--- /dev/null
+From 08dff274edda54310d6f1cf27b62fddf0f8d146e Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Thu, 11 Mar 2021 14:37:14 +0100
+Subject: cdc-acm: fix BREAK rx code path adding necessary calls
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit 08dff274edda54310d6f1cf27b62fddf0f8d146e upstream.
+
+Counting break events is nice but we should actually report them to
+the tty layer.
+
+Fixes: 5a6a62bdb9257 ("cdc-acm: add TIOCMIWAIT")
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Link: https://lore.kernel.org/r/20210311133714.31881-1-oneukum@suse.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/cdc-acm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -313,8 +313,10 @@ static void acm_process_notification(str
+ acm->iocount.dsr++;
+ if (difference & ACM_CTRL_DCD)
+ acm->iocount.dcd++;
+- if (newctrl & ACM_CTRL_BRK)
++ if (newctrl & ACM_CTRL_BRK) {
+ acm->iocount.brk++;
++ tty_insert_flip_char(&acm->port, 0, TTY_BREAK);
++ }
+ if (newctrl & ACM_CTRL_RI)
+ acm->iocount.rng++;
+ if (newctrl & ACM_CTRL_FRAMING)
usb-dwc3-pci-enable-dis_ux_susphy_quirk-for-intel-me.patch
video-hyperv_fb-fix-a-double-free-in-hvfb_probe.patch
firewire-nosy-fix-a-use-after-free-bug-in-nosy_ioctl.patch
+usbip-vhci_hcd-fix-shift-out-of-bounds-in-vhci_hub_control.patch
+usb-quirks-ignore-remote-wake-up-on-fibocom-l850-gl-lte-modem.patch
+usb-musb-fix-suspend-with-devices-connected-for-a64.patch
+usb-xhci-mtk-fix-broken-streams-issue-on-0.96-xhci.patch
+cdc-acm-fix-break-rx-code-path-adding-necessary-calls.patch
+usb-cdc-acm-untangle-a-circular-dependency-between-callback-and-softint.patch
+usb-cdc-acm-downgrade-message-to-debug.patch
+usb-cdc-acm-fix-double-free-on-probe-failure.patch
+usb-cdc-acm-fix-use-after-free-after-probe-failure.patch
+usb-gadget-udc-amd5536udc_pci-fix-null-ptr-dereference.patch
+usb-dwc2-fix-hprt0.prtsusp-bit-setting-for-hikey-960-board.patch
+usb-dwc2-prevent-core-suspend-when-port-connection-flag-is-0.patch
+usb-dwc3-qcom-skip-interconnect-init-for-acpi-probe.patch
+usb-dwc3-gadget-clear-dep-flags-after-stop-transfers-in-ep-disable.patch
--- /dev/null
+From e4c77070ad45fc940af1d7fb1e637c349e848951 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Thu, 11 Mar 2021 14:01:26 +0100
+Subject: USB: cdc-acm: downgrade message to debug
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit e4c77070ad45fc940af1d7fb1e637c349e848951 upstream.
+
+This failure is so common that logging an error here amounts
+to spamming log files.
+
+Reviewed-by: Bruno Thomsen <bruno.thomsen@gmail.com>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210311130126.15972-2-oneukum@suse.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/cdc-acm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -659,7 +659,8 @@ static void acm_port_dtr_rts(struct tty_
+
+ res = acm_set_control(acm, val);
+ if (res && (acm->ctrl_caps & USB_CDC_CAP_LINE))
+- dev_err(&acm->control->dev, "failed to set dtr/rts\n");
++ /* This is broken in too many devices to spam the logs */
++ dev_dbg(&acm->control->dev, "failed to set dtr/rts\n");
+ }
+
+ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty)
--- /dev/null
+From 7180495cb3d0e2a2860d282a468b4146c21da78f Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 22 Mar 2021 16:53:11 +0100
+Subject: USB: cdc-acm: fix double free on probe failure
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 7180495cb3d0e2a2860d282a468b4146c21da78f upstream.
+
+If tty-device registration fails the driver copy of any Country
+Selection functional descriptor would end up being freed twice; first
+explicitly in the error path and then again in the tty-port destructor.
+
+Drop the first erroneous free that was left when fixing a tty-port
+resource leak.
+
+Fixes: cae2bc768d17 ("usb: cdc-acm: Decrement tty port's refcount if probe() fail")
+Cc: stable@vger.kernel.org # 4.19
+Cc: Jaejoong Kim <climbbb.kim@gmail.com>
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20210322155318.9837-2-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/cdc-acm.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1521,7 +1521,6 @@ alloc_fail6:
+ &dev_attr_wCountryCodes);
+ device_remove_file(&acm->control->dev,
+ &dev_attr_iCountryCodeRelDate);
+- kfree(acm->country_codes);
+ }
+ device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities);
+ alloc_fail5:
--- /dev/null
+From 4e49bf376c0451ad2eae2592e093659cde12be9a Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 22 Mar 2021 16:53:12 +0100
+Subject: USB: cdc-acm: fix use-after-free after probe failure
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 4e49bf376c0451ad2eae2592e093659cde12be9a upstream.
+
+If tty-device registration fails the driver would fail to release the
+data interface. When the device is later disconnected, the disconnect
+callback would still be called for the data interface and would go about
+releasing already freed resources.
+
+Fixes: c93d81955005 ("usb: cdc-acm: fix error handling in acm_probe()")
+Cc: stable@vger.kernel.org # 3.9
+Cc: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20210322155318.9837-3-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/cdc-acm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1516,6 +1516,11 @@ skip_countries:
+
+ return 0;
+ alloc_fail6:
++ if (!acm->combined_interfaces) {
++ /* Clear driver data so that disconnect() returns early. */
++ usb_set_intfdata(data_interface, NULL);
++ usb_driver_release_interface(&acm_driver, data_interface);
++ }
+ if (acm->country_codes) {
+ device_remove_file(&acm->control->dev,
+ &dev_attr_wCountryCodes);
--- /dev/null
+From 6069e3e927c8fb3a1947b07d1a561644ea960248 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Thu, 11 Mar 2021 14:01:25 +0100
+Subject: USB: cdc-acm: untangle a circular dependency between callback and softint
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit 6069e3e927c8fb3a1947b07d1a561644ea960248 upstream.
+
+We have a cycle of callbacks scheduling works which submit
+URBs with thos callbacks. This needs to be blocked, stopped
+and unblocked to untangle the circle.
+
+The issue leads to faults like:
+
+[ 55.068392] Unable to handle kernel paging request at virtual address 6b6b6c03
+[ 55.075624] pgd = be866494
+[ 55.078335] [6b6b6c03] *pgd=00000000
+[ 55.081924] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
+[ 55.087238] Modules linked in: ppp_async crc_ccitt ppp_generic slhc
+xt_TCPMSS xt_tcpmss xt_hl nf_log_ipv6 nf_log_ipv4 nf_log_common
+xt_policy xt_limit xt_conntrack xt_tcpudp xt_pkttype ip6table_mangle
+iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4
+iptable_mangle ip6table_filter ip6_tables iptable_filter ip_tables
+des_generic md5 sch_fq_codel cdc_mbim cdc_wdm cdc_ncm usbnet mii
+cdc_acm usb_storage ip_tunnel xfrm_user xfrm6_tunnel tunnel6
+xfrm4_tunnel tunnel4 esp6 esp4 ah6 ah4 xfrm_algo xt_LOG xt_LED
+xt_comment x_tables ipv6
+[ 55.134954] CPU: 0 PID: 82 Comm: kworker/0:2 Tainted: G
+ T 5.8.17 #1
+[ 55.142526] Hardware name: Freescale i.MX7 Dual (Device Tree)
+[ 55.148304] Workqueue: events acm_softint [cdc_acm]
+[ 55.153196] PC is at kobject_get+0x10/0xa4
+[ 55.157302] LR is at usb_get_dev+0x14/0x1c
+[ 55.161402] pc : [<8047c06c>] lr : [<80560448>] psr: 20000193
+[ 55.167671] sp : bca39ea8 ip : 00007374 fp : bf6cbd80
+[ 55.172899] r10: 00000000 r9 : bdd92284 r8 : bdd92008
+[ 55.178128] r7 : 6b6b6b6b r6 : fffffffe r5 : 60000113 r4 : 6b6b6be3
+[ 55.184658] r3 : 6b6b6b6b r2 : 00000111 r1 : 00000000 r0 : 6b6b6be3
+[ 55.191191] Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none
+[ 55.198417] Control: 10c5387d Table: bcf0c06a DAC: 00000051
+[ 55.204168] Process kworker/0:2 (pid: 82, stack limit = 0x9bdd2a89)
+[ 55.210439] Stack: (0xbca39ea8 to 0xbca3a000)
+[ 55.214805] 9ea0: bf6cbd80 80769a50 6b6b6b6b 80560448 bdeb0500 8056bfe8
+[ 55.222991] 9ec0: 00000002 b76da000 00000000 bdeb0500 bdd92448 bca38000 bdeb0510 8056d69c
+[ 55.231177] 9ee0: bca38000 00000000 80c050fc 00000000 bca39f44 09d42015 00000000 00000001
+[ 55.239363] 9f00: bdd92448 bdd92438 bdd92000 7f1158c4 bdd92448 bca2ee00 bf6cbd80 bf6cef00
+[ 55.247549] 9f20: 00000000 00000000 00000000 801412d8 bf6cbd98 80c03d00 bca2ee00 bf6cbd80
+[ 55.255735] 9f40: bca2ee14 bf6cbd98 80c03d00 00000008 bca38000 80141568 00000000 80c446ae
+[ 55.263921] 9f60: 00000000 bc9ed880 bc9f0700 bca38000 bc117eb4 80141524 bca2ee00 bc9ed8a4
+[ 55.272107] 9f80: 00000000 80147cc8 00000000 bc9f0700 80147b84 00000000 00000000 00000000
+[ 55.280292] 9fa0: 00000000 00000000 00000000 80100148 00000000 00000000 00000000 00000000
+[ 55.288477] 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+[ 55.296662] 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
+[ 55.304860] [<8047c06c>] (kobject_get) from [<80560448>] (usb_get_dev+0x14/0x1c)
+[ 55.312271] [<80560448>] (usb_get_dev) from [<8056bfe8>] (usb_hcd_unlink_urb+0x50/0xd8)
+[ 55.320286] [<8056bfe8>] (usb_hcd_unlink_urb) from [<8056d69c>] (usb_kill_urb.part.0+0x44/0xd0)
+[ 55.329004] [<8056d69c>] (usb_kill_urb.part.0) from [<7f1158c4>] (acm_softint+0x4c/0x10c [cdc_acm])
+[ 55.338082] [<7f1158c4>] (acm_softint [cdc_acm]) from [<801412d8>] (process_one_work+0x19c/0x3e8)
+[ 55.346969] [<801412d8>] (process_one_work) from [<80141568>] (worker_thread+0x44/0x4dc)
+[ 55.355072] [<80141568>] (worker_thread) from [<80147cc8>] (kthread+0x144/0x180)
+[ 55.362481] [<80147cc8>] (kthread) from [<80100148>] (ret_from_fork+0x14/0x2c)
+[ 55.369706] Exception stack(0xbca39fb0 to 0xbca39ff8)
+
+Tested-by: Bruno Thomsen <bruno.thomsen@gmail.com>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210311130126.15972-1-oneukum@suse.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/cdc-acm.c | 48 +++++++++++++++++++++++++++++---------------
+ 1 file changed, 32 insertions(+), 16 deletions(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -147,17 +147,29 @@ static inline int acm_set_control(struct
+ #define acm_send_break(acm, ms) \
+ acm_ctrl_msg(acm, USB_CDC_REQ_SEND_BREAK, ms, NULL, 0)
+
+-static void acm_kill_urbs(struct acm *acm)
++static void acm_poison_urbs(struct acm *acm)
+ {
+ int i;
+
+- usb_kill_urb(acm->ctrlurb);
++ usb_poison_urb(acm->ctrlurb);
+ for (i = 0; i < ACM_NW; i++)
+- usb_kill_urb(acm->wb[i].urb);
++ usb_poison_urb(acm->wb[i].urb);
+ for (i = 0; i < acm->rx_buflimit; i++)
+- usb_kill_urb(acm->read_urbs[i]);
++ usb_poison_urb(acm->read_urbs[i]);
++}
++
++static void acm_unpoison_urbs(struct acm *acm)
++{
++ int i;
++
++ for (i = 0; i < acm->rx_buflimit; i++)
++ usb_unpoison_urb(acm->read_urbs[i]);
++ for (i = 0; i < ACM_NW; i++)
++ usb_unpoison_urb(acm->wb[i].urb);
++ usb_unpoison_urb(acm->ctrlurb);
+ }
+
++
+ /*
+ * Write buffer management.
+ * All of these assume proper locks taken by the caller.
+@@ -226,9 +238,10 @@ static int acm_start_wb(struct acm *acm,
+
+ rc = usb_submit_urb(wb->urb, GFP_ATOMIC);
+ if (rc < 0) {
+- dev_err(&acm->data->dev,
+- "%s - usb_submit_urb(write bulk) failed: %d\n",
+- __func__, rc);
++ if (rc != -EPERM)
++ dev_err(&acm->data->dev,
++ "%s - usb_submit_urb(write bulk) failed: %d\n",
++ __func__, rc);
+ acm_write_done(acm, wb);
+ }
+ return rc;
+@@ -482,11 +495,6 @@ static void acm_read_bulk_callback(struc
+ dev_vdbg(&acm->data->dev, "got urb %d, len %d, status %d\n",
+ rb->index, urb->actual_length, status);
+
+- if (!acm->dev) {
+- dev_dbg(&acm->data->dev, "%s - disconnected\n", __func__);
+- return;
+- }
+-
+ switch (status) {
+ case 0:
+ usb_mark_last_busy(acm->dev);
+@@ -733,6 +741,7 @@ static void acm_port_shutdown(struct tty
+ * Need to grab write_lock to prevent race with resume, but no need to
+ * hold it due to the tty-port initialised flag.
+ */
++ acm_poison_urbs(acm);
+ spin_lock_irq(&acm->write_lock);
+ spin_unlock_irq(&acm->write_lock);
+
+@@ -749,7 +758,8 @@ static void acm_port_shutdown(struct tty
+ usb_autopm_put_interface_async(acm->control);
+ }
+
+- acm_kill_urbs(acm);
++ acm_unpoison_urbs(acm);
++
+ }
+
+ static void acm_tty_cleanup(struct tty_struct *tty)
+@@ -1542,8 +1552,14 @@ static void acm_disconnect(struct usb_in
+ if (!acm)
+ return;
+
+- mutex_lock(&acm->mutex);
+ acm->disconnected = true;
++ /*
++ * there is a circular dependency. acm_softint() can resubmit
++ * the URBs in error handling so we need to block any
++ * submission right away
++ */
++ acm_poison_urbs(acm);
++ mutex_lock(&acm->mutex);
+ if (acm->country_codes) {
+ device_remove_file(&acm->control->dev,
+ &dev_attr_wCountryCodes);
+@@ -1562,7 +1578,6 @@ static void acm_disconnect(struct usb_in
+ tty_kref_put(tty);
+ }
+
+- acm_kill_urbs(acm);
+ cancel_delayed_work_sync(&acm->dwork);
+
+ tty_unregister_device(acm_tty_driver, acm->minor);
+@@ -1604,7 +1619,7 @@ static int acm_suspend(struct usb_interf
+ if (cnt)
+ return 0;
+
+- acm_kill_urbs(acm);
++ acm_poison_urbs(acm);
+ cancel_delayed_work_sync(&acm->dwork);
+ acm->urbs_in_error_delay = 0;
+
+@@ -1617,6 +1632,7 @@ static int acm_resume(struct usb_interfa
+ struct urb *urb;
+ int rv = 0;
+
++ acm_unpoison_urbs(acm);
+ spin_lock_irq(&acm->write_lock);
+
+ if (--acm->susp_count)
--- /dev/null
+From 5e3bbae8ee3d677a0aa2919dc62b5c60ea01ba61 Mon Sep 17 00:00:00 2001
+From: Artur Petrosyan <Arthur.Petrosyan@synopsys.com>
+Date: Fri, 26 Mar 2021 14:24:46 +0400
+Subject: usb: dwc2: Fix HPRT0.PrtSusp bit setting for HiKey 960 board.
+
+From: Artur Petrosyan <Arthur.Petrosyan@synopsys.com>
+
+commit 5e3bbae8ee3d677a0aa2919dc62b5c60ea01ba61 upstream.
+
+Increased the waiting timeout for HPRT0.PrtSusp register field
+to be set, because on HiKey 960 board HPRT0.PrtSusp wasn't
+generated with the existing timeout.
+
+Cc: <stable@vger.kernel.org> # 4.18
+Fixes: 22bb5cfdf13a ("usb: dwc2: Fix host exit from hibernation flow.")
+Signed-off-by: Artur Petrosyan <Arthur.Petrosyan@synopsys.com>
+Acked-by: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
+Link: https://lore.kernel.org/r/20210326102447.8F7FEA005D@mailhost.synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/hcd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -5398,7 +5398,7 @@ int dwc2_host_enter_hibernation(struct d
+ dwc2_writel(hsotg, hprt0, HPRT0);
+
+ /* Wait for the HPRT0.PrtSusp register field to be set */
+- if (dwc2_hsotg_wait_bit_set(hsotg, HPRT0, HPRT0_SUSP, 3000))
++ if (dwc2_hsotg_wait_bit_set(hsotg, HPRT0, HPRT0_SUSP, 5000))
+ dev_warn(hsotg->dev, "Suspend wasn't generated\n");
+
+ /*
--- /dev/null
+From 93f672804bf2d7a49ef3fd96827ea6290ca1841e Mon Sep 17 00:00:00 2001
+From: Artur Petrosyan <Arthur.Petrosyan@synopsys.com>
+Date: Fri, 26 Mar 2021 14:25:09 +0400
+Subject: usb: dwc2: Prevent core suspend when port connection flag is 0
+
+From: Artur Petrosyan <Arthur.Petrosyan@synopsys.com>
+
+commit 93f672804bf2d7a49ef3fd96827ea6290ca1841e upstream.
+
+In host mode port connection status flag is "0" when loading
+the driver. After loading the driver system asserts suspend
+which is handled by "_dwc2_hcd_suspend()" function. Before
+the system suspend the port connection status is "0". As
+result need to check the "port_connect_status" if it is "0",
+then skipping entering to suspend.
+
+Cc: <stable@vger.kernel.org> # 5.2
+Fixes: 6f6d70597c15 ("usb: dwc2: bus suspend/resume for hosts with DWC2_POWER_DOWN_PARAM_NONE")
+Signed-off-by: Artur Petrosyan <Arthur.Petrosyan@synopsys.com>
+Link: https://lore.kernel.org/r/20210326102510.BDEDEA005D@mailhost.synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc2/hcd.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -4322,7 +4322,8 @@ static int _dwc2_hcd_suspend(struct usb_
+ if (hsotg->op_state == OTG_STATE_B_PERIPHERAL)
+ goto unlock;
+
+- if (hsotg->params.power_down > DWC2_POWER_DOWN_PARAM_PARTIAL)
++ if (hsotg->params.power_down != DWC2_POWER_DOWN_PARAM_PARTIAL ||
++ hsotg->flags.b.port_connect_status == 0)
+ goto skip_power_saving;
+
+ /*
--- /dev/null
+From 5aef629704ad4d983ecf5c8a25840f16e45b6d59 Mon Sep 17 00:00:00 2001
+From: Wesley Cheng <wcheng@codeaurora.org>
+Date: Wed, 24 Mar 2021 11:31:04 -0700
+Subject: usb: dwc3: gadget: Clear DEP flags after stop transfers in ep disable
+
+From: Wesley Cheng <wcheng@codeaurora.org>
+
+commit 5aef629704ad4d983ecf5c8a25840f16e45b6d59 upstream.
+
+Ensure that dep->flags are cleared until after stop active transfers
+is completed. Otherwise, the ENDXFER command will not be executed
+during ep disable.
+
+Fixes: f09ddcfcb8c5 ("usb: dwc3: gadget: Prevent EP queuing while stopping transfers")
+Cc: stable <stable@vger.kernel.org>
+Reported-and-tested-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Wesley Cheng <wcheng@codeaurora.org>
+Link: https://lore.kernel.org/r/1616610664-16495-1-git-send-email-wcheng@codeaurora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -791,10 +791,6 @@ static int __dwc3_gadget_ep_disable(stru
+ reg &= ~DWC3_DALEPENA_EP(dep->number);
+ dwc3_writel(dwc->regs, DWC3_DALEPENA, reg);
+
+- dep->stream_capable = false;
+- dep->type = 0;
+- dep->flags = 0;
+-
+ /* Clear out the ep descriptors for non-ep0 */
+ if (dep->number > 1) {
+ dep->endpoint.comp_desc = NULL;
+@@ -803,6 +799,10 @@ static int __dwc3_gadget_ep_disable(stru
+
+ dwc3_remove_requests(dwc, dep);
+
++ dep->stream_capable = false;
++ dep->type = 0;
++ dep->flags = 0;
++
+ return 0;
+ }
+
--- /dev/null
+From 5e4010e36a58978e42b2ee13739ff9b50209c830 Mon Sep 17 00:00:00 2001
+From: Shawn Guo <shawn.guo@linaro.org>
+Date: Thu, 11 Mar 2021 14:03:18 +0800
+Subject: usb: dwc3: qcom: skip interconnect init for ACPI probe
+
+From: Shawn Guo <shawn.guo@linaro.org>
+
+commit 5e4010e36a58978e42b2ee13739ff9b50209c830 upstream.
+
+The ACPI probe starts failing since commit bea46b981515 ("usb: dwc3:
+qcom: Add interconnect support in dwc3 driver"), because there is no
+interconnect support for ACPI, and of_icc_get() call in
+dwc3_qcom_interconnect_init() will just return -EINVAL.
+
+Fix the problem by skipping interconnect init for ACPI probe, and then
+the NULL icc_path_ddr will simply just scheild all ICC calls.
+
+Fixes: bea46b981515 ("usb: dwc3: qcom: Add interconnect support in dwc3 driver")
+Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20210311060318.25418-1-shawn.guo@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/dwc3-qcom.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -244,6 +244,9 @@ static int dwc3_qcom_interconnect_init(s
+ struct device *dev = qcom->dev;
+ int ret;
+
++ if (has_acpi_companion(dev))
++ return 0;
++
+ qcom->icc_path_ddr = of_icc_get(dev, "usb-ddr");
+ if (IS_ERR(qcom->icc_path_ddr)) {
+ dev_err(dev, "failed to get usb-ddr path: %ld\n",
--- /dev/null
+From 72035f4954f0bca2d8c47cf31b3629c42116f5b7 Mon Sep 17 00:00:00 2001
+From: Tong Zhang <ztong0001@gmail.com>
+Date: Wed, 17 Mar 2021 19:04:00 -0400
+Subject: usb: gadget: udc: amd5536udc_pci fix null-ptr-dereference
+
+From: Tong Zhang <ztong0001@gmail.com>
+
+commit 72035f4954f0bca2d8c47cf31b3629c42116f5b7 upstream.
+
+init_dma_pools() calls dma_pool_create(...dev->dev) to create dma pool.
+however, dev->dev is actually set after calling init_dma_pools(), which
+effectively makes dma_pool_create(..NULL) and cause crash.
+To fix this issue, init dma only after dev->dev is set.
+
+[ 1.317993] RIP: 0010:dma_pool_create+0x83/0x290
+[ 1.323257] Call Trace:
+[ 1.323390] ? pci_write_config_word+0x27/0x30
+[ 1.323626] init_dma_pools+0x41/0x1a0 [snps_udc_core]
+[ 1.323899] udc_pci_probe+0x202/0x2b1 [amd5536udc_pci]
+
+Fixes: 7c51247a1f62 (usb: gadget: udc: Provide correct arguments for 'dma_pool_create')
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Tong Zhang <ztong0001@gmail.com>
+Link: https://lore.kernel.org/r/20210317230400.357756-1-ztong0001@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/amd5536udc_pci.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/gadget/udc/amd5536udc_pci.c
++++ b/drivers/usb/gadget/udc/amd5536udc_pci.c
+@@ -153,6 +153,11 @@ static int udc_pci_probe(
+ pci_set_master(pdev);
+ pci_try_set_mwi(pdev);
+
++ dev->phys_addr = resource;
++ dev->irq = pdev->irq;
++ dev->pdev = pdev;
++ dev->dev = &pdev->dev;
++
+ /* init dma pools */
+ if (use_dma) {
+ retval = init_dma_pools(dev);
+@@ -160,11 +165,6 @@ static int udc_pci_probe(
+ goto err_dma;
+ }
+
+- dev->phys_addr = resource;
+- dev->irq = pdev->irq;
+- dev->pdev = pdev;
+- dev->dev = &pdev->dev;
+-
+ /* general probing */
+ if (udc_probe(dev)) {
+ retval = -ENODEV;
--- /dev/null
+From 92af4fc6ec331228aca322ca37c8aea7b150a151 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Wed, 24 Mar 2021 09:11:41 +0200
+Subject: usb: musb: Fix suspend with devices connected for a64
+
+From: Tony Lindgren <tony@atomide.com>
+
+commit 92af4fc6ec331228aca322ca37c8aea7b150a151 upstream.
+
+Pinephone running on Allwinner A64 fails to suspend with USB devices
+connected as reported by Bhushan Shah <bshah@kde.org>. Reverting
+commit 5fbf7a253470 ("usb: musb: fix idling for suspend after
+disconnect interrupt") fixes the issue.
+
+Let's add suspend checks also for suspend after disconnect interrupt
+quirk handling like we already do elsewhere.
+
+Fixes: 5fbf7a253470 ("usb: musb: fix idling for suspend after disconnect interrupt")
+Reported-by: Bhushan Shah <bshah@kde.org>
+Tested-by: Bhushan Shah <bshah@kde.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20210324071142.42264-1-tony@atomide.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/musb/musb_core.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -2004,10 +2004,14 @@ static void musb_pm_runtime_check_sessio
+ MUSB_DEVCTL_HR;
+ switch (devctl & ~s) {
+ case MUSB_QUIRK_B_DISCONNECT_99:
+- musb_dbg(musb, "Poll devctl in case of suspend after disconnect\n");
+- schedule_delayed_work(&musb->irq_work,
+- msecs_to_jiffies(1000));
+- break;
++ if (musb->quirk_retries && !musb->flush_irq_work) {
++ musb_dbg(musb, "Poll devctl in case of suspend after disconnect\n");
++ schedule_delayed_work(&musb->irq_work,
++ msecs_to_jiffies(1000));
++ musb->quirk_retries--;
++ break;
++ }
++ fallthrough;
+ case MUSB_QUIRK_B_INVALID_VBUS_91:
+ if (musb->quirk_retries && !musb->flush_irq_work) {
+ musb_dbg(musb,
--- /dev/null
+From 0bd860493f81eb2a46173f6f5e44cc38331c8dbd Mon Sep 17 00:00:00 2001
+From: Vincent Palatin <vpalatin@chromium.org>
+Date: Fri, 19 Mar 2021 13:48:02 +0100
+Subject: USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem
+
+From: Vincent Palatin <vpalatin@chromium.org>
+
+commit 0bd860493f81eb2a46173f6f5e44cc38331c8dbd upstream.
+
+This LTE modem (M.2 card) has a bug in its power management:
+there is some kind of race condition for U3 wake-up between the host and
+the device. The modem firmware sometimes crashes/locks when both events
+happen at the same time and the modem fully drops off the USB bus (and
+sometimes re-enumerates, sometimes just gets stuck until the next
+reboot).
+
+Tested with the modem wired to the XHCI controller on an AMD 3015Ce
+platform. Without the patch, the modem dropped of the USB bus 5 times in
+3 days. With the quirk, it stayed connected for a week while the
+'runtime_suspended_time' counter incremented as excepted.
+
+Signed-off-by: Vincent Palatin <vpalatin@chromium.org>
+Link: https://lore.kernel.org/r/20210319124802.2315195-1-vpalatin@chromium.org
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -498,6 +498,10 @@ static const struct usb_device_id usb_qu
+ /* DJI CineSSD */
+ { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
+
++ /* Fibocom L850-GL LTE Modem */
++ { USB_DEVICE(0x2cb7, 0x0007), .driver_info =
++ USB_QUIRK_IGNORE_REMOTE_WAKEUP },
++
+ /* INTEL VALUE SSD */
+ { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
+
--- /dev/null
+From 6f978a30c9bb12dab1302d0f06951ee290f5e600 Mon Sep 17 00:00:00 2001
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Date: Tue, 23 Mar 2021 15:02:46 +0800
+Subject: usb: xhci-mtk: fix broken streams issue on 0.96 xHCI
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+commit 6f978a30c9bb12dab1302d0f06951ee290f5e600 upstream.
+
+The MediaTek 0.96 xHCI controller on some platforms does not
+support bulk stream even HCCPARAMS says supporting, due to MaxPSASize
+is set a default value 1 by mistake, here use XHCI_BROKEN_STREAMS
+quirk to fix it.
+
+Fixes: 94a631d91ad3 ("usb: xhci-mtk: check hcc_params after adding primary hcd")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Link: https://lore.kernel.org/r/1616482975-17841-4-git-send-email-chunfeng.yun@mediatek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-mtk.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-mtk.c
++++ b/drivers/usb/host/xhci-mtk.c
+@@ -397,6 +397,13 @@ static void xhci_mtk_quirks(struct devic
+ xhci->quirks |= XHCI_SPURIOUS_SUCCESS;
+ if (mtk->lpm_support)
+ xhci->quirks |= XHCI_LPM_SUPPORT;
++
++ /*
++ * MTK xHCI 0.96: PSA is 1 by default even if doesn't support stream,
++ * and it's 3 when support it.
++ */
++ if (xhci->hci_version < 0x100 && HCC_MAX_PSA(xhci->hcc_params) == 4)
++ xhci->quirks |= XHCI_BROKEN_STREAMS;
+ }
+
+ /* called during probe() after chip reset completes */
+@@ -548,7 +555,8 @@ static int xhci_mtk_probe(struct platfor
+ if (ret)
+ goto put_usb3_hcd;
+
+- if (HCC_MAX_PSA(xhci->hcc_params) >= 4)
++ if (HCC_MAX_PSA(xhci->hcc_params) >= 4 &&
++ !(xhci->quirks & XHCI_BROKEN_STREAMS))
+ xhci->shared_hcd->can_do_streams = 1;
+
+ ret = usb_add_hcd(xhci->shared_hcd, irq, IRQF_SHARED);
--- /dev/null
+From 1cc5ed25bdade86de2650a82b2730108a76de20c Mon Sep 17 00:00:00 2001
+From: Shuah Khan <skhan@linuxfoundation.org>
+Date: Wed, 24 Mar 2021 17:06:54 -0600
+Subject: usbip: vhci_hcd fix shift out-of-bounds in vhci_hub_control()
+
+From: Shuah Khan <skhan@linuxfoundation.org>
+
+commit 1cc5ed25bdade86de2650a82b2730108a76de20c upstream.
+
+Fix shift out-of-bounds in vhci_hub_control() SetPortFeature handling.
+
+UBSAN: shift-out-of-bounds in drivers/usb/usbip/vhci_hcd.c:605:42
+shift exponent 768 is too large for 32-bit type 'int'
+
+Reported-by: syzbot+3dea30b047f41084de66@syzkaller.appspotmail.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20210324230654.34798-1-skhan@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/usbip/vhci_hcd.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -594,6 +594,8 @@ static int vhci_hub_control(struct usb_h
+ pr_err("invalid port number %d\n", wIndex);
+ goto error;
+ }
++ if (wValue >= 32)
++ goto error;
+ if (hcd->speed == HCD_USB3) {
+ if ((vhci_hcd->port_status[rhport] &
+ USB_SS_PORT_STAT_POWER) != 0) {
projects / thirdparty / kernel / stable-queue.git / commitdiff
