]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.4-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 31 Mar 2020 07:59:30 +0000 (09:59 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 31 Mar 2020 07:59:30 +0000 (09:59 +0200)
added patches:
media-flexcop-usb-fix-endpoint-sanity-check.patch
media-usbtv-fix-control-message-timeouts.patch
staging-kpc2000-prevent-underflow-in-cpld_reconfigure.patch
staging-rtl8188eu-add-asus-usb-n10-nano-b1-to-device-table.patch
staging-wlan-ng-fix-odebug-bug-in-prism2sta_disconnect_usb.patch
staging-wlan-ng-fix-use-after-free-read-in-hfa384x_usbin_callback.patch
usb-cdc-acm-restore-capability-check-order.patch
usb-musb-fix-crash-with-highmen-pio-and-usbmon.patch
usb-serial-io_edgeport-fix-slab-out-of-bounds-read-in-edge_interrupt_callback.patch
usb-serial-option-add-broadmobi-bm806u.patch
usb-serial-option-add-support-for-askey-wwhc050.patch
usb-serial-option-add-wistron-neweb-d19q1.patch

13 files changed:
queue-5.4/media-flexcop-usb-fix-endpoint-sanity-check.patch [new file with mode: 0644]
queue-5.4/media-usbtv-fix-control-message-timeouts.patch [new file with mode: 0644]
queue-5.4/series
queue-5.4/staging-kpc2000-prevent-underflow-in-cpld_reconfigure.patch [new file with mode: 0644]
queue-5.4/staging-rtl8188eu-add-asus-usb-n10-nano-b1-to-device-table.patch [new file with mode: 0644]
queue-5.4/staging-wlan-ng-fix-odebug-bug-in-prism2sta_disconnect_usb.patch [new file with mode: 0644]
queue-5.4/staging-wlan-ng-fix-use-after-free-read-in-hfa384x_usbin_callback.patch [new file with mode: 0644]
queue-5.4/usb-cdc-acm-restore-capability-check-order.patch [new file with mode: 0644]
queue-5.4/usb-musb-fix-crash-with-highmen-pio-and-usbmon.patch [new file with mode: 0644]
queue-5.4/usb-serial-io_edgeport-fix-slab-out-of-bounds-read-in-edge_interrupt_callback.patch [new file with mode: 0644]
queue-5.4/usb-serial-option-add-broadmobi-bm806u.patch [new file with mode: 0644]
queue-5.4/usb-serial-option-add-support-for-askey-wwhc050.patch [new file with mode: 0644]
queue-5.4/usb-serial-option-add-wistron-neweb-d19q1.patch [new file with mode: 0644]

diff --git a/queue-5.4/media-flexcop-usb-fix-endpoint-sanity-check.patch b/queue-5.4/media-flexcop-usb-fix-endpoint-sanity-check.patch
new file mode 100644 (file)
index 0000000..814436b
--- /dev/null
@@ -0,0 +1,50 @@
+From bca243b1ce0e46be26f7c63b5591dfbb41f558e5 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 3 Jan 2020 17:35:08 +0100
+Subject: media: flexcop-usb: fix endpoint sanity check
+
+From: Johan Hovold <johan@kernel.org>
+
+commit bca243b1ce0e46be26f7c63b5591dfbb41f558e5 upstream.
+
+commit 1b976fc6d684 ("media: b2c2-flexcop-usb: add sanity checking") added
+an endpoint sanity check to address a NULL-pointer dereference on probe.
+Unfortunately the check was done on the current altsetting which was later
+changed.
+
+Fix this by moving the sanity check to after the altsetting is changed.
+
+Fixes: 1b976fc6d684 ("media: b2c2-flexcop-usb: add sanity checking")
+Cc: Oliver Neukum <oneukum@suse.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/b2c2/flexcop-usb.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/usb/b2c2/flexcop-usb.c
++++ b/drivers/media/usb/b2c2/flexcop-usb.c
+@@ -511,6 +511,9 @@ static int flexcop_usb_init(struct flexc
+               return ret;
+       }
++      if (fc_usb->uintf->cur_altsetting->desc.bNumEndpoints < 1)
++              return -ENODEV;
++
+       switch (fc_usb->udev->speed) {
+       case USB_SPEED_LOW:
+               err("cannot handle USB speed because it is too slow.");
+@@ -544,9 +547,6 @@ static int flexcop_usb_probe(struct usb_
+       struct flexcop_device *fc = NULL;
+       int ret;
+-      if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+-              return -ENODEV;
+-
+       if ((fc = flexcop_device_kmalloc(sizeof(struct flexcop_usb))) == NULL) {
+               err("out of memory\n");
+               return -ENOMEM;
diff --git a/queue-5.4/media-usbtv-fix-control-message-timeouts.patch b/queue-5.4/media-usbtv-fix-control-message-timeouts.patch
new file mode 100644 (file)
index 0000000..d9100ab
--- /dev/null
@@ -0,0 +1,64 @@
+From 536f561d871c5781bc33d26d415685211b94032e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 13 Jan 2020 18:18:18 +0100
+Subject: media: usbtv: fix control-message timeouts
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 536f561d871c5781bc33d26d415685211b94032e upstream.
+
+The driver was issuing synchronous uninterruptible control requests
+without using a timeout. This could lead to the driver hanging on
+various user requests due to a malfunctioning (or malicious) device
+until the device is physically disconnected.
+
+The USB upper limit of five seconds per request should be more than
+enough.
+
+Fixes: f3d27f34fdd7 ("[media] usbtv: Add driver for Fushicai USBTV007 video frame grabber")
+Fixes: c53a846c48f2 ("[media] usbtv: add video controls")
+Cc: stable <stable@vger.kernel.org>     # 3.11
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Lubomir Rintel <lkundrak@v3.sk>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/usbtv/usbtv-core.c  |    2 +-
+ drivers/media/usb/usbtv/usbtv-video.c |    5 +++--
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/usb/usbtv/usbtv-core.c
++++ b/drivers/media/usb/usbtv/usbtv-core.c
+@@ -56,7 +56,7 @@ int usbtv_set_regs(struct usbtv *usbtv,
+               ret = usb_control_msg(usbtv->udev, pipe, USBTV_REQUEST_REG,
+                       USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+-                      value, index, NULL, 0, 0);
++                      value, index, NULL, 0, USB_CTRL_GET_TIMEOUT);
+               if (ret < 0)
+                       return ret;
+       }
+--- a/drivers/media/usb/usbtv/usbtv-video.c
++++ b/drivers/media/usb/usbtv/usbtv-video.c
+@@ -800,7 +800,8 @@ static int usbtv_s_ctrl(struct v4l2_ctrl
+               ret = usb_control_msg(usbtv->udev,
+                       usb_rcvctrlpipe(usbtv->udev, 0), USBTV_CONTROL_REG,
+                       USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+-                      0, USBTV_BASE + 0x0244, (void *)data, 3, 0);
++                      0, USBTV_BASE + 0x0244, (void *)data, 3,
++                      USB_CTRL_GET_TIMEOUT);
+               if (ret < 0)
+                       goto error;
+       }
+@@ -851,7 +852,7 @@ static int usbtv_s_ctrl(struct v4l2_ctrl
+       ret = usb_control_msg(usbtv->udev, usb_sndctrlpipe(usbtv->udev, 0),
+                       USBTV_CONTROL_REG,
+                       USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+-                      0, index, (void *)data, size, 0);
++                      0, index, (void *)data, size, USB_CTRL_SET_TIMEOUT);
+ error:
+       if (ret < 0)
index 323160b590260de7bb388f2ec109822d5a1ae878..9d089e7b9f7450aaf5f5ac53e2593970d893b37e 100644 (file)
@@ -134,3 +134,15 @@ vti6-fix-memory-leak-of-skb-if-input-policy-check-fails.patch
 r8169-fix-phy-driver-check-on-platforms-w-o-module-softdeps.patch
 clocksource-drivers-hyper-v-untangle-stimers-and-tim.patch
 bpf-undo-incorrect-__reg_bound_offset32-handling.patch
+usb-serial-option-add-support-for-askey-wwhc050.patch
+usb-serial-option-add-broadmobi-bm806u.patch
+usb-serial-option-add-wistron-neweb-d19q1.patch
+usb-cdc-acm-restore-capability-check-order.patch
+usb-serial-io_edgeport-fix-slab-out-of-bounds-read-in-edge_interrupt_callback.patch
+usb-musb-fix-crash-with-highmen-pio-and-usbmon.patch
+media-flexcop-usb-fix-endpoint-sanity-check.patch
+media-usbtv-fix-control-message-timeouts.patch
+staging-kpc2000-prevent-underflow-in-cpld_reconfigure.patch
+staging-rtl8188eu-add-asus-usb-n10-nano-b1-to-device-table.patch
+staging-wlan-ng-fix-odebug-bug-in-prism2sta_disconnect_usb.patch
+staging-wlan-ng-fix-use-after-free-read-in-hfa384x_usbin_callback.patch
diff --git a/queue-5.4/staging-kpc2000-prevent-underflow-in-cpld_reconfigure.patch b/queue-5.4/staging-kpc2000-prevent-underflow-in-cpld_reconfigure.patch
new file mode 100644 (file)
index 0000000..568bf1f
--- /dev/null
@@ -0,0 +1,38 @@
+From 72db61d7d17a475d3cc9de1a7c871d518fcd82f0 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 24 Feb 2020 13:33:25 +0300
+Subject: staging: kpc2000: prevent underflow in cpld_reconfigure()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 72db61d7d17a475d3cc9de1a7c871d518fcd82f0 upstream.
+
+This function should not allow negative values of "wr_val".  If
+negatives are allowed then capping the upper bound at 7 is
+meaningless.  Let's make it unsigned.
+
+Fixes: 7dc7967fc39a ("staging: kpc2000: add initial set of Daktronics drivers")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200224103325.hrxdnaeqsthplu42@kili.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/kpc2000/kpc2000/core.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/kpc2000/kpc2000/core.c
++++ b/drivers/staging/kpc2000/kpc2000/core.c
+@@ -110,10 +110,10 @@ static ssize_t cpld_reconfigure(struct d
+                               const char *buf, size_t count)
+ {
+       struct kp2000_device *pcard = dev_get_drvdata(dev);
+-      long wr_val;
++      unsigned long wr_val;
+       int rv;
+-      rv = kstrtol(buf, 0, &wr_val);
++      rv = kstrtoul(buf, 0, &wr_val);
+       if (rv < 0)
+               return rv;
+       if (wr_val > 7)
diff --git a/queue-5.4/staging-rtl8188eu-add-asus-usb-n10-nano-b1-to-device-table.patch b/queue-5.4/staging-rtl8188eu-add-asus-usb-n10-nano-b1-to-device-table.patch
new file mode 100644 (file)
index 0000000..3e4721c
--- /dev/null
@@ -0,0 +1,32 @@
+From 38ef48f7d4b7342f145a1b4f96023bde99aeb245 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sat, 21 Mar 2020 13:00:11 -0500
+Subject: staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 38ef48f7d4b7342f145a1b4f96023bde99aeb245 upstream.
+
+The ASUS USB-N10 Nano B1 has been reported as a new RTL8188EU device.
+Add it to the device tables.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Reported-by: kovi <zraetn@gmail.com>
+Cc: Stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200321180011.26153-1-Larry.Finger@lwfinger.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8188eu/os_dep/usb_intf.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+@@ -32,6 +32,7 @@ static const struct usb_device_id rtw_us
+       /****** 8188EUS ********/
+       {USB_DEVICE(0x056e, 0x4008)}, /* Elecom WDC-150SU2M */
+       {USB_DEVICE(0x07b8, 0x8179)}, /* Abocom - Abocom */
++      {USB_DEVICE(0x0B05, 0x18F0)}, /* ASUS USB-N10 Nano B1 */
+       {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */
+       {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */
+       {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
diff --git a/queue-5.4/staging-wlan-ng-fix-odebug-bug-in-prism2sta_disconnect_usb.patch b/queue-5.4/staging-wlan-ng-fix-odebug-bug-in-prism2sta_disconnect_usb.patch
new file mode 100644 (file)
index 0000000..3048ad9
--- /dev/null
@@ -0,0 +1,31 @@
+From a1f165a6b738f0c9d744bad4af7a53909278f5fc Mon Sep 17 00:00:00 2001
+From: Qiujun Huang <hqjagain@gmail.com>
+Date: Wed, 25 Mar 2020 15:06:46 +0800
+Subject: staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb
+
+From: Qiujun Huang <hqjagain@gmail.com>
+
+commit a1f165a6b738f0c9d744bad4af7a53909278f5fc upstream.
+
+We should cancel hw->usb_work before kfree(hw).
+
+Reported-by: syzbot+6d2e7f6fa90e27be9d62@syzkaller.appspotmail.com
+Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/1585120006-30042-1-git-send-email-hqjagain@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/wlan-ng/prism2usb.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/wlan-ng/prism2usb.c
++++ b/drivers/staging/wlan-ng/prism2usb.c
+@@ -180,6 +180,7 @@ static void prism2sta_disconnect_usb(str
+               cancel_work_sync(&hw->link_bh);
+               cancel_work_sync(&hw->commsqual_bh);
++              cancel_work_sync(&hw->usb_work);
+               /* Now we complete any outstanding commands
+                * and tell everyone who is waiting for their
diff --git a/queue-5.4/staging-wlan-ng-fix-use-after-free-read-in-hfa384x_usbin_callback.patch b/queue-5.4/staging-wlan-ng-fix-use-after-free-read-in-hfa384x_usbin_callback.patch
new file mode 100644 (file)
index 0000000..ac93898
--- /dev/null
@@ -0,0 +1,35 @@
+From 1165dd73e811a07d947aee218510571f516081f6 Mon Sep 17 00:00:00 2001
+From: Qiujun Huang <hqjagain@gmail.com>
+Date: Thu, 26 Mar 2020 21:18:50 +0800
+Subject: staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback
+
+From: Qiujun Huang <hqjagain@gmail.com>
+
+commit 1165dd73e811a07d947aee218510571f516081f6 upstream.
+
+We can't handle the case length > WLAN_DATA_MAXLEN.
+Because the size of rxfrm->data is WLAN_DATA_MAXLEN(2312), and we can't
+read more than that.
+
+Thanks-to: Hillf Danton <hdanton@sina.com>
+Reported-and-tested-by: syzbot+7d42d68643a35f71ac8a@syzkaller.appspotmail.com
+Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200326131850.17711-1-hqjagain@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/wlan-ng/hfa384x_usb.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/staging/wlan-ng/hfa384x_usb.c
++++ b/drivers/staging/wlan-ng/hfa384x_usb.c
+@@ -3374,6 +3374,8 @@ static void hfa384x_int_rxmonitor(struct
+            WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) {
+               pr_debug("overlen frm: len=%zd\n",
+                        skblen - sizeof(struct p80211_caphdr));
++
++              return;
+       }
+       skb = dev_alloc_skb(skblen);
diff --git a/queue-5.4/usb-cdc-acm-restore-capability-check-order.patch b/queue-5.4/usb-cdc-acm-restore-capability-check-order.patch
new file mode 100644 (file)
index 0000000..841bdb1
--- /dev/null
@@ -0,0 +1,56 @@
+From 62d65bdd9d05158aa2547f8ef72375535f3bc6e3 Mon Sep 17 00:00:00 2001
+From: Matthias Reichl <hias@horus.com>
+Date: Fri, 27 Mar 2020 16:03:50 +0100
+Subject: USB: cdc-acm: restore capability check order
+
+From: Matthias Reichl <hias@horus.com>
+
+commit 62d65bdd9d05158aa2547f8ef72375535f3bc6e3 upstream.
+
+commit b401f8c4f492c ("USB: cdc-acm: fix rounding error in TIOCSSERIAL")
+introduced a regression by changing the order of capability and close
+settings change checks. When running with CAP_SYS_ADMIN setting the
+close settings to the values already set resulted in -EOPNOTSUPP.
+
+Fix this by changing the check order back to how it was before.
+
+Fixes: b401f8c4f492c ("USB: cdc-acm: fix rounding error in TIOCSSERIAL")
+Cc: Anthony Mallet <anthony.mallet@laas.fr>
+Cc: stable <stable@vger.kernel.org>
+Cc: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Matthias Reichl <hias@horus.com>
+Link: https://lore.kernel.org/r/20200327150350.3657-1-hias@horus.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-acm.c |   18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -923,16 +923,16 @@ static int set_serial_info(struct tty_st
+       mutex_lock(&acm->port.mutex);
+-      if ((ss->close_delay != old_close_delay) ||
+-            (ss->closing_wait != old_closing_wait)) {
+-              if (!capable(CAP_SYS_ADMIN))
++      if (!capable(CAP_SYS_ADMIN)) {
++              if ((ss->close_delay != old_close_delay) ||
++                  (ss->closing_wait != old_closing_wait))
+                       retval = -EPERM;
+-              else {
+-                      acm->port.close_delay  = close_delay;
+-                      acm->port.closing_wait = closing_wait;
+-              }
+-      } else
+-              retval = -EOPNOTSUPP;
++              else
++                      retval = -EOPNOTSUPP;
++      } else {
++              acm->port.close_delay  = close_delay;
++              acm->port.closing_wait = closing_wait;
++      }
+       mutex_unlock(&acm->port.mutex);
+       return retval;
diff --git a/queue-5.4/usb-musb-fix-crash-with-highmen-pio-and-usbmon.patch b/queue-5.4/usb-musb-fix-crash-with-highmen-pio-and-usbmon.patch
new file mode 100644 (file)
index 0000000..2dbb247
--- /dev/null
@@ -0,0 +1,79 @@
+From 52974d94a206ce428d9d9b6eaa208238024be82a Mon Sep 17 00:00:00 2001
+From: Mans Rullgard <mans@mansr.com>
+Date: Mon, 16 Mar 2020 16:11:35 -0500
+Subject: usb: musb: fix crash with highmen PIO and usbmon
+
+From: Mans Rullgard <mans@mansr.com>
+
+commit 52974d94a206ce428d9d9b6eaa208238024be82a upstream.
+
+When handling a PIO bulk transfer with highmem buffer, a temporary
+mapping is assigned to urb->transfer_buffer.  After the transfer is
+complete, an invalid address is left behind in this pointer.  This is
+not ordinarily a problem since nothing touches that buffer before the
+urb is released.  However, when usbmon is active, usbmon_urb_complete()
+calls (indirectly) mon_bin_get_data() which does access the transfer
+buffer if it is set.  To prevent an invalid memory access here, reset
+urb->transfer_buffer to NULL when finished (musb_host_rx()), or do not
+set it at all (musb_host_tx()).
+
+Fixes: 8e8a55165469 ("usb: musb: host: Handle highmem in PIO mode")
+Signed-off-by: Mans Rullgard <mans@mansr.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Link: https://lore.kernel.org/r/20200316211136.2274-8-b-liu@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_host.c |   17 +++++------------
+ 1 file changed, 5 insertions(+), 12 deletions(-)
+
+--- a/drivers/usb/musb/musb_host.c
++++ b/drivers/usb/musb/musb_host.c
+@@ -1462,10 +1462,7 @@ done:
+        * We need to map sg if the transfer_buffer is
+        * NULL.
+        */
+-      if (!urb->transfer_buffer)
+-              qh->use_sg = true;
+-
+-      if (qh->use_sg) {
++      if (!urb->transfer_buffer) {
+               /* sg_miter_start is already done in musb_ep_program */
+               if (!sg_miter_next(&qh->sg_miter)) {
+                       dev_err(musb->controller, "error: sg list empty\n");
+@@ -1473,9 +1470,8 @@ done:
+                       status = -EINVAL;
+                       goto done;
+               }
+-              urb->transfer_buffer = qh->sg_miter.addr;
+               length = min_t(u32, length, qh->sg_miter.length);
+-              musb_write_fifo(hw_ep, length, urb->transfer_buffer);
++              musb_write_fifo(hw_ep, length, qh->sg_miter.addr);
+               qh->sg_miter.consumed = length;
+               sg_miter_stop(&qh->sg_miter);
+       } else {
+@@ -1484,11 +1480,6 @@ done:
+       qh->segsize = length;
+-      if (qh->use_sg) {
+-              if (offset + length >= urb->transfer_buffer_length)
+-                      qh->use_sg = false;
+-      }
+-
+       musb_ep_select(mbase, epnum);
+       musb_writew(epio, MUSB_TXCSR,
+                       MUSB_TXCSR_H_WZC_BITS | MUSB_TXCSR_TXPKTRDY);
+@@ -2003,8 +1994,10 @@ finish:
+       urb->actual_length += xfer_len;
+       qh->offset += xfer_len;
+       if (done) {
+-              if (qh->use_sg)
++              if (qh->use_sg) {
+                       qh->use_sg = false;
++                      urb->transfer_buffer = NULL;
++              }
+               if (urb->status == -EINPROGRESS)
+                       urb->status = status;
diff --git a/queue-5.4/usb-serial-io_edgeport-fix-slab-out-of-bounds-read-in-edge_interrupt_callback.patch b/queue-5.4/usb-serial-io_edgeport-fix-slab-out-of-bounds-read-in-edge_interrupt_callback.patch
new file mode 100644 (file)
index 0000000..5661662
--- /dev/null
@@ -0,0 +1,36 @@
+From 57aa9f294b09463492f604feaa5cc719beaace32 Mon Sep 17 00:00:00 2001
+From: Qiujun Huang <hqjagain@gmail.com>
+Date: Wed, 25 Mar 2020 15:52:37 +0800
+Subject: USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback
+
+From: Qiujun Huang <hqjagain@gmail.com>
+
+commit 57aa9f294b09463492f604feaa5cc719beaace32 upstream.
+
+Fix slab-out-of-bounds read in the interrupt-URB completion handler.
+
+The boundary condition should be (length - 1) as we access
+data[position + 1].
+
+Reported-and-tested-by: syzbot+37ba33391ad5f3935bbd@syzkaller.appspotmail.com
+Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/io_edgeport.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/io_edgeport.c
++++ b/drivers/usb/serial/io_edgeport.c
+@@ -710,7 +710,7 @@ static void edge_interrupt_callback(stru
+               /* grab the txcredits for the ports if available */
+               position = 2;
+               portNumber = 0;
+-              while ((position < length) &&
++              while ((position < length - 1) &&
+                               (portNumber < edge_serial->serial->num_ports)) {
+                       txCredits = data[position] | (data[position+1] << 8);
+                       if (txCredits) {
diff --git a/queue-5.4/usb-serial-option-add-broadmobi-bm806u.patch b/queue-5.4/usb-serial-option-add-broadmobi-bm806u.patch
new file mode 100644 (file)
index 0000000..0e23035
--- /dev/null
@@ -0,0 +1,61 @@
+From 6cb2669cb97fc4fdf526127159ac59caae052247 Mon Sep 17 00:00:00 2001
+From: Pawel Dembicki <paweldembicki@gmail.com>
+Date: Wed, 25 Mar 2020 06:44:18 +0100
+Subject: USB: serial: option: add BroadMobi BM806U
+
+From: Pawel Dembicki <paweldembicki@gmail.com>
+
+commit 6cb2669cb97fc4fdf526127159ac59caae052247 upstream.
+
+BroadMobi BM806U is an Qualcomm MDM9225 based 3G/4G modem.
+Tested hardware BM806U is mounted on D-Link DWR-921-C3 router.
+
+T:  Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#=  2 Spd=480  MxCh= 0
+D:  Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
+P:  Vendor=2020 ProdID=2033 Rev= 2.28
+S:  Manufacturer=Mobile Connect
+S:  Product=Mobile Connect
+S:  SerialNumber=f842866cfd5a
+C:* #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E:  Ad=83(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
+E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E:  Ad=85(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
+E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E:  Ad=87(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
+E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+E:  Ad=89(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
+E:  Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Co-developed-by: Cezary Jackiewicz <cezary@eko.one.pl>
+Signed-off-by: Cezary Jackiewicz <cezary@eko.one.pl>
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1996,6 +1996,8 @@ static const struct usb_device_id option
+         .driver_info = RSVD(1) | RSVD(4) },
+       { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff),                     /* Olicard 600 */
+         .driver_info = RSVD(4) },
++      { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2033, 0xff),                     /* BroadMobi BM806U */
++        .driver_info = RSVD(4) },
+       { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff),                     /* BroadMobi BM818 */
+         .driver_info = RSVD(4) },
+       { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },                   /* OLICARD300 - MT6225 */
diff --git a/queue-5.4/usb-serial-option-add-support-for-askey-wwhc050.patch b/queue-5.4/usb-serial-option-add-support-for-askey-wwhc050.patch
new file mode 100644 (file)
index 0000000..2980c1d
--- /dev/null
@@ -0,0 +1,65 @@
+From 007d20dca2376a751b1dad03442f118438b7e65e Mon Sep 17 00:00:00 2001
+From: Pawel Dembicki <paweldembicki@gmail.com>
+Date: Wed, 25 Mar 2020 06:44:17 +0100
+Subject: USB: serial: option: add support for ASKEY WWHC050
+
+From: Pawel Dembicki <paweldembicki@gmail.com>
+
+commit 007d20dca2376a751b1dad03442f118438b7e65e upstream.
+
+ASKEY WWHC050 is a mcie LTE modem.
+The oem configuration states:
+
+T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=480  MxCh= 0
+D:  Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
+P:  Vendor=1690 ProdID=7588 Rev=ff.ff
+S:  Manufacturer=Android
+S:  Product=Android
+S:  SerialNumber=813f0eef6e6e
+C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
+E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+E:  Ad=86(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
+E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+E:  Ad=88(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
+E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none)
+E:  Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E:  Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us
+
+Tested on openwrt distribution.
+
+Co-developed-by: Cezary Jackiewicz <cezary@eko.one.pl>
+Signed-off-by: Cezary Jackiewicz <cezary@eko.one.pl>
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1992,6 +1992,8 @@ static const struct usb_device_id option
+       { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) },    /* D-Link DWM-152/C1 */
+       { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) },    /* D-Link DWM-156/C1 */
+       { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) },    /* D-Link DWM-156/A3 */
++      { USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff),                     /* ASKEY WWHC050 */
++        .driver_info = RSVD(1) | RSVD(4) },
+       { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff),                     /* Olicard 600 */
+         .driver_info = RSVD(4) },
+       { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff),                     /* BroadMobi BM818 */
diff --git a/queue-5.4/usb-serial-option-add-wistron-neweb-d19q1.patch b/queue-5.4/usb-serial-option-add-wistron-neweb-d19q1.patch
new file mode 100644 (file)
index 0000000..6684d7e
--- /dev/null
@@ -0,0 +1,63 @@
+From dfee7e2f478346b12ea651d5c28b069f6a4af563 Mon Sep 17 00:00:00 2001
+From: Pawel Dembicki <paweldembicki@gmail.com>
+Date: Wed, 25 Mar 2020 06:44:19 +0100
+Subject: USB: serial: option: add Wistron Neweb D19Q1
+
+From: Pawel Dembicki <paweldembicki@gmail.com>
+
+commit dfee7e2f478346b12ea651d5c28b069f6a4af563 upstream.
+
+This modem is embedded on dlink dwr-960 router.
+The oem configuration states:
+
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
+D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1435 ProdID=d191 Rev=ff.ff
+S: Manufacturer=Android
+S: Product=Android
+S: SerialNumber=0123456789ABCDEF
+C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
+E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none)
+E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us
+
+Tested on openwrt distribution
+
+Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1992,6 +1992,8 @@ static const struct usb_device_id option
+       { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) },    /* D-Link DWM-152/C1 */
+       { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) },    /* D-Link DWM-156/C1 */
+       { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) },    /* D-Link DWM-156/A3 */
++      { USB_DEVICE_INTERFACE_CLASS(0x1435, 0xd191, 0xff),                     /* Wistron Neweb D19Q1 */
++        .driver_info = RSVD(1) | RSVD(4) },
+       { USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff),                     /* ASKEY WWHC050 */
+         .driver_info = RSVD(1) | RSVD(4) },
+       { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff),                     /* Olicard 600 */