]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.14-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 9 Nov 2020 10:40:48 +0000 (11:40 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 9 Nov 2020 10:40:48 +0000 (11:40 +0100)
added patches:
arc-stack-unwinding-avoid-indefinite-looping.patch
fork-fix-copy_process-clone_parent-race-with-the-exiting-real_parent.patch
pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch
revert-arc-entry-fix-potential-efa-clobber-when-tif_syscall_trace.patch
serial-8250_mtk-fix-uart_get_baud_rate-warning.patch
serial-txx9-add-missing-platform_driver_unregister-on-error-in-serial_txx9_init.patch
usb-add-no_lpm-quirk-for-kingston-flash-drive.patch
usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch
usb-serial-cyberjack-fix-write-urb-completion-race.patch
usb-serial-option-add-le910cx-compositions-0x1203-0x1230-0x1231.patch
usb-serial-option-add-quectel-ec200t-module-support.patch
usb-serial-option-add-telit-fn980-composition-0x1055.patch

13 files changed:
queue-4.14/arc-stack-unwinding-avoid-indefinite-looping.patch [new file with mode: 0644]
queue-4.14/fork-fix-copy_process-clone_parent-race-with-the-exiting-real_parent.patch [new file with mode: 0644]
queue-4.14/pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch [new file with mode: 0644]
queue-4.14/revert-arc-entry-fix-potential-efa-clobber-when-tif_syscall_trace.patch [new file with mode: 0644]
queue-4.14/serial-8250_mtk-fix-uart_get_baud_rate-warning.patch [new file with mode: 0644]
queue-4.14/serial-txx9-add-missing-platform_driver_unregister-on-error-in-serial_txx9_init.patch [new file with mode: 0644]
queue-4.14/series
queue-4.14/usb-add-no_lpm-quirk-for-kingston-flash-drive.patch [new file with mode: 0644]
queue-4.14/usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch [new file with mode: 0644]
queue-4.14/usb-serial-cyberjack-fix-write-urb-completion-race.patch [new file with mode: 0644]
queue-4.14/usb-serial-option-add-le910cx-compositions-0x1203-0x1230-0x1231.patch [new file with mode: 0644]
queue-4.14/usb-serial-option-add-quectel-ec200t-module-support.patch [new file with mode: 0644]
queue-4.14/usb-serial-option-add-telit-fn980-composition-0x1055.patch [new file with mode: 0644]

diff --git a/queue-4.14/arc-stack-unwinding-avoid-indefinite-looping.patch b/queue-4.14/arc-stack-unwinding-avoid-indefinite-looping.patch
new file mode 100644 (file)
index 0000000..9f62aeb
--- /dev/null
@@ -0,0 +1,72 @@
+From 328d2168ca524d501fc4b133d6be076142bd305c Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <vgupta@synopsys.com>
+Date: Tue, 27 Oct 2020 15:01:17 -0700
+Subject: ARC: stack unwinding: avoid indefinite looping
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+commit 328d2168ca524d501fc4b133d6be076142bd305c upstream.
+
+Currently stack unwinder is a while(1) loop which relies on the dwarf
+unwinder to signal termination, which in turn relies on dwarf info to do
+so. This in theory could cause an infinite loop if the dwarf info was
+somehow messed up or the register contents were etc.
+
+This fix thus detects the excessive looping and breaks the loop.
+
+| Mem: 26184K used, 1009136K free, 0K shrd, 0K buff, 14416K cached
+| CPU:  0.0% usr 72.8% sys  0.0% nic 27.1% idle  0.0% io  0.0% irq  0.0% sirq
+| Load average: 4.33 2.60 1.11 2/74 139
+|   PID  PPID USER     STAT   VSZ %VSZ CPU %CPU COMMAND
+|   133     2 root     SWN      0  0.0   3 22.9 [rcu_torture_rea]
+|   132     2 root     SWN      0  0.0   0 22.0 [rcu_torture_rea]
+|   131     2 root     SWN      0  0.0   3 21.5 [rcu_torture_rea]
+|   126     2 root     RW       0  0.0   2  5.4 [rcu_torture_wri]
+|   129     2 root     SWN      0  0.0   0  0.2 [rcu_torture_fak]
+|   137     2 root     SW       0  0.0   0  0.2 [rcu_torture_cbf]
+|   127     2 root     SWN      0  0.0   0  0.1 [rcu_torture_fak]
+|   138   115 root     R     1464  0.1   2  0.1 top
+|   130     2 root     SWN      0  0.0   0  0.1 [rcu_torture_fak]
+|   128     2 root     SWN      0  0.0   0  0.1 [rcu_torture_fak]
+|   115     1 root     S     1472  0.1   1  0.0 -/bin/sh
+|   104     1 root     S     1464  0.1   0  0.0 inetd
+|     1     0 root     S     1456  0.1   2  0.0 init
+|    78     1 root     S     1456  0.1   0  0.0 syslogd -O /var/log/messages
+|   134     2 root     SW       0  0.0   2  0.0 [rcu_torture_sta]
+|    10     2 root     IW       0  0.0   1  0.0 [rcu_preempt]
+|    88     2 root     IW       0  0.0   1  0.0 [kworker/1:1-eve]
+|    66     2 root     IW       0  0.0   2  0.0 [kworker/2:2-eve]
+|    39     2 root     IW       0  0.0   2  0.0 [kworker/2:1-eve]
+| unwinder looping too long, aborting !
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arc/kernel/stacktrace.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/arch/arc/kernel/stacktrace.c
++++ b/arch/arc/kernel/stacktrace.c
+@@ -115,7 +115,7 @@ arc_unwind_core(struct task_struct *tsk,
+               int (*consumer_fn) (unsigned int, void *), void *arg)
+ {
+ #ifdef CONFIG_ARC_DW2_UNWIND
+-      int ret = 0;
++      int ret = 0, cnt = 0;
+       unsigned int address;
+       struct unwind_frame_info frame_info;
+@@ -135,6 +135,11 @@ arc_unwind_core(struct task_struct *tsk,
+                       break;
+               frame_info.regs.r63 = frame_info.regs.r31;
++
++              if (cnt++ > 128) {
++                      printk("unwinder looping too long, aborting !\n");
++                      return 0;
++              }
+       }
+       return address;         /* return the last address it saw */
diff --git a/queue-4.14/fork-fix-copy_process-clone_parent-race-with-the-exiting-real_parent.patch b/queue-4.14/fork-fix-copy_process-clone_parent-race-with-the-exiting-real_parent.patch
new file mode 100644 (file)
index 0000000..be7c46c
--- /dev/null
@@ -0,0 +1,55 @@
+From b4e00444cab4c3f3fec876dc0cccc8cbb0d1a948 Mon Sep 17 00:00:00 2001
+From: Eddy Wu <itseddy0402@gmail.com>
+Date: Sat, 7 Nov 2020 14:47:22 +0800
+Subject: fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent
+
+From: Eddy Wu <itseddy0402@gmail.com>
+
+commit b4e00444cab4c3f3fec876dc0cccc8cbb0d1a948 upstream.
+
+current->group_leader->exit_signal may change during copy_process() if
+current->real_parent exits.
+
+Move the assignment inside tasklist_lock to avoid the race.
+
+Signed-off-by: Eddy Wu <eddy_wu@trendmicro.com>
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/fork.c |   10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1833,14 +1833,9 @@ static __latent_entropy struct task_stru
+       /* ok, now we should be set up.. */
+       p->pid = pid_nr(pid);
+       if (clone_flags & CLONE_THREAD) {
+-              p->exit_signal = -1;
+               p->group_leader = current->group_leader;
+               p->tgid = current->tgid;
+       } else {
+-              if (clone_flags & CLONE_PARENT)
+-                      p->exit_signal = current->group_leader->exit_signal;
+-              else
+-                      p->exit_signal = (clone_flags & CSIGNAL);
+               p->group_leader = p;
+               p->tgid = p->pid;
+       }
+@@ -1885,9 +1880,14 @@ static __latent_entropy struct task_stru
+       if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
+               p->real_parent = current->real_parent;
+               p->parent_exec_id = current->parent_exec_id;
++              if (clone_flags & CLONE_THREAD)
++                      p->exit_signal = -1;
++              else
++                      p->exit_signal = current->group_leader->exit_signal;
+       } else {
+               p->real_parent = current;
+               p->parent_exec_id = current->self_exec_id;
++              p->exit_signal = (clone_flags & CSIGNAL);
+       }
+       klp_copy_process(p);
diff --git a/queue-4.14/pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch b/queue-4.14/pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch
new file mode 100644 (file)
index 0000000..a4d657c
--- /dev/null
@@ -0,0 +1,59 @@
+From 9226c504e364158a17a68ff1fe9d67d266922f50 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Thu, 22 Oct 2020 17:38:22 +0200
+Subject: PM: runtime: Resume the device earlier in __device_release_driver()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit 9226c504e364158a17a68ff1fe9d67d266922f50 upstream.
+
+Since the device is resumed from runtime-suspend in
+__device_release_driver() anyway, it is better to do that before
+looking for busy managed device links from it to consumers, because
+if there are any, device_links_unbind_consumers() will be called
+and it will cause the consumer devices' drivers to unbind, so the
+consumer devices will be runtime-resumed.  In turn, resuming each
+consumer device will cause the supplier to be resumed and when the
+runtime PM references from the given consumer to it are dropped, it
+may be suspended.  Then, the runtime-resume of the next consumer
+will cause the supplier to resume again and so on.
+
+Update the code accordingly.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Fixes: 9ed9895370ae ("driver core: Functional dependencies tracking support")
+Cc: All applicable <stable@vger.kernel.org> # All applicable
+Tested-by: Xiang Chen <chenxiang66@hisilicon.com>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/dd.c |    7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -816,6 +816,8 @@ static void __device_release_driver(stru
+       drv = dev->driver;
+       if (drv) {
++              pm_runtime_get_sync(dev);
++
+               while (device_links_busy(dev)) {
+                       device_unlock(dev);
+                       if (parent)
+@@ -831,11 +833,12 @@ static void __device_release_driver(stru
+                        * have released the driver successfully while this one
+                        * was waiting, so check for that.
+                        */
+-                      if (dev->driver != drv)
++                      if (dev->driver != drv) {
++                              pm_runtime_put(dev);
+                               return;
++                      }
+               }
+-              pm_runtime_get_sync(dev);
+               pm_runtime_clean_up_links(dev);
+               driver_sysfs_remove(dev);
diff --git a/queue-4.14/revert-arc-entry-fix-potential-efa-clobber-when-tif_syscall_trace.patch b/queue-4.14/revert-arc-entry-fix-potential-efa-clobber-when-tif_syscall_trace.patch
new file mode 100644 (file)
index 0000000..df6be93
--- /dev/null
@@ -0,0 +1,89 @@
+From Vineet.Gupta1@synopsys.com  Mon Nov  9 11:28:19 2020
+From: Vineet Gupta <Vineet.Gupta1@synopsys.com>
+Date: Mon, 19 Oct 2020 19:19:57 -0700
+Subject: Revert "ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE"
+To: stable@vger.kernel.org
+Cc: linux-snps-arc@lists.infradead.org, linux-kernel@vger.kernel.org, Vineet Gupta <Vineet.Gupta1@synopsys.com>, Waldemar Brodkorb <wbx@uclibc-ng.org>
+Message-ID: <20201020021957.1260521-1-vgupta@synopsys.com>
+
+From: Vineet Gupta <Vineet.Gupta1@synopsys.com>
+
+This reverts commit 00fdec98d9881bf5173af09aebd353ab3b9ac729.
+(but only from 5.2 and prior kernels)
+
+The original commit was a preventive fix based on code-review and was
+auto-picked for stable back-port (for better or worse).
+It was OK for v5.3+ kernels, but turned up needing an implicit change
+68e5c6f073bcf70 "(ARC: entry: EV_Trap expects r10 (vs. r9) to have
+ exception cause)" merged in v5.3 which itself was not backported.
+So to summarize the stable backport of this patch for v5.2 and prior
+kernels is busted and it won't boot.
+
+The obvious solution is backport 68e5c6f073bcf70 but that is a pain as
+it doesn't revert cleanly and each of affected kernels (so far v4.19,
+v4.14, v4.9, v4.4) needs a slightly different massaged varaint.
+So the easier fix is to simply revert the backport from 5.2 and prior.
+The issue was not a big deal as it would cause strace to sporadically
+not work correctly.
+
+Waldemar Brodkorb first reported this when running ARC uClibc regressions
+on latest stable kernels (with offending backport). Once he bisected it,
+the analysis was trivial, so thx to him for this.
+
+Reported-by: Waldemar Brodkorb <wbx@uclibc-ng.org>
+Bisected-by: Waldemar Brodkorb <wbx@uclibc-ng.org>
+Cc: stable <stable@vger.kernel.org> # 5.2 and prior
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arc/kernel/entry.S |   16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/arch/arc/kernel/entry.S
++++ b/arch/arc/kernel/entry.S
+@@ -156,6 +156,7 @@ END(EV_Extension)
+ tracesys:
+       ; save EFA in case tracer wants the PC of traced task
+       ; using ERET won't work since next-PC has already committed
++      lr  r12, [efa]
+       GET_CURR_TASK_FIELD_PTR   TASK_THREAD, r11
+       st  r12, [r11, THREAD_FAULT_ADDR]       ; thread.fault_address
+@@ -198,9 +199,15 @@ tracesys_exit:
+ ; Breakpoint TRAP
+ ; ---------------------------------------------
+ trap_with_param:
+-      mov r0, r12     ; EFA in case ptracer/gdb wants stop_pc
++
++      ; stop_pc info by gdb needs this info
++      lr  r0, [efa]
+       mov r1, sp
++      ; Now that we have read EFA, it is safe to do "fake" rtie
++      ;   and get out of CPU exception mode
++      FAKE_RET_FROM_EXCPN
++
+       ; Save callee regs in case gdb wants to have a look
+       ; SP will grow up by size of CALLEE Reg-File
+       ; NOTE: clobbers r12
+@@ -227,10 +234,6 @@ ENTRY(EV_Trap)
+       EXCEPTION_PROLOGUE
+-      lr  r12, [efa]
+-
+-      FAKE_RET_FROM_EXCPN
+-
+       ;============ TRAP 1   :breakpoints
+       ; Check ECR for trap with arg (PROLOGUE ensures r9 has ECR)
+       bmsk.f 0, r9, 7
+@@ -238,6 +241,9 @@ ENTRY(EV_Trap)
+       ;============ TRAP  (no param): syscall top level
++      ; First return from Exception to pure K mode (Exception/IRQs renabled)
++      FAKE_RET_FROM_EXCPN
++
+       ; If syscall tracing ongoing, invoke pre-post-hooks
+       GET_CURR_THR_INFO_FLAGS   r10
+       btst r10, TIF_SYSCALL_TRACE
diff --git a/queue-4.14/serial-8250_mtk-fix-uart_get_baud_rate-warning.patch b/queue-4.14/serial-8250_mtk-fix-uart_get_baud_rate-warning.patch
new file mode 100644 (file)
index 0000000..7bdb186
--- /dev/null
@@ -0,0 +1,38 @@
+From 912ab37c798770f21b182d656937072b58553378 Mon Sep 17 00:00:00 2001
+From: Claire Chang <tientzu@chromium.org>
+Date: Mon, 2 Nov 2020 20:07:49 +0800
+Subject: serial: 8250_mtk: Fix uart_get_baud_rate warning
+
+From: Claire Chang <tientzu@chromium.org>
+
+commit 912ab37c798770f21b182d656937072b58553378 upstream.
+
+Mediatek 8250 port supports speed higher than uartclk / 16. If the baud
+rates in both the new and the old termios setting are higher than
+uartclk / 16, the WARN_ON in uart_get_baud_rate() will be triggered.
+Passing NULL as the old termios so uart_get_baud_rate() will use
+uartclk / 16 - 1 as the new baud rate which will be replaced by the
+original baud rate later by tty_termios_encode_baud_rate() in
+mtk8250_set_termios().
+
+Fixes: 551e553f0d4a ("serial: 8250_mtk: Fix high-speed baud rates clamping")
+Signed-off-by: Claire Chang <tientzu@chromium.org>
+Link: https://lore.kernel.org/r/20201102120749.374458-1-tientzu@chromium.org
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_mtk.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/8250/8250_mtk.c
++++ b/drivers/tty/serial/8250/8250_mtk.c
+@@ -56,7 +56,7 @@ mtk8250_set_termios(struct uart_port *po
+        */
+       baud = tty_termios_baud_rate(termios);
+-      serial8250_do_set_termios(port, termios, old);
++      serial8250_do_set_termios(port, termios, NULL);
+       tty_termios_encode_baud_rate(termios, baud, baud);
diff --git a/queue-4.14/serial-txx9-add-missing-platform_driver_unregister-on-error-in-serial_txx9_init.patch b/queue-4.14/serial-txx9-add-missing-platform_driver_unregister-on-error-in-serial_txx9_init.patch
new file mode 100644 (file)
index 0000000..4ed8d15
--- /dev/null
@@ -0,0 +1,36 @@
+From 0c5fc92622ed5531ff324b20f014e9e3092f0187 Mon Sep 17 00:00:00 2001
+From: Qinglang Miao <miaoqinglang@huawei.com>
+Date: Tue, 3 Nov 2020 16:49:42 +0800
+Subject: serial: txx9: add missing platform_driver_unregister() on error in serial_txx9_init
+
+From: Qinglang Miao <miaoqinglang@huawei.com>
+
+commit 0c5fc92622ed5531ff324b20f014e9e3092f0187 upstream.
+
+Add the missing platform_driver_unregister() before return
+from serial_txx9_init in the error handling case when failed
+to register serial_txx9_pci_driver with macro ENABLE_SERIAL_TXX9_PCI
+defined.
+
+Fixes: ab4382d27412 ("tty: move drivers/serial/ to drivers/tty/serial/")
+Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
+Link: https://lore.kernel.org/r/20201103084942.109076-1-miaoqinglang@huawei.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/serial_txx9.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/tty/serial/serial_txx9.c
++++ b/drivers/tty/serial/serial_txx9.c
+@@ -1287,6 +1287,9 @@ static int __init serial_txx9_init(void)
+ #ifdef ENABLE_SERIAL_TXX9_PCI
+       ret = pci_register_driver(&serial_txx9_pci_driver);
++      if (ret) {
++              platform_driver_unregister(&serial_txx9_plat_driver);
++      }
+ #endif
+       if (ret == 0)
+               goto out;
index a274274d8365f959bbe2769f2c2e48ac4c5297d4..2944c078ac7b1f1b6cc31fef6d8878a37821d04a 100644 (file)
@@ -33,3 +33,15 @@ vsock-use-ns_capable_noaudit-on-socket-create.patch
 drm-vc4-drv-add-error-handding-for-bind.patch
 acpi-nfit-fix-comparison-to-enxio.patch
 vt-disable-kd_font_op_copy.patch
+fork-fix-copy_process-clone_parent-race-with-the-exiting-real_parent.patch
+serial-8250_mtk-fix-uart_get_baud_rate-warning.patch
+serial-txx9-add-missing-platform_driver_unregister-on-error-in-serial_txx9_init.patch
+usb-serial-cyberjack-fix-write-urb-completion-race.patch
+usb-serial-option-add-quectel-ec200t-module-support.patch
+usb-serial-option-add-le910cx-compositions-0x1203-0x1230-0x1231.patch
+usb-serial-option-add-telit-fn980-composition-0x1055.patch
+usb-add-no_lpm-quirk-for-kingston-flash-drive.patch
+usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch
+arc-stack-unwinding-avoid-indefinite-looping.patch
+revert-arc-entry-fix-potential-efa-clobber-when-tif_syscall_trace.patch
+pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch
diff --git a/queue-4.14/usb-add-no_lpm-quirk-for-kingston-flash-drive.patch b/queue-4.14/usb-add-no_lpm-quirk-for-kingston-flash-drive.patch
new file mode 100644 (file)
index 0000000..943c087
--- /dev/null
@@ -0,0 +1,39 @@
+From afaa2e745a246c5ab95103a65b1ed00101e1bc63 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 2 Nov 2020 09:58:21 -0500
+Subject: USB: Add NO_LPM quirk for Kingston flash drive
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit afaa2e745a246c5ab95103a65b1ed00101e1bc63 upstream.
+
+In Bugzilla #208257, Julien Humbert reports that a 32-GB Kingston
+flash drive spontaneously disconnects and reconnects, over and over.
+Testing revealed that disabling Link Power Management for the drive
+fixed the problem.
+
+This patch adds a quirk entry for that drive to turn off LPM permanently.
+
+CC: Hans de Goede <jwrdegoede@fedoraproject.org>
+CC: <stable@vger.kernel.org>
+Reported-and-tested-by: Julien Humbert <julroy67@gmail.com>
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/20201102145821.GA1478741@rowland.harvard.edu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -217,6 +217,9 @@ static const struct usb_device_id usb_qu
+       { USB_DEVICE(0x0926, 0x3333), .driver_info =
+                       USB_QUIRK_CONFIG_INTF_STRINGS },
++      /* Kingston DataTraveler 3.0 */
++      { USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM },
++
+       /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */
+       { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },
diff --git a/queue-4.14/usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch b/queue-4.14/usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch
new file mode 100644 (file)
index 0000000..53c77a6
--- /dev/null
@@ -0,0 +1,71 @@
+From 20914919ad31849ee2b9cfe0428f4a20335c9e2a Mon Sep 17 00:00:00 2001
+From: Macpaul Lin <macpaul.lin@mediatek.com>
+Date: Fri, 6 Nov 2020 13:54:29 +0800
+Subject: usb: mtu3: fix panic in mtu3_gadget_stop()
+
+From: Macpaul Lin <macpaul.lin@mediatek.com>
+
+commit 20914919ad31849ee2b9cfe0428f4a20335c9e2a upstream.
+
+This patch fixes a possible issue when mtu3_gadget_stop()
+already assigned NULL to mtu->gadget_driver during mtu_gadget_disconnect().
+
+[<ffffff9008161974>] notifier_call_chain+0xa4/0x128
+[<ffffff9008161fd4>] __atomic_notifier_call_chain+0x84/0x138
+[<ffffff9008162ec0>] notify_die+0xb0/0x120
+[<ffffff900809e340>] die+0x1f8/0x5d0
+[<ffffff90080d03b4>] __do_kernel_fault+0x19c/0x280
+[<ffffff90080d04dc>] do_bad_area+0x44/0x140
+[<ffffff90080d0f9c>] do_translation_fault+0x4c/0x90
+[<ffffff9008080a78>] do_mem_abort+0xb8/0x258
+[<ffffff90080849d0>] el1_da+0x24/0x3c
+[<ffffff9009bde01c>] mtu3_gadget_disconnect+0xac/0x128
+[<ffffff9009bd576c>] mtu3_irq+0x34c/0xc18
+[<ffffff90082ac03c>] __handle_irq_event_percpu+0x2ac/0xcd0
+[<ffffff90082acae0>] handle_irq_event_percpu+0x80/0x138
+[<ffffff90082acc44>] handle_irq_event+0xac/0x148
+[<ffffff90082b71cc>] handle_fasteoi_irq+0x234/0x568
+[<ffffff90082a8708>] generic_handle_irq+0x48/0x68
+[<ffffff90082a96ac>] __handle_domain_irq+0x264/0x1740
+[<ffffff90080819f4>] gic_handle_irq+0x14c/0x250
+[<ffffff9008084cec>] el1_irq+0xec/0x194
+[<ffffff90085b985c>] dma_pool_alloc+0x6e4/0xae0
+[<ffffff9008d7f890>] cmdq_mbox_pool_alloc_impl+0xb0/0x238
+[<ffffff9008d80904>] cmdq_pkt_alloc_buf+0x2dc/0x7c0
+[<ffffff9008d80f60>] cmdq_pkt_add_cmd_buffer+0x178/0x270
+[<ffffff9008d82320>] cmdq_pkt_perf_begin+0x108/0x148
+[<ffffff9008d824d8>] cmdq_pkt_create+0x178/0x1f0
+[<ffffff9008f96230>] mtk_crtc_config_default_path+0x328/0x7a0
+[<ffffff90090246cc>] mtk_drm_idlemgr_kick+0xa6c/0x1460
+[<ffffff9008f9bbb4>] mtk_drm_crtc_atomic_begin+0x1a4/0x1a68
+[<ffffff9008e8df9c>] drm_atomic_helper_commit_planes+0x154/0x878
+[<ffffff9008f2fb70>] mtk_atomic_complete.isra.16+0xe80/0x19c8
+[<ffffff9008f30910>] mtk_atomic_commit+0x258/0x898
+[<ffffff9008ef142c>] drm_atomic_commit+0xcc/0x108
+[<ffffff9008ef7cf0>] drm_mode_atomic_ioctl+0x1c20/0x2580
+[<ffffff9008ebc768>] drm_ioctl_kernel+0x118/0x1b0
+[<ffffff9008ebcde8>] drm_ioctl+0x5c0/0x920
+[<ffffff900863b030>] do_vfs_ioctl+0x188/0x1820
+[<ffffff900863c754>] SyS_ioctl+0x8c/0xa0
+
+Fixes: df2069acb005 ("usb: Add MediaTek USB3 DRD driver")
+Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
+Acked-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/1604642069-20961-1-git-send-email-macpaul.lin@mediatek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/mtu3/mtu3_gadget.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/mtu3/mtu3_gadget.c
++++ b/drivers/usb/mtu3/mtu3_gadget.c
+@@ -581,6 +581,7 @@ static int mtu3_gadget_stop(struct usb_g
+       spin_unlock_irqrestore(&mtu->lock, flags);
++      synchronize_irq(mtu->irq);
+       return 0;
+ }
diff --git a/queue-4.14/usb-serial-cyberjack-fix-write-urb-completion-race.patch b/queue-4.14/usb-serial-cyberjack-fix-write-urb-completion-race.patch
new file mode 100644 (file)
index 0000000..6b52de3
--- /dev/null
@@ -0,0 +1,57 @@
+From 985616f0457d9f555fff417d0da56174f70cc14f Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 26 Oct 2020 09:25:48 +0100
+Subject: USB: serial: cyberjack: fix write-URB completion race
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 985616f0457d9f555fff417d0da56174f70cc14f upstream.
+
+The write-URB busy flag was being cleared before the completion handler
+was done with the URB, something which could lead to corrupt transfers
+due to a racing write request if the URB is resubmitted.
+
+Fixes: 507ca9bc0476 ("[PATCH] USB: add ability for usb-serial drivers to determine if their write urb is currently being used.")
+Cc: stable <stable@vger.kernel.org>     # 2.6.13
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/cyberjack.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/cyberjack.c
++++ b/drivers/usb/serial/cyberjack.c
+@@ -358,11 +358,12 @@ static void cyberjack_write_bulk_callbac
+       struct cyberjack_private *priv = usb_get_serial_port_data(port);
+       struct device *dev = &port->dev;
+       int status = urb->status;
++      bool resubmitted = false;
+-      set_bit(0, &port->write_urbs_free);
+       if (status) {
+               dev_dbg(dev, "%s - nonzero write bulk status received: %d\n",
+                       __func__, status);
++              set_bit(0, &port->write_urbs_free);
+               return;
+       }
+@@ -395,6 +396,8 @@ static void cyberjack_write_bulk_callbac
+                       goto exit;
+               }
++              resubmitted = true;
++
+               dev_dbg(dev, "%s - priv->wrsent=%d\n", __func__, priv->wrsent);
+               dev_dbg(dev, "%s - priv->wrfilled=%d\n", __func__, priv->wrfilled);
+@@ -411,6 +414,8 @@ static void cyberjack_write_bulk_callbac
+ exit:
+       spin_unlock(&priv->lock);
++      if (!resubmitted)
++              set_bit(0, &port->write_urbs_free);
+       usb_serial_port_softint(port);
+ }
diff --git a/queue-4.14/usb-serial-option-add-le910cx-compositions-0x1203-0x1230-0x1231.patch b/queue-4.14/usb-serial-option-add-le910cx-compositions-0x1203-0x1230-0x1231.patch
new file mode 100644 (file)
index 0000000..fe6b0d6
--- /dev/null
@@ -0,0 +1,48 @@
+From 489979b4aab490b6b917c11dc02d81b4b742784a Mon Sep 17 00:00:00 2001
+From: Daniele Palmas <dnlplm@gmail.com>
+Date: Sat, 31 Oct 2020 23:54:58 +0100
+Subject: USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231
+
+From: Daniele Palmas <dnlplm@gmail.com>
+
+commit 489979b4aab490b6b917c11dc02d81b4b742784a upstream.
+
+Add following Telit LE910Cx compositions:
+
+0x1203: rndis, tty, adb, tty, tty, tty, tty
+0x1230: tty, adb, rmnet, audio, tty, tty, tty, tty
+0x1231: rndis, tty, adb, audio, tty, tty, tty, tty
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+Link: https://lore.kernel.org/r/20201031225458.10512-1-dnlplm@gmail.com
+[ johan: add comments after entries ]
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1206,6 +1206,8 @@ static const struct usb_device_id option
+         .driver_info = NCTRL(0) },
+       { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
+         .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
++      { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1203, 0xff),    /* Telit LE910Cx (RNDIS) */
++        .driver_info = NCTRL(2) | RSVD(3) },
+       { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
+         .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
+       { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+@@ -1220,6 +1222,10 @@ static const struct usb_device_id option
+       { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
+       { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
+         .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
++      { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1230, 0xff),    /* Telit LE910Cx (rmnet) */
++        .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
++      { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff),    /* Telit LE910Cx (RNDIS) */
++        .driver_info = NCTRL(2) | RSVD(3) },
+       { USB_DEVICE(TELIT_VENDOR_ID, 0x1260),
+         .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+       { USB_DEVICE(TELIT_VENDOR_ID, 0x1261),
diff --git a/queue-4.14/usb-serial-option-add-quectel-ec200t-module-support.patch b/queue-4.14/usb-serial-option-add-quectel-ec200t-module-support.patch
new file mode 100644 (file)
index 0000000..88e7422
--- /dev/null
@@ -0,0 +1,39 @@
+From a46b973bced1ba57420752bf38426acd9f6cbfa6 Mon Sep 17 00:00:00 2001
+From: Ziyi Cao <kernel@septs.pw>
+Date: Tue, 20 Oct 2020 00:08:06 +0800
+Subject: USB: serial: option: add Quectel EC200T module support
+
+From: Ziyi Cao <kernel@septs.pw>
+
+commit a46b973bced1ba57420752bf38426acd9f6cbfa6 upstream.
+
+Add usb product id of the Quectel EC200T module.
+
+Signed-off-by: Ziyi Cao <kernel@septs.pw>
+Link: https://lore.kernel.org/r/17f8a2a3-ce0f-4be7-8544-8fdf286907d0@www.fastmail.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -253,6 +253,7 @@ static void option_instat_callback(struc
+ #define QUECTEL_PRODUCT_EP06                  0x0306
+ #define QUECTEL_PRODUCT_EM12                  0x0512
+ #define QUECTEL_PRODUCT_RM500Q                        0x0800
++#define QUECTEL_PRODUCT_EC200T                        0x6026
+ #define CMOTECH_VENDOR_ID                     0x16d8
+ #define CMOTECH_PRODUCT_6001                  0x6001
+@@ -1120,6 +1121,7 @@ static const struct usb_device_id option
+       { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) },
+       { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10),
+         .driver_info = ZLP },
++      { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) },
+       { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
+       { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
diff --git a/queue-4.14/usb-serial-option-add-telit-fn980-composition-0x1055.patch b/queue-4.14/usb-serial-option-add-telit-fn980-composition-0x1055.patch
new file mode 100644 (file)
index 0000000..746ebfe
--- /dev/null
@@ -0,0 +1,34 @@
+From db0362eeb22992502764e825c79b922d7467e0eb Mon Sep 17 00:00:00 2001
+From: Daniele Palmas <dnlplm@gmail.com>
+Date: Tue, 3 Nov 2020 13:44:25 +0100
+Subject: USB: serial: option: add Telit FN980 composition 0x1055
+
+From: Daniele Palmas <dnlplm@gmail.com>
+
+commit db0362eeb22992502764e825c79b922d7467e0eb upstream.
+
+Add the following Telit FN980 composition:
+
+0x1055: tty, adb, tty, tty, tty, tty
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+Link: https://lore.kernel.org/r/20201103124425.12940-1-dnlplm@gmail.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1194,6 +1194,8 @@ static const struct usb_device_id option
+         .driver_info = NCTRL(0) | RSVD(1) },
+       { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1054, 0xff),    /* Telit FT980-KS */
+         .driver_info = NCTRL(2) | RSVD(3) },
++      { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1055, 0xff),    /* Telit FN980 (PCIe) */
++        .driver_info = NCTRL(0) | RSVD(1) },
+       { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+         .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
+       { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),