "dev"); +- if (IS_ERR_OR_NULL(xudc->genpd_dev_device)) { +- err = PTR_ERR(xudc->genpd_dev_device) ? : -ENODATA; ++ if (IS_ERR(xudc->genpd_dev_device)) { ++ err = PTR_ERR(xudc->genpd_dev_device); + dev_err(dev, "failed to get device power domain: %d\n", err); + return err; + } + + xudc->genpd_dev_ss = dev_pm_domain_attach_by_name(dev, "ss"); +- if (IS_ERR_OR_NULL(xudc->genpd_dev_ss)) { +- err = PTR_ERR(xudc->genpd_dev_ss) ? : -ENODATA; ++ if (IS_ERR(xudc->genpd_dev_ss)) { ++ err = PTR_ERR(xudc->genpd_dev_ss); + dev_err(dev, "failed to get SuperSpeed power domain: %d\n", err); + return err; + } diff --git a/queue-5.10/revert-usb-xhci-tegra-fix-error-check.patch b/queue-5.10/revert-usb-xhci-tegra-fix-error-check.patch new file mode 100644 index 00000000000..7021036bd4a --- /dev/null +++ b/queue-5.10/revert-usb-xhci-tegra-fix-error-check.patch @@ -0,0 +1,54 @@ +From 288b4fa1798e3637a9304c6e90a93d900e02369c Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 4 Jul 2023 17:08:27 +0300 +Subject: Revert "usb: xhci: tegra: Fix error check" + +From: Dan Carpenter + +commit 288b4fa1798e3637a9304c6e90a93d900e02369c upstream. + +This reverts commit 18fc7c435be3f17ea26a21b2e2312fcb9088e01f. + +The reverted commit was based on static analysis and a misunderstanding +of how PTR_ERR() and NULLs are supposed to work. When a function +returns both pointer errors and NULL then normally the NULL means +"continue operating without a feature because it was deliberately +turned off". The NULL should not be treated as a failure. If a driver +cannot work when that feature is disabled then the KConfig should +enforce that the function cannot return NULL. We should not need to +test for it. + +In this code, the patch means that certain tegra_xusb_probe() will +fail if the firmware supports power-domains but CONFIG_PM is disabled. + +Signed-off-by: Dan Carpenter +Fixes: 18fc7c435be3 ("usb: xhci: tegra: Fix error check") +Cc: stable +Link: https://lore.kernel.org/r/8baace8d-fb4b-41a4-ad5f-848ae643a23b@moroto.mountain +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-tegra.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/host/xhci-tegra.c ++++ b/drivers/usb/host/xhci-tegra.c +@@ -1042,15 +1042,15 @@ static int tegra_xusb_powerdomain_init(s + int err; + + tegra->genpd_dev_host = dev_pm_domain_attach_by_name(dev, "xusb_host"); +- if (IS_ERR_OR_NULL(tegra->genpd_dev_host)) { +- err = PTR_ERR(tegra->genpd_dev_host) ? : -ENODATA; ++ if (IS_ERR(tegra->genpd_dev_host)) { ++ err = PTR_ERR(tegra->genpd_dev_host); + dev_err(dev, "failed to get host pm-domain: %d\n", err); + return err; + } + + tegra->genpd_dev_ss = dev_pm_domain_attach_by_name(dev, "xusb_ss"); +- if (IS_ERR_OR_NULL(tegra->genpd_dev_ss)) { +- err = PTR_ERR(tegra->genpd_dev_ss) ? : -ENODATA; ++ if (IS_ERR(tegra->genpd_dev_ss)) { ++ err = PTR_ERR(tegra->genpd_dev_ss); + dev_err(dev, "failed to get superspeed pm-domain: %d\n", err); + return err; + } diff --git a/queue-5.10/serial-8250_dw-preserve-original-value-of-dlf-register.patch b/queue-5.10/serial-8250_dw-preserve-original-value-of-dlf-register.patch new file mode 100644 index 00000000000..6d8390f851a --- /dev/null +++ b/queue-5.10/serial-8250_dw-preserve-original-value-of-dlf-register.patch @@ -0,0 +1,53 @@ +From 748c5ea8b8796ae8ee80b8d3a3d940570b588d59 Mon Sep 17 00:00:00 2001 +From: Ruihong Luo +Date: Thu, 13 Jul 2023 08:42:36 +0800 +Subject: serial: 8250_dw: Preserve original value of DLF register +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ruihong Luo + +commit 748c5ea8b8796ae8ee80b8d3a3d940570b588d59 upstream. + +Preserve the original value of the Divisor Latch Fraction (DLF) register. +When the DLF register is modified without preservation, it can disrupt +the baudrate settings established by firmware or bootloader, leading to +data corruption and the generation of unreadable or distorted characters. + +Fixes: 701c5e73b296 ("serial: 8250_dw: add fractional divisor support") +Cc: stable +Signed-off-by: Ruihong Luo +Link: https://lore.kernel.org/stable/20230713004235.35904-1-colorsu1922%40gmail.com +Reviewed-by: Ilpo Järvinen +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230713004235.35904-1-colorsu1922@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_dwlib.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/8250/8250_dwlib.c ++++ b/drivers/tty/serial/8250/8250_dwlib.c +@@ -80,7 +80,7 @@ static void dw8250_set_divisor(struct ua + void dw8250_setup_port(struct uart_port *p) + { + struct uart_8250_port *up = up_to_u8250p(p); +- u32 reg; ++ u32 reg, old_dlf; + + /* + * If the Component Version Register returns zero, we know that +@@ -93,9 +93,11 @@ void dw8250_setup_port(struct uart_port + dev_dbg(p->dev, "Designware UART version %c.%c%c\n", + (reg >> 24) & 0xff, (reg >> 16) & 0xff, (reg >> 8) & 0xff); + ++ /* Preserve value written by firmware or bootloader */ ++ old_dlf = dw8250_readl_ext(p, DW_UART_DLF); + dw8250_writel_ext(p, DW_UART_DLF, ~0U); + reg = dw8250_readl_ext(p, DW_UART_DLF); +- dw8250_writel_ext(p, DW_UART_DLF, 0); ++ dw8250_writel_ext(p, DW_UART_DLF, old_dlf); + + if (reg) { + struct dw8250_port_data *d = p->private_data; diff --git a/queue-5.10/serial-qcom-geni-drop-bogus-runtime-pm-state-update.patch b/queue-5.10/serial-qcom-geni-drop-bogus-runtime-pm-state-update.patch new file mode 100644 index 00000000000..ae2e24b213c --- /dev/null +++ b/queue-5.10/serial-qcom-geni-drop-bogus-runtime-pm-state-update.patch @@ -0,0 +1,42 @@ +From 4dd8752a14ca0303fbdf0a6c68ff65f0a50bd2fa Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 13 Jul 2023 16:57:41 +0200 +Subject: serial: qcom-geni: drop bogus runtime pm state update + +From: Johan Hovold + +commit 4dd8752a14ca0303fbdf0a6c68ff65f0a50bd2fa upstream. + +The runtime PM state should not be changed by drivers that do not +implement runtime PM even if it happens to work around a bug in PM core. + +With the wake irq arming now fixed, drop the bogus runtime PM state +update which left the device in active state (and could potentially +prevent a parent device from suspending). + +Fixes: f3974413cf02 ("tty: serial: qcom_geni_serial: Wakeup IRQ cleanup") +Cc: 5.6+ # 5.6+ +Signed-off-by: Johan Hovold +Reviewed-by: Tony Lindgren +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/qcom_geni_serial.c | 7 ------- + 1 file changed, 7 deletions(-) + +--- a/drivers/tty/serial/qcom_geni_serial.c ++++ b/drivers/tty/serial/qcom_geni_serial.c +@@ -1468,13 +1468,6 @@ static int qcom_geni_serial_probe(struct + goto err; + } + +- /* +- * Set pm_runtime status as ACTIVE so that wakeup_irq gets +- * enabled/disabled from dev_pm_arm_wake_irq during system +- * suspend/resume respectively. +- */ +- pm_runtime_set_active(&pdev->dev); +- + if (port->wakeup_irq > 0) { + device_init_wakeup(&pdev->dev, true); + ret = dev_pm_set_dedicated_wake_irq(&pdev->dev, diff --git a/queue-5.10/serial-sifive-fix-sifive_serial_console_setup-section.patch b/queue-5.10/serial-sifive-fix-sifive_serial_console_setup-section.patch new file mode 100644 index 00000000000..30218908714 --- /dev/null +++ b/queue-5.10/serial-sifive-fix-sifive_serial_console_setup-section.patch @@ -0,0 +1,34 @@ +From 9b8fef6345d5487137d4193bb0a0eae2203c284e Mon Sep 17 00:00:00 2001 +From: Samuel Holland +Date: Fri, 23 Jun 2023 23:01:59 -0700 +Subject: serial: sifive: Fix sifive_serial_console_setup() section + +From: Samuel Holland + +commit 9b8fef6345d5487137d4193bb0a0eae2203c284e upstream. + +This function is called indirectly from the platform driver probe +function. Even if the driver is built in, it may be probed after +free_initmem() due to deferral or unbinding/binding via sysfs. +Thus the function cannot be marked as __init. + +Fixes: 45c054d0815b ("tty: serial: add driver for the SiFive UART") +Cc: stable +Signed-off-by: Samuel Holland +Link: https://lore.kernel.org/r/20230624060159.3401369-1-samuel.holland@sifive.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/sifive.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/sifive.c ++++ b/drivers/tty/serial/sifive.c +@@ -844,7 +844,7 @@ static void sifive_serial_console_write( + local_irq_restore(flags); + } + +-static int __init sifive_serial_console_setup(struct console *co, char *options) ++static int sifive_serial_console_setup(struct console *co, char *options) + { + struct sifive_serial_port *ssp; + int baud = SIFIVE_DEFAULT_BAUD_RATE; diff --git a/queue-5.10/series b/queue-5.10/series index 195be920f73..0d1592ed328 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -62,3 +62,31 @@ dm-raid-protect-md_stop-with-reconfig_mutex.patch ata-pata_ns87415-mark-ns87560_tf_read-static.patch ring-buffer-fix-wrong-stat-of-cpu_buffer-read.patch tracing-fix-warning-in-trace_buffered_event_disable.patch +revert-usb-gadget-tegra-xudc-fix-error-check-in-tegra_xudc_powerdomain_init.patch +usb-gadget-fix-the-memory-leak-in-raw_gadget-driver.patch +serial-qcom-geni-drop-bogus-runtime-pm-state-update.patch +serial-8250_dw-preserve-original-value-of-dlf-register.patch +serial-sifive-fix-sifive_serial_console_setup-section.patch +usb-serial-option-support-quectel-em060k_128.patch +usb-serial-option-add-quectel-ec200a-module-support.patch +usb-serial-simple-add-kaufmann-rks-can-vcp.patch +usb-serial-simple-sort-driver-entries.patch +can-gs_usb-gs_can_close-add-missing-set-of-can-state-to-can_state_stopped.patch +revert-usb-dwc3-core-enable-autoretry-feature-in-the-controller.patch +usb-dwc3-pci-skip-byt-gpio-lookup-table-for-hardwired-phy.patch +usb-dwc3-don-t-reset-device-side-if-dwc3-was-configured-as-host-only.patch +usb-ohci-at91-fix-the-unhandle-interrupt-when-resume.patch +usb-quirks-add-quirk-for-focusrite-scarlett.patch +usb-xhci-mtk-set-the-dma-max_seg_size.patch +revert-usb-xhci-tegra-fix-error-check.patch +documentation-security-bugs.rst-update-preferences-when-dealing-with-the-linux-distros-group.patch +documentation-security-bugs.rst-clarify-cve-handling.patch +staging-ks7010-potential-buffer-overflow-in-ks_wlan_set_encode_ext.patch +tty-n_gsm-fix-uaf-in-gsm_cleanup_mux.patch +alsa-hda-realtek-support-asus-g713pv-laptop.patch +alsa-hda-relatek-enable-mute-led-on-hp-250-g8.patch +hwmon-nct7802-fix-for-temp6-peci1-processed-even-if-peci1-disabled.patch +btrfs-check-for-commit-error-at-btrfs_attach_transaction_barrier.patch +file-always-lock-position-for-fmode_atomic_pos.patch +nfsd-remove-incorrect-check-in-nfsd4_validate_stateid.patch +tpm_tis-explicitly-check-for-error-code.patch diff --git a/queue-5.10/staging-ks7010-potential-buffer-overflow-in-ks_wlan_set_encode_ext.patch b/queue-5.10/staging-ks7010-potential-buffer-overflow-in-ks_wlan_set_encode_ext.patch new file mode 100644 index 00000000000..1d1959ad89c --- /dev/null +++ b/queue-5.10/staging-ks7010-potential-buffer-overflow-in-ks_wlan_set_encode_ext.patch @@ -0,0 +1,37 @@ +From 5f1c7031e044cb2fba82836d55cc235e2ad619dc Mon Sep 17 00:00:00 2001 +From: Zhang Shurong +Date: Sun, 9 Jul 2023 13:50:07 +0800 +Subject: staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() + +From: Zhang Shurong + +commit 5f1c7031e044cb2fba82836d55cc235e2ad619dc upstream. + +The "exc->key_len" is a u16 that comes from the user. If it's over +IW_ENCODING_TOKEN_MAX (64) that could lead to memory corruption. + +Fixes: b121d84882b9 ("staging: ks7010: simplify calls to memcpy()") +Cc: stable +Signed-off-by: Zhang Shurong +Reviewed-by: Dan Carpenter +Link: https://lore.kernel.org/r/tencent_5153B668C0283CAA15AA518325346E026A09@qq.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/ks7010/ks_wlan_net.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/staging/ks7010/ks_wlan_net.c ++++ b/drivers/staging/ks7010/ks_wlan_net.c +@@ -1584,8 +1584,10 @@ static int ks_wlan_set_encode_ext(struct + commit |= SME_WEP_FLAG; + } + if (enc->key_len) { +- memcpy(&key->key_val[0], &enc->key[0], enc->key_len); +- key->key_len = enc->key_len; ++ int key_len = clamp_val(enc->key_len, 0, IW_ENCODING_TOKEN_MAX); ++ ++ memcpy(&key->key_val[0], &enc->key[0], key_len); ++ key->key_len = key_len; + commit |= (SME_WEP_VAL1 << index); + } + break; diff --git a/queue-5.10/tpm_tis-explicitly-check-for-error-code.patch b/queue-5.10/tpm_tis-explicitly-check-for-error-code.patch new file mode 100644 index 00000000000..c5ea4252b3c --- /dev/null +++ b/queue-5.10/tpm_tis-explicitly-check-for-error-code.patch @@ -0,0 +1,48 @@ +From 513253f8c293c0c8bd46d09d337fc892bf8f9f48 Mon Sep 17 00:00:00 2001 +From: Alexander Steffen +Date: Tue, 13 Jun 2023 20:02:56 +0200 +Subject: tpm_tis: Explicitly check for error code + +From: Alexander Steffen + +commit 513253f8c293c0c8bd46d09d337fc892bf8f9f48 upstream. + +recv_data either returns the number of received bytes, or a negative value +representing an error code. Adding the return value directly to the total +number of received bytes therefore looks a little weird, since it might add +a negative error code to a sum of bytes. + +The following check for size < expected usually makes the function return +ETIME in that case, so it does not cause too many problems in practice. But +to make the code look cleaner and because the caller might still be +interested in the original error code, explicitly check for the presence of +an error code and pass that through. + +Cc: stable@vger.kernel.org +Fixes: cb5354253af2 ("[PATCH] tpm: spacing cleanups 2") +Signed-off-by: Alexander Steffen +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/tpm/tpm_tis_core.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -333,8 +333,13 @@ static int tpm_tis_recv(struct tpm_chip + goto out; + } + +- size += recv_data(chip, &buf[TPM_HEADER_SIZE], +- expected - TPM_HEADER_SIZE); ++ rc = recv_data(chip, &buf[TPM_HEADER_SIZE], ++ expected - TPM_HEADER_SIZE); ++ if (rc < 0) { ++ size = rc; ++ goto out; ++ } ++ size += rc; + if (size < expected) { + dev_err(&chip->dev, "Unable to read remainder of result\n"); + size = -ETIME; diff --git a/queue-5.10/tty-n_gsm-fix-uaf-in-gsm_cleanup_mux.patch b/queue-5.10/tty-n_gsm-fix-uaf-in-gsm_cleanup_mux.patch new file mode 100644 index 00000000000..54534691031 --- /dev/null +++ b/queue-5.10/tty-n_gsm-fix-uaf-in-gsm_cleanup_mux.patch @@ -0,0 +1,100 @@ +From 9b9c8195f3f0d74a826077fc1c01b9ee74907239 Mon Sep 17 00:00:00 2001 +From: Chaoyuan Peng +Date: Tue, 18 Jul 2023 04:39:43 +0000 +Subject: tty: n_gsm: fix UAF in gsm_cleanup_mux + +From: Chaoyuan Peng + +commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239 upstream. + +In gsm_cleanup_mux() the 'gsm->dlci' pointer was not cleaned properly, +leaving it a dangling pointer after gsm_dlci_release. +This leads to use-after-free where 'gsm->dlci[0]' are freed and accessed +by the subsequent gsm_cleanup_mux(). + +Such is the case in the following call trace: + + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106 + print_address_description+0x63/0x3b0 mm/kasan/report.c:248 + __kasan_report mm/kasan/report.c:434 [inline] + kasan_report+0x16b/0x1c0 mm/kasan/report.c:451 + gsm_cleanup_mux+0x76a/0x850 drivers/tty/n_gsm.c:2397 + gsm_config drivers/tty/n_gsm.c:2653 [inline] + gsmld_ioctl+0xaae/0x15b0 drivers/tty/n_gsm.c:2986 + tty_ioctl+0x8ff/0xc50 drivers/tty/tty_io.c:2816 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:874 [inline] + __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x61/0xcb + + +Allocated by task 3501: + kasan_save_stack mm/kasan/common.c:38 [inline] + kasan_set_track mm/kasan/common.c:46 [inline] + set_alloc_info mm/kasan/common.c:434 [inline] + ____kasan_kmalloc+0xba/0xf0 mm/kasan/common.c:513 + kasan_kmalloc include/linux/kasan.h:264 [inline] + kmem_cache_alloc_trace+0x143/0x290 mm/slub.c:3247 + kmalloc include/linux/slab.h:591 [inline] + kzalloc include/linux/slab.h:721 [inline] + gsm_dlci_alloc+0x53/0x3a0 drivers/tty/n_gsm.c:1932 + gsm_activate_mux+0x1c/0x330 drivers/tty/n_gsm.c:2438 + gsm_config drivers/tty/n_gsm.c:2677 [inline] + gsmld_ioctl+0xd46/0x15b0 drivers/tty/n_gsm.c:2986 + tty_ioctl+0x8ff/0xc50 drivers/tty/tty_io.c:2816 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:874 [inline] + __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x61/0xcb + +Freed by task 3501: + kasan_save_stack mm/kasan/common.c:38 [inline] + kasan_set_track+0x4b/0x80 mm/kasan/common.c:46 + kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360 + ____kasan_slab_free+0xd8/0x120 mm/kasan/common.c:366 + kasan_slab_free include/linux/kasan.h:230 [inline] + slab_free_hook mm/slub.c:1705 [inline] + slab_free_freelist_hook+0xdd/0x160 mm/slub.c:1731 + slab_free mm/slub.c:3499 [inline] + kfree+0xf1/0x270 mm/slub.c:4559 + dlci_put drivers/tty/n_gsm.c:1988 [inline] + gsm_dlci_release drivers/tty/n_gsm.c:2021 [inline] + gsm_cleanup_mux+0x574/0x850 drivers/tty/n_gsm.c:2415 + gsm_config drivers/tty/n_gsm.c:2653 [inline] + gsmld_ioctl+0xaae/0x15b0 drivers/tty/n_gsm.c:2986 + tty_ioctl+0x8ff/0xc50 drivers/tty/tty_io.c:2816 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:874 [inline] + __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x61/0xcb + +Fixes: aa371e96f05d ("tty: n_gsm: fix restart handling via CLD command") +Signed-off-by: Chaoyuan Peng +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/n_gsm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -2178,8 +2178,10 @@ static void gsm_cleanup_mux(struct gsm_m + + /* Free up any link layer users and finally the control channel */ + for (i = NUM_DLCI - 1; i >= 0; i--) +- if (gsm->dlci[i]) ++ if (gsm->dlci[i]) { + gsm_dlci_release(gsm->dlci[i]); ++ gsm->dlci[i] = NULL; ++ } + mutex_unlock(&gsm->mutex); + /* Now wipe the queues */ + tty_ldisc_flush(gsm->tty); diff --git a/queue-5.10/usb-dwc3-don-t-reset-device-side-if-dwc3-was-configured-as-host-only.patch b/queue-5.10/usb-dwc3-don-t-reset-device-side-if-dwc3-was-configured-as-host-only.patch new file mode 100644 index 00000000000..7f04a232f79 --- /dev/null +++ b/queue-5.10/usb-dwc3-don-t-reset-device-side-if-dwc3-was-configured-as-host-only.patch @@ -0,0 +1,41 @@ +From e835c0a4e23c38531dcee5ef77e8d1cf462658c7 Mon Sep 17 00:00:00 2001 +From: Jisheng Zhang +Date: Wed, 28 Jun 2023 00:20:18 +0800 +Subject: usb: dwc3: don't reset device side if dwc3 was configured as host-only + +From: Jisheng Zhang + +commit e835c0a4e23c38531dcee5ef77e8d1cf462658c7 upstream. + +Commit c4a5153e87fd ("usb: dwc3: core: Power-off core/PHYs on +system_suspend in host mode") replaces check for HOST only dr_mode with +current_dr_role. But during booting, the current_dr_role isn't +initialized, thus the device side reset is always issued even if dwc3 +was configured as host-only. What's more, on some platforms with host +only dwc3, aways issuing device side reset by accessing device register +block can cause kernel panic. + +Fixes: c4a5153e87fd ("usb: dwc3: core: Power-off core/PHYs on system_suspend in host mode") +Cc: stable +Signed-off-by: Jisheng Zhang +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/20230627162018.739-1-jszhang@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -275,9 +275,9 @@ int dwc3_core_soft_reset(struct dwc3 *dw + /* + * We're resetting only the device side because, if we're in host mode, + * XHCI driver will reset the host block. If dwc3 was configured for +- * host-only mode, then we can return early. ++ * host-only mode or current role is host, then we can return early. + */ +- if (dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST) ++ if (dwc->dr_mode == USB_DR_MODE_HOST || dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST) + return 0; + + reg = dwc3_readl(dwc->regs, DWC3_DCTL); diff --git a/queue-5.10/usb-dwc3-pci-skip-byt-gpio-lookup-table-for-hardwired-phy.patch b/queue-5.10/usb-dwc3-pci-skip-byt-gpio-lookup-table-for-hardwired-phy.patch new file mode 100644 index 00000000000..2c657a696d4 --- /dev/null +++ b/queue-5.10/usb-dwc3-pci-skip-byt-gpio-lookup-table-for-hardwired-phy.patch @@ -0,0 +1,69 @@ +From b32b8f2b9542d8039f5468303a6ca78c1b5611a5 Mon Sep 17 00:00:00 2001 +From: Gratian Crisan +Date: Wed, 26 Jul 2023 13:45:56 -0500 +Subject: usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy + +From: Gratian Crisan + +commit b32b8f2b9542d8039f5468303a6ca78c1b5611a5 upstream. + +Hardware based on the Bay Trail / BYT SoCs require an external ULPI phy for +USB device-mode. The phy chip usually has its 'reset' and 'chip select' +lines connected to GPIOs described by ACPI fwnodes in the DSDT table. + +Because of hardware with missing ACPI resources for the 'reset' and 'chip +select' GPIOs commit 5741022cbdf3 ("usb: dwc3: pci: Add GPIO lookup table +on platforms without ACPI GPIO resources") introduced a fallback +gpiod_lookup_table with hard-coded mappings for Bay Trail devices. + +However there are existing Bay Trail based devices, like the National +Instruments cRIO-903x series, where the phy chip has its 'reset' and +'chip-select' lines always asserted in hardware via resistor pull-ups. On +this hardware the phy chip is always enabled and the ACPI dsdt table is +missing information not only for the 'chip-select' and 'reset' lines but +also for the BYT GPIO controller itself "INT33FC". + +With the introduction of the gpiod_lookup_table initializing the USB +device-mode on these hardware now errors out. The error comes from the +gpiod_get_optional() calls in dwc3_pci_quirks() which will now return an +-ENOENT error due to the missing ACPI entry for the INT33FC gpio controller +used in the aforementioned table. + +This hardware used to work before because gpiod_get_optional() will return +NULL instead of -ENOENT if no GPIO has been assigned to the requested +function. The dwc3_pci_quirks() code for setting the 'cs' and 'reset' GPIOs +was then skipped (due to the NULL return). This is the correct behavior in +cases where the phy chip is hardwired and there are no GPIOs to control. + +Since the gpiod_lookup_table relies on the presence of INT33FC fwnode +in ACPI tables only add the table if we know the entry for the INT33FC +gpio controller is present. This allows Bay Trail based devices with +hardwired dwc3 ULPI phys to continue working. + +Fixes: 5741022cbdf3 ("usb: dwc3: pci: Add GPIO lookup table on platforms without ACPI GPIO resources") +Cc: stable +Signed-off-by: Gratian Crisan +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20230726184555.218091-2-gratian.crisan@ni.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-pci.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -173,10 +173,12 @@ static int dwc3_pci_quirks(struct dwc3_p + + /* + * A lot of BYT devices lack ACPI resource entries for +- * the GPIOs, add a fallback mapping to the reference ++ * the GPIOs. If the ACPI entry for the GPIO controller ++ * is present add a fallback mapping to the reference + * design GPIOs which all boards seem to use. + */ +- gpiod_add_lookup_table(&platform_bytcr_gpios); ++ if (acpi_dev_present("INT33FC", NULL, -1)) ++ gpiod_add_lookup_table(&platform_bytcr_gpios); + + /* + * These GPIOs will turn on the USB2 PHY. Note that we have to diff --git a/queue-5.10/usb-gadget-fix-the-memory-leak-in-raw_gadget-driver.patch b/queue-5.10/usb-gadget-fix-the-memory-leak-in-raw_gadget-driver.patch new file mode 100644 index 00000000000..5458332a7ea --- /dev/null +++ b/queue-5.10/usb-gadget-fix-the-memory-leak-in-raw_gadget-driver.patch @@ -0,0 +1,78 @@ +From 83e30f2bf86ef7c38fbd476ed81a88522b620628 Mon Sep 17 00:00:00 2001 +From: Zqiang +Date: Fri, 14 Jul 2023 15:40:11 +0800 +Subject: USB: gadget: Fix the memory leak in raw_gadget driver + +From: Zqiang + +commit 83e30f2bf86ef7c38fbd476ed81a88522b620628 upstream. + +Currently, increasing raw_dev->count happens before invoke the +raw_queue_event(), if the raw_queue_event() return error, invoke +raw_release() will not trigger the dev_free() to be called. + +[ 268.905865][ T5067] raw-gadget.0 gadget.0: failed to queue event +[ 268.912053][ T5067] udc dummy_udc.0: failed to start USB Raw Gadget: -12 +[ 268.918885][ T5067] raw-gadget.0: probe of gadget.0 failed with error -12 +[ 268.925956][ T5067] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy +[ 268.934657][ T5067] misc raw-gadget: fail, usb_gadget_register_driver returned -16 + +BUG: memory leak + +[] kmalloc_trace+0x24/0x90 mm/slab_common.c:1076 +[] kmalloc include/linux/slab.h:582 [inline] +[] kzalloc include/linux/slab.h:703 [inline] +[] dev_new drivers/usb/gadget/legacy/raw_gadget.c:191 [inline] +[] raw_open+0x45/0x110 drivers/usb/gadget/legacy/raw_gadget.c:385 +[] misc_open+0x1a9/0x1f0 drivers/char/misc.c:165 + +[] kmalloc_trace+0x24/0x90 mm/slab_common.c:1076 +[] kmalloc include/linux/slab.h:582 [inline] +[] raw_ioctl_init+0xdf/0x410 drivers/usb/gadget/legacy/raw_gadget.c:460 +[] raw_ioctl+0x5f9/0x1120 drivers/usb/gadget/legacy/raw_gadget.c:1250 +[] vfs_ioctl fs/ioctl.c:51 [inline] + +[] kmalloc_trace+0x24/0x90 mm/slab_common.c:1076 +[] kmalloc include/linux/slab.h:582 [inline] +[] kzalloc include/linux/slab.h:703 [inline] +[] dummy_alloc_request+0x5a/0xe0 drivers/usb/gadget/udc/dummy_hcd.c:665 +[] usb_ep_alloc_request+0x22/0xd0 drivers/usb/gadget/udc/core.c:196 +[] gadget_bind+0x6d/0x370 drivers/usb/gadget/legacy/raw_gadget.c:292 + +This commit therefore invoke kref_get() under the condition that +raw_queue_event() return success. + +Reported-by: syzbot+feb045d335c1fdde5bf7@syzkaller.appspotmail.com +Cc: stable +Closes: https://syzkaller.appspot.com/bug?extid=feb045d335c1fdde5bf7 +Signed-off-by: Zqiang +Reviewed-by: Andrey Konovalov +Tested-by: Andrey Konovalov +Link: https://lore.kernel.org/r/20230714074011.20989-1-qiang.zhang1211@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/legacy/raw_gadget.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/usb/gadget/legacy/raw_gadget.c ++++ b/drivers/usb/gadget/legacy/raw_gadget.c +@@ -309,13 +309,15 @@ static int gadget_bind(struct usb_gadget + dev->eps_num = i; + spin_unlock_irqrestore(&dev->lock, flags); + +- /* Matches kref_put() in gadget_unbind(). */ +- kref_get(&dev->count); +- + ret = raw_queue_event(dev, USB_RAW_EVENT_CONNECT, 0, NULL); +- if (ret < 0) ++ if (ret < 0) { + dev_err(&gadget->dev, "failed to queue event\n"); ++ set_gadget_data(gadget, NULL); ++ return ret; ++ } + ++ /* Matches kref_put() in gadget_unbind(). */ ++ kref_get(&dev->count); + return ret; + } + diff --git a/queue-5.10/usb-ohci-at91-fix-the-unhandle-interrupt-when-resume.patch b/queue-5.10/usb-ohci-at91-fix-the-unhandle-interrupt-when-resume.patch new file mode 100644 index 00000000000..bd913e77b02 --- /dev/null +++ b/queue-5.10/usb-ohci-at91-fix-the-unhandle-interrupt-when-resume.patch @@ -0,0 +1,43 @@ +From c55afcbeaa7a6f4fffdbc999a9bf3f0b29a5186f Mon Sep 17 00:00:00 2001 +From: Guiting Shen +Date: Mon, 26 Jun 2023 23:27:13 +0800 +Subject: usb: ohci-at91: Fix the unhandle interrupt when resume + +From: Guiting Shen + +commit c55afcbeaa7a6f4fffdbc999a9bf3f0b29a5186f upstream. + +The ohci_hcd_at91_drv_suspend() sets ohci->rh_state to OHCI_RH_HALTED when +suspend which will let the ohci_irq() skip the interrupt after resume. And +nobody to handle this interrupt. + +According to the comment in ohci_hcd_at91_drv_suspend(), it need to reset +when resume from suspend(MEM) to fix by setting "hibernated" argument of +ohci_resume(). + +Signed-off-by: Guiting Shen +Cc: stable +Reviewed-by: Alan Stern +Link: https://lore.kernel.org/r/20230626152713.18950-1-aarongt.shen@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/ohci-at91.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/ohci-at91.c ++++ b/drivers/usb/host/ohci-at91.c +@@ -647,7 +647,13 @@ ohci_hcd_at91_drv_resume(struct device * + else + at91_start_clock(ohci_at91); + +- ohci_resume(hcd, false); ++ /* ++ * According to the comment in ohci_hcd_at91_drv_suspend() ++ * we need to do a reset if the 48Mhz clock was stopped, ++ * that is, if ohci_at91->wakeup is clear. Tell ohci_resume() ++ * to reset in this case by setting its "hibernated" flag. ++ */ ++ ohci_resume(hcd, !ohci_at91->wakeup); + + return 0; + } diff --git a/queue-5.10/usb-quirks-add-quirk-for-focusrite-scarlett.patch b/queue-5.10/usb-quirks-add-quirk-for-focusrite-scarlett.patch new file mode 100644 index 00000000000..8ffc6ce0720 --- /dev/null +++ b/queue-5.10/usb-quirks-add-quirk-for-focusrite-scarlett.patch @@ -0,0 +1,66 @@ +From 9dc162e22387080e2d06de708b89920c0e158c9a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?=C5=81ukasz=20Bartosik?= +Date: Mon, 24 Jul 2023 13:29:11 +0200 +Subject: USB: quirks: add quirk for Focusrite Scarlett +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Łukasz Bartosik + +commit 9dc162e22387080e2d06de708b89920c0e158c9a upstream. + +The Focusrite Scarlett audio device does not behave correctly during +resumes. Below is what happens during every resume (captured with +Beagle 5000): + + + +// + + + +The Scarlett disconnects and is enumerated again. + +However from time to time it drops completely off the USB bus during +resume. Below is captured occurrence of such an event: + + + +// +// + + + + +To fix the condition a user has to unplug and plug the device again. + +With USB_QUIRK_RESET_RESUME applied ("usbcore.quirks=1235:8211:b") +for the Scarlett audio device the issue still reproduces. + +Applying USB_QUIRK_DISCONNECT_SUSPEND ("usbcore.quirks=1235:8211:m") +fixed the issue and the Scarlett audio device didn't drop off the USB +bus for ~5000 suspend/resume cycles where originally issue reproduced in +~100 or less suspend/resume cycles. + +Signed-off-by: Łukasz Bartosik +Cc: stable +Link: https://lore.kernel.org/r/20230724112911.1802577-1-lb@semihalf.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -437,6 +437,10 @@ static const struct usb_device_id usb_qu + /* novation SoundControl XL */ + { USB_DEVICE(0x1235, 0x0061), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* Focusrite Scarlett Solo USB */ ++ { USB_DEVICE(0x1235, 0x8211), .driver_info = ++ USB_QUIRK_DISCONNECT_SUSPEND }, ++ + /* Huawei 4G LTE module */ + { USB_DEVICE(0x12d1, 0x15bb), .driver_info = + USB_QUIRK_DISCONNECT_SUSPEND }, diff --git a/queue-5.10/usb-serial-option-add-quectel-ec200a-module-support.patch b/queue-5.10/usb-serial-option-add-quectel-ec200a-module-support.patch new file mode 100644 index 00000000000..05f72278932 --- /dev/null +++ b/queue-5.10/usb-serial-option-add-quectel-ec200a-module-support.patch @@ -0,0 +1,64 @@ +From 857ea9005806e2a458016880278f98715873e977 Mon Sep 17 00:00:00 2001 +From: Mohsen Tahmasebi +Date: Mon, 10 Jul 2023 11:22:18 +0330 +Subject: USB: serial: option: add Quectel EC200A module support + +From: Mohsen Tahmasebi + +commit 857ea9005806e2a458016880278f98715873e977 upstream. + +Add Quectel EC200A "DIAG, AT, MODEM": + +0x6005: ECM / RNDIS + DIAG + AT + MODEM + +T: Bus=01 Lev=01 Prnt=02 Port=05 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=6005 Rev=03.18 +S: Manufacturer=Android +S: Product=Android +S: SerialNumber=0000 +C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms + +Signed-off-by: Mohsen Tahmasebi +Tested-by: Mostafa Ghofrani +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -269,6 +269,7 @@ static void option_instat_callback(struc + #define QUECTEL_PRODUCT_RM520N 0x0801 + #define QUECTEL_PRODUCT_EC200U 0x0901 + #define QUECTEL_PRODUCT_EC200S_CN 0x6002 ++#define QUECTEL_PRODUCT_EC200A 0x6005 + #define QUECTEL_PRODUCT_EM061K_LWW 0x6008 + #define QUECTEL_PRODUCT_EM061K_LCN 0x6009 + #define QUECTEL_PRODUCT_EC200T 0x6026 +@@ -1229,6 +1230,7 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0900, 0xff, 0, 0), /* RM500U-CN */ + .driver_info = ZLP }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200A, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200U, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) }, diff --git a/queue-5.10/usb-serial-option-support-quectel-em060k_128.patch b/queue-5.10/usb-serial-option-support-quectel-em060k_128.patch new file mode 100644 index 00000000000..a2eb00eb16e --- /dev/null +++ b/queue-5.10/usb-serial-option-support-quectel-em060k_128.patch @@ -0,0 +1,73 @@ +From 4f7cab49cecee16120d27c1734cfdf3d6c0e5329 Mon Sep 17 00:00:00 2001 +From: Jerry Meng +Date: Thu, 29 Jun 2023 17:35:22 +0800 +Subject: USB: serial: option: support Quectel EM060K_128 + +From: Jerry Meng + +commit 4f7cab49cecee16120d27c1734cfdf3d6c0e5329 upstream. + +EM060K_128 is EM060K's sub-model, having the same name "Quectel EM060K-GL" + +MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL + +T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 8 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=0128 Rev= 5.04 +S: Manufacturer=Quectel +S: Product=Quectel EM060K-GL +S: SerialNumber=f6fa08b6 +C:* #Ifs= 8 Cfg#= 1 Atr=a0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=8f(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Jerry Meng +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -251,6 +251,7 @@ static void option_instat_callback(struc + #define QUECTEL_PRODUCT_EM061K_LTA 0x0123 + #define QUECTEL_PRODUCT_EM061K_LMS 0x0124 + #define QUECTEL_PRODUCT_EC25 0x0125 ++#define QUECTEL_PRODUCT_EM060K_128 0x0128 + #define QUECTEL_PRODUCT_EG91 0x0191 + #define QUECTEL_PRODUCT_EG95 0x0195 + #define QUECTEL_PRODUCT_BG96 0x0296 +@@ -1197,6 +1198,9 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0x00, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x40) }, diff --git a/queue-5.10/usb-serial-simple-add-kaufmann-rks-can-vcp.patch b/queue-5.10/usb-serial-simple-add-kaufmann-rks-can-vcp.patch new file mode 100644 index 00000000000..3419b0dd5c8 --- /dev/null +++ b/queue-5.10/usb-serial-simple-add-kaufmann-rks-can-vcp.patch @@ -0,0 +1,54 @@ +From dd92c8a1f99bcd166204ffc219ea5a23dd65d64f Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 12 Jul 2023 16:16:41 +0200 +Subject: USB: serial: simple: add Kaufmann RKS+CAN VCP + +From: Oliver Neukum + +commit dd92c8a1f99bcd166204ffc219ea5a23dd65d64f upstream. + +Add the device and product ID for this CAN bus interface / license +dongle. The device is usable either directly from user space or can be +attached to a kernel CAN interface with slcan_attach. + +Reported-by: Kaufmann Automotive GmbH +Tested-by: Kaufmann Automotive GmbH +Signed-off-by: Oliver Neukum +[ johan: amend commit message and move entries in sort order ] +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/usb-serial-simple.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/serial/usb-serial-simple.c ++++ b/drivers/usb/serial/usb-serial-simple.c +@@ -63,6 +63,11 @@ DEVICE(flashloader, FLASHLOADER_IDS); + 0x01) } + DEVICE(google, GOOGLE_IDS); + ++/* KAUFMANN RKS+CAN VCP */ ++#define KAUFMANN_IDS() \ ++ { USB_DEVICE(0x16d0, 0x0870) } ++DEVICE(kaufmann, KAUFMANN_IDS); ++ + /* Libtransistor USB console */ + #define LIBTRANSISTOR_IDS() \ + { USB_DEVICE(0x1209, 0x8b00) } +@@ -124,6 +129,7 @@ static struct usb_serial_driver * const + &funsoft_device, + &flashloader_device, + &google_device, ++ &kaufmann_device, + &libtransistor_device, + &vivopay_device, + &moto_modem_device, +@@ -142,6 +148,7 @@ static const struct usb_device_id id_tab + FUNSOFT_IDS(), + FLASHLOADER_IDS(), + GOOGLE_IDS(), ++ KAUFMANN_IDS(), + LIBTRANSISTOR_IDS(), + VIVOPAY_IDS(), + MOTO_IDS(), diff --git a/queue-5.10/usb-serial-simple-sort-driver-entries.patch b/queue-5.10/usb-serial-simple-sort-driver-entries.patch new file mode 100644 index 00000000000..b4b5fbd732e --- /dev/null +++ b/queue-5.10/usb-serial-simple-sort-driver-entries.patch @@ -0,0 +1,157 @@ +From d245aedc00775c4d7265a9f4522cc4e1fd34d102 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 20 Jul 2023 09:53:57 +0200 +Subject: USB: serial: simple: sort driver entries + +From: Johan Hovold + +commit d245aedc00775c4d7265a9f4522cc4e1fd34d102 upstream. + +Sort the driver symbols alphabetically in order to make it more obvious +where new driver entries should be added. + +Cc: stable@vger.kernel.org +Acked-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/usb-serial-simple.c | 66 ++++++++++++++++----------------- + 1 file changed, 33 insertions(+), 33 deletions(-) + +--- a/drivers/usb/serial/usb-serial-simple.c ++++ b/drivers/usb/serial/usb-serial-simple.c +@@ -38,16 +38,6 @@ static struct usb_serial_driver vendor## + { USB_DEVICE(0x0a21, 0x8001) } /* MMT-7305WW */ + DEVICE(carelink, CARELINK_IDS); + +-/* ZIO Motherboard USB driver */ +-#define ZIO_IDS() \ +- { USB_DEVICE(0x1CBE, 0x0103) } +-DEVICE(zio, ZIO_IDS); +- +-/* Funsoft Serial USB driver */ +-#define FUNSOFT_IDS() \ +- { USB_DEVICE(0x1404, 0xcddc) } +-DEVICE(funsoft, FUNSOFT_IDS); +- + /* Infineon Flashloader driver */ + #define FLASHLOADER_IDS() \ + { USB_DEVICE_INTERFACE_CLASS(0x058b, 0x0041, USB_CLASS_CDC_DATA) }, \ +@@ -55,6 +45,11 @@ DEVICE(funsoft, FUNSOFT_IDS); + { USB_DEVICE(0x8087, 0x0801) } + DEVICE(flashloader, FLASHLOADER_IDS); + ++/* Funsoft Serial USB driver */ ++#define FUNSOFT_IDS() \ ++ { USB_DEVICE(0x1404, 0xcddc) } ++DEVICE(funsoft, FUNSOFT_IDS); ++ + /* Google Serial USB SubClass */ + #define GOOGLE_IDS() \ + { USB_VENDOR_AND_INTERFACE_INFO(0x18d1, \ +@@ -63,6 +58,11 @@ DEVICE(flashloader, FLASHLOADER_IDS); + 0x01) } + DEVICE(google, GOOGLE_IDS); + ++/* HP4x (48/49) Generic Serial driver */ ++#define HP4X_IDS() \ ++ { USB_DEVICE(0x03f0, 0x0121) } ++DEVICE(hp4x, HP4X_IDS); ++ + /* KAUFMANN RKS+CAN VCP */ + #define KAUFMANN_IDS() \ + { USB_DEVICE(0x16d0, 0x0870) } +@@ -73,11 +73,6 @@ DEVICE(kaufmann, KAUFMANN_IDS); + { USB_DEVICE(0x1209, 0x8b00) } + DEVICE(libtransistor, LIBTRANSISTOR_IDS); + +-/* ViVOpay USB Serial Driver */ +-#define VIVOPAY_IDS() \ +- { USB_DEVICE(0x1d5f, 0x1004) } /* ViVOpay 8800 */ +-DEVICE(vivopay, VIVOPAY_IDS); +- + /* Motorola USB Phone driver */ + #define MOTO_IDS() \ + { USB_DEVICE(0x05c6, 0x3197) }, /* unknown Motorola phone */ \ +@@ -106,10 +101,10 @@ DEVICE(nokia, NOKIA_IDS); + { USB_DEVICE(0x09d7, 0x0100) } /* NovAtel FlexPack GPS */ + DEVICE_N(novatel_gps, NOVATEL_IDS, 3); + +-/* HP4x (48/49) Generic Serial driver */ +-#define HP4X_IDS() \ +- { USB_DEVICE(0x03f0, 0x0121) } +-DEVICE(hp4x, HP4X_IDS); ++/* Siemens USB/MPI adapter */ ++#define SIEMENS_IDS() \ ++ { USB_DEVICE(0x908, 0x0004) } ++DEVICE(siemens_mpi, SIEMENS_IDS); + + /* Suunto ANT+ USB Driver */ + #define SUUNTO_IDS() \ +@@ -117,47 +112,52 @@ DEVICE(hp4x, HP4X_IDS); + { USB_DEVICE(0x0fcf, 0x1009) } /* Dynastream ANT USB-m Stick */ + DEVICE(suunto, SUUNTO_IDS); + +-/* Siemens USB/MPI adapter */ +-#define SIEMENS_IDS() \ +- { USB_DEVICE(0x908, 0x0004) } +-DEVICE(siemens_mpi, SIEMENS_IDS); ++/* ViVOpay USB Serial Driver */ ++#define VIVOPAY_IDS() \ ++ { USB_DEVICE(0x1d5f, 0x1004) } /* ViVOpay 8800 */ ++DEVICE(vivopay, VIVOPAY_IDS); ++ ++/* ZIO Motherboard USB driver */ ++#define ZIO_IDS() \ ++ { USB_DEVICE(0x1CBE, 0x0103) } ++DEVICE(zio, ZIO_IDS); + + /* All of the above structures mushed into two lists */ + static struct usb_serial_driver * const serial_drivers[] = { + &carelink_device, +- &zio_device, +- &funsoft_device, + &flashloader_device, ++ &funsoft_device, + &google_device, ++ &hp4x_device, + &kaufmann_device, + &libtransistor_device, +- &vivopay_device, + &moto_modem_device, + &motorola_tetra_device, + &nokia_device, + &novatel_gps_device, +- &hp4x_device, +- &suunto_device, + &siemens_mpi_device, ++ &suunto_device, ++ &vivopay_device, ++ &zio_device, + NULL + }; + + static const struct usb_device_id id_table[] = { + CARELINK_IDS(), +- ZIO_IDS(), +- FUNSOFT_IDS(), + FLASHLOADER_IDS(), ++ FUNSOFT_IDS(), + GOOGLE_IDS(), ++ HP4X_IDS(), + KAUFMANN_IDS(), + LIBTRANSISTOR_IDS(), +- VIVOPAY_IDS(), + MOTO_IDS(), + MOTOROLA_TETRA_IDS(), + NOKIA_IDS(), + NOVATEL_IDS(), +- HP4X_IDS(), +- SUUNTO_IDS(), + SIEMENS_IDS(), ++ SUUNTO_IDS(), ++ VIVOPAY_IDS(), ++ ZIO_IDS(), + { }, + }; + MODULE_DEVICE_TABLE(usb, id_table); diff --git a/queue-5.10/usb-xhci-mtk-set-the-dma-max_seg_size.patch b/queue-5.10/usb-xhci-mtk-set-the-dma-max_seg_size.patch new file mode 100644 index 00000000000..861343a8f19 --- /dev/null +++ b/queue-5.10/usb-xhci-mtk-set-the-dma-max_seg_size.patch @@ -0,0 +1,35 @@ +From 9fd10829a9eb482e192a845675ecc5480e0bfa10 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Wed, 19 Jul 2023 13:01:04 +0000 +Subject: usb: xhci-mtk: set the dma max_seg_size + +From: Ricardo Ribalda + +commit 9fd10829a9eb482e192a845675ecc5480e0bfa10 upstream. + +Allow devices to have dma operations beyond 64K, and avoid warnings such +as: + +DMA-API: xhci-mtk 11200000.usb: mapping sg segment longer than device claims to support [len=98304] [max=65536] + +Fixes: 0cbd4b34cda9 ("xhci: mediatek: support MTK xHCI host controller") +Cc: stable +Tested-by: Zubin Mithra +Reported-by: Zubin Mithra +Signed-off-by: Ricardo Ribalda +Link: https://lore.kernel.org/r/20230628-mtk-usb-v2-1-c8c34eb9f229@chromium.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-mtk.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/host/xhci-mtk.c ++++ b/drivers/usb/host/xhci-mtk.c +@@ -535,6 +535,7 @@ static int xhci_mtk_probe(struct platfor + } + + device_init_wakeup(dev, true); ++ dma_set_max_seg_size(dev, UINT_MAX); + + xhci = hcd_to_xhci(hcd); + xhci->main_hcd = hcd;