From: Greg Kroah-Hartman Date: Mon, 26 Jul 2021 08:38:17 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.4.277~54 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a81ae8aee9b6da49206f1d6151fb65a5a52a185b;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: usb-dwc2-gadget-fix-sending-zero-length-packet-in-ddma-mode.patch usb-max-3421-prevent-corruption-of-freed-memory.patch usb-renesas_usbhs-fix-superfluous-irqs-happen-after-usb_pkt_pop.patch usb-serial-cp210x-add-id-for-cel-em3588-usb-zigbee-stick.patch usb-serial-cp210x-fix-comments-for-ge-cs1000.patch usb-serial-option-add-support-for-u-blox-lara-r6-family.patch usb-usb-storage-add-lacie-rugged-usb3-fw-to-ignore_uas.patch --- diff --git a/queue-4.14/series b/queue-4.14/series index ec2fcb0d68c..dd53ff4f912 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -62,3 +62,10 @@ alsa-sb-fix-potential-abba-deadlock-in-csp-driver.patch xhci-fix-lost-usb-2-remote-wake.patch kvm-ppc-book3s-fix-h_rtas-rets-buffer-overflow.patch usb-hub-disable-usb-3-device-initiated-lpm-if-exit-latency-is-too-high.patch +usb-usb-storage-add-lacie-rugged-usb3-fw-to-ignore_uas.patch +usb-max-3421-prevent-corruption-of-freed-memory.patch +usb-renesas_usbhs-fix-superfluous-irqs-happen-after-usb_pkt_pop.patch +usb-serial-option-add-support-for-u-blox-lara-r6-family.patch +usb-serial-cp210x-fix-comments-for-ge-cs1000.patch +usb-serial-cp210x-add-id-for-cel-em3588-usb-zigbee-stick.patch +usb-dwc2-gadget-fix-sending-zero-length-packet-in-ddma-mode.patch diff --git a/queue-4.14/usb-dwc2-gadget-fix-sending-zero-length-packet-in-ddma-mode.patch b/queue-4.14/usb-dwc2-gadget-fix-sending-zero-length-packet-in-ddma-mode.patch new file mode 100644 index 00000000000..2717de378fb --- /dev/null +++ b/queue-4.14/usb-dwc2-gadget-fix-sending-zero-length-packet-in-ddma-mode.patch @@ -0,0 +1,47 @@ +From d53dc38857f6dbefabd9eecfcbf67b6eac9a1ef4 Mon Sep 17 00:00:00 2001 +From: Minas Harutyunyan +Date: Tue, 20 Jul 2021 05:41:24 -0700 +Subject: usb: dwc2: gadget: Fix sending zero length packet in DDMA mode. + +From: Minas Harutyunyan + +commit d53dc38857f6dbefabd9eecfcbf67b6eac9a1ef4 upstream. + +Sending zero length packet in DDMA mode perform by DMA descriptor +by setting SP (short packet) flag. + +For DDMA in function dwc2_hsotg_complete_in() does not need to send +zlp. + +Tested by USBCV MSC tests. + +Fixes: f71b5e2533de ("usb: dwc2: gadget: fix zero length packet transfers") +Cc: stable +Signed-off-by: Minas Harutyunyan +Link: https://lore.kernel.org/r/967bad78c55dd2db1c19714eee3d0a17cf99d74a.1626777738.git.Minas.Harutyunyan@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/gadget.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -2702,12 +2702,14 @@ static void dwc2_hsotg_complete_in(struc + return; + } + +- /* Zlp for all endpoints, for ep0 only in DATA IN stage */ ++ /* Zlp for all endpoints in non DDMA, for ep0 only in DATA IN stage */ + if (hs_ep->send_zlp) { +- dwc2_hsotg_program_zlp(hsotg, hs_ep); + hs_ep->send_zlp = 0; +- /* transfer will be completed on next complete interrupt */ +- return; ++ if (!using_desc_dma(hsotg)) { ++ dwc2_hsotg_program_zlp(hsotg, hs_ep); ++ /* transfer will be completed on next complete interrupt */ ++ return; ++ } + } + + if (hs_ep->index == 0 && hsotg->ep0_state == DWC2_EP0_DATA_IN) { diff --git a/queue-4.14/usb-max-3421-prevent-corruption-of-freed-memory.patch b/queue-4.14/usb-max-3421-prevent-corruption-of-freed-memory.patch new file mode 100644 index 00000000000..90868a606c4 --- /dev/null +++ b/queue-4.14/usb-max-3421-prevent-corruption-of-freed-memory.patch @@ -0,0 +1,132 @@ +From b5fdf5c6e6bee35837e160c00ac89327bdad031b Mon Sep 17 00:00:00 2001 +From: Mark Tomlinson +Date: Fri, 25 Jun 2021 15:14:56 +1200 +Subject: usb: max-3421: Prevent corruption of freed memory + +From: Mark Tomlinson + +commit b5fdf5c6e6bee35837e160c00ac89327bdad031b upstream. + +The MAX-3421 USB driver remembers the state of the USB toggles for a +device/endpoint. To save SPI writes, this was only done when a new +device/endpoint was being used. Unfortunately, if the old device was +removed, this would cause writes to freed memory. + +To fix this, a simpler scheme is used. The toggles are read from +hardware when a URB is completed, and the toggles are always written to +hardware when any URB transaction is started. This will cause a few more +SPI transactions, but no causes kernel panics. + +Fixes: 2d53139f3162 ("Add support for using a MAX3421E chip as a host driver.") +Cc: stable +Signed-off-by: Mark Tomlinson +Link: https://lore.kernel.org/r/20210625031456.8632-1-mark.tomlinson@alliedtelesis.co.nz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/max3421-hcd.c | 44 +++++++++++++---------------------------- + 1 file changed, 14 insertions(+), 30 deletions(-) + +--- a/drivers/usb/host/max3421-hcd.c ++++ b/drivers/usb/host/max3421-hcd.c +@@ -149,8 +149,6 @@ struct max3421_hcd { + */ + struct urb *curr_urb; + enum scheduling_pass sched_pass; +- struct usb_device *loaded_dev; /* dev that's loaded into the chip */ +- int loaded_epnum; /* epnum whose toggles are loaded */ + int urb_done; /* > 0 -> no errors, < 0: errno */ + size_t curr_len; + u8 hien; +@@ -488,39 +486,17 @@ max3421_set_speed(struct usb_hcd *hcd, s + * Caller must NOT hold HCD spinlock. + */ + static void +-max3421_set_address(struct usb_hcd *hcd, struct usb_device *dev, int epnum, +- int force_toggles) ++max3421_set_address(struct usb_hcd *hcd, struct usb_device *dev, int epnum) + { +- struct max3421_hcd *max3421_hcd = hcd_to_max3421(hcd); +- int old_epnum, same_ep, rcvtog, sndtog; +- struct usb_device *old_dev; ++ int rcvtog, sndtog; + u8 hctl; + +- old_dev = max3421_hcd->loaded_dev; +- old_epnum = max3421_hcd->loaded_epnum; +- +- same_ep = (dev == old_dev && epnum == old_epnum); +- if (same_ep && !force_toggles) +- return; +- +- if (old_dev && !same_ep) { +- /* save the old end-points toggles: */ +- u8 hrsl = spi_rd8(hcd, MAX3421_REG_HRSL); +- +- rcvtog = (hrsl >> MAX3421_HRSL_RCVTOGRD_BIT) & 1; +- sndtog = (hrsl >> MAX3421_HRSL_SNDTOGRD_BIT) & 1; +- +- /* no locking: HCD (i.e., we) own toggles, don't we? */ +- usb_settoggle(old_dev, old_epnum, 0, rcvtog); +- usb_settoggle(old_dev, old_epnum, 1, sndtog); +- } + /* setup new endpoint's toggle bits: */ + rcvtog = usb_gettoggle(dev, epnum, 0); + sndtog = usb_gettoggle(dev, epnum, 1); + hctl = (BIT(rcvtog + MAX3421_HCTL_RCVTOG0_BIT) | + BIT(sndtog + MAX3421_HCTL_SNDTOG0_BIT)); + +- max3421_hcd->loaded_epnum = epnum; + spi_wr8(hcd, MAX3421_REG_HCTL, hctl); + + /* +@@ -528,7 +504,6 @@ max3421_set_address(struct usb_hcd *hcd, + * address-assignment so it's best to just always load the + * address whenever the end-point changed/was forced. + */ +- max3421_hcd->loaded_dev = dev; + spi_wr8(hcd, MAX3421_REG_PERADDR, dev->devnum); + } + +@@ -663,7 +638,7 @@ max3421_select_and_start_urb(struct usb_ + struct max3421_hcd *max3421_hcd = hcd_to_max3421(hcd); + struct urb *urb, *curr_urb = NULL; + struct max3421_ep *max3421_ep; +- int epnum, force_toggles = 0; ++ int epnum; + struct usb_host_endpoint *ep; + struct list_head *pos; + unsigned long flags; +@@ -773,7 +748,6 @@ done: + usb_settoggle(urb->dev, epnum, 0, 1); + usb_settoggle(urb->dev, epnum, 1, 1); + max3421_ep->pkt_state = PKT_STATE_SETUP; +- force_toggles = 1; + } else + max3421_ep->pkt_state = PKT_STATE_TRANSFER; + } +@@ -781,7 +755,7 @@ done: + spin_unlock_irqrestore(&max3421_hcd->lock, flags); + + max3421_ep->last_active = max3421_hcd->frame_number; +- max3421_set_address(hcd, urb->dev, epnum, force_toggles); ++ max3421_set_address(hcd, urb->dev, epnum); + max3421_set_speed(hcd, urb->dev); + max3421_next_transfer(hcd, 0); + return 1; +@@ -1376,6 +1350,16 @@ max3421_urb_done(struct usb_hcd *hcd) + status = 0; + urb = max3421_hcd->curr_urb; + if (urb) { ++ /* save the old end-points toggles: */ ++ u8 hrsl = spi_rd8(hcd, MAX3421_REG_HRSL); ++ int rcvtog = (hrsl >> MAX3421_HRSL_RCVTOGRD_BIT) & 1; ++ int sndtog = (hrsl >> MAX3421_HRSL_SNDTOGRD_BIT) & 1; ++ int epnum = usb_endpoint_num(&urb->ep->desc); ++ ++ /* no locking: HCD (i.e., we) own toggles, don't we? */ ++ usb_settoggle(urb->dev, epnum, 0, rcvtog); ++ usb_settoggle(urb->dev, epnum, 1, sndtog); ++ + max3421_hcd->curr_urb = NULL; + spin_lock_irqsave(&max3421_hcd->lock, flags); + usb_hcd_unlink_urb_from_ep(hcd, urb); diff --git a/queue-4.14/usb-renesas_usbhs-fix-superfluous-irqs-happen-after-usb_pkt_pop.patch b/queue-4.14/usb-renesas_usbhs-fix-superfluous-irqs-happen-after-usb_pkt_pop.patch new file mode 100644 index 00000000000..6f2e638abcb --- /dev/null +++ b/queue-4.14/usb-renesas_usbhs-fix-superfluous-irqs-happen-after-usb_pkt_pop.patch @@ -0,0 +1,51 @@ +From 5719df243e118fb343725e8b2afb1637e1af1373 Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Thu, 24 Jun 2021 21:20:39 +0900 +Subject: usb: renesas_usbhs: Fix superfluous irqs happen after usb_pkt_pop() + +From: Yoshihiro Shimoda + +commit 5719df243e118fb343725e8b2afb1637e1af1373 upstream. + +This driver has a potential issue which this driver is possible to +cause superfluous irqs after usb_pkt_pop() is called. So, after +the commit 3af32605289e ("usb: renesas_usbhs: fix error return +code of usbhsf_pkt_handler()") had been applied, we could observe +the following error happened when we used g_audio. + + renesas_usbhs e6590000.usb: irq_ready run_error 1 : -22 + +To fix the issue, disable the tx or rx interrupt in usb_pkt_pop(). + +Fixes: 2743e7f90dc0 ("usb: renesas_usbhs: fix the usb_pkt_pop()") +Cc: # v4.4+ +Signed-off-by: Yoshihiro Shimoda +Link: https://lore.kernel.org/r/20210624122039.596528-1-yoshihiro.shimoda.uh@renesas.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/renesas_usbhs/fifo.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/renesas_usbhs/fifo.c ++++ b/drivers/usb/renesas_usbhs/fifo.c +@@ -112,6 +112,8 @@ static struct dma_chan *usbhsf_dma_chan_ + #define usbhsf_dma_map(p) __usbhsf_dma_map_ctrl(p, 1) + #define usbhsf_dma_unmap(p) __usbhsf_dma_map_ctrl(p, 0) + static int __usbhsf_dma_map_ctrl(struct usbhs_pkt *pkt, int map); ++static void usbhsf_tx_irq_ctrl(struct usbhs_pipe *pipe, int enable); ++static void usbhsf_rx_irq_ctrl(struct usbhs_pipe *pipe, int enable); + struct usbhs_pkt *usbhs_pkt_pop(struct usbhs_pipe *pipe, struct usbhs_pkt *pkt) + { + struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe); +@@ -135,6 +137,11 @@ struct usbhs_pkt *usbhs_pkt_pop(struct u + dmaengine_terminate_all(chan); + usbhsf_fifo_clear(pipe, fifo); + usbhsf_dma_unmap(pkt); ++ } else { ++ if (usbhs_pipe_is_dir_in(pipe)) ++ usbhsf_rx_irq_ctrl(pipe, 0); ++ else ++ usbhsf_tx_irq_ctrl(pipe, 0); + } + + usbhs_pipe_running(pipe, 0); diff --git a/queue-4.14/usb-serial-cp210x-add-id-for-cel-em3588-usb-zigbee-stick.patch b/queue-4.14/usb-serial-cp210x-add-id-for-cel-em3588-usb-zigbee-stick.patch new file mode 100644 index 00000000000..604c02a7a7e --- /dev/null +++ b/queue-4.14/usb-serial-cp210x-add-id-for-cel-em3588-usb-zigbee-stick.patch @@ -0,0 +1,29 @@ +From d6a206e60124a9759dd7f6dfb86b0e1d3b1df82e Mon Sep 17 00:00:00 2001 +From: John Keeping +Date: Wed, 21 Jul 2021 17:17:45 +0100 +Subject: USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick + +From: John Keeping + +commit d6a206e60124a9759dd7f6dfb86b0e1d3b1df82e upstream. + +Add the USB serial device ID for the CEL ZigBee EM3588 radio stick. + +Signed-off-by: John Keeping +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -159,6 +159,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x10C4, 0x89A4) }, /* CESINEL FTBC Flexible Thyristor Bridge Controller */ + { USB_DEVICE(0x10C4, 0x89FB) }, /* Qivicon ZigBee USB Radio Stick */ + { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ ++ { USB_DEVICE(0x10C4, 0x8A5B) }, /* CEL EM3588 ZigBee USB Stick */ + { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */ + { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ diff --git a/queue-4.14/usb-serial-cp210x-fix-comments-for-ge-cs1000.patch b/queue-4.14/usb-serial-cp210x-fix-comments-for-ge-cs1000.patch new file mode 100644 index 00000000000..ed42500f4da --- /dev/null +++ b/queue-4.14/usb-serial-cp210x-fix-comments-for-ge-cs1000.patch @@ -0,0 +1,34 @@ +From e9db418d4b828dd049caaf5ed65dc86f93bb1a0c Mon Sep 17 00:00:00 2001 +From: Ian Ray +Date: Mon, 19 Jul 2021 18:43:49 +0200 +Subject: USB: serial: cp210x: fix comments for GE CS1000 + +From: Ian Ray + +commit e9db418d4b828dd049caaf5ed65dc86f93bb1a0c upstream. + +Fix comments for GE CS1000 CP210x USB ID assignments. + +Fixes: 42213a0190b5 ("USB: serial: cp210x: add some more GE USB IDs") +Signed-off-by: Ian Ray +Signed-off-by: Sebastian Reichel +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/cp210x.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -206,8 +206,8 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */ + { USB_DEVICE(0x1901, 0x0195) }, /* GE B850/B650/B450 CP2104 DP UART interface */ + { USB_DEVICE(0x1901, 0x0196) }, /* GE B850 CP2105 DP UART interface */ +- { USB_DEVICE(0x1901, 0x0197) }, /* GE CS1000 Display serial interface */ +- { USB_DEVICE(0x1901, 0x0198) }, /* GE CS1000 M.2 Key E serial interface */ ++ { USB_DEVICE(0x1901, 0x0197) }, /* GE CS1000 M.2 Key E serial interface */ ++ { USB_DEVICE(0x1901, 0x0198) }, /* GE CS1000 Display serial interface */ + { USB_DEVICE(0x199B, 0xBA30) }, /* LORD WSDA-200-USB */ + { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */ + { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ diff --git a/queue-4.14/usb-serial-option-add-support-for-u-blox-lara-r6-family.patch b/queue-4.14/usb-serial-option-add-support-for-u-blox-lara-r6-family.patch new file mode 100644 index 00000000000..50a1d1efa9e --- /dev/null +++ b/queue-4.14/usb-serial-option-add-support-for-u-blox-lara-r6-family.patch @@ -0,0 +1,49 @@ +From 94b619a07655805a1622484967754f5848640456 Mon Sep 17 00:00:00 2001 +From: Marco De Marco +Date: Mon, 5 Jul 2021 19:44:21 +0000 +Subject: USB: serial: option: add support for u-blox LARA-R6 family + +From: Marco De Marco + +commit 94b619a07655805a1622484967754f5848640456 upstream. + +The patch is meant to support LARA-R6 Cat 1 module family. + +Module USB ID: +Vendor ID: 0x05c6 +Product ID: 0x90fA + +Interface layout: +If 0: Diagnostic +If 1: AT parser +If 2: AT parser +If 3: QMI wwan (not available in all versions) + +Signed-off-by: Marco De Marco +Link: https://lore.kernel.org/r/49260184.kfMIbaSn9k@mars +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -241,6 +241,7 @@ static void option_instat_callback(struc + #define QUECTEL_PRODUCT_UC15 0x9090 + /* These u-blox products use Qualcomm's vendor ID */ + #define UBLOX_PRODUCT_R410M 0x90b2 ++#define UBLOX_PRODUCT_R6XX 0x90fa + /* These Yuga products use Qualcomm's vendor ID */ + #define YUGA_PRODUCT_CLM920_NC5 0x9625 + +@@ -1104,6 +1105,8 @@ static const struct usb_device_id option + /* u-blox products using Qualcomm vendor ID */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R410M), + .driver_info = RSVD(1) | RSVD(3) }, ++ { USB_DEVICE(QUALCOMM_VENDOR_ID, UBLOX_PRODUCT_R6XX), ++ .driver_info = RSVD(3) }, + /* Quectel products using Quectel vendor ID */ + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21, 0xff, 0xff, 0xff), + .driver_info = NUMEP2 }, diff --git a/queue-4.14/usb-usb-storage-add-lacie-rugged-usb3-fw-to-ignore_uas.patch b/queue-4.14/usb-usb-storage-add-lacie-rugged-usb3-fw-to-ignore_uas.patch new file mode 100644 index 00000000000..c40142591fa --- /dev/null +++ b/queue-4.14/usb-usb-storage-add-lacie-rugged-usb3-fw-to-ignore_uas.patch @@ -0,0 +1,42 @@ +From 6abf2fe6b4bf6e5256b80c5817908151d2d33e9f Mon Sep 17 00:00:00 2001 +From: Julian Sikorski +Date: Tue, 20 Jul 2021 19:19:10 +0200 +Subject: USB: usb-storage: Add LaCie Rugged USB3-FW to IGNORE_UAS + +From: Julian Sikorski + +commit 6abf2fe6b4bf6e5256b80c5817908151d2d33e9f upstream. + +LaCie Rugged USB3-FW appears to be incompatible with UAS. It generates +errors like: +[ 1151.582598] sd 14:0:0:0: tag#16 uas_eh_abort_handler 0 uas-tag 1 inflight: IN +[ 1151.582602] sd 14:0:0:0: tag#16 CDB: Report supported operation codes a3 0c 01 12 00 00 00 00 02 00 00 00 +[ 1151.588594] scsi host14: uas_eh_device_reset_handler start +[ 1151.710482] usb 2-4: reset SuperSpeed Gen 1 USB device number 2 using xhci_hcd +[ 1151.741398] scsi host14: uas_eh_device_reset_handler success +[ 1181.785534] scsi host14: uas_eh_device_reset_handler start + +Signed-off-by: Julian Sikorski +Cc: stable +Link: https://lore.kernel.org/r/20210720171910.36497-1-belegdol+github@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/storage/unusual_uas.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -58,6 +58,13 @@ UNUSUAL_DEV(0x059f, 0x105f, 0x0000, 0x99 + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_NO_REPORT_OPCODES | US_FL_NO_SAME), + ++/* Reported-by: Julian Sikorski */ ++UNUSUAL_DEV(0x059f, 0x1061, 0x0000, 0x9999, ++ "LaCie", ++ "Rugged USB3-FW", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_IGNORE_UAS), ++ + /* + * Apricorn USB3 dongle sometimes returns "USBSUSBSUSBS" in response to SCSI + * commands in UAS mode. Observed with the 1.28 firmware; are there others?