From: Greg Kroah-Hartman Date: Tue, 31 Mar 2020 07:59:52 +0000 (+0200) Subject: 5.5-stable patches X-Git-Tag: v5.6.1~14 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=152982dc934d3d934f8b29677538a1eb27bfe250;p=thirdparty%2Fkernel%2Fstable-queue.git 5.5-stable patches added patches: media-flexcop-usb-fix-endpoint-sanity-check.patch media-usbtv-fix-control-message-timeouts.patch staging-kpc2000-prevent-underflow-in-cpld_reconfigure.patch staging-rtl8188eu-add-asus-usb-n10-nano-b1-to-device-table.patch staging-wfx-add-proper-compatible-string.patch staging-wfx-annotate-nested-gc_list-vs-tx-queue-locking.patch staging-wfx-fix-init-remove-vs-irq-race.patch staging-wlan-ng-fix-odebug-bug-in-prism2sta_disconnect_usb.patch staging-wlan-ng-fix-use-after-free-read-in-hfa384x_usbin_callback.patch usb-cdc-acm-restore-capability-check-order.patch usb-musb-fix-crash-with-highmen-pio-and-usbmon.patch usb-serial-io_edgeport-fix-slab-out-of-bounds-read-in-edge_interrupt_callback.patch usb-serial-option-add-broadmobi-bm806u.patch usb-serial-option-add-support-for-askey-wwhc050.patch usb-serial-option-add-wistron-neweb-d19q1.patch --- diff --git a/queue-5.5/media-flexcop-usb-fix-endpoint-sanity-check.patch b/queue-5.5/media-flexcop-usb-fix-endpoint-sanity-check.patch new file mode 100644 index 00000000000..814436b67cb --- /dev/null +++ b/queue-5.5/media-flexcop-usb-fix-endpoint-sanity-check.patch @@ -0,0 +1,50 @@ +From bca243b1ce0e46be26f7c63b5591dfbb41f558e5 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 3 Jan 2020 17:35:08 +0100 +Subject: media: flexcop-usb: fix endpoint sanity check + +From: Johan Hovold + +commit bca243b1ce0e46be26f7c63b5591dfbb41f558e5 upstream. + +commit 1b976fc6d684 ("media: b2c2-flexcop-usb: add sanity checking") added +an endpoint sanity check to address a NULL-pointer dereference on probe. +Unfortunately the check was done on the current altsetting which was later +changed. + +Fix this by moving the sanity check to after the altsetting is changed. + +Fixes: 1b976fc6d684 ("media: b2c2-flexcop-usb: add sanity checking") +Cc: Oliver Neukum +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/b2c2/flexcop-usb.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/media/usb/b2c2/flexcop-usb.c ++++ b/drivers/media/usb/b2c2/flexcop-usb.c +@@ -511,6 +511,9 @@ static int flexcop_usb_init(struct flexc + return ret; + } + ++ if (fc_usb->uintf->cur_altsetting->desc.bNumEndpoints < 1) ++ return -ENODEV; ++ + switch (fc_usb->udev->speed) { + case USB_SPEED_LOW: + err("cannot handle USB speed because it is too slow."); +@@ -544,9 +547,6 @@ static int flexcop_usb_probe(struct usb_ + struct flexcop_device *fc = NULL; + int ret; + +- if (intf->cur_altsetting->desc.bNumEndpoints < 1) +- return -ENODEV; +- + if ((fc = flexcop_device_kmalloc(sizeof(struct flexcop_usb))) == NULL) { + err("out of memory\n"); + return -ENOMEM; diff --git a/queue-5.5/media-usbtv-fix-control-message-timeouts.patch b/queue-5.5/media-usbtv-fix-control-message-timeouts.patch new file mode 100644 index 00000000000..d9100aba2d3 --- /dev/null +++ b/queue-5.5/media-usbtv-fix-control-message-timeouts.patch @@ -0,0 +1,64 @@ +From 536f561d871c5781bc33d26d415685211b94032e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 13 Jan 2020 18:18:18 +0100 +Subject: media: usbtv: fix control-message timeouts + +From: Johan Hovold + +commit 536f561d871c5781bc33d26d415685211b94032e upstream. + +The driver was issuing synchronous uninterruptible control requests +without using a timeout. This could lead to the driver hanging on +various user requests due to a malfunctioning (or malicious) device +until the device is physically disconnected. + +The USB upper limit of five seconds per request should be more than +enough. + +Fixes: f3d27f34fdd7 ("[media] usbtv: Add driver for Fushicai USBTV007 video frame grabber") +Fixes: c53a846c48f2 ("[media] usbtv: add video controls") +Cc: stable # 3.11 +Signed-off-by: Johan Hovold +Acked-by: Lubomir Rintel +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/usb/usbtv/usbtv-core.c | 2 +- + drivers/media/usb/usbtv/usbtv-video.c | 5 +++-- + 2 files changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/media/usb/usbtv/usbtv-core.c ++++ b/drivers/media/usb/usbtv/usbtv-core.c +@@ -56,7 +56,7 @@ int usbtv_set_regs(struct usbtv *usbtv, + + ret = usb_control_msg(usbtv->udev, pipe, USBTV_REQUEST_REG, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- value, index, NULL, 0, 0); ++ value, index, NULL, 0, USB_CTRL_GET_TIMEOUT); + if (ret < 0) + return ret; + } +--- a/drivers/media/usb/usbtv/usbtv-video.c ++++ b/drivers/media/usb/usbtv/usbtv-video.c +@@ -800,7 +800,8 @@ static int usbtv_s_ctrl(struct v4l2_ctrl + ret = usb_control_msg(usbtv->udev, + usb_rcvctrlpipe(usbtv->udev, 0), USBTV_CONTROL_REG, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- 0, USBTV_BASE + 0x0244, (void *)data, 3, 0); ++ 0, USBTV_BASE + 0x0244, (void *)data, 3, ++ USB_CTRL_GET_TIMEOUT); + if (ret < 0) + goto error; + } +@@ -851,7 +852,7 @@ static int usbtv_s_ctrl(struct v4l2_ctrl + ret = usb_control_msg(usbtv->udev, usb_sndctrlpipe(usbtv->udev, 0), + USBTV_CONTROL_REG, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- 0, index, (void *)data, size, 0); ++ 0, index, (void *)data, size, USB_CTRL_SET_TIMEOUT); + + error: + if (ret < 0) diff --git a/queue-5.5/series b/queue-5.5/series index 30a267bfe2a..1b12513d171 100644 --- a/queue-5.5/series +++ b/queue-5.5/series @@ -146,3 +146,18 @@ vti6-fix-memory-leak-of-skb-if-input-policy-check-fails.patch r8169-fix-phy-driver-check-on-platforms-w-o-module-softdeps.patch clocksource-drivers-hyper-v-untangle-stimers-and-tim.patch bpf-undo-incorrect-__reg_bound_offset32-handling.patch +usb-serial-option-add-support-for-askey-wwhc050.patch +usb-serial-option-add-broadmobi-bm806u.patch +usb-serial-option-add-wistron-neweb-d19q1.patch +usb-cdc-acm-restore-capability-check-order.patch +usb-serial-io_edgeport-fix-slab-out-of-bounds-read-in-edge_interrupt_callback.patch +usb-musb-fix-crash-with-highmen-pio-and-usbmon.patch +media-flexcop-usb-fix-endpoint-sanity-check.patch +media-usbtv-fix-control-message-timeouts.patch +staging-kpc2000-prevent-underflow-in-cpld_reconfigure.patch +staging-rtl8188eu-add-asus-usb-n10-nano-b1-to-device-table.patch +staging-wlan-ng-fix-odebug-bug-in-prism2sta_disconnect_usb.patch +staging-wlan-ng-fix-use-after-free-read-in-hfa384x_usbin_callback.patch +staging-wfx-add-proper-compatible-string.patch +staging-wfx-fix-init-remove-vs-irq-race.patch +staging-wfx-annotate-nested-gc_list-vs-tx-queue-locking.patch diff --git a/queue-5.5/staging-kpc2000-prevent-underflow-in-cpld_reconfigure.patch b/queue-5.5/staging-kpc2000-prevent-underflow-in-cpld_reconfigure.patch new file mode 100644 index 00000000000..568bf1f21b4 --- /dev/null +++ b/queue-5.5/staging-kpc2000-prevent-underflow-in-cpld_reconfigure.patch @@ -0,0 +1,38 @@ +From 72db61d7d17a475d3cc9de1a7c871d518fcd82f0 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 24 Feb 2020 13:33:25 +0300 +Subject: staging: kpc2000: prevent underflow in cpld_reconfigure() + +From: Dan Carpenter + +commit 72db61d7d17a475d3cc9de1a7c871d518fcd82f0 upstream. + +This function should not allow negative values of "wr_val". If +negatives are allowed then capping the upper bound at 7 is +meaningless. Let's make it unsigned. + +Fixes: 7dc7967fc39a ("staging: kpc2000: add initial set of Daktronics drivers") +Signed-off-by: Dan Carpenter +Cc: stable +Link: https://lore.kernel.org/r/20200224103325.hrxdnaeqsthplu42@kili.mountain +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/kpc2000/kpc2000/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/staging/kpc2000/kpc2000/core.c ++++ b/drivers/staging/kpc2000/kpc2000/core.c +@@ -110,10 +110,10 @@ static ssize_t cpld_reconfigure(struct d + const char *buf, size_t count) + { + struct kp2000_device *pcard = dev_get_drvdata(dev); +- long wr_val; ++ unsigned long wr_val; + int rv; + +- rv = kstrtol(buf, 0, &wr_val); ++ rv = kstrtoul(buf, 0, &wr_val); + if (rv < 0) + return rv; + if (wr_val > 7) diff --git a/queue-5.5/staging-rtl8188eu-add-asus-usb-n10-nano-b1-to-device-table.patch b/queue-5.5/staging-rtl8188eu-add-asus-usb-n10-nano-b1-to-device-table.patch new file mode 100644 index 00000000000..3e4721c04f2 --- /dev/null +++ b/queue-5.5/staging-rtl8188eu-add-asus-usb-n10-nano-b1-to-device-table.patch @@ -0,0 +1,32 @@ +From 38ef48f7d4b7342f145a1b4f96023bde99aeb245 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Sat, 21 Mar 2020 13:00:11 -0500 +Subject: staging: rtl8188eu: Add ASUS USB-N10 Nano B1 to device table + +From: Larry Finger + +commit 38ef48f7d4b7342f145a1b4f96023bde99aeb245 upstream. + +The ASUS USB-N10 Nano B1 has been reported as a new RTL8188EU device. +Add it to the device tables. + +Signed-off-by: Larry Finger +Reported-by: kovi +Cc: Stable +Link: https://lore.kernel.org/r/20200321180011.26153-1-Larry.Finger@lwfinger.net +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c ++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +@@ -32,6 +32,7 @@ static const struct usb_device_id rtw_us + /****** 8188EUS ********/ + {USB_DEVICE(0x056e, 0x4008)}, /* Elecom WDC-150SU2M */ + {USB_DEVICE(0x07b8, 0x8179)}, /* Abocom - Abocom */ ++ {USB_DEVICE(0x0B05, 0x18F0)}, /* ASUS USB-N10 Nano B1 */ + {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */ + {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */ + {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */ diff --git a/queue-5.5/staging-wfx-add-proper-compatible-string.patch b/queue-5.5/staging-wfx-add-proper-compatible-string.patch new file mode 100644 index 00000000000..c346d115d16 --- /dev/null +++ b/queue-5.5/staging-wfx-add-proper-compatible-string.patch @@ -0,0 +1,106 @@ +From eec6e3ee636ec3adaa85ebe4b4acaacfcf06277e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= +Date: Tue, 11 Feb 2020 11:35:02 +0100 +Subject: staging: wfx: add proper "compatible" string +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Mirosław + +commit eec6e3ee636ec3adaa85ebe4b4acaacfcf06277e upstream. + +Add "compatible" string matching "vendor,chip" template and proper +GPIO flags handling. Keep support for old name and reset polarity +for older devicetrees. + +Cc: stable@vger.kernel.org # d3a5bcb4a17f ("gpio: add gpiod_toggle_active_low()") +Cc: stable@vger.kernel.org +Fixes: 0096214a59a7 ("staging: wfx: add support for I/O access") +Signed-off-by: Michał Mirosław +Link: https://lore.kernel.org/r/0e6dda06f145676861860f073a53dc95987c7ab5.1581416843.git.mirq-linux@rere.qmqm.pl +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/wfx/Documentation/devicetree/bindings/net/wireless/siliabs,wfx.txt | 7 ++--- + drivers/staging/wfx/bus_spi.c | 14 +++++++--- + 2 files changed, 14 insertions(+), 7 deletions(-) + +--- a/drivers/staging/wfx/Documentation/devicetree/bindings/net/wireless/siliabs,wfx.txt ++++ b/drivers/staging/wfx/Documentation/devicetree/bindings/net/wireless/siliabs,wfx.txt +@@ -6,7 +6,7 @@ SPI + You have to declare the WFxxx chip in your device tree. + + Required properties: +- - compatible: Should be "silabs,wfx-spi" ++ - compatible: Should be "silabs,wf200" + - reg: Chip select address of device + - spi-max-frequency: Maximum SPI clocking speed of device in Hz + - interrupts-extended: Should contain interrupt line (interrupt-parent + +@@ -15,6 +15,7 @@ Required properties: + Optional properties: + - reset-gpios: phandle of gpio that will be used to reset chip during probe. + Without this property, you may encounter issues with warm boot. ++ (Legacy: when compatible == "silabs,wfx-spi", the gpio is inverted.) + + Please consult Documentation/devicetree/bindings/spi/spi-bus.txt for optional + SPI connection related properties, +@@ -23,12 +24,12 @@ Example: + + &spi1 { + wfx { +- compatible = "silabs,wfx-spi"; ++ compatible = "silabs,wf200"; + pinctrl-names = "default"; + pinctrl-0 = <&wfx_irq &wfx_gpios>; + interrupts-extended = <&gpio 16 IRQ_TYPE_EDGE_RISING>; + wakeup-gpios = <&gpio 12 GPIO_ACTIVE_HIGH>; +- reset-gpios = <&gpio 13 GPIO_ACTIVE_HIGH>; ++ reset-gpios = <&gpio 13 GPIO_ACTIVE_LOW>; + reg = <0>; + spi-max-frequency = <42000000>; + }; +--- a/drivers/staging/wfx/bus_spi.c ++++ b/drivers/staging/wfx/bus_spi.c +@@ -27,6 +27,8 @@ MODULE_PARM_DESC(gpio_reset, "gpio numbe + #define SET_WRITE 0x7FFF /* usage: and operation */ + #define SET_READ 0x8000 /* usage: or operation */ + ++#define WFX_RESET_INVERTED 1 ++ + static const struct wfx_platform_data wfx_spi_pdata = { + .file_fw = "wfm_wf200", + .file_pds = "wf200.pds", +@@ -199,9 +201,11 @@ static int wfx_spi_probe(struct spi_devi + if (!bus->gpio_reset) { + dev_warn(&func->dev, "try to load firmware anyway\n"); + } else { +- gpiod_set_value(bus->gpio_reset, 0); +- udelay(100); ++ if (spi_get_device_id(func)->driver_data & WFX_RESET_INVERTED) ++ gpiod_toggle_active_low(bus->gpio_reset); + gpiod_set_value(bus->gpio_reset, 1); ++ udelay(100); ++ gpiod_set_value(bus->gpio_reset, 0); + udelay(2000); + } + +@@ -243,14 +247,16 @@ static int wfx_spi_disconnect(struct spi + * stripped. + */ + static const struct spi_device_id wfx_spi_id[] = { +- { "wfx-spi", 0 }, ++ { "wfx-spi", WFX_RESET_INVERTED }, ++ { "wf200", 0 }, + { }, + }; + MODULE_DEVICE_TABLE(spi, wfx_spi_id); + + #ifdef CONFIG_OF + static const struct of_device_id wfx_spi_of_match[] = { +- { .compatible = "silabs,wfx-spi" }, ++ { .compatible = "silabs,wfx-spi", .data = (void *)WFX_RESET_INVERTED }, ++ { .compatible = "silabs,wf200" }, + { }, + }; + MODULE_DEVICE_TABLE(of, wfx_spi_of_match); diff --git a/queue-5.5/staging-wfx-annotate-nested-gc_list-vs-tx-queue-locking.patch b/queue-5.5/staging-wfx-annotate-nested-gc_list-vs-tx-queue-locking.patch new file mode 100644 index 00000000000..da9bf2a8999 --- /dev/null +++ b/queue-5.5/staging-wfx-annotate-nested-gc_list-vs-tx-queue-locking.patch @@ -0,0 +1,97 @@ +From e2525a95cc0887c7dc0549cb5d0ac3e796e1d54c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= +Date: Tue, 11 Feb 2020 11:35:01 +0100 +Subject: staging: wfx: annotate nested gc_list vs tx queue locking +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Mirosław + +commit e2525a95cc0887c7dc0549cb5d0ac3e796e1d54c upstream. + +Lockdep is complaining about recursive locking, because it can't make +a difference between locked skb_queues. Annotate nested locks and avoid +double bh_disable/enable. + +[...] +insmod/815 is trying to acquire lock: +cb7d6418 (&(&list->lock)->rlock){+...}, at: wfx_tx_queues_clear+0xfc/0x198 [wfx] + +but task is already holding lock: +cb7d61f4 (&(&list->lock)->rlock){+...}, at: wfx_tx_queues_clear+0xa0/0x198 [wfx] + +[...] +Possible unsafe locking scenario: + + CPU0 + ---- + lock(&(&list->lock)->rlock); + lock(&(&list->lock)->rlock); + +Cc: stable@vger.kernel.org +Fixes: 9bca45f3d692 ("staging: wfx: allow to send 802.11 frames") +Signed-off-by: Michał Mirosław +Link: https://lore.kernel.org/r/5e30397af95854b4a7deea073b730c00229f42ba.1581416843.git.mirq-linux@rere.qmqm.pl +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/wfx/queue.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/staging/wfx/queue.c ++++ b/drivers/staging/wfx/queue.c +@@ -132,12 +132,12 @@ static void wfx_tx_queue_clear(struct wf + spin_lock_bh(&queue->queue.lock); + while ((item = __skb_dequeue(&queue->queue)) != NULL) + skb_queue_head(gc_list, item); +- spin_lock_bh(&stats->pending.lock); ++ spin_lock_nested(&stats->pending.lock, 1); + for (i = 0; i < ARRAY_SIZE(stats->link_map_cache); ++i) { + stats->link_map_cache[i] -= queue->link_map_cache[i]; + queue->link_map_cache[i] = 0; + } +- spin_unlock_bh(&stats->pending.lock); ++ spin_unlock(&stats->pending.lock); + spin_unlock_bh(&queue->queue.lock); + } + +@@ -213,9 +213,9 @@ void wfx_tx_queue_put(struct wfx_dev *wd + + ++queue->link_map_cache[tx_priv->link_id]; + +- spin_lock_bh(&stats->pending.lock); ++ spin_lock_nested(&stats->pending.lock, 1); + ++stats->link_map_cache[tx_priv->link_id]; +- spin_unlock_bh(&stats->pending.lock); ++ spin_unlock(&stats->pending.lock); + spin_unlock_bh(&queue->queue.lock); + } + +@@ -244,11 +244,11 @@ static struct sk_buff *wfx_tx_queue_get( + __skb_unlink(skb, &queue->queue); + --queue->link_map_cache[tx_priv->link_id]; + +- spin_lock_bh(&stats->pending.lock); ++ spin_lock_nested(&stats->pending.lock, 1); + __skb_queue_tail(&stats->pending, skb); + if (!--stats->link_map_cache[tx_priv->link_id]) + wakeup_stats = true; +- spin_unlock_bh(&stats->pending.lock); ++ spin_unlock(&stats->pending.lock); + } + spin_unlock_bh(&queue->queue.lock); + if (wakeup_stats) +@@ -266,10 +266,10 @@ int wfx_pending_requeue(struct wfx_dev * + spin_lock_bh(&queue->queue.lock); + ++queue->link_map_cache[tx_priv->link_id]; + +- spin_lock_bh(&stats->pending.lock); ++ spin_lock_nested(&stats->pending.lock, 1); + ++stats->link_map_cache[tx_priv->link_id]; + __skb_unlink(skb, &stats->pending); +- spin_unlock_bh(&stats->pending.lock); ++ spin_unlock(&stats->pending.lock); + __skb_queue_tail(&queue->queue, skb); + spin_unlock_bh(&queue->queue.lock); + return 0; diff --git a/queue-5.5/staging-wfx-fix-init-remove-vs-irq-race.patch b/queue-5.5/staging-wfx-fix-init-remove-vs-irq-race.patch new file mode 100644 index 00000000000..443a3ceb1da --- /dev/null +++ b/queue-5.5/staging-wfx-fix-init-remove-vs-irq-race.patch @@ -0,0 +1,181 @@ +From 4033714d6cbe04893aa0708d1fcaa45dd8eb3f53 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= +Date: Tue, 11 Feb 2020 11:35:01 +0100 +Subject: staging: wfx: fix init/remove vs IRQ race +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Mirosław + +commit 4033714d6cbe04893aa0708d1fcaa45dd8eb3f53 upstream. + +Current code races in init/exit with interrupt handlers. This is noticed +by the warning below. Fix it by using devres for ordering allocations and +IRQ de/registration. + +WARNING: CPU: 0 PID: 827 at drivers/staging/wfx/bus_spi.c:142 wfx_spi_irq_handler+0x5c/0x64 [wfx] +race condition in driver init/deinit + +Cc: stable@vger.kernel.org +Fixes: 0096214a59a7 ("staging: wfx: add support for I/O access") +Signed-off-by: Michał Mirosław +Reviewed-by: Jérôme Pouiller +Link: https://lore.kernel.org/r/f0c66cbb3110c2736cd4357c753fba8c14ee3aee.1581416843.git.mirq-linux@rere.qmqm.pl +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/wfx/bus_sdio.c | 15 ++++++--------- + drivers/staging/wfx/bus_spi.c | 27 ++++++++++++++------------- + drivers/staging/wfx/main.c | 21 +++++++++++++-------- + drivers/staging/wfx/main.h | 1 - + 4 files changed, 33 insertions(+), 31 deletions(-) + +--- a/drivers/staging/wfx/bus_sdio.c ++++ b/drivers/staging/wfx/bus_sdio.c +@@ -200,25 +200,23 @@ static int wfx_sdio_probe(struct sdio_fu + if (ret) + goto err0; + +- ret = wfx_sdio_irq_subscribe(bus); +- if (ret) +- goto err1; +- + bus->core = wfx_init_common(&func->dev, &wfx_sdio_pdata, + &wfx_sdio_hwbus_ops, bus); + if (!bus->core) { + ret = -EIO; +- goto err2; ++ goto err1; + } + ++ ret = wfx_sdio_irq_subscribe(bus); ++ if (ret) ++ goto err1; ++ + ret = wfx_probe(bus->core); + if (ret) +- goto err3; ++ goto err2; + + return 0; + +-err3: +- wfx_free_common(bus->core); + err2: + wfx_sdio_irq_unsubscribe(bus); + err1: +@@ -234,7 +232,6 @@ static void wfx_sdio_remove(struct sdio_ + struct wfx_sdio_priv *bus = sdio_get_drvdata(func); + + wfx_release(bus->core); +- wfx_free_common(bus->core); + wfx_sdio_irq_unsubscribe(bus); + sdio_claim_host(func); + sdio_disable_func(func); +--- a/drivers/staging/wfx/bus_spi.c ++++ b/drivers/staging/wfx/bus_spi.c +@@ -154,6 +154,11 @@ static void wfx_spi_request_rx(struct wo + wfx_bh_request_rx(bus->core); + } + ++static void wfx_flush_irq_work(void *w) ++{ ++ flush_work(w); ++} ++ + static size_t wfx_spi_align_size(void *priv, size_t size) + { + // Most of SPI controllers avoid DMA if buffer size is not 32bit aligned +@@ -209,22 +214,23 @@ static int wfx_spi_probe(struct spi_devi + udelay(2000); + } + +- ret = devm_request_irq(&func->dev, func->irq, wfx_spi_irq_handler, +- IRQF_TRIGGER_RISING, "wfx", bus); +- if (ret) +- return ret; +- + INIT_WORK(&bus->request_rx, wfx_spi_request_rx); + bus->core = wfx_init_common(&func->dev, &wfx_spi_pdata, + &wfx_spi_hwbus_ops, bus); + if (!bus->core) + return -EIO; + +- ret = wfx_probe(bus->core); ++ ret = devm_add_action_or_reset(&func->dev, wfx_flush_irq_work, ++ &bus->request_rx); + if (ret) +- wfx_free_common(bus->core); ++ return ret; ++ ++ ret = devm_request_irq(&func->dev, func->irq, wfx_spi_irq_handler, ++ IRQF_TRIGGER_RISING, "wfx", bus); ++ if (ret) ++ return ret; + +- return ret; ++ return wfx_probe(bus->core); + } + + /* Disconnect Function to be called by SPI stack when device is disconnected */ +@@ -233,11 +239,6 @@ static int wfx_spi_disconnect(struct spi + struct wfx_spi_priv *bus = spi_get_drvdata(func); + + wfx_release(bus->core); +- wfx_free_common(bus->core); +- // A few IRQ will be sent during device release. Hopefully, no IRQ +- // should happen after wdev/wvif are released. +- devm_free_irq(&func->dev, func->irq, bus); +- flush_work(&bus->request_rx); + return 0; + } + +--- a/drivers/staging/wfx/main.c ++++ b/drivers/staging/wfx/main.c +@@ -261,6 +261,16 @@ static int wfx_send_pdata_pds(struct wfx + return ret; + } + ++static void wfx_free_common(void *data) ++{ ++ struct wfx_dev *wdev = data; ++ ++ mutex_destroy(&wdev->rx_stats_lock); ++ mutex_destroy(&wdev->conf_mutex); ++ wfx_tx_queues_deinit(wdev); ++ ieee80211_free_hw(wdev->hw); ++} ++ + struct wfx_dev *wfx_init_common(struct device *dev, + const struct wfx_platform_data *pdata, + const struct hwbus_ops *hwbus_ops, +@@ -326,15 +336,10 @@ struct wfx_dev *wfx_init_common(struct d + wfx_init_hif_cmd(&wdev->hif_cmd); + wfx_tx_queues_init(wdev); + +- return wdev; +-} ++ if (devm_add_action_or_reset(dev, wfx_free_common, wdev)) ++ return NULL; + +-void wfx_free_common(struct wfx_dev *wdev) +-{ +- mutex_destroy(&wdev->rx_stats_lock); +- mutex_destroy(&wdev->conf_mutex); +- wfx_tx_queues_deinit(wdev); +- ieee80211_free_hw(wdev->hw); ++ return wdev; + } + + int wfx_probe(struct wfx_dev *wdev) +--- a/drivers/staging/wfx/main.h ++++ b/drivers/staging/wfx/main.h +@@ -34,7 +34,6 @@ struct wfx_dev *wfx_init_common(struct d + const struct wfx_platform_data *pdata, + const struct hwbus_ops *hwbus_ops, + void *hwbus_priv); +-void wfx_free_common(struct wfx_dev *wdev); + + int wfx_probe(struct wfx_dev *wdev); + void wfx_release(struct wfx_dev *wdev); diff --git a/queue-5.5/staging-wlan-ng-fix-odebug-bug-in-prism2sta_disconnect_usb.patch b/queue-5.5/staging-wlan-ng-fix-odebug-bug-in-prism2sta_disconnect_usb.patch new file mode 100644 index 00000000000..3048ad9a935 --- /dev/null +++ b/queue-5.5/staging-wlan-ng-fix-odebug-bug-in-prism2sta_disconnect_usb.patch @@ -0,0 +1,31 @@ +From a1f165a6b738f0c9d744bad4af7a53909278f5fc Mon Sep 17 00:00:00 2001 +From: Qiujun Huang +Date: Wed, 25 Mar 2020 15:06:46 +0800 +Subject: staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb + +From: Qiujun Huang + +commit a1f165a6b738f0c9d744bad4af7a53909278f5fc upstream. + +We should cancel hw->usb_work before kfree(hw). + +Reported-by: syzbot+6d2e7f6fa90e27be9d62@syzkaller.appspotmail.com +Signed-off-by: Qiujun Huang +Cc: stable +Link: https://lore.kernel.org/r/1585120006-30042-1-git-send-email-hqjagain@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/wlan-ng/prism2usb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/wlan-ng/prism2usb.c ++++ b/drivers/staging/wlan-ng/prism2usb.c +@@ -180,6 +180,7 @@ static void prism2sta_disconnect_usb(str + + cancel_work_sync(&hw->link_bh); + cancel_work_sync(&hw->commsqual_bh); ++ cancel_work_sync(&hw->usb_work); + + /* Now we complete any outstanding commands + * and tell everyone who is waiting for their diff --git a/queue-5.5/staging-wlan-ng-fix-use-after-free-read-in-hfa384x_usbin_callback.patch b/queue-5.5/staging-wlan-ng-fix-use-after-free-read-in-hfa384x_usbin_callback.patch new file mode 100644 index 00000000000..5de8a5ce219 --- /dev/null +++ b/queue-5.5/staging-wlan-ng-fix-use-after-free-read-in-hfa384x_usbin_callback.patch @@ -0,0 +1,35 @@ +From 1165dd73e811a07d947aee218510571f516081f6 Mon Sep 17 00:00:00 2001 +From: Qiujun Huang +Date: Thu, 26 Mar 2020 21:18:50 +0800 +Subject: staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback + +From: Qiujun Huang + +commit 1165dd73e811a07d947aee218510571f516081f6 upstream. + +We can't handle the case length > WLAN_DATA_MAXLEN. +Because the size of rxfrm->data is WLAN_DATA_MAXLEN(2312), and we can't +read more than that. + +Thanks-to: Hillf Danton +Reported-and-tested-by: syzbot+7d42d68643a35f71ac8a@syzkaller.appspotmail.com +Signed-off-by: Qiujun Huang +Cc: stable +Link: https://lore.kernel.org/r/20200326131850.17711-1-hqjagain@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/wlan-ng/hfa384x_usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/staging/wlan-ng/hfa384x_usb.c ++++ b/drivers/staging/wlan-ng/hfa384x_usb.c +@@ -3372,6 +3372,8 @@ static void hfa384x_int_rxmonitor(struct + WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) { + pr_debug("overlen frm: len=%zd\n", + skblen - sizeof(struct p80211_caphdr)); ++ ++ return; + } + + skb = dev_alloc_skb(skblen); diff --git a/queue-5.5/usb-cdc-acm-restore-capability-check-order.patch b/queue-5.5/usb-cdc-acm-restore-capability-check-order.patch new file mode 100644 index 00000000000..841bdb13994 --- /dev/null +++ b/queue-5.5/usb-cdc-acm-restore-capability-check-order.patch @@ -0,0 +1,56 @@ +From 62d65bdd9d05158aa2547f8ef72375535f3bc6e3 Mon Sep 17 00:00:00 2001 +From: Matthias Reichl +Date: Fri, 27 Mar 2020 16:03:50 +0100 +Subject: USB: cdc-acm: restore capability check order + +From: Matthias Reichl + +commit 62d65bdd9d05158aa2547f8ef72375535f3bc6e3 upstream. + +commit b401f8c4f492c ("USB: cdc-acm: fix rounding error in TIOCSSERIAL") +introduced a regression by changing the order of capability and close +settings change checks. When running with CAP_SYS_ADMIN setting the +close settings to the values already set resulted in -EOPNOTSUPP. + +Fix this by changing the check order back to how it was before. + +Fixes: b401f8c4f492c ("USB: cdc-acm: fix rounding error in TIOCSSERIAL") +Cc: Anthony Mallet +Cc: stable +Cc: Oliver Neukum +Signed-off-by: Matthias Reichl +Link: https://lore.kernel.org/r/20200327150350.3657-1-hias@horus.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -923,16 +923,16 @@ static int set_serial_info(struct tty_st + + mutex_lock(&acm->port.mutex); + +- if ((ss->close_delay != old_close_delay) || +- (ss->closing_wait != old_closing_wait)) { +- if (!capable(CAP_SYS_ADMIN)) ++ if (!capable(CAP_SYS_ADMIN)) { ++ if ((ss->close_delay != old_close_delay) || ++ (ss->closing_wait != old_closing_wait)) + retval = -EPERM; +- else { +- acm->port.close_delay = close_delay; +- acm->port.closing_wait = closing_wait; +- } +- } else +- retval = -EOPNOTSUPP; ++ else ++ retval = -EOPNOTSUPP; ++ } else { ++ acm->port.close_delay = close_delay; ++ acm->port.closing_wait = closing_wait; ++ } + + mutex_unlock(&acm->port.mutex); + return retval; diff --git a/queue-5.5/usb-musb-fix-crash-with-highmen-pio-and-usbmon.patch b/queue-5.5/usb-musb-fix-crash-with-highmen-pio-and-usbmon.patch new file mode 100644 index 00000000000..2dbb247f196 --- /dev/null +++ b/queue-5.5/usb-musb-fix-crash-with-highmen-pio-and-usbmon.patch @@ -0,0 +1,79 @@ +From 52974d94a206ce428d9d9b6eaa208238024be82a Mon Sep 17 00:00:00 2001 +From: Mans Rullgard +Date: Mon, 16 Mar 2020 16:11:35 -0500 +Subject: usb: musb: fix crash with highmen PIO and usbmon + +From: Mans Rullgard + +commit 52974d94a206ce428d9d9b6eaa208238024be82a upstream. + +When handling a PIO bulk transfer with highmem buffer, a temporary +mapping is assigned to urb->transfer_buffer. After the transfer is +complete, an invalid address is left behind in this pointer. This is +not ordinarily a problem since nothing touches that buffer before the +urb is released. However, when usbmon is active, usbmon_urb_complete() +calls (indirectly) mon_bin_get_data() which does access the transfer +buffer if it is set. To prevent an invalid memory access here, reset +urb->transfer_buffer to NULL when finished (musb_host_rx()), or do not +set it at all (musb_host_tx()). + +Fixes: 8e8a55165469 ("usb: musb: host: Handle highmem in PIO mode") +Signed-off-by: Mans Rullgard +Cc: stable@vger.kernel.org +Signed-off-by: Bin Liu +Link: https://lore.kernel.org/r/20200316211136.2274-8-b-liu@ti.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/musb/musb_host.c | 17 +++++------------ + 1 file changed, 5 insertions(+), 12 deletions(-) + +--- a/drivers/usb/musb/musb_host.c ++++ b/drivers/usb/musb/musb_host.c +@@ -1462,10 +1462,7 @@ done: + * We need to map sg if the transfer_buffer is + * NULL. + */ +- if (!urb->transfer_buffer) +- qh->use_sg = true; +- +- if (qh->use_sg) { ++ if (!urb->transfer_buffer) { + /* sg_miter_start is already done in musb_ep_program */ + if (!sg_miter_next(&qh->sg_miter)) { + dev_err(musb->controller, "error: sg list empty\n"); +@@ -1473,9 +1470,8 @@ done: + status = -EINVAL; + goto done; + } +- urb->transfer_buffer = qh->sg_miter.addr; + length = min_t(u32, length, qh->sg_miter.length); +- musb_write_fifo(hw_ep, length, urb->transfer_buffer); ++ musb_write_fifo(hw_ep, length, qh->sg_miter.addr); + qh->sg_miter.consumed = length; + sg_miter_stop(&qh->sg_miter); + } else { +@@ -1484,11 +1480,6 @@ done: + + qh->segsize = length; + +- if (qh->use_sg) { +- if (offset + length >= urb->transfer_buffer_length) +- qh->use_sg = false; +- } +- + musb_ep_select(mbase, epnum); + musb_writew(epio, MUSB_TXCSR, + MUSB_TXCSR_H_WZC_BITS | MUSB_TXCSR_TXPKTRDY); +@@ -2003,8 +1994,10 @@ finish: + urb->actual_length += xfer_len; + qh->offset += xfer_len; + if (done) { +- if (qh->use_sg) ++ if (qh->use_sg) { + qh->use_sg = false; ++ urb->transfer_buffer = NULL; ++ } + + if (urb->status == -EINPROGRESS) + urb->status = status; diff --git a/queue-5.5/usb-serial-io_edgeport-fix-slab-out-of-bounds-read-in-edge_interrupt_callback.patch b/queue-5.5/usb-serial-io_edgeport-fix-slab-out-of-bounds-read-in-edge_interrupt_callback.patch new file mode 100644 index 00000000000..56616626bc2 --- /dev/null +++ b/queue-5.5/usb-serial-io_edgeport-fix-slab-out-of-bounds-read-in-edge_interrupt_callback.patch @@ -0,0 +1,36 @@ +From 57aa9f294b09463492f604feaa5cc719beaace32 Mon Sep 17 00:00:00 2001 +From: Qiujun Huang +Date: Wed, 25 Mar 2020 15:52:37 +0800 +Subject: USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback + +From: Qiujun Huang + +commit 57aa9f294b09463492f604feaa5cc719beaace32 upstream. + +Fix slab-out-of-bounds read in the interrupt-URB completion handler. + +The boundary condition should be (length - 1) as we access +data[position + 1]. + +Reported-and-tested-by: syzbot+37ba33391ad5f3935bbd@syzkaller.appspotmail.com +Signed-off-by: Qiujun Huang +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/io_edgeport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/io_edgeport.c ++++ b/drivers/usb/serial/io_edgeport.c +@@ -710,7 +710,7 @@ static void edge_interrupt_callback(stru + /* grab the txcredits for the ports if available */ + position = 2; + portNumber = 0; +- while ((position < length) && ++ while ((position < length - 1) && + (portNumber < edge_serial->serial->num_ports)) { + txCredits = data[position] | (data[position+1] << 8); + if (txCredits) { diff --git a/queue-5.5/usb-serial-option-add-broadmobi-bm806u.patch b/queue-5.5/usb-serial-option-add-broadmobi-bm806u.patch new file mode 100644 index 00000000000..0e230357cea --- /dev/null +++ b/queue-5.5/usb-serial-option-add-broadmobi-bm806u.patch @@ -0,0 +1,61 @@ +From 6cb2669cb97fc4fdf526127159ac59caae052247 Mon Sep 17 00:00:00 2001 +From: Pawel Dembicki +Date: Wed, 25 Mar 2020 06:44:18 +0100 +Subject: USB: serial: option: add BroadMobi BM806U + +From: Pawel Dembicki + +commit 6cb2669cb97fc4fdf526127159ac59caae052247 upstream. + +BroadMobi BM806U is an Qualcomm MDM9225 based 3G/4G modem. +Tested hardware BM806U is mounted on D-Link DWR-921-C3 router. + +T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=2020 ProdID=2033 Rev= 2.28 +S: Manufacturer=Mobile Connect +S: Product=Mobile Connect +S: SerialNumber=f842866cfd5a +C:* #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Co-developed-by: Cezary Jackiewicz +Signed-off-by: Cezary Jackiewicz +Signed-off-by: Pawel Dembicki +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1996,6 +1996,8 @@ static const struct usb_device_id option + .driver_info = RSVD(1) | RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ + .driver_info = RSVD(4) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2033, 0xff), /* BroadMobi BM806U */ ++ .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff), /* BroadMobi BM818 */ + .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ diff --git a/queue-5.5/usb-serial-option-add-support-for-askey-wwhc050.patch b/queue-5.5/usb-serial-option-add-support-for-askey-wwhc050.patch new file mode 100644 index 00000000000..2980c1ddd60 --- /dev/null +++ b/queue-5.5/usb-serial-option-add-support-for-askey-wwhc050.patch @@ -0,0 +1,65 @@ +From 007d20dca2376a751b1dad03442f118438b7e65e Mon Sep 17 00:00:00 2001 +From: Pawel Dembicki +Date: Wed, 25 Mar 2020 06:44:17 +0100 +Subject: USB: serial: option: add support for ASKEY WWHC050 + +From: Pawel Dembicki + +commit 007d20dca2376a751b1dad03442f118438b7e65e upstream. + +ASKEY WWHC050 is a mcie LTE modem. +The oem configuration states: + +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1690 ProdID=7588 Rev=ff.ff +S: Manufacturer=Android +S: Product=Android +S: SerialNumber=813f0eef6e6e +C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us + +Tested on openwrt distribution. + +Co-developed-by: Cezary Jackiewicz +Signed-off-by: Cezary Jackiewicz +Signed-off-by: Pawel Dembicki +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1992,6 +1992,8 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ ++ { USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff), /* ASKEY WWHC050 */ ++ .driver_info = RSVD(1) | RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ + .driver_info = RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff), /* BroadMobi BM818 */ diff --git a/queue-5.5/usb-serial-option-add-wistron-neweb-d19q1.patch b/queue-5.5/usb-serial-option-add-wistron-neweb-d19q1.patch new file mode 100644 index 00000000000..6684d7e656f --- /dev/null +++ b/queue-5.5/usb-serial-option-add-wistron-neweb-d19q1.patch @@ -0,0 +1,63 @@ +From dfee7e2f478346b12ea651d5c28b069f6a4af563 Mon Sep 17 00:00:00 2001 +From: Pawel Dembicki +Date: Wed, 25 Mar 2020 06:44:19 +0100 +Subject: USB: serial: option: add Wistron Neweb D19Q1 + +From: Pawel Dembicki + +commit dfee7e2f478346b12ea651d5c28b069f6a4af563 upstream. + +This modem is embedded on dlink dwr-960 router. +The oem configuration states: + +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1435 ProdID=d191 Rev=ff.ff +S: Manufacturer=Android +S: Product=Android +S: SerialNumber=0123456789ABCDEF +C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us + +Tested on openwrt distribution + +Signed-off-by: Pawel Dembicki +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1992,6 +1992,8 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ ++ { USB_DEVICE_INTERFACE_CLASS(0x1435, 0xd191, 0xff), /* Wistron Neweb D19Q1 */ ++ .driver_info = RSVD(1) | RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff), /* ASKEY WWHC050 */ + .driver_info = RSVD(1) | RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */