--- /dev/null
+From bca243b1ce0e46be26f7c63b5591dfbb41f558e5 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 3 Jan 2020 17:35:08 +0100
+Subject: media: flexcop-usb: fix endpoint sanity check
+
+From: Johan Hovold <johan@kernel.org>
+
+commit bca243b1ce0e46be26f7c63b5591dfbb41f558e5 upstream.
+
+commit 1b976fc6d684 ("media: b2c2-flexcop-usb: add sanity checking") added
+an endpoint sanity check to address a NULL-pointer dereference on probe.
+Unfortunately the check was done on the current altsetting which was later
+changed.
+
+Fix this by moving the sanity check to after the altsetting is changed.
+
+Fixes: 1b976fc6d684 ("media: b2c2-flexcop-usb: add sanity checking")
+Cc: Oliver Neukum <oneukum@suse.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/b2c2/flexcop-usb.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/usb/b2c2/flexcop-usb.c
++++ b/drivers/media/usb/b2c2/flexcop-usb.c
+@@ -511,6 +511,9 @@ static int flexcop_usb_init(struct flexc
+ return ret;
+ }
+
++ if (fc_usb->uintf->cur_altsetting->desc.bNumEndpoints < 1)
++ return -ENODEV;
++
+ switch (fc_usb->udev->speed) {
+ case USB_SPEED_LOW:
+ err("cannot handle USB speed because it is too slow.");
+@@ -544,9 +547,6 @@ static int flexcop_usb_probe(struct usb_
+ struct flexcop_device *fc = NULL;
+ int ret;
+
+- if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+- return -ENODEV;
+-
+ if ((fc = flexcop_device_kmalloc(sizeof(struct flexcop_usb))) == NULL) {
+ err("out of memory\n");
+ return -ENOMEM;
--- /dev/null
+From 536f561d871c5781bc33d26d415685211b94032e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 13 Jan 2020 18:18:18 +0100
+Subject: media: usbtv: fix control-message timeouts
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 536f561d871c5781bc33d26d415685211b94032e upstream.
+
+The driver was issuing synchronous uninterruptible control requests
+without using a timeout. This could lead to the driver hanging on
+various user requests due to a malfunctioning (or malicious) device
+until the device is physically disconnected.
+
+The USB upper limit of five seconds per request should be more than
+enough.
+
+Fixes: f3d27f34fdd7 ("[media] usbtv: Add driver for Fushicai USBTV007 video frame grabber")
+Fixes: c53a846c48f2 ("[media] usbtv: add video controls")
+Cc: stable <stable@vger.kernel.org> # 3.11
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Lubomir Rintel <lkundrak@v3.sk>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/usbtv/usbtv-core.c | 2 +-
+ drivers/media/usb/usbtv/usbtv-video.c | 5 +++--
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/usb/usbtv/usbtv-core.c
++++ b/drivers/media/usb/usbtv/usbtv-core.c
+@@ -56,7 +56,7 @@ int usbtv_set_regs(struct usbtv *usbtv,
+
+ ret = usb_control_msg(usbtv->udev, pipe, USBTV_REQUEST_REG,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- value, index, NULL, 0, 0);
++ value, index, NULL, 0, USB_CTRL_GET_TIMEOUT);
+ if (ret < 0)
+ return ret;
+ }
+--- a/drivers/media/usb/usbtv/usbtv-video.c
++++ b/drivers/media/usb/usbtv/usbtv-video.c
+@@ -800,7 +800,8 @@ static int usbtv_s_ctrl(struct v4l2_ctrl
+ ret = usb_control_msg(usbtv->udev,
+ usb_rcvctrlpipe(usbtv->udev, 0), USBTV_CONTROL_REG,
+ USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- 0, USBTV_BASE + 0x0244, (void *)data, 3, 0);
++ 0, USBTV_BASE + 0x0244, (void *)data, 3,
++ USB_CTRL_GET_TIMEOUT);
+ if (ret < 0)
+ goto error;
+ }
+@@ -851,7 +852,7 @@ static int usbtv_s_ctrl(struct v4l2_ctrl
+ ret = usb_control_msg(usbtv->udev, usb_sndctrlpipe(usbtv->udev, 0),
+ USBTV_CONTROL_REG,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- 0, index, (void *)data, size, 0);
++ 0, index, (void *)data, size, USB_CTRL_SET_TIMEOUT);
+
+ error:
+ if (ret < 0)
bpf-undo-incorrect-__reg_bound_offset32-handling.patch
+usb-serial-option-add-support-for-askey-wwhc050.patch
+usb-serial-option-add-broadmobi-bm806u.patch
+usb-serial-option-add-wistron-neweb-d19q1.patch
+usb-cdc-acm-restore-capability-check-order.patch
+usb-serial-io_edgeport-fix-slab-out-of-bounds-read-in-edge_interrupt_callback.patch
+usb-musb-fix-crash-with-highmen-pio-and-usbmon.patch
+media-flexcop-usb-fix-endpoint-sanity-check.patch
+media-usbtv-fix-control-message-timeouts.patch
+staging-kpc2000-prevent-underflow-in-cpld_reconfigure.patch
+staging-rtl8188eu-add-asus-usb-n10-nano-b1-to-device-table.patch
+staging-wlan-ng-fix-odebug-bug-in-prism2sta_disconnect_usb.patch
+staging-wlan-ng-fix-use-after-free-read-in-hfa384x_usbin_callback.patch
+staging-wfx-add-proper-compatible-string.patch
+staging-wfx-fix-init-remove-vs-irq-race.patch
+staging-wfx-annotate-nested-gc_list-vs-tx-queue-locking.patch
--- /dev/null
+From 72db61d7d17a475d3cc9de1a7c871d518fcd82f0 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 24 Feb 2020 13:33:25 +0300
+Subject: staging: kpc2000: prevent underflow in cpld_reconfigure()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 72db61d7d17a475d3cc9de1a7c871d518fcd82f0 upstream.
+
+This function should not allow negative values of "wr_val". If
+negatives are allowed then capping the upper bound at 7 is
+meaningless. Let's make it unsigned.
+
+Fixes: 7dc7967fc39a ("staging: kpc2000: add initial set of Daktronics drivers")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200224103325.hrxdnaeqsthplu42@kili.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/kpc2000/kpc2000/core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/kpc2000/kpc2000/core.c
++++ b/drivers/staging/kpc2000/kpc2000/core.c
+@@ -110,10 +110,10 @@ static ssize_t cpld_reconfigure(struct d
+ const char *buf, size_t count)
+ {
+ struct kp2000_device *pcard = dev_get_drvdata(dev);
+- long wr_val;
++ unsigned long wr_val;
+ int rv;
+
+- rv = kstrtol(buf, 0, &wr_val);
++ rv = kstrtoul(buf, 0, &wr_val);
+ if (rv < 0)
+ return rv;
+ if (wr_val > 7)
--- /dev/null
+From 38ef48f7d4b7342f145a1b4f96023bde99aeb245 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sat, 21 Mar 2020 13:00:11 -0500
+Subject: staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 38ef48f7d4b7342f145a1b4f96023bde99aeb245 upstream.
+
+The ASUS USB-N10 Nano B1 has been reported as a new RTL8188EU device.
+Add it to the device tables.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Reported-by: kovi <zraetn@gmail.com>
+Cc: Stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200321180011.26153-1-Larry.Finger@lwfinger.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+@@ -32,6 +32,7 @@ static const struct usb_device_id rtw_us
+ /****** 8188EUS ********/
+ {USB_DEVICE(0x056e, 0x4008)}, /* Elecom WDC-150SU2M */
+ {USB_DEVICE(0x07b8, 0x8179)}, /* Abocom - Abocom */
++ {USB_DEVICE(0x0B05, 0x18F0)}, /* ASUS USB-N10 Nano B1 */
+ {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
+ {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
+ {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
--- /dev/null
+From eec6e3ee636ec3adaa85ebe4b4acaacfcf06277e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
+Date: Tue, 11 Feb 2020 11:35:02 +0100
+Subject: staging: wfx: add proper "compatible" string
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+commit eec6e3ee636ec3adaa85ebe4b4acaacfcf06277e upstream.
+
+Add "compatible" string matching "vendor,chip" template and proper
+GPIO flags handling. Keep support for old name and reset polarity
+for older devicetrees.
+
+Cc: stable@vger.kernel.org # d3a5bcb4a17f ("gpio: add gpiod_toggle_active_low()")
+Cc: stable@vger.kernel.org
+Fixes: 0096214a59a7 ("staging: wfx: add support for I/O access")
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Link: https://lore.kernel.org/r/0e6dda06f145676861860f073a53dc95987c7ab5.1581416843.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/wfx/Documentation/devicetree/bindings/net/wireless/siliabs,wfx.txt | 7 ++---
+ drivers/staging/wfx/bus_spi.c | 14 +++++++---
+ 2 files changed, 14 insertions(+), 7 deletions(-)
+
+--- a/drivers/staging/wfx/Documentation/devicetree/bindings/net/wireless/siliabs,wfx.txt
++++ b/drivers/staging/wfx/Documentation/devicetree/bindings/net/wireless/siliabs,wfx.txt
+@@ -6,7 +6,7 @@ SPI
+ You have to declare the WFxxx chip in your device tree.
+
+ Required properties:
+- - compatible: Should be "silabs,wfx-spi"
++ - compatible: Should be "silabs,wf200"
+ - reg: Chip select address of device
+ - spi-max-frequency: Maximum SPI clocking speed of device in Hz
+ - interrupts-extended: Should contain interrupt line (interrupt-parent +
+@@ -15,6 +15,7 @@ Required properties:
+ Optional properties:
+ - reset-gpios: phandle of gpio that will be used to reset chip during probe.
+ Without this property, you may encounter issues with warm boot.
++ (Legacy: when compatible == "silabs,wfx-spi", the gpio is inverted.)
+
+ Please consult Documentation/devicetree/bindings/spi/spi-bus.txt for optional
+ SPI connection related properties,
+@@ -23,12 +24,12 @@ Example:
+
+ &spi1 {
+ wfx {
+- compatible = "silabs,wfx-spi";
++ compatible = "silabs,wf200";
+ pinctrl-names = "default";
+ pinctrl-0 = <&wfx_irq &wfx_gpios>;
+ interrupts-extended = <&gpio 16 IRQ_TYPE_EDGE_RISING>;
+ wakeup-gpios = <&gpio 12 GPIO_ACTIVE_HIGH>;
+- reset-gpios = <&gpio 13 GPIO_ACTIVE_HIGH>;
++ reset-gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+ reg = <0>;
+ spi-max-frequency = <42000000>;
+ };
+--- a/drivers/staging/wfx/bus_spi.c
++++ b/drivers/staging/wfx/bus_spi.c
+@@ -27,6 +27,8 @@ MODULE_PARM_DESC(gpio_reset, "gpio numbe
+ #define SET_WRITE 0x7FFF /* usage: and operation */
+ #define SET_READ 0x8000 /* usage: or operation */
+
++#define WFX_RESET_INVERTED 1
++
+ static const struct wfx_platform_data wfx_spi_pdata = {
+ .file_fw = "wfm_wf200",
+ .file_pds = "wf200.pds",
+@@ -201,9 +203,11 @@ static int wfx_spi_probe(struct spi_devi
+ if (!bus->gpio_reset) {
+ dev_warn(&func->dev, "try to load firmware anyway\n");
+ } else {
+- gpiod_set_value(bus->gpio_reset, 0);
+- udelay(100);
++ if (spi_get_device_id(func)->driver_data & WFX_RESET_INVERTED)
++ gpiod_toggle_active_low(bus->gpio_reset);
+ gpiod_set_value(bus->gpio_reset, 1);
++ udelay(100);
++ gpiod_set_value(bus->gpio_reset, 0);
+ udelay(2000);
+ }
+
+@@ -244,14 +248,16 @@ static int wfx_spi_remove(struct spi_dev
+ * stripped.
+ */
+ static const struct spi_device_id wfx_spi_id[] = {
+- { "wfx-spi", 0 },
++ { "wfx-spi", WFX_RESET_INVERTED },
++ { "wf200", 0 },
+ { },
+ };
+ MODULE_DEVICE_TABLE(spi, wfx_spi_id);
+
+ #ifdef CONFIG_OF
+ static const struct of_device_id wfx_spi_of_match[] = {
+- { .compatible = "silabs,wfx-spi" },
++ { .compatible = "silabs,wfx-spi", .data = (void *)WFX_RESET_INVERTED },
++ { .compatible = "silabs,wf200" },
+ { },
+ };
+ MODULE_DEVICE_TABLE(of, wfx_spi_of_match);
--- /dev/null
+From e2525a95cc0887c7dc0549cb5d0ac3e796e1d54c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
+Date: Tue, 11 Feb 2020 11:35:01 +0100
+Subject: staging: wfx: annotate nested gc_list vs tx queue locking
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+commit e2525a95cc0887c7dc0549cb5d0ac3e796e1d54c upstream.
+
+Lockdep is complaining about recursive locking, because it can't make
+a difference between locked skb_queues. Annotate nested locks and avoid
+double bh_disable/enable.
+
+[...]
+insmod/815 is trying to acquire lock:
+cb7d6418 (&(&list->lock)->rlock){+...}, at: wfx_tx_queues_clear+0xfc/0x198 [wfx]
+
+but task is already holding lock:
+cb7d61f4 (&(&list->lock)->rlock){+...}, at: wfx_tx_queues_clear+0xa0/0x198 [wfx]
+
+[...]
+Possible unsafe locking scenario:
+
+ CPU0
+ ----
+ lock(&(&list->lock)->rlock);
+ lock(&(&list->lock)->rlock);
+
+Cc: stable@vger.kernel.org
+Fixes: 9bca45f3d692 ("staging: wfx: allow to send 802.11 frames")
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Link: https://lore.kernel.org/r/5e30397af95854b4a7deea073b730c00229f42ba.1581416843.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/wfx/queue.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/staging/wfx/queue.c
++++ b/drivers/staging/wfx/queue.c
+@@ -130,12 +130,12 @@ static void wfx_tx_queue_clear(struct wf
+ spin_lock_bh(&queue->queue.lock);
+ while ((item = __skb_dequeue(&queue->queue)) != NULL)
+ skb_queue_head(gc_list, item);
+- spin_lock_bh(&stats->pending.lock);
++ spin_lock_nested(&stats->pending.lock, 1);
+ for (i = 0; i < ARRAY_SIZE(stats->link_map_cache); ++i) {
+ stats->link_map_cache[i] -= queue->link_map_cache[i];
+ queue->link_map_cache[i] = 0;
+ }
+- spin_unlock_bh(&stats->pending.lock);
++ spin_unlock(&stats->pending.lock);
+ spin_unlock_bh(&queue->queue.lock);
+ }
+
+@@ -207,9 +207,9 @@ void wfx_tx_queue_put(struct wfx_dev *wd
+
+ ++queue->link_map_cache[tx_priv->link_id];
+
+- spin_lock_bh(&stats->pending.lock);
++ spin_lock_nested(&stats->pending.lock, 1);
+ ++stats->link_map_cache[tx_priv->link_id];
+- spin_unlock_bh(&stats->pending.lock);
++ spin_unlock(&stats->pending.lock);
+ spin_unlock_bh(&queue->queue.lock);
+ }
+
+@@ -237,11 +237,11 @@ static struct sk_buff *wfx_tx_queue_get(
+ __skb_unlink(skb, &queue->queue);
+ --queue->link_map_cache[tx_priv->link_id];
+
+- spin_lock_bh(&stats->pending.lock);
++ spin_lock_nested(&stats->pending.lock, 1);
+ __skb_queue_tail(&stats->pending, skb);
+ if (!--stats->link_map_cache[tx_priv->link_id])
+ wakeup_stats = true;
+- spin_unlock_bh(&stats->pending.lock);
++ spin_unlock(&stats->pending.lock);
+ }
+ spin_unlock_bh(&queue->queue.lock);
+ if (wakeup_stats)
+@@ -259,10 +259,10 @@ int wfx_pending_requeue(struct wfx_dev *
+ spin_lock_bh(&queue->queue.lock);
+ ++queue->link_map_cache[tx_priv->link_id];
+
+- spin_lock_bh(&stats->pending.lock);
++ spin_lock_nested(&stats->pending.lock, 1);
+ ++stats->link_map_cache[tx_priv->link_id];
+ __skb_unlink(skb, &stats->pending);
+- spin_unlock_bh(&stats->pending.lock);
++ spin_unlock(&stats->pending.lock);
+ __skb_queue_tail(&queue->queue, skb);
+ spin_unlock_bh(&queue->queue.lock);
+ return 0;
--- /dev/null
+From 4033714d6cbe04893aa0708d1fcaa45dd8eb3f53 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
+Date: Tue, 11 Feb 2020 11:35:01 +0100
+Subject: staging: wfx: fix init/remove vs IRQ race
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+commit 4033714d6cbe04893aa0708d1fcaa45dd8eb3f53 upstream.
+
+Current code races in init/exit with interrupt handlers. This is noticed
+by the warning below. Fix it by using devres for ordering allocations and
+IRQ de/registration.
+
+WARNING: CPU: 0 PID: 827 at drivers/staging/wfx/bus_spi.c:142 wfx_spi_irq_handler+0x5c/0x64 [wfx]
+race condition in driver init/deinit
+
+Cc: stable@vger.kernel.org
+Fixes: 0096214a59a7 ("staging: wfx: add support for I/O access")
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Reviewed-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
+Link: https://lore.kernel.org/r/f0c66cbb3110c2736cd4357c753fba8c14ee3aee.1581416843.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/wfx/bus_sdio.c | 15 ++++++---------
+ drivers/staging/wfx/bus_spi.c | 27 ++++++++++++++-------------
+ drivers/staging/wfx/main.c | 21 +++++++++++++--------
+ drivers/staging/wfx/main.h | 1 -
+ 4 files changed, 33 insertions(+), 31 deletions(-)
+
+--- a/drivers/staging/wfx/bus_sdio.c
++++ b/drivers/staging/wfx/bus_sdio.c
+@@ -200,25 +200,23 @@ static int wfx_sdio_probe(struct sdio_fu
+ if (ret)
+ goto err0;
+
+- ret = wfx_sdio_irq_subscribe(bus);
+- if (ret)
+- goto err1;
+-
+ bus->core = wfx_init_common(&func->dev, &wfx_sdio_pdata,
+ &wfx_sdio_hwbus_ops, bus);
+ if (!bus->core) {
+ ret = -EIO;
+- goto err2;
++ goto err1;
+ }
+
++ ret = wfx_sdio_irq_subscribe(bus);
++ if (ret)
++ goto err1;
++
+ ret = wfx_probe(bus->core);
+ if (ret)
+- goto err3;
++ goto err2;
+
+ return 0;
+
+-err3:
+- wfx_free_common(bus->core);
+ err2:
+ wfx_sdio_irq_unsubscribe(bus);
+ err1:
+@@ -234,7 +232,6 @@ static void wfx_sdio_remove(struct sdio_
+ struct wfx_sdio_priv *bus = sdio_get_drvdata(func);
+
+ wfx_release(bus->core);
+- wfx_free_common(bus->core);
+ wfx_sdio_irq_unsubscribe(bus);
+ sdio_claim_host(func);
+ sdio_disable_func(func);
+--- a/drivers/staging/wfx/bus_spi.c
++++ b/drivers/staging/wfx/bus_spi.c
+@@ -156,6 +156,11 @@ static void wfx_spi_request_rx(struct wo
+ wfx_bh_request_rx(bus->core);
+ }
+
++static void wfx_flush_irq_work(void *w)
++{
++ flush_work(w);
++}
++
+ static size_t wfx_spi_align_size(void *priv, size_t size)
+ {
+ // Most of SPI controllers avoid DMA if buffer size is not 32bit aligned
+@@ -211,22 +216,23 @@ static int wfx_spi_probe(struct spi_devi
+ udelay(2000);
+ }
+
+- ret = devm_request_irq(&func->dev, func->irq, wfx_spi_irq_handler,
+- IRQF_TRIGGER_RISING, "wfx", bus);
+- if (ret)
+- return ret;
+-
+ INIT_WORK(&bus->request_rx, wfx_spi_request_rx);
+ bus->core = wfx_init_common(&func->dev, &wfx_spi_pdata,
+ &wfx_spi_hwbus_ops, bus);
+ if (!bus->core)
+ return -EIO;
+
+- ret = wfx_probe(bus->core);
++ ret = devm_add_action_or_reset(&func->dev, wfx_flush_irq_work,
++ &bus->request_rx);
+ if (ret)
+- wfx_free_common(bus->core);
++ return ret;
++
++ ret = devm_request_irq(&func->dev, func->irq, wfx_spi_irq_handler,
++ IRQF_TRIGGER_RISING, "wfx", bus);
++ if (ret)
++ return ret;
+
+- return ret;
++ return wfx_probe(bus->core);
+ }
+
+ static int wfx_spi_remove(struct spi_device *func)
+@@ -234,11 +240,6 @@ static int wfx_spi_remove(struct spi_dev
+ struct wfx_spi_priv *bus = spi_get_drvdata(func);
+
+ wfx_release(bus->core);
+- wfx_free_common(bus->core);
+- // A few IRQ will be sent during device release. Hopefully, no IRQ
+- // should happen after wdev/wvif are released.
+- devm_free_irq(&func->dev, func->irq, bus);
+- flush_work(&bus->request_rx);
+ return 0;
+ }
+
+--- a/drivers/staging/wfx/main.c
++++ b/drivers/staging/wfx/main.c
+@@ -262,6 +262,16 @@ static int wfx_send_pdata_pds(struct wfx
+ return ret;
+ }
+
++static void wfx_free_common(void *data)
++{
++ struct wfx_dev *wdev = data;
++
++ mutex_destroy(&wdev->rx_stats_lock);
++ mutex_destroy(&wdev->conf_mutex);
++ wfx_tx_queues_deinit(wdev);
++ ieee80211_free_hw(wdev->hw);
++}
++
+ struct wfx_dev *wfx_init_common(struct device *dev,
+ const struct wfx_platform_data *pdata,
+ const struct hwbus_ops *hwbus_ops,
+@@ -332,15 +342,10 @@ struct wfx_dev *wfx_init_common(struct d
+ wfx_init_hif_cmd(&wdev->hif_cmd);
+ wfx_tx_queues_init(wdev);
+
+- return wdev;
+-}
++ if (devm_add_action_or_reset(dev, wfx_free_common, wdev))
++ return NULL;
+
+-void wfx_free_common(struct wfx_dev *wdev)
+-{
+- mutex_destroy(&wdev->rx_stats_lock);
+- mutex_destroy(&wdev->conf_mutex);
+- wfx_tx_queues_deinit(wdev);
+- ieee80211_free_hw(wdev->hw);
++ return wdev;
+ }
+
+ int wfx_probe(struct wfx_dev *wdev)
+--- a/drivers/staging/wfx/main.h
++++ b/drivers/staging/wfx/main.h
+@@ -34,7 +34,6 @@ struct wfx_dev *wfx_init_common(struct d
+ const struct wfx_platform_data *pdata,
+ const struct hwbus_ops *hwbus_ops,
+ void *hwbus_priv);
+-void wfx_free_common(struct wfx_dev *wdev);
+
+ int wfx_probe(struct wfx_dev *wdev);
+ void wfx_release(struct wfx_dev *wdev);
--- /dev/null
+From a1f165a6b738f0c9d744bad4af7a53909278f5fc Mon Sep 17 00:00:00 2001
+From: Qiujun Huang <hqjagain@gmail.com>
+Date: Wed, 25 Mar 2020 15:06:46 +0800
+Subject: staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb
+
+From: Qiujun Huang <hqjagain@gmail.com>
+
+commit a1f165a6b738f0c9d744bad4af7a53909278f5fc upstream.
+
+We should cancel hw->usb_work before kfree(hw).
+
+Reported-by: syzbot+6d2e7f6fa90e27be9d62@syzkaller.appspotmail.com
+Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/1585120006-30042-1-git-send-email-hqjagain@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/wlan-ng/prism2usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/wlan-ng/prism2usb.c
++++ b/drivers/staging/wlan-ng/prism2usb.c
+@@ -180,6 +180,7 @@ static void prism2sta_disconnect_usb(str
+
+ cancel_work_sync(&hw->link_bh);
+ cancel_work_sync(&hw->commsqual_bh);
++ cancel_work_sync(&hw->usb_work);
+
+ /* Now we complete any outstanding commands
+ * and tell everyone who is waiting for their
--- /dev/null
+From 1165dd73e811a07d947aee218510571f516081f6 Mon Sep 17 00:00:00 2001
+From: Qiujun Huang <hqjagain@gmail.com>
+Date: Thu, 26 Mar 2020 21:18:50 +0800
+Subject: staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback
+
+From: Qiujun Huang <hqjagain@gmail.com>
+
+commit 1165dd73e811a07d947aee218510571f516081f6 upstream.
+
+We can't handle the case length > WLAN_DATA_MAXLEN.
+Because the size of rxfrm->data is WLAN_DATA_MAXLEN(2312), and we can't
+read more than that.
+
+Thanks-to: Hillf Danton <hdanton@sina.com>
+Reported-and-tested-by: syzbot+7d42d68643a35f71ac8a@syzkaller.appspotmail.com
+Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200326131850.17711-1-hqjagain@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/wlan-ng/hfa384x_usb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/staging/wlan-ng/hfa384x_usb.c
++++ b/drivers/staging/wlan-ng/hfa384x_usb.c
+@@ -3372,6 +3372,8 @@ static void hfa384x_int_rxmonitor(struct
+ WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) {
+ pr_debug("overlen frm: len=%zd\n",
+ skblen - sizeof(struct p80211_caphdr));
++
++ return;
+ }
+
+ skb = dev_alloc_skb(skblen);
--- /dev/null
+From 62d65bdd9d05158aa2547f8ef72375535f3bc6e3 Mon Sep 17 00:00:00 2001
+From: Matthias Reichl <hias@horus.com>
+Date: Fri, 27 Mar 2020 16:03:50 +0100
+Subject: USB: cdc-acm: restore capability check order
+
+From: Matthias Reichl <hias@horus.com>
+
+commit 62d65bdd9d05158aa2547f8ef72375535f3bc6e3 upstream.
+
+commit b401f8c4f492c ("USB: cdc-acm: fix rounding error in TIOCSSERIAL")
+introduced a regression by changing the order of capability and close
+settings change checks. When running with CAP_SYS_ADMIN setting the
+close settings to the values already set resulted in -EOPNOTSUPP.
+
+Fix this by changing the check order back to how it was before.
+
+Fixes: b401f8c4f492c ("USB: cdc-acm: fix rounding error in TIOCSSERIAL")
+Cc: Anthony Mallet <anthony.mallet@laas.fr>
+Cc: stable <stable@vger.kernel.org>
+Cc: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Matthias Reichl <hias@horus.com>
+Link: https://lore.kernel.org/r/20200327150350.3657-1-hias@horus.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-acm.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -923,16 +923,16 @@ static int set_serial_info(struct tty_st
+
+ mutex_lock(&acm->port.mutex);
+
+- if ((ss->close_delay != old_close_delay) ||
+- (ss->closing_wait != old_closing_wait)) {
+- if (!capable(CAP_SYS_ADMIN))
++ if (!capable(CAP_SYS_ADMIN)) {
++ if ((ss->close_delay != old_close_delay) ||
++ (ss->closing_wait != old_closing_wait))
+ retval = -EPERM;
+- else {
+- acm->port.close_delay = close_delay;
+- acm->port.closing_wait = closing_wait;
+- }
+- } else
+- retval = -EOPNOTSUPP;
++ else
++ retval = -EOPNOTSUPP;
++ } else {
++ acm->port.close_delay = close_delay;
++ acm->port.closing_wait = closing_wait;
++ }
+
+ mutex_unlock(&acm->port.mutex);
+ return retval;
--- /dev/null
+From 52974d94a206ce428d9d9b6eaa208238024be82a Mon Sep 17 00:00:00 2001
+From: Mans Rullgard <mans@mansr.com>
+Date: Mon, 16 Mar 2020 16:11:35 -0500
+Subject: usb: musb: fix crash with highmen PIO and usbmon
+
+From: Mans Rullgard <mans@mansr.com>
+
+commit 52974d94a206ce428d9d9b6eaa208238024be82a upstream.
+
+When handling a PIO bulk transfer with highmem buffer, a temporary
+mapping is assigned to urb->transfer_buffer. After the transfer is
+complete, an invalid address is left behind in this pointer. This is
+not ordinarily a problem since nothing touches that buffer before the
+urb is released. However, when usbmon is active, usbmon_urb_complete()
+calls (indirectly) mon_bin_get_data() which does access the transfer
+buffer if it is set. To prevent an invalid memory access here, reset
+urb->transfer_buffer to NULL when finished (musb_host_rx()), or do not
+set it at all (musb_host_tx()).
+
+Fixes: 8e8a55165469 ("usb: musb: host: Handle highmem in PIO mode")
+Signed-off-by: Mans Rullgard <mans@mansr.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Link: https://lore.kernel.org/r/20200316211136.2274-8-b-liu@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_host.c | 17 +++++------------
+ 1 file changed, 5 insertions(+), 12 deletions(-)
+
+--- a/drivers/usb/musb/musb_host.c
++++ b/drivers/usb/musb/musb_host.c
+@@ -1436,10 +1436,7 @@ done:
+ * We need to map sg if the transfer_buffer is
+ * NULL.
+ */
+- if (!urb->transfer_buffer)
+- qh->use_sg = true;
+-
+- if (qh->use_sg) {
++ if (!urb->transfer_buffer) {
+ /* sg_miter_start is already done in musb_ep_program */
+ if (!sg_miter_next(&qh->sg_miter)) {
+ dev_err(musb->controller, "error: sg list empty\n");
+@@ -1447,9 +1444,8 @@ done:
+ status = -EINVAL;
+ goto done;
+ }
+- urb->transfer_buffer = qh->sg_miter.addr;
+ length = min_t(u32, length, qh->sg_miter.length);
+- musb_write_fifo(hw_ep, length, urb->transfer_buffer);
++ musb_write_fifo(hw_ep, length, qh->sg_miter.addr);
+ qh->sg_miter.consumed = length;
+ sg_miter_stop(&qh->sg_miter);
+ } else {
+@@ -1458,11 +1454,6 @@ done:
+
+ qh->segsize = length;
+
+- if (qh->use_sg) {
+- if (offset + length >= urb->transfer_buffer_length)
+- qh->use_sg = false;
+- }
+-
+ musb_ep_select(mbase, epnum);
+ musb_writew(epio, MUSB_TXCSR,
+ MUSB_TXCSR_H_WZC_BITS | MUSB_TXCSR_TXPKTRDY);
+@@ -1977,8 +1968,10 @@ finish:
+ urb->actual_length += xfer_len;
+ qh->offset += xfer_len;
+ if (done) {
+- if (qh->use_sg)
++ if (qh->use_sg) {
+ qh->use_sg = false;
++ urb->transfer_buffer = NULL;
++ }
+
+ if (urb->status == -EINPROGRESS)
+ urb->status = status;
--- /dev/null
+From 57aa9f294b09463492f604feaa5cc719beaace32 Mon Sep 17 00:00:00 2001
+From: Qiujun Huang <hqjagain@gmail.com>
+Date: Wed, 25 Mar 2020 15:52:37 +0800
+Subject: USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback
+
+From: Qiujun Huang <hqjagain@gmail.com>
+
+commit 57aa9f294b09463492f604feaa5cc719beaace32 upstream.
+
+Fix slab-out-of-bounds read in the interrupt-URB completion handler.
+
+The boundary condition should be (length - 1) as we access
+data[position + 1].
+
+Reported-and-tested-by: syzbot+37ba33391ad5f3935bbd@syzkaller.appspotmail.com
+Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/io_edgeport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/io_edgeport.c
++++ b/drivers/usb/serial/io_edgeport.c
+@@ -710,7 +710,7 @@ static void edge_interrupt_callback(stru
+ /* grab the txcredits for the ports if available */
+ position = 2;
+ portNumber = 0;
+- while ((position < length) &&
++ while ((position < length - 1) &&
+ (portNumber < edge_serial->serial->num_ports)) {
+ txCredits = data[position] | (data[position+1] << 8);
+ if (txCredits) {
--- /dev/null
+From 6cb2669cb97fc4fdf526127159ac59caae052247 Mon Sep 17 00:00:00 2001
+From: Pawel Dembicki <paweldembicki@gmail.com>
+Date: Wed, 25 Mar 2020 06:44:18 +0100
+Subject: USB: serial: option: add BroadMobi BM806U
+
+From: Pawel Dembicki <paweldembicki@gmail.com>
+
+commit 6cb2669cb97fc4fdf526127159ac59caae052247 upstream.
+
+BroadMobi BM806U is an Qualcomm MDM9225 based 3G/4G modem.
+Tested hardware BM806U is mounted on D-Link DWR-921-C3 router.
+
+T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
+D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=2020 ProdID=2033 Rev= 2.28
+S: Manufacturer=Mobile Connect
+S: Product=Mobile Connect
+S: SerialNumber=f842866cfd5a
+C:* #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Co-developed-by: Cezary Jackiewicz <cezary@eko.one.pl>
+Signed-off-by: Cezary Jackiewicz <cezary@eko.one.pl>
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1996,6 +1996,8 @@ static const struct usb_device_id option
+ .driver_info = RSVD(1) | RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */
+ .driver_info = RSVD(4) },
++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2033, 0xff), /* BroadMobi BM806U */
++ .driver_info = RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff), /* BroadMobi BM818 */
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
--- /dev/null
+From 007d20dca2376a751b1dad03442f118438b7e65e Mon Sep 17 00:00:00 2001
+From: Pawel Dembicki <paweldembicki@gmail.com>
+Date: Wed, 25 Mar 2020 06:44:17 +0100
+Subject: USB: serial: option: add support for ASKEY WWHC050
+
+From: Pawel Dembicki <paweldembicki@gmail.com>
+
+commit 007d20dca2376a751b1dad03442f118438b7e65e upstream.
+
+ASKEY WWHC050 is a mcie LTE modem.
+The oem configuration states:
+
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
+D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1690 ProdID=7588 Rev=ff.ff
+S: Manufacturer=Android
+S: Product=Android
+S: SerialNumber=813f0eef6e6e
+C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none)
+E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us
+
+Tested on openwrt distribution.
+
+Co-developed-by: Cezary Jackiewicz <cezary@eko.one.pl>
+Signed-off-by: Cezary Jackiewicz <cezary@eko.one.pl>
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1992,6 +1992,8 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
++ { USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff), /* ASKEY WWHC050 */
++ .driver_info = RSVD(1) | RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff), /* BroadMobi BM818 */
--- /dev/null
+From dfee7e2f478346b12ea651d5c28b069f6a4af563 Mon Sep 17 00:00:00 2001
+From: Pawel Dembicki <paweldembicki@gmail.com>
+Date: Wed, 25 Mar 2020 06:44:19 +0100
+Subject: USB: serial: option: add Wistron Neweb D19Q1
+
+From: Pawel Dembicki <paweldembicki@gmail.com>
+
+commit dfee7e2f478346b12ea651d5c28b069f6a4af563 upstream.
+
+This modem is embedded on dlink dwr-960 router.
+The oem configuration states:
+
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
+D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1435 ProdID=d191 Rev=ff.ff
+S: Manufacturer=Android
+S: Product=Android
+S: SerialNumber=0123456789ABCDEF
+C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none)
+E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us
+
+Tested on openwrt distribution
+
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1992,6 +1992,8 @@ static const struct usb_device_id option
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
++ { USB_DEVICE_INTERFACE_CLASS(0x1435, 0xd191, 0xff), /* Wistron Neweb D19Q1 */
++ .driver_info = RSVD(1) | RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff), /* ASKEY WWHC050 */
+ .driver_info = RSVD(1) | RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */
projects / thirdparty / kernel / stable-queue.git / commitdiff
