From: Greg Kroah-Hartman Date: Sun, 1 Sep 2024 09:27:50 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.19.321~29 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b26494bbfb90ed993abda826d3f5e964f31af20a;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: cdc-acm-add-disable_echo-quirk-for-ge-healthcare-ui-controller.patch usb-core-sysfs-unmerge-usb3_hardware_lpm_attr_group-in-remove_power_attributes.patch usb-dwc3-core-prevent-usb-core-invalid-event-buffer-address-access.patch usb-dwc3-omap-add-missing-depopulate-in-probe-error-path.patch usb-dwc3-st-fix-probed-platform-device-ref-count-on-probe-error-path.patch usb-serial-option-add-meig-smart-srm825l.patch --- diff --git a/queue-4.19/cdc-acm-add-disable_echo-quirk-for-ge-healthcare-ui-controller.patch b/queue-4.19/cdc-acm-add-disable_echo-quirk-for-ge-healthcare-ui-controller.patch new file mode 100644 index 00000000000..895fdacb491 --- /dev/null +++ b/queue-4.19/cdc-acm-add-disable_echo-quirk-for-ge-healthcare-ui-controller.patch @@ -0,0 +1,33 @@ +From 0b00583ecacb0b51712a5ecd34cf7e6684307c67 Mon Sep 17 00:00:00 2001 +From: Ian Ray +Date: Wed, 14 Aug 2024 10:29:05 +0300 +Subject: cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller + +From: Ian Ray + +commit 0b00583ecacb0b51712a5ecd34cf7e6684307c67 upstream. + +USB_DEVICE(0x1901, 0x0006) may send data before cdc_acm is ready, which +may be misinterpreted in the default N_TTY line discipline. + +Signed-off-by: Ian Ray +Acked-by: Oliver Neuku +Cc: stable +Link: https://lore.kernel.org/r/20240814072905.2501-1-ian.ray@gehealthcare.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/cdc-acm.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1807,6 +1807,9 @@ static const struct usb_device_id acm_id + { USB_DEVICE(0x11ca, 0x0201), /* VeriFone Mx870 Gadget Serial */ + .driver_info = SINGLE_RX_URB, + }, ++ { USB_DEVICE(0x1901, 0x0006), /* GE Healthcare Patient Monitor UI Controller */ ++ .driver_info = DISABLE_ECHO, /* DISABLE ECHO in termios flag */ ++ }, + { USB_DEVICE(0x1965, 0x0018), /* Uniden UBC125XLT */ + .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ + }, diff --git a/queue-4.19/series b/queue-4.19/series index 2f07ab5284f..dc872cda958 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -87,3 +87,9 @@ net-prevent-mss-overflow-in-skb_segment.patch soundwire-stream-fix-programming-slave-ports-for-non-continous-port-maps.patch gtp-fix-a-potential-null-pointer-dereference.patch net-busy-poll-use-ktime_get_ns-instead-of-local_cloc.patch +cdc-acm-add-disable_echo-quirk-for-ge-healthcare-ui-controller.patch +usb-serial-option-add-meig-smart-srm825l.patch +usb-dwc3-omap-add-missing-depopulate-in-probe-error-path.patch +usb-dwc3-core-prevent-usb-core-invalid-event-buffer-address-access.patch +usb-dwc3-st-fix-probed-platform-device-ref-count-on-probe-error-path.patch +usb-core-sysfs-unmerge-usb3_hardware_lpm_attr_group-in-remove_power_attributes.patch diff --git a/queue-4.19/usb-core-sysfs-unmerge-usb3_hardware_lpm_attr_group-in-remove_power_attributes.patch b/queue-4.19/usb-core-sysfs-unmerge-usb3_hardware_lpm_attr_group-in-remove_power_attributes.patch new file mode 100644 index 00000000000..855c556fd55 --- /dev/null +++ b/queue-4.19/usb-core-sysfs-unmerge-usb3_hardware_lpm_attr_group-in-remove_power_attributes.patch @@ -0,0 +1,32 @@ +From 3a8839bbb86da7968a792123ed2296d063871a52 Mon Sep 17 00:00:00 2001 +From: Zijun Hu +Date: Tue, 20 Aug 2024 19:01:27 +0800 +Subject: usb: core: sysfs: Unmerge @usb3_hardware_lpm_attr_group in remove_power_attributes() + +From: Zijun Hu + +commit 3a8839bbb86da7968a792123ed2296d063871a52 upstream. + +Device attribute group @usb3_hardware_lpm_attr_group is merged by +add_power_attributes(), but it is not unmerged explicitly, fixed by +unmerging it in remove_power_attributes(). + +Fixes: 655fe4effe0f ("usbcore: add sysfs support to xHCI usb3 hardware LPM") +Cc: stable@vger.kernel.org +Signed-off-by: Zijun Hu +Link: https://lore.kernel.org/r/20240820-sysfs_fix-v2-1-a9441487077e@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/sysfs.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/core/sysfs.c ++++ b/drivers/usb/core/sysfs.c +@@ -689,6 +689,7 @@ static int add_power_attributes(struct d + + static void remove_power_attributes(struct device *dev) + { ++ sysfs_unmerge_group(&dev->kobj, &usb3_hardware_lpm_attr_group); + sysfs_unmerge_group(&dev->kobj, &usb2_hardware_lpm_attr_group); + sysfs_unmerge_group(&dev->kobj, &power_attr_group); + } diff --git a/queue-4.19/usb-dwc3-core-prevent-usb-core-invalid-event-buffer-address-access.patch b/queue-4.19/usb-dwc3-core-prevent-usb-core-invalid-event-buffer-address-access.patch new file mode 100644 index 00000000000..8a0c1affc0a --- /dev/null +++ b/queue-4.19/usb-dwc3-core-prevent-usb-core-invalid-event-buffer-address-access.patch @@ -0,0 +1,55 @@ +From 14e497183df28c006603cc67fd3797a537eef7b9 Mon Sep 17 00:00:00 2001 +From: Selvarasu Ganesan +Date: Thu, 15 Aug 2024 12:18:31 +0530 +Subject: usb: dwc3: core: Prevent USB core invalid event buffer address access + +From: Selvarasu Ganesan + +commit 14e497183df28c006603cc67fd3797a537eef7b9 upstream. + +This commit addresses an issue where the USB core could access an +invalid event buffer address during runtime suspend, potentially causing +SMMU faults and other memory issues in Exynos platforms. The problem +arises from the following sequence. + 1. In dwc3_gadget_suspend, there is a chance of a timeout when + moving the USB core to the halt state after clearing the + run/stop bit by software. + 2. In dwc3_core_exit, the event buffer is cleared regardless of + the USB core's status, which may lead to an SMMU faults and + other memory issues. if the USB core tries to access the event + buffer address. + +To prevent this hardware quirk on Exynos platforms, this commit ensures +that the event buffer address is not cleared by software when the USB +core is active during runtime suspend by checking its status before +clearing the buffer address. + +Cc: stable +Signed-off-by: Selvarasu Ganesan +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/20240815064836.1491-1-selvarasu.g@samsung.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -419,9 +419,17 @@ int dwc3_event_buffers_setup(struct dwc3 + void dwc3_event_buffers_cleanup(struct dwc3 *dwc) + { + struct dwc3_event_buffer *evt; ++ u32 reg; + + if (!dwc->ev_buf) + return; ++ /* ++ * Exynos platforms may not be able to access event buffer if the ++ * controller failed to halt on dwc3_core_exit(). ++ */ ++ reg = dwc3_readl(dwc->regs, DWC3_DSTS); ++ if (!(reg & DWC3_DSTS_DEVCTRLHLT)) ++ return; + + evt = dwc->ev_buf; + diff --git a/queue-4.19/usb-dwc3-omap-add-missing-depopulate-in-probe-error-path.patch b/queue-4.19/usb-dwc3-omap-add-missing-depopulate-in-probe-error-path.patch new file mode 100644 index 00000000000..b8a176110b2 --- /dev/null +++ b/queue-4.19/usb-dwc3-omap-add-missing-depopulate-in-probe-error-path.patch @@ -0,0 +1,40 @@ +From 2aa765a43817ec8add990f83c8e54a9a5d87aa9c Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Fri, 16 Aug 2024 09:54:08 +0200 +Subject: usb: dwc3: omap: add missing depopulate in probe error path + +From: Krzysztof Kozlowski + +commit 2aa765a43817ec8add990f83c8e54a9a5d87aa9c upstream. + +Depopulate device in probe error paths to fix leak of children +resources. + +Fixes: ee249b455494 ("usb: dwc3: omap: remove IRQ_NOAUTOEN used with shared irq") +Cc: stable@vger.kernel.org +Acked-by: Thinh Nguyen +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Radhey Shyam Pandey +Link: https://lore.kernel.org/r/20240816075409.23080-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-omap.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/dwc3-omap.c ++++ b/drivers/usb/dwc3/dwc3-omap.c +@@ -526,11 +526,13 @@ static int dwc3_omap_probe(struct platfo + if (ret) { + dev_err(dev, "failed to request IRQ #%d --> %d\n", + omap->irq, ret); +- goto err1; ++ goto err2; + } + dwc3_omap_enable_irqs(omap); + return 0; + ++err2: ++ of_platform_depopulate(dev); + err1: + pm_runtime_put_sync(dev); + pm_runtime_disable(dev); diff --git a/queue-4.19/usb-dwc3-st-fix-probed-platform-device-ref-count-on-probe-error-path.patch b/queue-4.19/usb-dwc3-st-fix-probed-platform-device-ref-count-on-probe-error-path.patch new file mode 100644 index 00000000000..4d31b452e9e --- /dev/null +++ b/queue-4.19/usb-dwc3-st-fix-probed-platform-device-ref-count-on-probe-error-path.patch @@ -0,0 +1,61 @@ +From ddfcfeba891064b88bb844208b43bef2ef970f0c Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 14 Aug 2024 11:39:56 +0200 +Subject: usb: dwc3: st: fix probed platform device ref count on probe error path + +From: Krzysztof Kozlowski + +commit ddfcfeba891064b88bb844208b43bef2ef970f0c upstream. + +The probe function never performs any paltform device allocation, thus +error path "undo_platform_dev_alloc" is entirely bogus. It drops the +reference count from the platform device being probed. If error path is +triggered, this will lead to unbalanced device reference counts and +premature release of device resources, thus possible use-after-free when +releasing remaining devm-managed resources. + +Fixes: f83fca0707c6 ("usb: dwc3: add ST dwc3 glue layer to manage dwc3 HC") +Cc: stable@vger.kernel.org +Signed-off-by: Krzysztof Kozlowski +Acked-by: Thinh Nguyen +Reviewed-by: Patrice Chotard +Link: https://lore.kernel.org/r/20240814093957.37940-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-st.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +--- a/drivers/usb/dwc3/dwc3-st.c ++++ b/drivers/usb/dwc3/dwc3-st.c +@@ -219,10 +219,8 @@ static int st_dwc3_probe(struct platform + dwc3_data->regmap = regmap; + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "syscfg-reg"); +- if (!res) { +- ret = -ENXIO; +- goto undo_platform_dev_alloc; +- } ++ if (!res) ++ return -ENXIO; + + dwc3_data->syscfg_reg_off = res->start; + +@@ -233,8 +231,7 @@ static int st_dwc3_probe(struct platform + devm_reset_control_get_exclusive(dev, "powerdown"); + if (IS_ERR(dwc3_data->rstc_pwrdn)) { + dev_err(&pdev->dev, "could not get power controller\n"); +- ret = PTR_ERR(dwc3_data->rstc_pwrdn); +- goto undo_platform_dev_alloc; ++ return PTR_ERR(dwc3_data->rstc_pwrdn); + } + + /* Manage PowerDown */ +@@ -296,8 +293,6 @@ undo_softreset: + reset_control_assert(dwc3_data->rstc_rst); + undo_powerdown: + reset_control_assert(dwc3_data->rstc_pwrdn); +-undo_platform_dev_alloc: +- platform_device_put(pdev); + return ret; + } + diff --git a/queue-4.19/usb-serial-option-add-meig-smart-srm825l.patch b/queue-4.19/usb-serial-option-add-meig-smart-srm825l.patch new file mode 100644 index 00000000000..eb2381ed902 --- /dev/null +++ b/queue-4.19/usb-serial-option-add-meig-smart-srm825l.patch @@ -0,0 +1,71 @@ +From 9a471de516c35219d1722c13367191ce1f120fe9 Mon Sep 17 00:00:00 2001 +From: ZHANG Yuntian +Date: Sat, 3 Aug 2024 15:46:07 +0800 +Subject: USB: serial: option: add MeiG Smart SRM825L + +From: ZHANG Yuntian + +commit 9a471de516c35219d1722c13367191ce1f120fe9 upstream. + +Add support for MeiG Smart SRM825L which is based on Qualcomm 315 chip. + +T: Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=2dee ProdID=4d22 Rev= 4.14 +S: Manufacturer=MEIG +S: Product=LTE-A Module +S: SerialNumber=6f345e48 +C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=896mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan +E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +Signed-off-by: ZHANG Yuntian +Link: https://lore.kernel.org/0041DFA5200EFB1B+20240803074619.563116-1-yt@radxa.com/ +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -619,6 +619,8 @@ static void option_instat_callback(struc + + /* MeiG Smart Technology products */ + #define MEIGSMART_VENDOR_ID 0x2dee ++/* MeiG Smart SRM825L based on Qualcomm 315 */ ++#define MEIGSMART_PRODUCT_SRM825L 0x4d22 + /* MeiG Smart SLM320 based on UNISOC UIS8910 */ + #define MEIGSMART_PRODUCT_SLM320 0x4d41 + +@@ -2366,6 +2368,9 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, LUAT_PRODUCT_AIR720U, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SLM320, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x40) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(MEIGSMART_VENDOR_ID, MEIGSMART_PRODUCT_SRM825L, 0xff, 0xff, 0x60) }, + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids);