From: Greg Kroah-Hartman Date: Mon, 9 Nov 2020 10:42:14 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v4.4.242~9 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ddd4d8af0a0d768d982b608b8fd9c9260445672d;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: arc-stack-unwinding-avoid-indefinite-looping.patch fork-fix-copy_process-clone_parent-race-with-the-exiting-real_parent.patch pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch revert-arc-entry-fix-potential-efa-clobber-when-tif_syscall_trace.patch serial-8250_mtk-fix-uart_get_baud_rate-warning.patch serial-txx9-add-missing-platform_driver_unregister-on-error-in-serial_txx9_init.patch usb-add-no_lpm-quirk-for-kingston-flash-drive.patch usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch usb-serial-cyberjack-fix-write-urb-completion-race.patch usb-serial-option-add-le910cx-compositions-0x1203-0x1230-0x1231.patch usb-serial-option-add-quectel-ec200t-module-support.patch usb-serial-option-add-telit-fn980-composition-0x1055.patch --- diff --git a/queue-4.19/arc-stack-unwinding-avoid-indefinite-looping.patch b/queue-4.19/arc-stack-unwinding-avoid-indefinite-looping.patch new file mode 100644 index 00000000000..9f62aeb377a --- /dev/null +++ b/queue-4.19/arc-stack-unwinding-avoid-indefinite-looping.patch @@ -0,0 +1,72 @@ +From 328d2168ca524d501fc4b133d6be076142bd305c Mon Sep 17 00:00:00 2001 +From: Vineet Gupta +Date: Tue, 27 Oct 2020 15:01:17 -0700 +Subject: ARC: stack unwinding: avoid indefinite looping + +From: Vineet Gupta + +commit 328d2168ca524d501fc4b133d6be076142bd305c upstream. + +Currently stack unwinder is a while(1) loop which relies on the dwarf +unwinder to signal termination, which in turn relies on dwarf info to do +so. This in theory could cause an infinite loop if the dwarf info was +somehow messed up or the register contents were etc. + +This fix thus detects the excessive looping and breaks the loop. + +| Mem: 26184K used, 1009136K free, 0K shrd, 0K buff, 14416K cached +| CPU: 0.0% usr 72.8% sys 0.0% nic 27.1% idle 0.0% io 0.0% irq 0.0% sirq +| Load average: 4.33 2.60 1.11 2/74 139 +| PID PPID USER STAT VSZ %VSZ CPU %CPU COMMAND +| 133 2 root SWN 0 0.0 3 22.9 [rcu_torture_rea] +| 132 2 root SWN 0 0.0 0 22.0 [rcu_torture_rea] +| 131 2 root SWN 0 0.0 3 21.5 [rcu_torture_rea] +| 126 2 root RW 0 0.0 2 5.4 [rcu_torture_wri] +| 129 2 root SWN 0 0.0 0 0.2 [rcu_torture_fak] +| 137 2 root SW 0 0.0 0 0.2 [rcu_torture_cbf] +| 127 2 root SWN 0 0.0 0 0.1 [rcu_torture_fak] +| 138 115 root R 1464 0.1 2 0.1 top +| 130 2 root SWN 0 0.0 0 0.1 [rcu_torture_fak] +| 128 2 root SWN 0 0.0 0 0.1 [rcu_torture_fak] +| 115 1 root S 1472 0.1 1 0.0 -/bin/sh +| 104 1 root S 1464 0.1 0 0.0 inetd +| 1 0 root S 1456 0.1 2 0.0 init +| 78 1 root S 1456 0.1 0 0.0 syslogd -O /var/log/messages +| 134 2 root SW 0 0.0 2 0.0 [rcu_torture_sta] +| 10 2 root IW 0 0.0 1 0.0 [rcu_preempt] +| 88 2 root IW 0 0.0 1 0.0 [kworker/1:1-eve] +| 66 2 root IW 0 0.0 2 0.0 [kworker/2:2-eve] +| 39 2 root IW 0 0.0 2 0.0 [kworker/2:1-eve] +| unwinder looping too long, aborting ! + +Cc: +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/kernel/stacktrace.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/arch/arc/kernel/stacktrace.c ++++ b/arch/arc/kernel/stacktrace.c +@@ -115,7 +115,7 @@ arc_unwind_core(struct task_struct *tsk, + int (*consumer_fn) (unsigned int, void *), void *arg) + { + #ifdef CONFIG_ARC_DW2_UNWIND +- int ret = 0; ++ int ret = 0, cnt = 0; + unsigned int address; + struct unwind_frame_info frame_info; + +@@ -135,6 +135,11 @@ arc_unwind_core(struct task_struct *tsk, + break; + + frame_info.regs.r63 = frame_info.regs.r31; ++ ++ if (cnt++ > 128) { ++ printk("unwinder looping too long, aborting !\n"); ++ return 0; ++ } + } + + return address; /* return the last address it saw */ diff --git a/queue-4.19/fork-fix-copy_process-clone_parent-race-with-the-exiting-real_parent.patch b/queue-4.19/fork-fix-copy_process-clone_parent-race-with-the-exiting-real_parent.patch new file mode 100644 index 00000000000..748c0f0e429 --- /dev/null +++ b/queue-4.19/fork-fix-copy_process-clone_parent-race-with-the-exiting-real_parent.patch @@ -0,0 +1,55 @@ +From b4e00444cab4c3f3fec876dc0cccc8cbb0d1a948 Mon Sep 17 00:00:00 2001 +From: Eddy Wu +Date: Sat, 7 Nov 2020 14:47:22 +0800 +Subject: fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent + +From: Eddy Wu + +commit b4e00444cab4c3f3fec876dc0cccc8cbb0d1a948 upstream. + +current->group_leader->exit_signal may change during copy_process() if +current->real_parent exits. + +Move the assignment inside tasklist_lock to avoid the race. + +Signed-off-by: Eddy Wu +Acked-by: Oleg Nesterov +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/fork.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1965,14 +1965,9 @@ static __latent_entropy struct task_stru + /* ok, now we should be set up.. */ + p->pid = pid_nr(pid); + if (clone_flags & CLONE_THREAD) { +- p->exit_signal = -1; + p->group_leader = current->group_leader; + p->tgid = current->tgid; + } else { +- if (clone_flags & CLONE_PARENT) +- p->exit_signal = current->group_leader->exit_signal; +- else +- p->exit_signal = (clone_flags & CSIGNAL); + p->group_leader = p; + p->tgid = p->pid; + } +@@ -2017,9 +2012,14 @@ static __latent_entropy struct task_stru + if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) { + p->real_parent = current->real_parent; + p->parent_exec_id = current->parent_exec_id; ++ if (clone_flags & CLONE_THREAD) ++ p->exit_signal = -1; ++ else ++ p->exit_signal = current->group_leader->exit_signal; + } else { + p->real_parent = current; + p->parent_exec_id = current->self_exec_id; ++ p->exit_signal = (clone_flags & CSIGNAL); + } + + klp_copy_process(p); diff --git a/queue-4.19/pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch b/queue-4.19/pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch new file mode 100644 index 00000000000..77a7069ab85 --- /dev/null +++ b/queue-4.19/pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch @@ -0,0 +1,59 @@ +From 9226c504e364158a17a68ff1fe9d67d266922f50 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Thu, 22 Oct 2020 17:38:22 +0200 +Subject: PM: runtime: Resume the device earlier in __device_release_driver() + +From: Rafael J. Wysocki + +commit 9226c504e364158a17a68ff1fe9d67d266922f50 upstream. + +Since the device is resumed from runtime-suspend in +__device_release_driver() anyway, it is better to do that before +looking for busy managed device links from it to consumers, because +if there are any, device_links_unbind_consumers() will be called +and it will cause the consumer devices' drivers to unbind, so the +consumer devices will be runtime-resumed. In turn, resuming each +consumer device will cause the supplier to be resumed and when the +runtime PM references from the given consumer to it are dropped, it +may be suspended. Then, the runtime-resume of the next consumer +will cause the supplier to resume again and so on. + +Update the code accordingly. + +Signed-off-by: Rafael J. Wysocki +Fixes: 9ed9895370ae ("driver core: Functional dependencies tracking support") +Cc: All applicable # All applicable +Tested-by: Xiang Chen +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/dd.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -931,6 +931,8 @@ static void __device_release_driver(stru + + drv = dev->driver; + if (drv) { ++ pm_runtime_get_sync(dev); ++ + while (device_links_busy(dev)) { + device_unlock(dev); + if (parent && dev->bus->need_parent_lock) +@@ -946,11 +948,12 @@ static void __device_release_driver(stru + * have released the driver successfully while this one + * was waiting, so check for that. + */ +- if (dev->driver != drv) ++ if (dev->driver != drv) { ++ pm_runtime_put(dev); + return; ++ } + } + +- pm_runtime_get_sync(dev); + pm_runtime_clean_up_links(dev); + + driver_sysfs_remove(dev); diff --git a/queue-4.19/revert-arc-entry-fix-potential-efa-clobber-when-tif_syscall_trace.patch b/queue-4.19/revert-arc-entry-fix-potential-efa-clobber-when-tif_syscall_trace.patch new file mode 100644 index 00000000000..df6be9344a6 --- /dev/null +++ b/queue-4.19/revert-arc-entry-fix-potential-efa-clobber-when-tif_syscall_trace.patch @@ -0,0 +1,89 @@ +From Vineet.Gupta1@synopsys.com Mon Nov 9 11:28:19 2020 +From: Vineet Gupta +Date: Mon, 19 Oct 2020 19:19:57 -0700 +Subject: Revert "ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE" +To: stable@vger.kernel.org +Cc: linux-snps-arc@lists.infradead.org, linux-kernel@vger.kernel.org, Vineet Gupta , Waldemar Brodkorb +Message-ID: <20201020021957.1260521-1-vgupta@synopsys.com> + +From: Vineet Gupta + +This reverts commit 00fdec98d9881bf5173af09aebd353ab3b9ac729. +(but only from 5.2 and prior kernels) + +The original commit was a preventive fix based on code-review and was +auto-picked for stable back-port (for better or worse). +It was OK for v5.3+ kernels, but turned up needing an implicit change +68e5c6f073bcf70 "(ARC: entry: EV_Trap expects r10 (vs. r9) to have + exception cause)" merged in v5.3 which itself was not backported. +So to summarize the stable backport of this patch for v5.2 and prior +kernels is busted and it won't boot. + +The obvious solution is backport 68e5c6f073bcf70 but that is a pain as +it doesn't revert cleanly and each of affected kernels (so far v4.19, +v4.14, v4.9, v4.4) needs a slightly different massaged varaint. +So the easier fix is to simply revert the backport from 5.2 and prior. +The issue was not a big deal as it would cause strace to sporadically +not work correctly. + +Waldemar Brodkorb first reported this when running ARC uClibc regressions +on latest stable kernels (with offending backport). Once he bisected it, +the analysis was trivial, so thx to him for this. + +Reported-by: Waldemar Brodkorb +Bisected-by: Waldemar Brodkorb +Cc: stable # 5.2 and prior +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman +--- + arch/arc/kernel/entry.S | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/arch/arc/kernel/entry.S ++++ b/arch/arc/kernel/entry.S +@@ -156,6 +156,7 @@ END(EV_Extension) + tracesys: + ; save EFA in case tracer wants the PC of traced task + ; using ERET won't work since next-PC has already committed ++ lr r12, [efa] + GET_CURR_TASK_FIELD_PTR TASK_THREAD, r11 + st r12, [r11, THREAD_FAULT_ADDR] ; thread.fault_address + +@@ -198,9 +199,15 @@ tracesys_exit: + ; Breakpoint TRAP + ; --------------------------------------------- + trap_with_param: +- mov r0, r12 ; EFA in case ptracer/gdb wants stop_pc ++ ++ ; stop_pc info by gdb needs this info ++ lr r0, [efa] + mov r1, sp + ++ ; Now that we have read EFA, it is safe to do "fake" rtie ++ ; and get out of CPU exception mode ++ FAKE_RET_FROM_EXCPN ++ + ; Save callee regs in case gdb wants to have a look + ; SP will grow up by size of CALLEE Reg-File + ; NOTE: clobbers r12 +@@ -227,10 +234,6 @@ ENTRY(EV_Trap) + + EXCEPTION_PROLOGUE + +- lr r12, [efa] +- +- FAKE_RET_FROM_EXCPN +- + ;============ TRAP 1 :breakpoints + ; Check ECR for trap with arg (PROLOGUE ensures r9 has ECR) + bmsk.f 0, r9, 7 +@@ -238,6 +241,9 @@ ENTRY(EV_Trap) + + ;============ TRAP (no param): syscall top level + ++ ; First return from Exception to pure K mode (Exception/IRQs renabled) ++ FAKE_RET_FROM_EXCPN ++ + ; If syscall tracing ongoing, invoke pre-post-hooks + GET_CURR_THR_INFO_FLAGS r10 + btst r10, TIF_SYSCALL_TRACE diff --git a/queue-4.19/serial-8250_mtk-fix-uart_get_baud_rate-warning.patch b/queue-4.19/serial-8250_mtk-fix-uart_get_baud_rate-warning.patch new file mode 100644 index 00000000000..f8c1dd7ea49 --- /dev/null +++ b/queue-4.19/serial-8250_mtk-fix-uart_get_baud_rate-warning.patch @@ -0,0 +1,38 @@ +From 912ab37c798770f21b182d656937072b58553378 Mon Sep 17 00:00:00 2001 +From: Claire Chang +Date: Mon, 2 Nov 2020 20:07:49 +0800 +Subject: serial: 8250_mtk: Fix uart_get_baud_rate warning + +From: Claire Chang + +commit 912ab37c798770f21b182d656937072b58553378 upstream. + +Mediatek 8250 port supports speed higher than uartclk / 16. If the baud +rates in both the new and the old termios setting are higher than +uartclk / 16, the WARN_ON in uart_get_baud_rate() will be triggered. +Passing NULL as the old termios so uart_get_baud_rate() will use +uartclk / 16 - 1 as the new baud rate which will be replaced by the +original baud rate later by tty_termios_encode_baud_rate() in +mtk8250_set_termios(). + +Fixes: 551e553f0d4a ("serial: 8250_mtk: Fix high-speed baud rates clamping") +Signed-off-by: Claire Chang +Link: https://lore.kernel.org/r/20201102120749.374458-1-tientzu@chromium.org +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/8250/8250_mtk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_mtk.c ++++ b/drivers/tty/serial/8250/8250_mtk.c +@@ -47,7 +47,7 @@ mtk8250_set_termios(struct uart_port *po + */ + baud = tty_termios_baud_rate(termios); + +- serial8250_do_set_termios(port, termios, old); ++ serial8250_do_set_termios(port, termios, NULL); + + tty_termios_encode_baud_rate(termios, baud, baud); + diff --git a/queue-4.19/serial-txx9-add-missing-platform_driver_unregister-on-error-in-serial_txx9_init.patch b/queue-4.19/serial-txx9-add-missing-platform_driver_unregister-on-error-in-serial_txx9_init.patch new file mode 100644 index 00000000000..b9cf61ffc4f --- /dev/null +++ b/queue-4.19/serial-txx9-add-missing-platform_driver_unregister-on-error-in-serial_txx9_init.patch @@ -0,0 +1,36 @@ +From 0c5fc92622ed5531ff324b20f014e9e3092f0187 Mon Sep 17 00:00:00 2001 +From: Qinglang Miao +Date: Tue, 3 Nov 2020 16:49:42 +0800 +Subject: serial: txx9: add missing platform_driver_unregister() on error in serial_txx9_init + +From: Qinglang Miao + +commit 0c5fc92622ed5531ff324b20f014e9e3092f0187 upstream. + +Add the missing platform_driver_unregister() before return +from serial_txx9_init in the error handling case when failed +to register serial_txx9_pci_driver with macro ENABLE_SERIAL_TXX9_PCI +defined. + +Fixes: ab4382d27412 ("tty: move drivers/serial/ to drivers/tty/serial/") +Signed-off-by: Qinglang Miao +Link: https://lore.kernel.org/r/20201103084942.109076-1-miaoqinglang@huawei.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/serial_txx9.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/tty/serial/serial_txx9.c ++++ b/drivers/tty/serial/serial_txx9.c +@@ -1284,6 +1284,9 @@ static int __init serial_txx9_init(void) + + #ifdef ENABLE_SERIAL_TXX9_PCI + ret = pci_register_driver(&serial_txx9_pci_driver); ++ if (ret) { ++ platform_driver_unregister(&serial_txx9_plat_driver); ++ } + #endif + if (ret == 0) + goto out; diff --git a/queue-4.19/series b/queue-4.19/series index a0931381bc9..c22fa38d229 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -53,3 +53,15 @@ vsock-use-ns_capable_noaudit-on-socket-create.patch drm-vc4-drv-add-error-handding-for-bind.patch acpi-nfit-fix-comparison-to-enxio.patch vt-disable-kd_font_op_copy.patch +fork-fix-copy_process-clone_parent-race-with-the-exiting-real_parent.patch +serial-8250_mtk-fix-uart_get_baud_rate-warning.patch +serial-txx9-add-missing-platform_driver_unregister-on-error-in-serial_txx9_init.patch +usb-serial-cyberjack-fix-write-urb-completion-race.patch +usb-serial-option-add-quectel-ec200t-module-support.patch +usb-serial-option-add-le910cx-compositions-0x1203-0x1230-0x1231.patch +usb-serial-option-add-telit-fn980-composition-0x1055.patch +usb-add-no_lpm-quirk-for-kingston-flash-drive.patch +usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch +arc-stack-unwinding-avoid-indefinite-looping.patch +revert-arc-entry-fix-potential-efa-clobber-when-tif_syscall_trace.patch +pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch diff --git a/queue-4.19/usb-add-no_lpm-quirk-for-kingston-flash-drive.patch b/queue-4.19/usb-add-no_lpm-quirk-for-kingston-flash-drive.patch new file mode 100644 index 00000000000..f8b379d0d73 --- /dev/null +++ b/queue-4.19/usb-add-no_lpm-quirk-for-kingston-flash-drive.patch @@ -0,0 +1,39 @@ +From afaa2e745a246c5ab95103a65b1ed00101e1bc63 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 2 Nov 2020 09:58:21 -0500 +Subject: USB: Add NO_LPM quirk for Kingston flash drive + +From: Alan Stern + +commit afaa2e745a246c5ab95103a65b1ed00101e1bc63 upstream. + +In Bugzilla #208257, Julien Humbert reports that a 32-GB Kingston +flash drive spontaneously disconnects and reconnects, over and over. +Testing revealed that disabling Link Power Management for the drive +fixed the problem. + +This patch adds a quirk entry for that drive to turn off LPM permanently. + +CC: Hans de Goede +CC: +Reported-and-tested-by: Julien Humbert +Signed-off-by: Alan Stern +Link: https://lore.kernel.org/r/20201102145821.GA1478741@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -378,6 +378,9 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x0926, 0x3333), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + ++ /* Kingston DataTraveler 3.0 */ ++ { USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */ + { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF }, + diff --git a/queue-4.19/usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch b/queue-4.19/usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch new file mode 100644 index 00000000000..a54a58c0a0d --- /dev/null +++ b/queue-4.19/usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch @@ -0,0 +1,71 @@ +From 20914919ad31849ee2b9cfe0428f4a20335c9e2a Mon Sep 17 00:00:00 2001 +From: Macpaul Lin +Date: Fri, 6 Nov 2020 13:54:29 +0800 +Subject: usb: mtu3: fix panic in mtu3_gadget_stop() + +From: Macpaul Lin + +commit 20914919ad31849ee2b9cfe0428f4a20335c9e2a upstream. + +This patch fixes a possible issue when mtu3_gadget_stop() +already assigned NULL to mtu->gadget_driver during mtu_gadget_disconnect(). + +[] notifier_call_chain+0xa4/0x128 +[] __atomic_notifier_call_chain+0x84/0x138 +[] notify_die+0xb0/0x120 +[] die+0x1f8/0x5d0 +[] __do_kernel_fault+0x19c/0x280 +[] do_bad_area+0x44/0x140 +[] do_translation_fault+0x4c/0x90 +[] do_mem_abort+0xb8/0x258 +[] el1_da+0x24/0x3c +[] mtu3_gadget_disconnect+0xac/0x128 +[] mtu3_irq+0x34c/0xc18 +[] __handle_irq_event_percpu+0x2ac/0xcd0 +[] handle_irq_event_percpu+0x80/0x138 +[] handle_irq_event+0xac/0x148 +[] handle_fasteoi_irq+0x234/0x568 +[] generic_handle_irq+0x48/0x68 +[] __handle_domain_irq+0x264/0x1740 +[] gic_handle_irq+0x14c/0x250 +[] el1_irq+0xec/0x194 +[] dma_pool_alloc+0x6e4/0xae0 +[] cmdq_mbox_pool_alloc_impl+0xb0/0x238 +[] cmdq_pkt_alloc_buf+0x2dc/0x7c0 +[] cmdq_pkt_add_cmd_buffer+0x178/0x270 +[] cmdq_pkt_perf_begin+0x108/0x148 +[] cmdq_pkt_create+0x178/0x1f0 +[] mtk_crtc_config_default_path+0x328/0x7a0 +[] mtk_drm_idlemgr_kick+0xa6c/0x1460 +[] mtk_drm_crtc_atomic_begin+0x1a4/0x1a68 +[] drm_atomic_helper_commit_planes+0x154/0x878 +[] mtk_atomic_complete.isra.16+0xe80/0x19c8 +[] mtk_atomic_commit+0x258/0x898 +[] drm_atomic_commit+0xcc/0x108 +[] drm_mode_atomic_ioctl+0x1c20/0x2580 +[] drm_ioctl_kernel+0x118/0x1b0 +[] drm_ioctl+0x5c0/0x920 +[] do_vfs_ioctl+0x188/0x1820 +[] SyS_ioctl+0x8c/0xa0 + +Fixes: df2069acb005 ("usb: Add MediaTek USB3 DRD driver") +Signed-off-by: Macpaul Lin +Acked-by: Chunfeng Yun +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/1604642069-20961-1-git-send-email-macpaul.lin@mediatek.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/mtu3/mtu3_gadget.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/mtu3/mtu3_gadget.c ++++ b/drivers/usb/mtu3/mtu3_gadget.c +@@ -573,6 +573,7 @@ static int mtu3_gadget_stop(struct usb_g + + spin_unlock_irqrestore(&mtu->lock, flags); + ++ synchronize_irq(mtu->irq); + return 0; + } + diff --git a/queue-4.19/usb-serial-cyberjack-fix-write-urb-completion-race.patch b/queue-4.19/usb-serial-cyberjack-fix-write-urb-completion-race.patch new file mode 100644 index 00000000000..a061e347ce9 --- /dev/null +++ b/queue-4.19/usb-serial-cyberjack-fix-write-urb-completion-race.patch @@ -0,0 +1,57 @@ +From 985616f0457d9f555fff417d0da56174f70cc14f Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 26 Oct 2020 09:25:48 +0100 +Subject: USB: serial: cyberjack: fix write-URB completion race + +From: Johan Hovold + +commit 985616f0457d9f555fff417d0da56174f70cc14f upstream. + +The write-URB busy flag was being cleared before the completion handler +was done with the URB, something which could lead to corrupt transfers +due to a racing write request if the URB is resubmitted. + +Fixes: 507ca9bc0476 ("[PATCH] USB: add ability for usb-serial drivers to determine if their write urb is currently being used.") +Cc: stable # 2.6.13 +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cyberjack.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/cyberjack.c ++++ b/drivers/usb/serial/cyberjack.c +@@ -357,11 +357,12 @@ static void cyberjack_write_bulk_callbac + struct device *dev = &port->dev; + int status = urb->status; + unsigned long flags; ++ bool resubmitted = false; + +- set_bit(0, &port->write_urbs_free); + if (status) { + dev_dbg(dev, "%s - nonzero write bulk status received: %d\n", + __func__, status); ++ set_bit(0, &port->write_urbs_free); + return; + } + +@@ -394,6 +395,8 @@ static void cyberjack_write_bulk_callbac + goto exit; + } + ++ resubmitted = true; ++ + dev_dbg(dev, "%s - priv->wrsent=%d\n", __func__, priv->wrsent); + dev_dbg(dev, "%s - priv->wrfilled=%d\n", __func__, priv->wrfilled); + +@@ -410,6 +413,8 @@ static void cyberjack_write_bulk_callbac + + exit: + spin_unlock_irqrestore(&priv->lock, flags); ++ if (!resubmitted) ++ set_bit(0, &port->write_urbs_free); + usb_serial_port_softint(port); + } + diff --git a/queue-4.19/usb-serial-option-add-le910cx-compositions-0x1203-0x1230-0x1231.patch b/queue-4.19/usb-serial-option-add-le910cx-compositions-0x1203-0x1230-0x1231.patch new file mode 100644 index 00000000000..9cad0460b41 --- /dev/null +++ b/queue-4.19/usb-serial-option-add-le910cx-compositions-0x1203-0x1230-0x1231.patch @@ -0,0 +1,48 @@ +From 489979b4aab490b6b917c11dc02d81b4b742784a Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Sat, 31 Oct 2020 23:54:58 +0100 +Subject: USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231 + +From: Daniele Palmas + +commit 489979b4aab490b6b917c11dc02d81b4b742784a upstream. + +Add following Telit LE910Cx compositions: + +0x1203: rndis, tty, adb, tty, tty, tty, tty +0x1230: tty, adb, rmnet, audio, tty, tty, tty, tty +0x1231: rndis, tty, adb, audio, tty, tty, tty, tty + +Signed-off-by: Daniele Palmas +Link: https://lore.kernel.org/r/20201031225458.10512-1-dnlplm@gmail.com +[ johan: add comments after entries ] +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1203,6 +1203,8 @@ static const struct usb_device_id option + .driver_info = NCTRL(0) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1203, 0xff), /* Telit LE910Cx (RNDIS) */ ++ .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920), +@@ -1217,6 +1219,10 @@ static const struct usb_device_id option + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1230, 0xff), /* Telit LE910Cx (rmnet) */ ++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff), /* Telit LE910Cx (RNDIS) */ ++ .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x1260), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x1261), diff --git a/queue-4.19/usb-serial-option-add-quectel-ec200t-module-support.patch b/queue-4.19/usb-serial-option-add-quectel-ec200t-module-support.patch new file mode 100644 index 00000000000..d398d0a6184 --- /dev/null +++ b/queue-4.19/usb-serial-option-add-quectel-ec200t-module-support.patch @@ -0,0 +1,39 @@ +From a46b973bced1ba57420752bf38426acd9f6cbfa6 Mon Sep 17 00:00:00 2001 +From: Ziyi Cao +Date: Tue, 20 Oct 2020 00:08:06 +0800 +Subject: USB: serial: option: add Quectel EC200T module support + +From: Ziyi Cao + +commit a46b973bced1ba57420752bf38426acd9f6cbfa6 upstream. + +Add usb product id of the Quectel EC200T module. + +Signed-off-by: Ziyi Cao +Link: https://lore.kernel.org/r/17f8a2a3-ce0f-4be7-8544-8fdf286907d0@www.fastmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -250,6 +250,7 @@ static void option_instat_callback(struc + #define QUECTEL_PRODUCT_EP06 0x0306 + #define QUECTEL_PRODUCT_EM12 0x0512 + #define QUECTEL_PRODUCT_RM500Q 0x0800 ++#define QUECTEL_PRODUCT_EC200T 0x6026 + + #define CMOTECH_VENDOR_ID 0x16d8 + #define CMOTECH_PRODUCT_6001 0x6001 +@@ -1117,6 +1118,7 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10), + .driver_info = ZLP }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) }, + + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, diff --git a/queue-4.19/usb-serial-option-add-telit-fn980-composition-0x1055.patch b/queue-4.19/usb-serial-option-add-telit-fn980-composition-0x1055.patch new file mode 100644 index 00000000000..c7d40874ec4 --- /dev/null +++ b/queue-4.19/usb-serial-option-add-telit-fn980-composition-0x1055.patch @@ -0,0 +1,34 @@ +From db0362eeb22992502764e825c79b922d7467e0eb Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Tue, 3 Nov 2020 13:44:25 +0100 +Subject: USB: serial: option: add Telit FN980 composition 0x1055 + +From: Daniele Palmas + +commit db0362eeb22992502764e825c79b922d7467e0eb upstream. + +Add the following Telit FN980 composition: + +0x1055: tty, adb, tty, tty, tty, tty + +Signed-off-by: Daniele Palmas +Link: https://lore.kernel.org/r/20201103124425.12940-1-dnlplm@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1191,6 +1191,8 @@ static const struct usb_device_id option + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1054, 0xff), /* Telit FT980-KS */ + .driver_info = NCTRL(2) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1055, 0xff), /* Telit FN980 (PCIe) */ ++ .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),