From 832d8567f10a6e5e807183c898fee7a43aad76a7 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 1 Mar 2023 17:13:29 +0100 Subject: [PATCH] 5.15-stable patches added patches: usb-core-don-t-hold-device-lock-while-reading-the-descriptors-sysfs-file.patch usb-dwc3-pci-add-support-for-the-intel-meteor-lake-m.patch usb-gadget-u_serial-add-null-pointer-check-in-gserial_resume.patch usb-serial-option-add-support-for-vw-skoda-carstick-lte.patch --- queue-5.15/series | 4 + ...e-reading-the-descriptors-sysfs-file.patch | 72 ++++++++++++++++ ...-support-for-the-intel-meteor-lake-m.patch | 40 +++++++++ ...null-pointer-check-in-gserial_resume.patch | 84 +++++++++++++++++++ ...dd-support-for-vw-skoda-carstick-lte.patch | 52 ++++++++++++ 5 files changed, 252 insertions(+) create mode 100644 queue-5.15/usb-core-don-t-hold-device-lock-while-reading-the-descriptors-sysfs-file.patch create mode 100644 queue-5.15/usb-dwc3-pci-add-support-for-the-intel-meteor-lake-m.patch create mode 100644 queue-5.15/usb-gadget-u_serial-add-null-pointer-check-in-gserial_resume.patch create mode 100644 queue-5.15/usb-serial-option-add-support-for-vw-skoda-carstick-lte.patch diff --git a/queue-5.15/series b/queue-5.15/series index 983f3a52f2b..28ea150775a 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -16,3 +16,7 @@ net-remove-warn_on_once-sk-sk_forward_alloc-from-sk_stream_kill_queues.patch vc_screen-don-t-clobber-return-value-in-vcs_read.patch scripts-tags.sh-invoke-realpath-via-xargs.patch scripts-tags.sh-fix-incompatibility-with-pcre2.patch +usb-dwc3-pci-add-support-for-the-intel-meteor-lake-m.patch +usb-serial-option-add-support-for-vw-skoda-carstick-lte.patch +usb-gadget-u_serial-add-null-pointer-check-in-gserial_resume.patch +usb-core-don-t-hold-device-lock-while-reading-the-descriptors-sysfs-file.patch diff --git a/queue-5.15/usb-core-don-t-hold-device-lock-while-reading-the-descriptors-sysfs-file.patch b/queue-5.15/usb-core-don-t-hold-device-lock-while-reading-the-descriptors-sysfs-file.patch new file mode 100644 index 00000000000..b450531a2fd --- /dev/null +++ b/queue-5.15/usb-core-don-t-hold-device-lock-while-reading-the-descriptors-sysfs-file.patch @@ -0,0 +1,72 @@ +From 45bf39f8df7f05efb83b302c65ae3b9bc92b7065 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 31 Jan 2023 15:49:04 -0500 +Subject: USB: core: Don't hold device lock while reading the "descriptors" sysfs file + +From: Alan Stern + +commit 45bf39f8df7f05efb83b302c65ae3b9bc92b7065 upstream. + +Ever since commit 83e83ecb79a8 ("usb: core: get config and string +descriptors for unauthorized devices") was merged in 2013, there has +been no mechanism for reallocating the rawdescriptors buffers in +struct usb_device after the initial enumeration. Before that commit, +the buffers would be deallocated when a device was deauthorized and +reallocated when it was authorized and enumerated. + +This means that the locking in the read_descriptors() routine is not +needed, since the buffers it reads will never be reallocated while the +routine is running. This locking can interfere with user programs +trying to read a hub's descriptors via sysfs while new child devices +of the hub are being initialized, since the hub is locked during this +procedure. + +Since the locking in read_descriptors() hasn't been needed for over +nine years, we can remove it. + +Reported-and-tested-by: Troels Liebe Bentsen +Signed-off-by: Alan Stern +CC: stable@vger.kernel.org +Link: https://lore.kernel.org/r/Y9l+wDTRbuZABzsE@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/hub.c | 5 ++--- + drivers/usb/core/sysfs.c | 5 ----- + 2 files changed, 2 insertions(+), 8 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2382,9 +2382,8 @@ static int usb_enumerate_device_otg(stru + * usb_enumerate_device - Read device configs/intfs/otg (usbcore-internal) + * @udev: newly addressed device (in ADDRESS state) + * +- * This is only called by usb_new_device() and usb_authorize_device() +- * and FIXME -- all comments that apply to them apply here wrt to +- * environment. ++ * This is only called by usb_new_device() -- all comments that apply there ++ * apply here wrt to environment. + * + * If the device is WUSB and not authorized, we don't attempt to read + * the string descriptors, as they will be errored out by the device +--- a/drivers/usb/core/sysfs.c ++++ b/drivers/usb/core/sysfs.c +@@ -868,11 +868,7 @@ read_descriptors(struct file *filp, stru + size_t srclen, n; + int cfgno; + void *src; +- int retval; + +- retval = usb_lock_device_interruptible(udev); +- if (retval < 0) +- return -EINTR; + /* The binary attribute begins with the device descriptor. + * Following that are the raw descriptor entries for all the + * configurations (config plus subsidiary descriptors). +@@ -897,7 +893,6 @@ read_descriptors(struct file *filp, stru + off -= srclen; + } + } +- usb_unlock_device(udev); + return count - nleft; + } + diff --git a/queue-5.15/usb-dwc3-pci-add-support-for-the-intel-meteor-lake-m.patch b/queue-5.15/usb-dwc3-pci-add-support-for-the-intel-meteor-lake-m.patch new file mode 100644 index 00000000000..0a10d4780d2 --- /dev/null +++ b/queue-5.15/usb-dwc3-pci-add-support-for-the-intel-meteor-lake-m.patch @@ -0,0 +1,40 @@ +From 8e5248c3a8778f3e394e9a19195bc7a48f567ca2 Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Wed, 15 Feb 2023 15:27:11 +0200 +Subject: usb: dwc3: pci: add support for the Intel Meteor Lake-M + +From: Heikki Krogerus + +commit 8e5248c3a8778f3e394e9a19195bc7a48f567ca2 upstream. + +This patch adds the necessary PCI IDs for Intel Meteor Lake-M +devices. + +Signed-off-by: Heikki Krogerus +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230215132711.35668-1-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-pci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -45,6 +45,7 @@ + #define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1 + #define PCI_DEVICE_ID_INTEL_RPL 0xa70e + #define PCI_DEVICE_ID_INTEL_RPLS 0x7a61 ++#define PCI_DEVICE_ID_INTEL_MTLM 0x7eb1 + #define PCI_DEVICE_ID_INTEL_MTLP 0x7ec1 + #define PCI_DEVICE_ID_INTEL_MTL 0x7e7e + #define PCI_DEVICE_ID_INTEL_TGL 0x9a15 +@@ -427,6 +428,9 @@ static const struct pci_device_id dwc3_p + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_RPLS), + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTLM), ++ (kernel_ulong_t) &dwc3_pci_intel_swnode, }, ++ + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTLP), + (kernel_ulong_t) &dwc3_pci_intel_swnode, }, + diff --git a/queue-5.15/usb-gadget-u_serial-add-null-pointer-check-in-gserial_resume.patch b/queue-5.15/usb-gadget-u_serial-add-null-pointer-check-in-gserial_resume.patch new file mode 100644 index 00000000000..c7f4ac042a2 --- /dev/null +++ b/queue-5.15/usb-gadget-u_serial-add-null-pointer-check-in-gserial_resume.patch @@ -0,0 +1,84 @@ +From 5ec63fdbca604568890c577753c6f66c5b3ef0b5 Mon Sep 17 00:00:00 2001 +From: Prashanth K +Date: Mon, 13 Feb 2023 23:00:38 +0530 +Subject: usb: gadget: u_serial: Add null pointer check in gserial_resume + +From: Prashanth K + +commit 5ec63fdbca604568890c577753c6f66c5b3ef0b5 upstream. + +Consider a case where gserial_disconnect has already cleared +gser->ioport. And if a wakeup interrupt triggers afterwards, +gserial_resume gets called, which will lead to accessing of +gser->ioport and thus causing null pointer dereference.Add +a null pointer check to prevent this. + +Added a static spinlock to prevent gser->ioport from becoming +null after the newly added check. + +Fixes: aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume callbacks") +Cc: stable +Signed-off-by: Prashanth K +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/1676309438-14922-1-git-send-email-quic_prashk@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/u_serial.c | 23 +++++++++++++++++++---- + 1 file changed, 19 insertions(+), 4 deletions(-) + +--- a/drivers/usb/gadget/function/u_serial.c ++++ b/drivers/usb/gadget/function/u_serial.c +@@ -81,6 +81,9 @@ + #define WRITE_BUF_SIZE 8192 /* TX only */ + #define GS_CONSOLE_BUF_SIZE 8192 + ++/* Prevents race conditions while accessing gser->ioport */ ++static DEFINE_SPINLOCK(serial_port_lock); ++ + /* console info */ + struct gs_console { + struct console console; +@@ -1374,8 +1377,10 @@ void gserial_disconnect(struct gserial * + if (!port) + return; + ++ spin_lock_irqsave(&serial_port_lock, flags); ++ + /* tell the TTY glue not to do I/O here any more */ +- spin_lock_irqsave(&port->port_lock, flags); ++ spin_lock(&port->port_lock); + + gs_console_disconnect(port); + +@@ -1390,7 +1395,8 @@ void gserial_disconnect(struct gserial * + tty_hangup(port->port.tty); + } + port->suspended = false; +- spin_unlock_irqrestore(&port->port_lock, flags); ++ spin_unlock(&port->port_lock); ++ spin_unlock_irqrestore(&serial_port_lock, flags); + + /* disable endpoints, aborting down any active I/O */ + usb_ep_disable(gser->out); +@@ -1424,10 +1430,19 @@ EXPORT_SYMBOL_GPL(gserial_suspend); + + void gserial_resume(struct gserial *gser) + { +- struct gs_port *port = gser->ioport; ++ struct gs_port *port; + unsigned long flags; + +- spin_lock_irqsave(&port->port_lock, flags); ++ spin_lock_irqsave(&serial_port_lock, flags); ++ port = gser->ioport; ++ ++ if (!port) { ++ spin_unlock_irqrestore(&serial_port_lock, flags); ++ return; ++ } ++ ++ spin_lock(&port->port_lock); ++ spin_unlock(&serial_port_lock); + port->suspended = false; + if (!port->start_delayed) { + spin_unlock_irqrestore(&port->port_lock, flags); diff --git a/queue-5.15/usb-serial-option-add-support-for-vw-skoda-carstick-lte.patch b/queue-5.15/usb-serial-option-add-support-for-vw-skoda-carstick-lte.patch new file mode 100644 index 00000000000..34fd48d0f1e --- /dev/null +++ b/queue-5.15/usb-serial-option-add-support-for-vw-skoda-carstick-lte.patch @@ -0,0 +1,52 @@ +From 617c331d91077f896111044628c096802551dc66 Mon Sep 17 00:00:00 2001 +From: Florian Zumbiehl +Date: Mon, 6 Feb 2023 02:04:28 +0100 +Subject: USB: serial: option: add support for VW/Skoda "Carstick LTE" + +From: Florian Zumbiehl + +commit 617c331d91077f896111044628c096802551dc66 upstream. + +Add support for VW/Skoda "Carstick LTE" + +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1c9e ProdID=7605 Rev=02.00 +S: Manufacturer=USB Modem +S: Product=USB Modem +C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) + +The stick has AT command interfaces on interfaces 1, 2, and 3, and does PPP +on interface 3. + +Signed-off-by: Florian Zumbiehl +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -402,6 +402,8 @@ static void option_instat_callback(struc + #define LONGCHEER_VENDOR_ID 0x1c9e + + /* 4G Systems products */ ++/* This one was sold as the VW and Skoda "Carstick LTE" */ ++#define FOUR_G_SYSTEMS_PRODUCT_CARSTICK_LTE 0x7605 + /* This is the 4G XS Stick W14 a.k.a. Mobilcom Debitel Surf-Stick * + * It seems to contain a Qualcomm QSC6240/6290 chipset */ + #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603 +@@ -1976,6 +1978,8 @@ static const struct usb_device_id option + .driver_info = RSVD(2) }, + { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) }, + { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) }, ++ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_CARSTICK_LTE), ++ .driver_info = RSVD(0) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14), + .driver_info = NCTRL(0) | NCTRL(1) }, + { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W100), -- 2.47.3