From: Greg Kroah-Hartman Date: Tue, 2 Dec 2025 15:44:34 +0000 (+0100) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8f55bec0113169de7d6e9097688a20830ccd6034;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: drm-amd-display-check-null-before-accessing.patch drm-sti-fix-device-leaks-at-component-probe.patch libceph-fix-potential-use-after-free-in-have_mon_and_osd_map.patch usb-serial-ftdi_sio-add-support-for-u-blox-evk-m101.patch usb-serial-option-add-support-for-rolling-rw101r-gl.patch --- diff --git a/queue-5.10/drm-amd-display-check-null-before-accessing.patch b/queue-5.10/drm-amd-display-check-null-before-accessing.patch new file mode 100644 index 0000000000..ea82d1e6bb --- /dev/null +++ b/queue-5.10/drm-amd-display-check-null-before-accessing.patch @@ -0,0 +1,82 @@ +From 3ce62c189693e8ed7b3abe551802bbc67f3ace54 Mon Sep 17 00:00:00 2001 +From: Alex Hung +Date: Fri, 7 Nov 2025 15:35:58 -0700 +Subject: drm/amd/display: Check NULL before accessing + +From: Alex Hung + +commit 3ce62c189693e8ed7b3abe551802bbc67f3ace54 upstream. + +[WHAT] +IGT kms_cursor_legacy's long-nonblocking-modeset-vs-cursor-atomic +fails with NULL pointer dereference. This can be reproduced with +both an eDP panel and a DP monitors connected. + + BUG: kernel NULL pointer dereference, address: 0000000000000000 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: Oops: 0000 [#1] SMP NOPTI + CPU: 13 UID: 0 PID: 2960 Comm: kms_cursor_lega Not tainted +6.16.0-99-custom #8 PREEMPT(voluntary) + Hardware name: AMD ........ + RIP: 0010:dc_stream_get_scanoutpos+0x34/0x130 [amdgpu] + Code: 57 4d 89 c7 41 56 49 89 ce 41 55 49 89 d5 41 54 49 + 89 fc 53 48 83 ec 18 48 8b 87 a0 64 00 00 48 89 75 d0 48 c7 c6 e0 41 30 + c2 <48> 8b 38 48 8b 9f 68 06 00 00 e8 8d d7 fd ff 31 c0 48 81 c3 e0 02 + RSP: 0018:ffffd0f3c2bd7608 EFLAGS: 00010292 + RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffd0f3c2bd7668 + RDX: ffffd0f3c2bd7664 RSI: ffffffffc23041e0 RDI: ffff8b32494b8000 + RBP: ffffd0f3c2bd7648 R08: ffffd0f3c2bd766c R09: ffffd0f3c2bd7760 + R10: ffffd0f3c2bd7820 R11: 0000000000000000 R12: ffff8b32494b8000 + R13: ffffd0f3c2bd7664 R14: ffffd0f3c2bd7668 R15: ffffd0f3c2bd766c + FS: 000071f631b68700(0000) GS:ffff8b399f114000(0000) +knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000000 CR3: 00000001b8105000 CR4: 0000000000f50ef0 + PKRU: 55555554 + Call Trace: + + dm_crtc_get_scanoutpos+0xd7/0x180 [amdgpu] + amdgpu_display_get_crtc_scanoutpos+0x86/0x1c0 [amdgpu] + ? __pfx_amdgpu_crtc_get_scanout_position+0x10/0x10[amdgpu] + amdgpu_crtc_get_scanout_position+0x27/0x50 [amdgpu] + drm_crtc_vblank_helper_get_vblank_timestamp_internal+0xf7/0x400 + drm_crtc_vblank_helper_get_vblank_timestamp+0x1c/0x30 + drm_crtc_get_last_vbltimestamp+0x55/0x90 + drm_crtc_next_vblank_start+0x45/0xa0 + drm_atomic_helper_wait_for_fences+0x81/0x1f0 + ... + +Cc: Mario Limonciello +Cc: Alex Deucher +Reviewed-by: Aurabindo Pillai +Signed-off-by: Alex Hung +Signed-off-by: Alex Deucher +(cherry picked from commit 621e55f1919640acab25383362b96e65f2baea3c) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c +@@ -586,9 +586,14 @@ bool dc_stream_get_scanoutpos(const stru + { + uint8_t i; + bool ret = false; +- struct dc *dc = stream->ctx->dc; +- struct resource_context *res_ctx = +- &dc->current_state->res_ctx; ++ struct dc *dc; ++ struct resource_context *res_ctx; ++ ++ if (!stream->ctx) ++ return false; ++ ++ dc = stream->ctx->dc; ++ res_ctx = &dc->current_state->res_ctx; + + for (i = 0; i < MAX_PIPES; i++) { + struct timing_generator *tg = res_ctx->pipe_ctx[i].stream_res.tg; diff --git a/queue-5.10/drm-sti-fix-device-leaks-at-component-probe.patch b/queue-5.10/drm-sti-fix-device-leaks-at-component-probe.patch new file mode 100644 index 0000000000..c70ccf33a2 --- /dev/null +++ b/queue-5.10/drm-sti-fix-device-leaks-at-component-probe.patch @@ -0,0 +1,54 @@ +From 620a8f131154250f6a64a07d049a4f235d6451a5 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 22 Sep 2025 14:20:12 +0200 +Subject: drm: sti: fix device leaks at component probe + +From: Johan Hovold + +commit 620a8f131154250f6a64a07d049a4f235d6451a5 upstream. + +Make sure to drop the references taken to the vtg devices by +of_find_device_by_node() when looking up their driver data during +component probe. + +Note that holding a reference to a platform device does not prevent its +driver data from going away so there is no point in keeping the +reference after the lookup helper returns. + +Fixes: cc6b741c6f63 ("drm: sti: remove useless fields from vtg structure") +Cc: stable@vger.kernel.org # 4.16 +Cc: Benjamin Gaignard +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20250922122012.27407-1-johan@kernel.org +Signed-off-by: Raphael Gallais-Pou +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/sti/sti_vtg.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/sti/sti_vtg.c b/drivers/gpu/drm/sti/sti_vtg.c +index ee81691b3203..ce6bc7e7b135 100644 +--- a/drivers/gpu/drm/sti/sti_vtg.c ++++ b/drivers/gpu/drm/sti/sti_vtg.c +@@ -143,12 +143,17 @@ struct sti_vtg { + struct sti_vtg *of_vtg_find(struct device_node *np) + { + struct platform_device *pdev; ++ struct sti_vtg *vtg; + + pdev = of_find_device_by_node(np); + if (!pdev) + return NULL; + +- return (struct sti_vtg *)platform_get_drvdata(pdev); ++ vtg = platform_get_drvdata(pdev); ++ ++ put_device(&pdev->dev); ++ ++ return vtg; + } + + static void vtg_reset(struct sti_vtg *vtg) +-- +2.52.0 + diff --git a/queue-5.10/libceph-fix-potential-use-after-free-in-have_mon_and_osd_map.patch b/queue-5.10/libceph-fix-potential-use-after-free-in-have_mon_and_osd_map.patch new file mode 100644 index 0000000000..39c8ec974a --- /dev/null +++ b/queue-5.10/libceph-fix-potential-use-after-free-in-have_mon_and_osd_map.patch @@ -0,0 +1,222 @@ +From 076381c261374c587700b3accf410bdd2dba334e Mon Sep 17 00:00:00 2001 +From: Ilya Dryomov +Date: Mon, 3 Nov 2025 21:34:01 +0100 +Subject: libceph: fix potential use-after-free in have_mon_and_osd_map() + +From: Ilya Dryomov + +commit 076381c261374c587700b3accf410bdd2dba334e upstream. + +The wait loop in __ceph_open_session() can race with the client +receiving a new monmap or osdmap shortly after the initial map is +received. Both ceph_monc_handle_map() and handle_one_map() install +a new map immediately after freeing the old one + + kfree(monc->monmap); + monc->monmap = monmap; + + ceph_osdmap_destroy(osdc->osdmap); + osdc->osdmap = newmap; + +under client->monc.mutex and client->osdc.lock respectively, but +because neither is taken in have_mon_and_osd_map() it's possible for +client->monc.monmap->epoch and client->osdc.osdmap->epoch arms in + + client->monc.monmap && client->monc.monmap->epoch && + client->osdc.osdmap && client->osdc.osdmap->epoch; + +condition to dereference an already freed map. This happens to be +reproducible with generic/395 and generic/397 with KASAN enabled: + + BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70 + Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305 + CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266 + ... + Call Trace: + + have_mon_and_osd_map+0x56/0x70 + ceph_open_session+0x182/0x290 + ceph_get_tree+0x333/0x680 + vfs_get_tree+0x49/0x180 + do_new_mount+0x1a3/0x2d0 + path_mount+0x6dd/0x730 + do_mount+0x99/0xe0 + __do_sys_mount+0x141/0x180 + do_syscall_64+0x9f/0x100 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + + + Allocated by task 13305: + ceph_osdmap_alloc+0x16/0x130 + ceph_osdc_init+0x27a/0x4c0 + ceph_create_client+0x153/0x190 + create_fs_client+0x50/0x2a0 + ceph_get_tree+0xff/0x680 + vfs_get_tree+0x49/0x180 + do_new_mount+0x1a3/0x2d0 + path_mount+0x6dd/0x730 + do_mount+0x99/0xe0 + __do_sys_mount+0x141/0x180 + do_syscall_64+0x9f/0x100 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + + Freed by task 9475: + kfree+0x212/0x290 + handle_one_map+0x23c/0x3b0 + ceph_osdc_handle_map+0x3c9/0x590 + mon_dispatch+0x655/0x6f0 + ceph_con_process_message+0xc3/0xe0 + ceph_con_v1_try_read+0x614/0x760 + ceph_con_workfn+0x2de/0x650 + process_one_work+0x486/0x7c0 + process_scheduled_works+0x73/0x90 + worker_thread+0x1c8/0x2a0 + kthread+0x2ec/0x300 + ret_from_fork+0x24/0x40 + ret_from_fork_asm+0x1a/0x30 + +Rewrite the wait loop to check the above condition directly with +client->monc.mutex and client->osdc.lock taken as appropriate. While +at it, improve the timeout handling (previously mount_timeout could be +exceeded in case wait_event_interruptible_timeout() slept more than +once) and access client->auth_err under client->monc.mutex to match +how it's set in finish_auth(). + +monmap_show() and osdmap_show() now take the respective lock before +accessing the map as well. + +Cc: stable@vger.kernel.org +Reported-by: David Howells +Signed-off-by: Ilya Dryomov +Reviewed-by: Viacheslav Dubeyko +Signed-off-by: Greg Kroah-Hartman +--- + net/ceph/ceph_common.c | 53 +++++++++++++++++++++++++++++-------------------- + net/ceph/debugfs.c | 14 +++++++++--- + 2 files changed, 42 insertions(+), 25 deletions(-) + +--- a/net/ceph/ceph_common.c ++++ b/net/ceph/ceph_common.c +@@ -750,41 +750,52 @@ void ceph_reset_client_addr(struct ceph_ + EXPORT_SYMBOL(ceph_reset_client_addr); + + /* +- * true if we have the mon map (and have thus joined the cluster) +- */ +-static bool have_mon_and_osd_map(struct ceph_client *client) +-{ +- return client->monc.monmap && client->monc.monmap->epoch && +- client->osdc.osdmap && client->osdc.osdmap->epoch; +-} +- +-/* + * mount: join the ceph cluster, and open root directory. + */ + int __ceph_open_session(struct ceph_client *client, unsigned long started) + { +- unsigned long timeout = client->options->mount_timeout; +- long err; ++ DEFINE_WAIT_FUNC(wait, woken_wake_function); ++ long timeout = ceph_timeout_jiffies(client->options->mount_timeout); ++ bool have_monmap, have_osdmap; ++ int err; + + /* open session, and wait for mon and osd maps */ + err = ceph_monc_open_session(&client->monc); + if (err < 0) + return err; + +- while (!have_mon_and_osd_map(client)) { +- if (timeout && time_after_eq(jiffies, started + timeout)) +- return -ETIMEDOUT; ++ add_wait_queue(&client->auth_wq, &wait); ++ for (;;) { ++ mutex_lock(&client->monc.mutex); ++ err = client->auth_err; ++ have_monmap = client->monc.monmap && client->monc.monmap->epoch; ++ mutex_unlock(&client->monc.mutex); ++ ++ down_read(&client->osdc.lock); ++ have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch; ++ up_read(&client->osdc.lock); ++ ++ if (err || (have_monmap && have_osdmap)) ++ break; ++ ++ if (signal_pending(current)) { ++ err = -ERESTARTSYS; ++ break; ++ } ++ ++ if (!timeout) { ++ err = -ETIMEDOUT; ++ break; ++ } + + /* wait */ + dout("mount waiting for mon_map\n"); +- err = wait_event_interruptible_timeout(client->auth_wq, +- have_mon_and_osd_map(client) || (client->auth_err < 0), +- ceph_timeout_jiffies(timeout)); +- if (err < 0) +- return err; +- if (client->auth_err < 0) +- return client->auth_err; ++ timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout); + } ++ remove_wait_queue(&client->auth_wq, &wait); ++ ++ if (err) ++ return err; + + pr_info("client%llu fsid %pU\n", ceph_client_gid(client), + &client->fsid); +--- a/net/ceph/debugfs.c ++++ b/net/ceph/debugfs.c +@@ -36,8 +36,9 @@ static int monmap_show(struct seq_file * + int i; + struct ceph_client *client = s->private; + ++ mutex_lock(&client->monc.mutex); + if (client->monc.monmap == NULL) +- return 0; ++ goto out_unlock; + + seq_printf(s, "epoch %d\n", client->monc.monmap->epoch); + for (i = 0; i < client->monc.monmap->num_mon; i++) { +@@ -48,6 +49,9 @@ static int monmap_show(struct seq_file * + ENTITY_NAME(inst->name), + ceph_pr_addr(&inst->addr)); + } ++ ++out_unlock: ++ mutex_unlock(&client->monc.mutex); + return 0; + } + +@@ -56,13 +60,14 @@ static int osdmap_show(struct seq_file * + int i; + struct ceph_client *client = s->private; + struct ceph_osd_client *osdc = &client->osdc; +- struct ceph_osdmap *map = osdc->osdmap; ++ struct ceph_osdmap *map; + struct rb_node *n; + ++ down_read(&osdc->lock); ++ map = osdc->osdmap; + if (map == NULL) +- return 0; ++ goto out_unlock; + +- down_read(&osdc->lock); + seq_printf(s, "epoch %u barrier %u flags 0x%x\n", map->epoch, + osdc->epoch_barrier, map->flags); + +@@ -131,6 +136,7 @@ static int osdmap_show(struct seq_file * + seq_printf(s, "]\n"); + } + ++out_unlock: + up_read(&osdc->lock); + return 0; + } diff --git a/queue-5.10/series b/queue-5.10/series index bf3e8a1ddd..a2be7b1d9e 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -282,3 +282,8 @@ usb-storage-remove-subclass-and-protocol-overrides-from-novatek-quirk.patch usb-storage-sddr55-reject-out-of-bound-new_pba.patch usb-dwc3-fix-race-condition-between-concurrent-dwc3_remove_requests-call-paths.patch xhci-dbgtty-fix-data-corruption-when-transmitting-data-form-dbc-to-host.patch +usb-serial-ftdi_sio-add-support-for-u-blox-evk-m101.patch +usb-serial-option-add-support-for-rolling-rw101r-gl.patch +drm-sti-fix-device-leaks-at-component-probe.patch +drm-amd-display-check-null-before-accessing.patch +libceph-fix-potential-use-after-free-in-have_mon_and_osd_map.patch diff --git a/queue-5.10/usb-serial-ftdi_sio-add-support-for-u-blox-evk-m101.patch b/queue-5.10/usb-serial-ftdi_sio-add-support-for-u-blox-evk-m101.patch new file mode 100644 index 0000000000..acc4eb8740 --- /dev/null +++ b/queue-5.10/usb-serial-ftdi_sio-add-support-for-u-blox-evk-m101.patch @@ -0,0 +1,58 @@ +From 2d8ab771d5316de64f3bb920b82575c58eb00b1b Mon Sep 17 00:00:00 2001 +From: Oleksandr Suvorov +Date: Thu, 30 Oct 2025 17:42:54 +0200 +Subject: USB: serial: ftdi_sio: add support for u-blox EVK-M101 + +From: Oleksandr Suvorov + +commit 2d8ab771d5316de64f3bb920b82575c58eb00b1b upstream. + +The U-Blox EVK-M101 enumerates as 1546:0506 [1] with four FTDI interfaces: +- EVK-M101 current sensors +- EVK-M101 I2C +- EVK-M101 UART +- EVK-M101 port D + +Only the third USB interface is a UART. This change lets ftdi_sio probe +the VID/PID and registers only interface #3 as a TTY, leaving the rest +available for other drivers. + +[1] +usb 5-1.3: new high-speed USB device number 11 using xhci_hcd +usb 5-1.3: New USB device found, idVendor=1546, idProduct=0506, bcdDevice= 8.00 +usb 5-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0 +usb 5-1.3: Product: EVK-M101 +usb 5-1.3: Manufacturer: u-blox AG + +Datasheet: https://content.u-blox.com/sites/default/files/documents/EVK-M10_UserGuide_UBX-21003949.pdf + +Signed-off-by: Oleksandr Suvorov +Link: https://lore.kernel.org/20250926060235.3442748-1-cryosay@gmail.com/ +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/ftdi_sio.c | 1 + + drivers/usb/serial/ftdi_sio_ids.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1052,6 +1052,7 @@ static const struct usb_device_id id_tab + /* U-Blox devices */ + { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) }, + { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, ++ { USB_DEVICE_INTERFACE_NUMBER(UBLOX_VID, UBLOX_EVK_M101_PID, 2) }, + /* FreeCalypso USB adapters */ + { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -1607,6 +1607,7 @@ + #define UBLOX_VID 0x1546 + #define UBLOX_C099F9P_ZED_PID 0x0502 + #define UBLOX_C099F9P_ODIN_PID 0x0503 ++#define UBLOX_EVK_M101_PID 0x0506 + + /* + * GMC devices diff --git a/queue-5.10/usb-serial-option-add-support-for-rolling-rw101r-gl.patch b/queue-5.10/usb-serial-option-add-support-for-rolling-rw101r-gl.patch new file mode 100644 index 0000000000..fdb9c4f33d --- /dev/null +++ b/queue-5.10/usb-serial-option-add-support-for-rolling-rw101r-gl.patch @@ -0,0 +1,162 @@ +From 523bf0a59e674b52e4b5607a2aba655fbfa20ff2 Mon Sep 17 00:00:00 2001 +From: Vanillan Wang +Date: Mon, 10 Nov 2025 12:20:41 +0800 +Subject: USB: serial: option: add support for Rolling RW101R-GL + +From: Vanillan Wang + +commit 523bf0a59e674b52e4b5607a2aba655fbfa20ff2 upstream. + +- VID:PID 33f8:0301, RW101R-GL for laptop debug M.2 cards (with MBIM + interface for Linux/Chrome OS) + + 0x0301: mbim, pipe + +T: Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=33f8 ProdID=0301 Rev=05.04 +S: Manufacturer=Rolling Wireless S.a.r.l. +S: Product=Rolling RW101R-GL Module +S: SerialNumber=3ec4efdf +C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms + +- VID:PID 33f8:01a8, RW101R-GL for laptop debug M.2 cards (with MBIM + interface for Linux/Chrome OS) + + 0x01a8: mbim, diag, AT, ADB, pipe1, pipe2 + +T: Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=33f8 ProdID=01a8 Rev=05.04 +S: Manufacturer=Rolling Wireless S.a.r.l. +S: Product=Rolling RW101R-GL Module +S: SerialNumber=3ec4efdf +C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=89(I) Atr=03(Int.) MxPS= 10 Ivl=32ms + +- VID:PID 33f8:0302, RW101R-GL for laptop debug M.2 cards (with MBIM + interface for Linux/Chrome OS) + + 0x0302: mbim, pipe + +T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=33f8 ProdID=0302 Rev=05.04 +S: Manufacturer=Rolling Wireless S.a.r.l. +S: Product=Rolling RW101R-GL Module +S: SerialNumber=3ec4efdf +C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms + +- VID:PID 33f8:01a9, RW101R-GL for laptop debug M.2 cards (with MBIM + interface for Linux/Chrome OS) + + 0x01a9: mbim, diag, AT, ADB, pipe1, pipe2 + +T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=33f8 ProdID=01a9 Rev=05.04 +S: Manufacturer=Rolling Wireless S.a.r.l. +S: Product=Rolling RW101R-GL Module +S: SerialNumber=3ec4efdf +C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=89(I) Atr=03(Int.) MxPS= 10 Ivl=32ms + +Signed-off-by: Vanillan Wang +Cc: stable@vger.kernel.org +[ johan: sort vendor entries, edit commit message slightly ] +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 5de856f65f0d..e9400727ad36 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2424,12 +2424,18 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ + { USB_DEVICE(0x33f8, 0x0104), /* Rolling RW101-GL (laptop RMNET) */ + .driver_info = RSVD(4) | RSVD(5) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */ ++ .driver_info = RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a2, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a3, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a4, 0xff), /* Rolling RW101-GL (laptop MBIM) */ + .driver_info = RSVD(4) }, +- { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */ +- .driver_info = RSVD(5) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a8, 0xff), /* Rolling RW101R-GL (laptop MBIM) */ ++ .driver_info = RSVD(4) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a9, 0xff), /* Rolling RW101R-GL (laptop MBIM) */ ++ .driver_info = RSVD(4) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0301, 0xff) }, /* Rolling RW101R-GL (laptop MBIM) */ ++ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0302, 0xff) }, /* Rolling RW101R-GL (laptop MBIM) */ + { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0802, 0xff), /* Rolling RW350-GL (laptop MBIM) */ + .driver_info = RSVD(5) }, + { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Global */ +-- +2.52.0 +