From: Greg Kroah-Hartman Date: Mon, 5 Apr 2021 08:06:28 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v4.4.265~18 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bb3a968025a46ed0169aa1a8d1a9d0fdae97ac0d;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: cdc-acm-fix-break-rx-code-path-adding-necessary-calls.patch usb-cdc-acm-downgrade-message-to-debug.patch usb-cdc-acm-fix-double-free-on-probe-failure.patch usb-cdc-acm-fix-use-after-free-after-probe-failure.patch usb-cdc-acm-untangle-a-circular-dependency-between-callback-and-softint.patch usb-dwc2-fix-hprt0.prtsusp-bit-setting-for-hikey-960-board.patch usb-dwc2-prevent-core-suspend-when-port-connection-flag-is-0.patch usb-dwc3-gadget-clear-dep-flags-after-stop-transfers-in-ep-disable.patch usb-dwc3-qcom-skip-interconnect-init-for-acpi-probe.patch usb-gadget-udc-amd5536udc_pci-fix-null-ptr-dereference.patch usb-musb-fix-suspend-with-devices-connected-for-a64.patch usb-quirks-ignore-remote-wake-up-on-fibocom-l850-gl-lte-modem.patch usb-xhci-mtk-fix-broken-streams-issue-on-0.96-xhci.patch usbip-vhci_hcd-fix-shift-out-of-bounds-in-vhci_hub_control.patch --- diff --git a/queue-5.10/cdc-acm-fix-break-rx-code-path-adding-necessary-calls.patch b/queue-5.10/cdc-acm-fix-break-rx-code-path-adding-necessary-calls.patch new file mode 100644 index 00000000000..7282a4dd188 --- /dev/null +++ b/queue-5.10/cdc-acm-fix-break-rx-code-path-adding-necessary-calls.patch @@ -0,0 +1,35 @@ +From 08dff274edda54310d6f1cf27b62fddf0f8d146e Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 11 Mar 2021 14:37:14 +0100 +Subject: cdc-acm: fix BREAK rx code path adding necessary calls + +From: Oliver Neukum + +commit 08dff274edda54310d6f1cf27b62fddf0f8d146e upstream. + +Counting break events is nice but we should actually report them to +the tty layer. + +Fixes: 5a6a62bdb9257 ("cdc-acm: add TIOCMIWAIT") +Signed-off-by: Oliver Neukum +Link: https://lore.kernel.org/r/20210311133714.31881-1-oneukum@suse.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/cdc-acm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -313,8 +313,10 @@ static void acm_process_notification(str + acm->iocount.dsr++; + if (difference & ACM_CTRL_DCD) + acm->iocount.dcd++; +- if (newctrl & ACM_CTRL_BRK) ++ if (newctrl & ACM_CTRL_BRK) { + acm->iocount.brk++; ++ tty_insert_flip_char(&acm->port, 0, TTY_BREAK); ++ } + if (newctrl & ACM_CTRL_RI) + acm->iocount.rng++; + if (newctrl & ACM_CTRL_FRAMING) diff --git a/queue-5.10/series b/queue-5.10/series index 262163154fa..5c3ec62a1d2 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -102,3 +102,17 @@ firmware-stratix10-svc-reset-command_reconfig_flag_p.patch usb-dwc3-pci-enable-dis_ux_susphy_quirk-for-intel-me.patch video-hyperv_fb-fix-a-double-free-in-hvfb_probe.patch firewire-nosy-fix-a-use-after-free-bug-in-nosy_ioctl.patch +usbip-vhci_hcd-fix-shift-out-of-bounds-in-vhci_hub_control.patch +usb-quirks-ignore-remote-wake-up-on-fibocom-l850-gl-lte-modem.patch +usb-musb-fix-suspend-with-devices-connected-for-a64.patch +usb-xhci-mtk-fix-broken-streams-issue-on-0.96-xhci.patch +cdc-acm-fix-break-rx-code-path-adding-necessary-calls.patch +usb-cdc-acm-untangle-a-circular-dependency-between-callback-and-softint.patch +usb-cdc-acm-downgrade-message-to-debug.patch +usb-cdc-acm-fix-double-free-on-probe-failure.patch +usb-cdc-acm-fix-use-after-free-after-probe-failure.patch +usb-gadget-udc-amd5536udc_pci-fix-null-ptr-dereference.patch +usb-dwc2-fix-hprt0.prtsusp-bit-setting-for-hikey-960-board.patch +usb-dwc2-prevent-core-suspend-when-port-connection-flag-is-0.patch +usb-dwc3-qcom-skip-interconnect-init-for-acpi-probe.patch +usb-dwc3-gadget-clear-dep-flags-after-stop-transfers-in-ep-disable.patch diff --git a/queue-5.10/usb-cdc-acm-downgrade-message-to-debug.patch b/queue-5.10/usb-cdc-acm-downgrade-message-to-debug.patch new file mode 100644 index 00000000000..c94e0e61872 --- /dev/null +++ b/queue-5.10/usb-cdc-acm-downgrade-message-to-debug.patch @@ -0,0 +1,33 @@ +From e4c77070ad45fc940af1d7fb1e637c349e848951 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 11 Mar 2021 14:01:26 +0100 +Subject: USB: cdc-acm: downgrade message to debug + +From: Oliver Neukum + +commit e4c77070ad45fc940af1d7fb1e637c349e848951 upstream. + +This failure is so common that logging an error here amounts +to spamming log files. + +Reviewed-by: Bruno Thomsen +Signed-off-by: Oliver Neukum +Cc: stable +Link: https://lore.kernel.org/r/20210311130126.15972-2-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/cdc-acm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -659,7 +659,8 @@ static void acm_port_dtr_rts(struct tty_ + + res = acm_set_control(acm, val); + if (res && (acm->ctrl_caps & USB_CDC_CAP_LINE)) +- dev_err(&acm->control->dev, "failed to set dtr/rts\n"); ++ /* This is broken in too many devices to spam the logs */ ++ dev_dbg(&acm->control->dev, "failed to set dtr/rts\n"); + } + + static int acm_port_activate(struct tty_port *port, struct tty_struct *tty) diff --git a/queue-5.10/usb-cdc-acm-fix-double-free-on-probe-failure.patch b/queue-5.10/usb-cdc-acm-fix-double-free-on-probe-failure.patch new file mode 100644 index 00000000000..b4b74c3065d --- /dev/null +++ b/queue-5.10/usb-cdc-acm-fix-double-free-on-probe-failure.patch @@ -0,0 +1,37 @@ +From 7180495cb3d0e2a2860d282a468b4146c21da78f Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 22 Mar 2021 16:53:11 +0100 +Subject: USB: cdc-acm: fix double free on probe failure + +From: Johan Hovold + +commit 7180495cb3d0e2a2860d282a468b4146c21da78f upstream. + +If tty-device registration fails the driver copy of any Country +Selection functional descriptor would end up being freed twice; first +explicitly in the error path and then again in the tty-port destructor. + +Drop the first erroneous free that was left when fixing a tty-port +resource leak. + +Fixes: cae2bc768d17 ("usb: cdc-acm: Decrement tty port's refcount if probe() fail") +Cc: stable@vger.kernel.org # 4.19 +Cc: Jaejoong Kim +Acked-by: Oliver Neukum +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210322155318.9837-2-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/cdc-acm.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1521,7 +1521,6 @@ alloc_fail6: + &dev_attr_wCountryCodes); + device_remove_file(&acm->control->dev, + &dev_attr_iCountryCodeRelDate); +- kfree(acm->country_codes); + } + device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities); + alloc_fail5: diff --git a/queue-5.10/usb-cdc-acm-fix-use-after-free-after-probe-failure.patch b/queue-5.10/usb-cdc-acm-fix-use-after-free-after-probe-failure.patch new file mode 100644 index 00000000000..bbb01813c14 --- /dev/null +++ b/queue-5.10/usb-cdc-acm-fix-use-after-free-after-probe-failure.patch @@ -0,0 +1,39 @@ +From 4e49bf376c0451ad2eae2592e093659cde12be9a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 22 Mar 2021 16:53:12 +0100 +Subject: USB: cdc-acm: fix use-after-free after probe failure + +From: Johan Hovold + +commit 4e49bf376c0451ad2eae2592e093659cde12be9a upstream. + +If tty-device registration fails the driver would fail to release the +data interface. When the device is later disconnected, the disconnect +callback would still be called for the data interface and would go about +releasing already freed resources. + +Fixes: c93d81955005 ("usb: cdc-acm: fix error handling in acm_probe()") +Cc: stable@vger.kernel.org # 3.9 +Cc: Alexey Khoroshilov +Acked-by: Oliver Neukum +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210322155318.9837-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/cdc-acm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1516,6 +1516,11 @@ skip_countries: + + return 0; + alloc_fail6: ++ if (!acm->combined_interfaces) { ++ /* Clear driver data so that disconnect() returns early. */ ++ usb_set_intfdata(data_interface, NULL); ++ usb_driver_release_interface(&acm_driver, data_interface); ++ } + if (acm->country_codes) { + device_remove_file(&acm->control->dev, + &dev_attr_wCountryCodes); diff --git a/queue-5.10/usb-cdc-acm-untangle-a-circular-dependency-between-callback-and-softint.patch b/queue-5.10/usb-cdc-acm-untangle-a-circular-dependency-between-callback-and-softint.patch new file mode 100644 index 00000000000..867b83b59c7 --- /dev/null +++ b/queue-5.10/usb-cdc-acm-untangle-a-circular-dependency-between-callback-and-softint.patch @@ -0,0 +1,194 @@ +From 6069e3e927c8fb3a1947b07d1a561644ea960248 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 11 Mar 2021 14:01:25 +0100 +Subject: USB: cdc-acm: untangle a circular dependency between callback and softint + +From: Oliver Neukum + +commit 6069e3e927c8fb3a1947b07d1a561644ea960248 upstream. + +We have a cycle of callbacks scheduling works which submit +URBs with thos callbacks. This needs to be blocked, stopped +and unblocked to untangle the circle. + +The issue leads to faults like: + +[ 55.068392] Unable to handle kernel paging request at virtual address 6b6b6c03 +[ 55.075624] pgd = be866494 +[ 55.078335] [6b6b6c03] *pgd=00000000 +[ 55.081924] Internal error: Oops: 5 [#1] PREEMPT SMP ARM +[ 55.087238] Modules linked in: ppp_async crc_ccitt ppp_generic slhc +xt_TCPMSS xt_tcpmss xt_hl nf_log_ipv6 nf_log_ipv4 nf_log_common +xt_policy xt_limit xt_conntrack xt_tcpudp xt_pkttype ip6table_mangle +iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 +iptable_mangle ip6table_filter ip6_tables iptable_filter ip_tables +des_generic md5 sch_fq_codel cdc_mbim cdc_wdm cdc_ncm usbnet mii +cdc_acm usb_storage ip_tunnel xfrm_user xfrm6_tunnel tunnel6 +xfrm4_tunnel tunnel4 esp6 esp4 ah6 ah4 xfrm_algo xt_LOG xt_LED +xt_comment x_tables ipv6 +[ 55.134954] CPU: 0 PID: 82 Comm: kworker/0:2 Tainted: G + T 5.8.17 #1 +[ 55.142526] Hardware name: Freescale i.MX7 Dual (Device Tree) +[ 55.148304] Workqueue: events acm_softint [cdc_acm] +[ 55.153196] PC is at kobject_get+0x10/0xa4 +[ 55.157302] LR is at usb_get_dev+0x14/0x1c +[ 55.161402] pc : [<8047c06c>] lr : [<80560448>] psr: 20000193 +[ 55.167671] sp : bca39ea8 ip : 00007374 fp : bf6cbd80 +[ 55.172899] r10: 00000000 r9 : bdd92284 r8 : bdd92008 +[ 55.178128] r7 : 6b6b6b6b r6 : fffffffe r5 : 60000113 r4 : 6b6b6be3 +[ 55.184658] r3 : 6b6b6b6b r2 : 00000111 r1 : 00000000 r0 : 6b6b6be3 +[ 55.191191] Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none +[ 55.198417] Control: 10c5387d Table: bcf0c06a DAC: 00000051 +[ 55.204168] Process kworker/0:2 (pid: 82, stack limit = 0x9bdd2a89) +[ 55.210439] Stack: (0xbca39ea8 to 0xbca3a000) +[ 55.214805] 9ea0: bf6cbd80 80769a50 6b6b6b6b 80560448 bdeb0500 8056bfe8 +[ 55.222991] 9ec0: 00000002 b76da000 00000000 bdeb0500 bdd92448 bca38000 bdeb0510 8056d69c +[ 55.231177] 9ee0: bca38000 00000000 80c050fc 00000000 bca39f44 09d42015 00000000 00000001 +[ 55.239363] 9f00: bdd92448 bdd92438 bdd92000 7f1158c4 bdd92448 bca2ee00 bf6cbd80 bf6cef00 +[ 55.247549] 9f20: 00000000 00000000 00000000 801412d8 bf6cbd98 80c03d00 bca2ee00 bf6cbd80 +[ 55.255735] 9f40: bca2ee14 bf6cbd98 80c03d00 00000008 bca38000 80141568 00000000 80c446ae +[ 55.263921] 9f60: 00000000 bc9ed880 bc9f0700 bca38000 bc117eb4 80141524 bca2ee00 bc9ed8a4 +[ 55.272107] 9f80: 00000000 80147cc8 00000000 bc9f0700 80147b84 00000000 00000000 00000000 +[ 55.280292] 9fa0: 00000000 00000000 00000000 80100148 00000000 00000000 00000000 00000000 +[ 55.288477] 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +[ 55.296662] 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 +[ 55.304860] [<8047c06c>] (kobject_get) from [<80560448>] (usb_get_dev+0x14/0x1c) +[ 55.312271] [<80560448>] (usb_get_dev) from [<8056bfe8>] (usb_hcd_unlink_urb+0x50/0xd8) +[ 55.320286] [<8056bfe8>] (usb_hcd_unlink_urb) from [<8056d69c>] (usb_kill_urb.part.0+0x44/0xd0) +[ 55.329004] [<8056d69c>] (usb_kill_urb.part.0) from [<7f1158c4>] (acm_softint+0x4c/0x10c [cdc_acm]) +[ 55.338082] [<7f1158c4>] (acm_softint [cdc_acm]) from [<801412d8>] (process_one_work+0x19c/0x3e8) +[ 55.346969] [<801412d8>] (process_one_work) from [<80141568>] (worker_thread+0x44/0x4dc) +[ 55.355072] [<80141568>] (worker_thread) from [<80147cc8>] (kthread+0x144/0x180) +[ 55.362481] [<80147cc8>] (kthread) from [<80100148>] (ret_from_fork+0x14/0x2c) +[ 55.369706] Exception stack(0xbca39fb0 to 0xbca39ff8) + +Tested-by: Bruno Thomsen +Signed-off-by: Oliver Neukum +Cc: stable +Link: https://lore.kernel.org/r/20210311130126.15972-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/cdc-acm.c | 48 +++++++++++++++++++++++++++++--------------- + 1 file changed, 32 insertions(+), 16 deletions(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -147,17 +147,29 @@ static inline int acm_set_control(struct + #define acm_send_break(acm, ms) \ + acm_ctrl_msg(acm, USB_CDC_REQ_SEND_BREAK, ms, NULL, 0) + +-static void acm_kill_urbs(struct acm *acm) ++static void acm_poison_urbs(struct acm *acm) + { + int i; + +- usb_kill_urb(acm->ctrlurb); ++ usb_poison_urb(acm->ctrlurb); + for (i = 0; i < ACM_NW; i++) +- usb_kill_urb(acm->wb[i].urb); ++ usb_poison_urb(acm->wb[i].urb); + for (i = 0; i < acm->rx_buflimit; i++) +- usb_kill_urb(acm->read_urbs[i]); ++ usb_poison_urb(acm->read_urbs[i]); ++} ++ ++static void acm_unpoison_urbs(struct acm *acm) ++{ ++ int i; ++ ++ for (i = 0; i < acm->rx_buflimit; i++) ++ usb_unpoison_urb(acm->read_urbs[i]); ++ for (i = 0; i < ACM_NW; i++) ++ usb_unpoison_urb(acm->wb[i].urb); ++ usb_unpoison_urb(acm->ctrlurb); + } + ++ + /* + * Write buffer management. + * All of these assume proper locks taken by the caller. +@@ -226,9 +238,10 @@ static int acm_start_wb(struct acm *acm, + + rc = usb_submit_urb(wb->urb, GFP_ATOMIC); + if (rc < 0) { +- dev_err(&acm->data->dev, +- "%s - usb_submit_urb(write bulk) failed: %d\n", +- __func__, rc); ++ if (rc != -EPERM) ++ dev_err(&acm->data->dev, ++ "%s - usb_submit_urb(write bulk) failed: %d\n", ++ __func__, rc); + acm_write_done(acm, wb); + } + return rc; +@@ -482,11 +495,6 @@ static void acm_read_bulk_callback(struc + dev_vdbg(&acm->data->dev, "got urb %d, len %d, status %d\n", + rb->index, urb->actual_length, status); + +- if (!acm->dev) { +- dev_dbg(&acm->data->dev, "%s - disconnected\n", __func__); +- return; +- } +- + switch (status) { + case 0: + usb_mark_last_busy(acm->dev); +@@ -733,6 +741,7 @@ static void acm_port_shutdown(struct tty + * Need to grab write_lock to prevent race with resume, but no need to + * hold it due to the tty-port initialised flag. + */ ++ acm_poison_urbs(acm); + spin_lock_irq(&acm->write_lock); + spin_unlock_irq(&acm->write_lock); + +@@ -749,7 +758,8 @@ static void acm_port_shutdown(struct tty + usb_autopm_put_interface_async(acm->control); + } + +- acm_kill_urbs(acm); ++ acm_unpoison_urbs(acm); ++ + } + + static void acm_tty_cleanup(struct tty_struct *tty) +@@ -1542,8 +1552,14 @@ static void acm_disconnect(struct usb_in + if (!acm) + return; + +- mutex_lock(&acm->mutex); + acm->disconnected = true; ++ /* ++ * there is a circular dependency. acm_softint() can resubmit ++ * the URBs in error handling so we need to block any ++ * submission right away ++ */ ++ acm_poison_urbs(acm); ++ mutex_lock(&acm->mutex); + if (acm->country_codes) { + device_remove_file(&acm->control->dev, + &dev_attr_wCountryCodes); +@@ -1562,7 +1578,6 @@ static void acm_disconnect(struct usb_in + tty_kref_put(tty); + } + +- acm_kill_urbs(acm); + cancel_delayed_work_sync(&acm->dwork); + + tty_unregister_device(acm_tty_driver, acm->minor); +@@ -1604,7 +1619,7 @@ static int acm_suspend(struct usb_interf + if (cnt) + return 0; + +- acm_kill_urbs(acm); ++ acm_poison_urbs(acm); + cancel_delayed_work_sync(&acm->dwork); + acm->urbs_in_error_delay = 0; + +@@ -1617,6 +1632,7 @@ static int acm_resume(struct usb_interfa + struct urb *urb; + int rv = 0; + ++ acm_unpoison_urbs(acm); + spin_lock_irq(&acm->write_lock); + + if (--acm->susp_count) diff --git a/queue-5.10/usb-dwc2-fix-hprt0.prtsusp-bit-setting-for-hikey-960-board.patch b/queue-5.10/usb-dwc2-fix-hprt0.prtsusp-bit-setting-for-hikey-960-board.patch new file mode 100644 index 00000000000..3f333a39fe4 --- /dev/null +++ b/queue-5.10/usb-dwc2-fix-hprt0.prtsusp-bit-setting-for-hikey-960-board.patch @@ -0,0 +1,34 @@ +From 5e3bbae8ee3d677a0aa2919dc62b5c60ea01ba61 Mon Sep 17 00:00:00 2001 +From: Artur Petrosyan +Date: Fri, 26 Mar 2021 14:24:46 +0400 +Subject: usb: dwc2: Fix HPRT0.PrtSusp bit setting for HiKey 960 board. + +From: Artur Petrosyan + +commit 5e3bbae8ee3d677a0aa2919dc62b5c60ea01ba61 upstream. + +Increased the waiting timeout for HPRT0.PrtSusp register field +to be set, because on HiKey 960 board HPRT0.PrtSusp wasn't +generated with the existing timeout. + +Cc: # 4.18 +Fixes: 22bb5cfdf13a ("usb: dwc2: Fix host exit from hibernation flow.") +Signed-off-by: Artur Petrosyan +Acked-by: Minas Harutyunyan +Link: https://lore.kernel.org/r/20210326102447.8F7FEA005D@mailhost.synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/hcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -5398,7 +5398,7 @@ int dwc2_host_enter_hibernation(struct d + dwc2_writel(hsotg, hprt0, HPRT0); + + /* Wait for the HPRT0.PrtSusp register field to be set */ +- if (dwc2_hsotg_wait_bit_set(hsotg, HPRT0, HPRT0_SUSP, 3000)) ++ if (dwc2_hsotg_wait_bit_set(hsotg, HPRT0, HPRT0_SUSP, 5000)) + dev_warn(hsotg->dev, "Suspend wasn't generated\n"); + + /* diff --git a/queue-5.10/usb-dwc2-prevent-core-suspend-when-port-connection-flag-is-0.patch b/queue-5.10/usb-dwc2-prevent-core-suspend-when-port-connection-flag-is-0.patch new file mode 100644 index 00000000000..41f31c607f4 --- /dev/null +++ b/queue-5.10/usb-dwc2-prevent-core-suspend-when-port-connection-flag-is-0.patch @@ -0,0 +1,37 @@ +From 93f672804bf2d7a49ef3fd96827ea6290ca1841e Mon Sep 17 00:00:00 2001 +From: Artur Petrosyan +Date: Fri, 26 Mar 2021 14:25:09 +0400 +Subject: usb: dwc2: Prevent core suspend when port connection flag is 0 + +From: Artur Petrosyan + +commit 93f672804bf2d7a49ef3fd96827ea6290ca1841e upstream. + +In host mode port connection status flag is "0" when loading +the driver. After loading the driver system asserts suspend +which is handled by "_dwc2_hcd_suspend()" function. Before +the system suspend the port connection status is "0". As +result need to check the "port_connect_status" if it is "0", +then skipping entering to suspend. + +Cc: # 5.2 +Fixes: 6f6d70597c15 ("usb: dwc2: bus suspend/resume for hosts with DWC2_POWER_DOWN_PARAM_NONE") +Signed-off-by: Artur Petrosyan +Link: https://lore.kernel.org/r/20210326102510.BDEDEA005D@mailhost.synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/hcd.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -4322,7 +4322,8 @@ static int _dwc2_hcd_suspend(struct usb_ + if (hsotg->op_state == OTG_STATE_B_PERIPHERAL) + goto unlock; + +- if (hsotg->params.power_down > DWC2_POWER_DOWN_PARAM_PARTIAL) ++ if (hsotg->params.power_down != DWC2_POWER_DOWN_PARAM_PARTIAL || ++ hsotg->flags.b.port_connect_status == 0) + goto skip_power_saving; + + /* diff --git a/queue-5.10/usb-dwc3-gadget-clear-dep-flags-after-stop-transfers-in-ep-disable.patch b/queue-5.10/usb-dwc3-gadget-clear-dep-flags-after-stop-transfers-in-ep-disable.patch new file mode 100644 index 00000000000..cd9ebbbd425 --- /dev/null +++ b/queue-5.10/usb-dwc3-gadget-clear-dep-flags-after-stop-transfers-in-ep-disable.patch @@ -0,0 +1,48 @@ +From 5aef629704ad4d983ecf5c8a25840f16e45b6d59 Mon Sep 17 00:00:00 2001 +From: Wesley Cheng +Date: Wed, 24 Mar 2021 11:31:04 -0700 +Subject: usb: dwc3: gadget: Clear DEP flags after stop transfers in ep disable + +From: Wesley Cheng + +commit 5aef629704ad4d983ecf5c8a25840f16e45b6d59 upstream. + +Ensure that dep->flags are cleared until after stop active transfers +is completed. Otherwise, the ENDXFER command will not be executed +during ep disable. + +Fixes: f09ddcfcb8c5 ("usb: dwc3: gadget: Prevent EP queuing while stopping transfers") +Cc: stable +Reported-and-tested-by: Andy Shevchenko +Tested-by: Marek Szyprowski +Signed-off-by: Wesley Cheng +Link: https://lore.kernel.org/r/1616610664-16495-1-git-send-email-wcheng@codeaurora.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -791,10 +791,6 @@ static int __dwc3_gadget_ep_disable(stru + reg &= ~DWC3_DALEPENA_EP(dep->number); + dwc3_writel(dwc->regs, DWC3_DALEPENA, reg); + +- dep->stream_capable = false; +- dep->type = 0; +- dep->flags = 0; +- + /* Clear out the ep descriptors for non-ep0 */ + if (dep->number > 1) { + dep->endpoint.comp_desc = NULL; +@@ -803,6 +799,10 @@ static int __dwc3_gadget_ep_disable(stru + + dwc3_remove_requests(dwc, dep); + ++ dep->stream_capable = false; ++ dep->type = 0; ++ dep->flags = 0; ++ + return 0; + } + diff --git a/queue-5.10/usb-dwc3-qcom-skip-interconnect-init-for-acpi-probe.patch b/queue-5.10/usb-dwc3-qcom-skip-interconnect-init-for-acpi-probe.patch new file mode 100644 index 00000000000..8ff73aa9e2b --- /dev/null +++ b/queue-5.10/usb-dwc3-qcom-skip-interconnect-init-for-acpi-probe.patch @@ -0,0 +1,38 @@ +From 5e4010e36a58978e42b2ee13739ff9b50209c830 Mon Sep 17 00:00:00 2001 +From: Shawn Guo +Date: Thu, 11 Mar 2021 14:03:18 +0800 +Subject: usb: dwc3: qcom: skip interconnect init for ACPI probe + +From: Shawn Guo + +commit 5e4010e36a58978e42b2ee13739ff9b50209c830 upstream. + +The ACPI probe starts failing since commit bea46b981515 ("usb: dwc3: +qcom: Add interconnect support in dwc3 driver"), because there is no +interconnect support for ACPI, and of_icc_get() call in +dwc3_qcom_interconnect_init() will just return -EINVAL. + +Fix the problem by skipping interconnect init for ACPI probe, and then +the NULL icc_path_ddr will simply just scheild all ICC calls. + +Fixes: bea46b981515 ("usb: dwc3: qcom: Add interconnect support in dwc3 driver") +Signed-off-by: Shawn Guo +Cc: stable +Link: https://lore.kernel.org/r/20210311060318.25418-1-shawn.guo@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-qcom.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/dwc3/dwc3-qcom.c ++++ b/drivers/usb/dwc3/dwc3-qcom.c +@@ -244,6 +244,9 @@ static int dwc3_qcom_interconnect_init(s + struct device *dev = qcom->dev; + int ret; + ++ if (has_acpi_companion(dev)) ++ return 0; ++ + qcom->icc_path_ddr = of_icc_get(dev, "usb-ddr"); + if (IS_ERR(qcom->icc_path_ddr)) { + dev_err(dev, "failed to get usb-ddr path: %ld\n", diff --git a/queue-5.10/usb-gadget-udc-amd5536udc_pci-fix-null-ptr-dereference.patch b/queue-5.10/usb-gadget-udc-amd5536udc_pci-fix-null-ptr-dereference.patch new file mode 100644 index 00000000000..625313ff4cd --- /dev/null +++ b/queue-5.10/usb-gadget-udc-amd5536udc_pci-fix-null-ptr-dereference.patch @@ -0,0 +1,55 @@ +From 72035f4954f0bca2d8c47cf31b3629c42116f5b7 Mon Sep 17 00:00:00 2001 +From: Tong Zhang +Date: Wed, 17 Mar 2021 19:04:00 -0400 +Subject: usb: gadget: udc: amd5536udc_pci fix null-ptr-dereference + +From: Tong Zhang + +commit 72035f4954f0bca2d8c47cf31b3629c42116f5b7 upstream. + +init_dma_pools() calls dma_pool_create(...dev->dev) to create dma pool. +however, dev->dev is actually set after calling init_dma_pools(), which +effectively makes dma_pool_create(..NULL) and cause crash. +To fix this issue, init dma only after dev->dev is set. + +[ 1.317993] RIP: 0010:dma_pool_create+0x83/0x290 +[ 1.323257] Call Trace: +[ 1.323390] ? pci_write_config_word+0x27/0x30 +[ 1.323626] init_dma_pools+0x41/0x1a0 [snps_udc_core] +[ 1.323899] udc_pci_probe+0x202/0x2b1 [amd5536udc_pci] + +Fixes: 7c51247a1f62 (usb: gadget: udc: Provide correct arguments for 'dma_pool_create') +Cc: stable +Signed-off-by: Tong Zhang +Link: https://lore.kernel.org/r/20210317230400.357756-1-ztong0001@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/amd5536udc_pci.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/usb/gadget/udc/amd5536udc_pci.c ++++ b/drivers/usb/gadget/udc/amd5536udc_pci.c +@@ -153,6 +153,11 @@ static int udc_pci_probe( + pci_set_master(pdev); + pci_try_set_mwi(pdev); + ++ dev->phys_addr = resource; ++ dev->irq = pdev->irq; ++ dev->pdev = pdev; ++ dev->dev = &pdev->dev; ++ + /* init dma pools */ + if (use_dma) { + retval = init_dma_pools(dev); +@@ -160,11 +165,6 @@ static int udc_pci_probe( + goto err_dma; + } + +- dev->phys_addr = resource; +- dev->irq = pdev->irq; +- dev->pdev = pdev; +- dev->dev = &pdev->dev; +- + /* general probing */ + if (udc_probe(dev)) { + retval = -ENODEV; diff --git a/queue-5.10/usb-musb-fix-suspend-with-devices-connected-for-a64.patch b/queue-5.10/usb-musb-fix-suspend-with-devices-connected-for-a64.patch new file mode 100644 index 00000000000..8889cc1526a --- /dev/null +++ b/queue-5.10/usb-musb-fix-suspend-with-devices-connected-for-a64.patch @@ -0,0 +1,49 @@ +From 92af4fc6ec331228aca322ca37c8aea7b150a151 Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Wed, 24 Mar 2021 09:11:41 +0200 +Subject: usb: musb: Fix suspend with devices connected for a64 + +From: Tony Lindgren + +commit 92af4fc6ec331228aca322ca37c8aea7b150a151 upstream. + +Pinephone running on Allwinner A64 fails to suspend with USB devices +connected as reported by Bhushan Shah . Reverting +commit 5fbf7a253470 ("usb: musb: fix idling for suspend after +disconnect interrupt") fixes the issue. + +Let's add suspend checks also for suspend after disconnect interrupt +quirk handling like we already do elsewhere. + +Fixes: 5fbf7a253470 ("usb: musb: fix idling for suspend after disconnect interrupt") +Reported-by: Bhushan Shah +Tested-by: Bhushan Shah +Signed-off-by: Tony Lindgren +Link: https://lore.kernel.org/r/20210324071142.42264-1-tony@atomide.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/musb/musb_core.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -2004,10 +2004,14 @@ static void musb_pm_runtime_check_sessio + MUSB_DEVCTL_HR; + switch (devctl & ~s) { + case MUSB_QUIRK_B_DISCONNECT_99: +- musb_dbg(musb, "Poll devctl in case of suspend after disconnect\n"); +- schedule_delayed_work(&musb->irq_work, +- msecs_to_jiffies(1000)); +- break; ++ if (musb->quirk_retries && !musb->flush_irq_work) { ++ musb_dbg(musb, "Poll devctl in case of suspend after disconnect\n"); ++ schedule_delayed_work(&musb->irq_work, ++ msecs_to_jiffies(1000)); ++ musb->quirk_retries--; ++ break; ++ } ++ fallthrough; + case MUSB_QUIRK_B_INVALID_VBUS_91: + if (musb->quirk_retries && !musb->flush_irq_work) { + musb_dbg(musb, diff --git a/queue-5.10/usb-quirks-ignore-remote-wake-up-on-fibocom-l850-gl-lte-modem.patch b/queue-5.10/usb-quirks-ignore-remote-wake-up-on-fibocom-l850-gl-lte-modem.patch new file mode 100644 index 00000000000..cc1704006e3 --- /dev/null +++ b/queue-5.10/usb-quirks-ignore-remote-wake-up-on-fibocom-l850-gl-lte-modem.patch @@ -0,0 +1,42 @@ +From 0bd860493f81eb2a46173f6f5e44cc38331c8dbd Mon Sep 17 00:00:00 2001 +From: Vincent Palatin +Date: Fri, 19 Mar 2021 13:48:02 +0100 +Subject: USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem + +From: Vincent Palatin + +commit 0bd860493f81eb2a46173f6f5e44cc38331c8dbd upstream. + +This LTE modem (M.2 card) has a bug in its power management: +there is some kind of race condition for U3 wake-up between the host and +the device. The modem firmware sometimes crashes/locks when both events +happen at the same time and the modem fully drops off the USB bus (and +sometimes re-enumerates, sometimes just gets stuck until the next +reboot). + +Tested with the modem wired to the XHCI controller on an AMD 3015Ce +platform. Without the patch, the modem dropped of the USB bus 5 times in +3 days. With the quirk, it stayed connected for a week while the +'runtime_suspended_time' counter incremented as excepted. + +Signed-off-by: Vincent Palatin +Link: https://lore.kernel.org/r/20210319124802.2315195-1-vpalatin@chromium.org +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -498,6 +498,10 @@ static const struct usb_device_id usb_qu + /* DJI CineSSD */ + { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, + ++ /* Fibocom L850-GL LTE Modem */ ++ { USB_DEVICE(0x2cb7, 0x0007), .driver_info = ++ USB_QUIRK_IGNORE_REMOTE_WAKEUP }, ++ + /* INTEL VALUE SSD */ + { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, + diff --git a/queue-5.10/usb-xhci-mtk-fix-broken-streams-issue-on-0.96-xhci.patch b/queue-5.10/usb-xhci-mtk-fix-broken-streams-issue-on-0.96-xhci.patch new file mode 100644 index 00000000000..a2091892ec2 --- /dev/null +++ b/queue-5.10/usb-xhci-mtk-fix-broken-streams-issue-on-0.96-xhci.patch @@ -0,0 +1,49 @@ +From 6f978a30c9bb12dab1302d0f06951ee290f5e600 Mon Sep 17 00:00:00 2001 +From: Chunfeng Yun +Date: Tue, 23 Mar 2021 15:02:46 +0800 +Subject: usb: xhci-mtk: fix broken streams issue on 0.96 xHCI + +From: Chunfeng Yun + +commit 6f978a30c9bb12dab1302d0f06951ee290f5e600 upstream. + +The MediaTek 0.96 xHCI controller on some platforms does not +support bulk stream even HCCPARAMS says supporting, due to MaxPSASize +is set a default value 1 by mistake, here use XHCI_BROKEN_STREAMS +quirk to fix it. + +Fixes: 94a631d91ad3 ("usb: xhci-mtk: check hcc_params after adding primary hcd") +Cc: stable +Signed-off-by: Chunfeng Yun +Link: https://lore.kernel.org/r/1616482975-17841-4-git-send-email-chunfeng.yun@mediatek.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-mtk.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-mtk.c ++++ b/drivers/usb/host/xhci-mtk.c +@@ -397,6 +397,13 @@ static void xhci_mtk_quirks(struct devic + xhci->quirks |= XHCI_SPURIOUS_SUCCESS; + if (mtk->lpm_support) + xhci->quirks |= XHCI_LPM_SUPPORT; ++ ++ /* ++ * MTK xHCI 0.96: PSA is 1 by default even if doesn't support stream, ++ * and it's 3 when support it. ++ */ ++ if (xhci->hci_version < 0x100 && HCC_MAX_PSA(xhci->hcc_params) == 4) ++ xhci->quirks |= XHCI_BROKEN_STREAMS; + } + + /* called during probe() after chip reset completes */ +@@ -548,7 +555,8 @@ static int xhci_mtk_probe(struct platfor + if (ret) + goto put_usb3_hcd; + +- if (HCC_MAX_PSA(xhci->hcc_params) >= 4) ++ if (HCC_MAX_PSA(xhci->hcc_params) >= 4 && ++ !(xhci->quirks & XHCI_BROKEN_STREAMS)) + xhci->shared_hcd->can_do_streams = 1; + + ret = usb_add_hcd(xhci->shared_hcd, irq, IRQF_SHARED); diff --git a/queue-5.10/usbip-vhci_hcd-fix-shift-out-of-bounds-in-vhci_hub_control.patch b/queue-5.10/usbip-vhci_hcd-fix-shift-out-of-bounds-in-vhci_hub_control.patch new file mode 100644 index 00000000000..0dd1a22f871 --- /dev/null +++ b/queue-5.10/usbip-vhci_hcd-fix-shift-out-of-bounds-in-vhci_hub_control.patch @@ -0,0 +1,34 @@ +From 1cc5ed25bdade86de2650a82b2730108a76de20c Mon Sep 17 00:00:00 2001 +From: Shuah Khan +Date: Wed, 24 Mar 2021 17:06:54 -0600 +Subject: usbip: vhci_hcd fix shift out-of-bounds in vhci_hub_control() + +From: Shuah Khan + +commit 1cc5ed25bdade86de2650a82b2730108a76de20c upstream. + +Fix shift out-of-bounds in vhci_hub_control() SetPortFeature handling. + +UBSAN: shift-out-of-bounds in drivers/usb/usbip/vhci_hcd.c:605:42 +shift exponent 768 is too large for 32-bit type 'int' + +Reported-by: syzbot+3dea30b047f41084de66@syzkaller.appspotmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Shuah Khan +Link: https://lore.kernel.org/r/20210324230654.34798-1-skhan@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/usbip/vhci_hcd.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -594,6 +594,8 @@ static int vhci_hub_control(struct usb_h + pr_err("invalid port number %d\n", wIndex); + goto error; + } ++ if (wValue >= 32) ++ goto error; + if (hcd->speed == HCD_USB3) { + if ((vhci_hcd->port_status[rhport] & + USB_SS_PORT_STAT_POWER) != 0) {