From: Greg Kroah-Hartman Date: Thu, 3 Apr 2025 14:43:51 +0000 (+0100) Subject: 6.6-stable patches X-Git-Tag: v6.1.133~10 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5ad98dc80d438b2edfaa53fac6e79fc1736f51b6;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: memstick-rtsx_usb_ms-fix-slab-use-after-free-in-rtsx_usb_ms_drv_remove.patch net-usb-qmi_wwan-add-telit-cinterion-fe990b-composition.patch net-usb-qmi_wwan-add-telit-cinterion-fn990b-composition.patch net-usb-usbnet-restore-usb-d-name-exception-for-local-mac-addresses.patch serial-8250_dma-terminate-correct-dma-in-tx_dma_flush.patch tty-serial-8250-add-brainboxes-xc-devices.patch tty-serial-8250-add-some-more-device-ids.patch tty-serial-fsl_lpuart-disable-transmitter-before-changing-rs485-related-registers.patch --- diff --git a/queue-6.6/memstick-rtsx_usb_ms-fix-slab-use-after-free-in-rtsx_usb_ms_drv_remove.patch b/queue-6.6/memstick-rtsx_usb_ms-fix-slab-use-after-free-in-rtsx_usb_ms_drv_remove.patch new file mode 100644 index 0000000000..e1d04248c3 --- /dev/null +++ b/queue-6.6/memstick-rtsx_usb_ms-fix-slab-use-after-free-in-rtsx_usb_ms_drv_remove.patch @@ -0,0 +1,181 @@ +From 4676741a3464b300b486e70585c3c9b692be1632 Mon Sep 17 00:00:00 2001 +From: Luo Qiu +Date: Mon, 17 Mar 2025 18:14:38 +0800 +Subject: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove + +From: Luo Qiu + +commit 4676741a3464b300b486e70585c3c9b692be1632 upstream. + +This fixes the following crash: + +================================================================== +BUG: KASAN: slab-use-after-free in rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] +Read of size 8 at addr ffff888136335380 by task kworker/6:0/140241 + +CPU: 6 UID: 0 PID: 140241 Comm: kworker/6:0 Kdump: loaded Tainted: G E 6.14.0-rc6+ #1 +Tainted: [E]=UNSIGNED_MODULE +Hardware name: LENOVO 30FNA1V7CW/1057, BIOS S0EKT54A 07/01/2024 +Workqueue: events rtsx_usb_ms_poll_card [rtsx_usb_ms] +Call Trace: + + dump_stack_lvl+0x51/0x70 + print_address_description.constprop.0+0x27/0x320 + ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] + print_report+0x3e/0x70 + kasan_report+0xab/0xe0 + ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] + rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] + ? __pfx_rtsx_usb_ms_poll_card+0x10/0x10 [rtsx_usb_ms] + ? __pfx___schedule+0x10/0x10 + ? kick_pool+0x3b/0x270 + process_one_work+0x357/0x660 + worker_thread+0x390/0x4c0 + ? __pfx_worker_thread+0x10/0x10 + kthread+0x190/0x1d0 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x2d/0x50 + ? __pfx_kthread+0x10/0x10 + ret_from_fork_asm+0x1a/0x30 + + +Allocated by task 161446: + kasan_save_stack+0x20/0x40 + kasan_save_track+0x10/0x30 + __kasan_kmalloc+0x7b/0x90 + __kmalloc_noprof+0x1a7/0x470 + memstick_alloc_host+0x1f/0xe0 [memstick] + rtsx_usb_ms_drv_probe+0x47/0x320 [rtsx_usb_ms] + platform_probe+0x60/0xe0 + call_driver_probe+0x35/0x120 + really_probe+0x123/0x410 + __driver_probe_device+0xc7/0x1e0 + driver_probe_device+0x49/0xf0 + __device_attach_driver+0xc6/0x160 + bus_for_each_drv+0xe4/0x160 + __device_attach+0x13a/0x2b0 + bus_probe_device+0xbd/0xd0 + device_add+0x4a5/0x760 + platform_device_add+0x189/0x370 + mfd_add_device+0x587/0x5e0 + mfd_add_devices+0xb1/0x130 + rtsx_usb_probe+0x28e/0x2e0 [rtsx_usb] + usb_probe_interface+0x15c/0x460 + call_driver_probe+0x35/0x120 + really_probe+0x123/0x410 + __driver_probe_device+0xc7/0x1e0 + driver_probe_device+0x49/0xf0 + __device_attach_driver+0xc6/0x160 + bus_for_each_drv+0xe4/0x160 + __device_attach+0x13a/0x2b0 + rebind_marked_interfaces.isra.0+0xcc/0x110 + usb_reset_device+0x352/0x410 + usbdev_do_ioctl+0xe5c/0x1860 + usbdev_ioctl+0xa/0x20 + __x64_sys_ioctl+0xc5/0xf0 + do_syscall_64+0x59/0x170 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +Freed by task 161506: + kasan_save_stack+0x20/0x40 + kasan_save_track+0x10/0x30 + kasan_save_free_info+0x36/0x60 + __kasan_slab_free+0x34/0x50 + kfree+0x1fd/0x3b0 + device_release+0x56/0xf0 + kobject_cleanup+0x73/0x1c0 + rtsx_usb_ms_drv_remove+0x13d/0x220 [rtsx_usb_ms] + platform_remove+0x2f/0x50 + device_release_driver_internal+0x24b/0x2e0 + bus_remove_device+0x124/0x1d0 + device_del+0x239/0x530 + platform_device_del.part.0+0x19/0xe0 + platform_device_unregister+0x1c/0x40 + mfd_remove_devices_fn+0x167/0x170 + device_for_each_child_reverse+0xc9/0x130 + mfd_remove_devices+0x6e/0xa0 + rtsx_usb_disconnect+0x2e/0xd0 [rtsx_usb] + usb_unbind_interface+0xf3/0x3f0 + device_release_driver_internal+0x24b/0x2e0 + proc_disconnect_claim+0x13d/0x220 + usbdev_do_ioctl+0xb5e/0x1860 + usbdev_ioctl+0xa/0x20 + __x64_sys_ioctl+0xc5/0xf0 + do_syscall_64+0x59/0x170 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +Last potentially related work creation: + kasan_save_stack+0x20/0x40 + kasan_record_aux_stack+0x85/0x90 + insert_work+0x29/0x100 + __queue_work+0x34a/0x540 + call_timer_fn+0x2a/0x160 + expire_timers+0x5f/0x1f0 + __run_timer_base.part.0+0x1b6/0x1e0 + run_timer_softirq+0x8b/0xe0 + handle_softirqs+0xf9/0x360 + __irq_exit_rcu+0x114/0x130 + sysvec_apic_timer_interrupt+0x72/0x90 + asm_sysvec_apic_timer_interrupt+0x16/0x20 + +Second to last potentially related work creation: + kasan_save_stack+0x20/0x40 + kasan_record_aux_stack+0x85/0x90 + insert_work+0x29/0x100 + __queue_work+0x34a/0x540 + call_timer_fn+0x2a/0x160 + expire_timers+0x5f/0x1f0 + __run_timer_base.part.0+0x1b6/0x1e0 + run_timer_softirq+0x8b/0xe0 + handle_softirqs+0xf9/0x360 + __irq_exit_rcu+0x114/0x130 + sysvec_apic_timer_interrupt+0x72/0x90 + asm_sysvec_apic_timer_interrupt+0x16/0x20 + +The buggy address belongs to the object at ffff888136335000 + which belongs to the cache kmalloc-2k of size 2048 +The buggy address is located 896 bytes inside of + freed 2048-byte region [ffff888136335000, ffff888136335800) + +The buggy address belongs to the physical page: +page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x136330 +head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 +flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff) +page_type: f5(slab) +raw: 0017ffffc0000040 ffff888100042f00 ffffea000417a000 dead000000000002 +raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 +head: 0017ffffc0000040 ffff888100042f00 ffffea000417a000 dead000000000002 +head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 +head: 0017ffffc0000003 ffffea0004d8cc01 ffffffffffffffff 0000000000000000 +head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 +page dumped because: kasan: bad access detected + +Memory state around the buggy address: + ffff888136335280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ffff888136335300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +>ffff888136335380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ^ + ffff888136335400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ffff888136335480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +================================================================== + +Fixes: 6827ca573c03 ("memstick: rtsx_usb_ms: Support runtime power management") +Signed-off-by: Luo Qiu +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/4B7BC3E6E291E6F2+20250317101438.25650-1-luoqiu@kylinsec.com.cn +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/memstick/host/rtsx_usb_ms.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/memstick/host/rtsx_usb_ms.c ++++ b/drivers/memstick/host/rtsx_usb_ms.c +@@ -813,6 +813,7 @@ static int rtsx_usb_ms_drv_remove(struct + + host->eject = true; + cancel_work_sync(&host->handle_req); ++ cancel_delayed_work_sync(&host->poll_card); + + mutex_lock(&host->host_mutex); + if (host->req) { diff --git a/queue-6.6/net-usb-qmi_wwan-add-telit-cinterion-fe990b-composition.patch b/queue-6.6/net-usb-qmi_wwan-add-telit-cinterion-fe990b-composition.patch new file mode 100644 index 0000000000..7d7c12f07c --- /dev/null +++ b/queue-6.6/net-usb-qmi_wwan-add-telit-cinterion-fe990b-composition.patch @@ -0,0 +1,71 @@ +From e8cdd91926aac2c53a23925c538ad4c44be4201f Mon Sep 17 00:00:00 2001 +From: Fabio Porcedda +Date: Thu, 27 Feb 2025 12:24:39 +0100 +Subject: net: usb: qmi_wwan: add Telit Cinterion FE990B composition + +From: Fabio Porcedda + +commit e8cdd91926aac2c53a23925c538ad4c44be4201f upstream. + +Add the following Telit Cinterion FE990B composition: +0x10b0: rmnet + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) + + tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb + +usb-devices: +T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10b0 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FE990 +S: SerialNumber=28c2595e +C: #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Cc: stable@vger.kernel.org +Signed-off-by: Fabio Porcedda +Link: https://patch.msgid.link/20250227112441.3653819-2-fabio.porcedda@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1373,6 +1373,7 @@ static const struct usb_device_id produc + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a0, 0)}, /* Telit FN920C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a4, 0)}, /* Telit FN920C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10a9, 0)}, /* Telit FN920C04 */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10b0, 0)}, /* Telit FE990B */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c0, 0)}, /* Telit FE910C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c4, 0)}, /* Telit FE910C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c8, 0)}, /* Telit FE910C04 */ diff --git a/queue-6.6/net-usb-qmi_wwan-add-telit-cinterion-fn990b-composition.patch b/queue-6.6/net-usb-qmi_wwan-add-telit-cinterion-fn990b-composition.patch new file mode 100644 index 0000000000..ee209ee0d4 --- /dev/null +++ b/queue-6.6/net-usb-qmi_wwan-add-telit-cinterion-fn990b-composition.patch @@ -0,0 +1,70 @@ +From 9dba9a45f8ca64a7df32aada14c20a3153af1ac8 Mon Sep 17 00:00:00 2001 +From: Fabio Porcedda +Date: Wed, 5 Feb 2025 18:16:46 +0100 +Subject: net: usb: qmi_wwan: add Telit Cinterion FN990B composition + +From: Fabio Porcedda + +commit 9dba9a45f8ca64a7df32aada14c20a3153af1ac8 upstream. + +Add the following Telit Cinterion FN990B composition: + +0x10d0: rmnet + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) + + tty (diag) + DPL + QDSS (Qualcomm Debug SubSystem) + adb +T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 17 Spd=480 MxCh= 0 +D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10d0 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FN990 +S: SerialNumber=43b38f19 +C: #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) +E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none) +E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs +E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Cc: stable@vger.kernel.org +Signed-off-by: Fabio Porcedda +Link: https://patch.msgid.link/20250205171649.618162-3-fabio.porcedda@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1376,6 +1376,7 @@ static const struct usb_device_id produc + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c0, 0)}, /* Telit FE910C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c4, 0)}, /* Telit FE910C04 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x10c8, 0)}, /* Telit FE910C04 */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x10d0, 0)}, /* Telit FN990B */ + {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ + {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ diff --git a/queue-6.6/net-usb-usbnet-restore-usb-d-name-exception-for-local-mac-addresses.patch b/queue-6.6/net-usb-usbnet-restore-usb-d-name-exception-for-local-mac-addresses.patch new file mode 100644 index 0000000000..410a09694a --- /dev/null +++ b/queue-6.6/net-usb-usbnet-restore-usb-d-name-exception-for-local-mac-addresses.patch @@ -0,0 +1,78 @@ +From 2ea396448f26d0d7d66224cb56500a6789c7ed07 Mon Sep 17 00:00:00 2001 +From: Dominique Martinet +Date: Wed, 26 Mar 2025 17:32:36 +0900 +Subject: net: usb: usbnet: restore usb%d name exception for local mac addresses + +From: Dominique Martinet + +commit 2ea396448f26d0d7d66224cb56500a6789c7ed07 upstream. + +commit 8a7d12d674ac ("net: usb: usbnet: fix name regression") assumed +that local addresses always came from the kernel, but some devices hand +out local mac addresses so we ended up with point-to-point devices with +a mac set by the driver, renaming to eth%d when they used to be named +usb%d. + +Userspace should not rely on device name, but for the sake of stability +restore the local mac address check portion of the naming exception: +point to point devices which either have no mac set by the driver or +have a local mac handed out by the driver will keep the usb%d name. + +(some USB LTE modems are known to hand out a stable mac from the locally +administered range; that mac appears to be random (different for +mulitple devices) and can be reset with device-specific commands, so +while such devices would benefit from getting a OUI reserved, we have +to deal with these and might as well preserve the existing behavior +to avoid breaking fragile openwrt configurations and such on upgrade.) + +Link: https://lkml.kernel.org/r/20241203130457.904325-1-asmadeus@codewreck.org +Fixes: 8a7d12d674ac ("net: usb: usbnet: fix name regression") +Cc: stable@vger.kernel.org +Tested-by: Ahmed Naseef +Signed-off-by: Dominique Martinet +Acked-by: Oliver Neukum +Link: https://patch.msgid.link/20250326-usbnet_rename-v2-1-57eb21fcff26@atmark-techno.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/usbnet.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -178,6 +178,17 @@ int usbnet_get_ethernet_addr(struct usbn + } + EXPORT_SYMBOL_GPL(usbnet_get_ethernet_addr); + ++static bool usbnet_needs_usb_name_format(struct usbnet *dev, struct net_device *net) ++{ ++ /* Point to point devices which don't have a real MAC address ++ * (or report a fake local one) have historically used the usb%d ++ * naming. Preserve this.. ++ */ ++ return (dev->driver_info->flags & FLAG_POINTTOPOINT) != 0 && ++ (is_zero_ether_addr(net->dev_addr) || ++ is_local_ether_addr(net->dev_addr)); ++} ++ + static void intr_complete (struct urb *urb) + { + struct usbnet *dev = urb->context; +@@ -1766,13 +1777,11 @@ usbnet_probe (struct usb_interface *udev + if (status < 0) + goto out1; + +- // heuristic: "usb%d" for links we know are two-host, +- // else "eth%d" when there's reasonable doubt. userspace +- // can rename the link if it knows better. ++ /* heuristic: rename to "eth%d" if we are not sure this link ++ * is two-host (these links keep "usb%d") ++ */ + if ((dev->driver_info->flags & FLAG_ETHER) != 0 && +- ((dev->driver_info->flags & FLAG_POINTTOPOINT) == 0 || +- /* somebody touched it*/ +- !is_zero_ether_addr(net->dev_addr))) ++ !usbnet_needs_usb_name_format(dev, net)) + strscpy(net->name, "eth%d", sizeof(net->name)); + /* WLAN devices should always be named "wlan%d" */ + if ((dev->driver_info->flags & FLAG_WLAN) != 0) diff --git a/queue-6.6/serial-8250_dma-terminate-correct-dma-in-tx_dma_flush.patch b/queue-6.6/serial-8250_dma-terminate-correct-dma-in-tx_dma_flush.patch new file mode 100644 index 0000000000..6aee9e940b --- /dev/null +++ b/queue-6.6/serial-8250_dma-terminate-correct-dma-in-tx_dma_flush.patch @@ -0,0 +1,37 @@ +From a26503092c75abba70a0be2aa01145ecf90c2a22 Mon Sep 17 00:00:00 2001 +From: John Keeping +Date: Mon, 24 Feb 2025 12:18:30 +0000 +Subject: serial: 8250_dma: terminate correct DMA in tx_dma_flush() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: John Keeping + +commit a26503092c75abba70a0be2aa01145ecf90c2a22 upstream. + +When flushing transmit side DMA, it is the transmit channel that should +be terminated, not the receive channel. + +Fixes: 9e512eaaf8f40 ("serial: 8250: Fix fifo underflow on flush") +Cc: stable +Reported-by: Wentao Guan +Signed-off-by: John Keeping +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20250224121831.1429323-1-jkeeping@inmusicbrands.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_dma.c ++++ b/drivers/tty/serial/8250/8250_dma.c +@@ -152,7 +152,7 @@ void serial8250_tx_dma_flush(struct uart + */ + dma->tx_size = 0; + +- dmaengine_terminate_async(dma->rxchan); ++ dmaengine_terminate_async(dma->txchan); + } + + int serial8250_rx_dma(struct uart_8250_port *p) diff --git a/queue-6.6/series b/queue-6.6/series index 33981705b2..e97d1fb658 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -15,3 +15,11 @@ netfilter-socket-lookup-orig-tuple-for-ipv6-snat.patch alsa-hda-realtek-support-mute-led-on-hp-laptop-15s-du3xxx.patch counter-stm32-lptimer-cnt-fix-error-handling-when-enabling.patch counter-microchip-tcb-capture-fix-undefined-counter-channel-state-on-probe.patch +tty-serial-8250-add-some-more-device-ids.patch +tty-serial-8250-add-brainboxes-xc-devices.patch +tty-serial-fsl_lpuart-disable-transmitter-before-changing-rs485-related-registers.patch +net-usb-qmi_wwan-add-telit-cinterion-fn990b-composition.patch +net-usb-qmi_wwan-add-telit-cinterion-fe990b-composition.patch +net-usb-usbnet-restore-usb-d-name-exception-for-local-mac-addresses.patch +memstick-rtsx_usb_ms-fix-slab-use-after-free-in-rtsx_usb_ms_drv_remove.patch +serial-8250_dma-terminate-correct-dma-in-tx_dma_flush.patch diff --git a/queue-6.6/tty-serial-8250-add-brainboxes-xc-devices.patch b/queue-6.6/tty-serial-8250-add-brainboxes-xc-devices.patch new file mode 100644 index 0000000000..39e10db83f --- /dev/null +++ b/queue-6.6/tty-serial-8250-add-brainboxes-xc-devices.patch @@ -0,0 +1,66 @@ +From 5c7e2896481a177bbda41d7850f05a9f5a8aee2b Mon Sep 17 00:00:00 2001 +From: Cameron Williams +Date: Mon, 10 Mar 2025 22:27:10 +0000 +Subject: tty: serial: 8250: Add Brainboxes XC devices + +From: Cameron Williams + +commit 5c7e2896481a177bbda41d7850f05a9f5a8aee2b upstream. + +These ExpressCard devices use the OxPCIE chip and can be used with +this driver. + +Signed-off-by: Cameron Williams +Cc: stable +Link: https://lore.kernel.org/r/DB7PR02MB3802907A9360F27F6CD67AAFC4D62@DB7PR02MB3802.eurprd02.prod.outlook.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_pci.c | 30 ++++++++++++++++++++++++++++++ + 1 file changed, 30 insertions(+) + +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -2577,6 +2577,22 @@ static struct pci_serial_quirk pci_seria + .setup = pci_oxsemi_tornado_setup, + }, + { ++ .vendor = PCI_VENDOR_ID_INTASHIELD, ++ .device = 0x4026, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .init = pci_oxsemi_tornado_init, ++ .setup = pci_oxsemi_tornado_setup, ++ }, ++ { ++ .vendor = PCI_VENDOR_ID_INTASHIELD, ++ .device = 0x4021, ++ .subvendor = PCI_ANY_ID, ++ .subdevice = PCI_ANY_ID, ++ .init = pci_oxsemi_tornado_init, ++ .setup = pci_oxsemi_tornado_setup, ++ }, ++ { + .vendor = PCI_VENDOR_ID_INTEL, + .device = 0x8811, + .subvendor = PCI_ANY_ID, +@@ -5469,6 +5485,20 @@ static const struct pci_device_id serial + PCI_ANY_ID, PCI_ANY_ID, + 0, 0, + pbn_oxsemi_1_15625000 }, ++ /* ++ * Brainboxes XC-235 ++ */ ++ { PCI_VENDOR_ID_INTASHIELD, 0x4026, ++ PCI_ANY_ID, PCI_ANY_ID, ++ 0, 0, ++ pbn_oxsemi_1_15625000 }, ++ /* ++ * Brainboxes XC-475 ++ */ ++ { PCI_VENDOR_ID_INTASHIELD, 0x4021, ++ PCI_ANY_ID, PCI_ANY_ID, ++ 0, 0, ++ pbn_oxsemi_1_15625000 }, + + /* + * Perle PCI-RAS cards diff --git a/queue-6.6/tty-serial-8250-add-some-more-device-ids.patch b/queue-6.6/tty-serial-8250-add-some-more-device-ids.patch new file mode 100644 index 0000000000..7a1fd4d670 --- /dev/null +++ b/queue-6.6/tty-serial-8250-add-some-more-device-ids.patch @@ -0,0 +1,51 @@ +From be6a23650908e2f827f2e7839a3fbae41ccb5b63 Mon Sep 17 00:00:00 2001 +From: Cameron Williams +Date: Sun, 23 Feb 2025 22:07:38 +0000 +Subject: tty: serial: 8250: Add some more device IDs + +From: Cameron Williams + +commit be6a23650908e2f827f2e7839a3fbae41ccb5b63 upstream. + +These card IDs got missed the first time around. + +Cc: stable +Signed-off-by: Cameron Williams +Link: https://lore.kernel.org/r/DB7PR02MB380295BCC879CCF91315AC38C4C12@DB7PR02MB3802.eurprd02.prod.outlook.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_pci.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -5107,6 +5107,14 @@ static const struct pci_device_id serial + PCI_ANY_ID, PCI_ANY_ID, + 0, 0, + pbn_b2_2_115200 }, ++ { PCI_VENDOR_ID_INTASHIELD, 0x0BA2, ++ PCI_ANY_ID, PCI_ANY_ID, ++ 0, 0, ++ pbn_b2_2_115200 }, ++ { PCI_VENDOR_ID_INTASHIELD, 0x0BA3, ++ PCI_ANY_ID, PCI_ANY_ID, ++ 0, 0, ++ pbn_b2_2_115200 }, + /* + * Brainboxes UC-235/246 + */ +@@ -5227,6 +5235,14 @@ static const struct pci_device_id serial + PCI_ANY_ID, PCI_ANY_ID, + 0, 0, + pbn_b2_4_115200 }, ++ { PCI_VENDOR_ID_INTASHIELD, 0x0C42, ++ PCI_ANY_ID, PCI_ANY_ID, ++ 0, 0, ++ pbn_b2_4_115200 }, ++ { PCI_VENDOR_ID_INTASHIELD, 0x0C43, ++ PCI_ANY_ID, PCI_ANY_ID, ++ 0, 0, ++ pbn_b2_4_115200 }, + /* + * Brainboxes UC-420 + */ diff --git a/queue-6.6/tty-serial-fsl_lpuart-disable-transmitter-before-changing-rs485-related-registers.patch b/queue-6.6/tty-serial-fsl_lpuart-disable-transmitter-before-changing-rs485-related-registers.patch new file mode 100644 index 0000000000..6d8d0df280 --- /dev/null +++ b/queue-6.6/tty-serial-fsl_lpuart-disable-transmitter-before-changing-rs485-related-registers.patch @@ -0,0 +1,57 @@ +From f5cb528d6441eb860250a2f085773aac4f44085e Mon Sep 17 00:00:00 2001 +From: Sherry Sun +Date: Wed, 12 Mar 2025 10:25:03 +0800 +Subject: tty: serial: fsl_lpuart: disable transmitter before changing RS485 related registers + +From: Sherry Sun + +commit f5cb528d6441eb860250a2f085773aac4f44085e upstream. + +According to the LPUART reference manual, TXRTSE and TXRTSPOL of MODIR +register only can be changed when the transmitter is disabled. +So disable the transmitter before changing RS485 related registers and +re-enable it after the change is done. + +Fixes: 67b01837861c ("tty: serial: lpuart: Add RS485 support for 32-bit uart flavour") +Cc: stable +Signed-off-by: Sherry Sun +Reviewed-by: Frank Li +Link: https://lore.kernel.org/r/20250312022503.1342990-1-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/fsl_lpuart.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1488,6 +1488,19 @@ static int lpuart32_config_rs485(struct + + unsigned long modem = lpuart32_read(&sport->port, UARTMODIR) + & ~(UARTMODIR_TXRTSPOL | UARTMODIR_TXRTSE); ++ u32 ctrl; ++ ++ /* TXRTSE and TXRTSPOL only can be changed when transmitter is disabled. */ ++ ctrl = lpuart32_read(&sport->port, UARTCTRL); ++ if (ctrl & UARTCTRL_TE) { ++ /* wait for the transmit engine to complete */ ++ lpuart32_wait_bit_set(&sport->port, UARTSTAT, UARTSTAT_TC); ++ lpuart32_write(&sport->port, ctrl & ~UARTCTRL_TE, UARTCTRL); ++ ++ while (lpuart32_read(&sport->port, UARTCTRL) & UARTCTRL_TE) ++ cpu_relax(); ++ } ++ + lpuart32_write(&sport->port, modem, UARTMODIR); + + if (rs485->flags & SER_RS485_ENABLED) { +@@ -1507,6 +1520,10 @@ static int lpuart32_config_rs485(struct + } + + lpuart32_write(&sport->port, modem, UARTMODIR); ++ ++ if (ctrl & UARTCTRL_TE) ++ lpuart32_write(&sport->port, ctrl, UARTCTRL); ++ + return 0; + } +