From d4cf59355f90d8cf2b90484d0d5966e805bbfa48 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 1 May 2022 18:01:31 +0200 Subject: [PATCH] 5.15-stable patches added patches: usb-mtu3-fix-usb-3.0-dual-role-switch-from-device-to-host.patch usb-quirks-add-a-realtek-card-reader.patch usb-quirks-add-string-quirk-for-vcom-device.patch usb-serial-cp210x-add-pids-for-kamstrup-usb-meter-reader.patch usb-serial-option-add-support-for-cinterion-mv32-wa-mv32-wb.patch usb-serial-option-add-telit-0x1057-0x1058-0x1075-compositions.patch usb-serial-whiteheat-fix-heap-overflow-in-whiteheat_get_dtr_rts.patch usb-xhci-tegra-fix-pm-usage-reference-leak-of-tegra_xusb_unpowergate_partitions.patch xhci-enable-runtime-pm-on-second-alderlake-controller.patch xhci-increase-usb-u3-u0-link-resume-timeout-from-100ms-to-500ms.patch xhci-stop-polling-roothubs-after-shutdown.patch --- queue-5.15/series | 11 +++ ...dual-role-switch-from-device-to-host.patch | 51 +++++++++++++ ...usb-quirks-add-a-realtek-card-reader.patch | 31 ++++++++ ...rks-add-string-quirk-for-vcom-device.patch | 31 ++++++++ ...d-pids-for-kamstrup-usb-meter-reader.patch | 38 ++++++++++ ...upport-for-cinterion-mv32-wa-mv32-wb.patch | 75 +++++++++++++++++++ ...it-0x1057-0x1058-0x1075-compositions.patch | 46 ++++++++++++ ...ap-overflow-in-whiteheat_get_dtr_rts.patch | 72 ++++++++++++++++++ ...of-tegra_xusb_unpowergate_partitions.patch | 42 +++++++++++ ...me-pm-on-second-alderlake-controller.patch | 41 ++++++++++ ...k-resume-timeout-from-100ms-to-500ms.patch | 37 +++++++++ ...stop-polling-roothubs-after-shutdown.patch | 49 ++++++++++++ 12 files changed, 524 insertions(+) create mode 100644 queue-5.15/series create mode 100644 queue-5.15/usb-mtu3-fix-usb-3.0-dual-role-switch-from-device-to-host.patch create mode 100644 queue-5.15/usb-quirks-add-a-realtek-card-reader.patch create mode 100644 queue-5.15/usb-quirks-add-string-quirk-for-vcom-device.patch create mode 100644 queue-5.15/usb-serial-cp210x-add-pids-for-kamstrup-usb-meter-reader.patch create mode 100644 queue-5.15/usb-serial-option-add-support-for-cinterion-mv32-wa-mv32-wb.patch create mode 100644 queue-5.15/usb-serial-option-add-telit-0x1057-0x1058-0x1075-compositions.patch create mode 100644 queue-5.15/usb-serial-whiteheat-fix-heap-overflow-in-whiteheat_get_dtr_rts.patch create mode 100644 queue-5.15/usb-xhci-tegra-fix-pm-usage-reference-leak-of-tegra_xusb_unpowergate_partitions.patch create mode 100644 queue-5.15/xhci-enable-runtime-pm-on-second-alderlake-controller.patch create mode 100644 queue-5.15/xhci-increase-usb-u3-u0-link-resume-timeout-from-100ms-to-500ms.patch create mode 100644 queue-5.15/xhci-stop-polling-roothubs-after-shutdown.patch diff --git a/queue-5.15/series b/queue-5.15/series new file mode 100644 index 00000000000..1ca7ddfc96c --- /dev/null +++ b/queue-5.15/series @@ -0,0 +1,11 @@ +usb-mtu3-fix-usb-3.0-dual-role-switch-from-device-to-host.patch +usb-quirks-add-a-realtek-card-reader.patch +usb-quirks-add-string-quirk-for-vcom-device.patch +usb-serial-whiteheat-fix-heap-overflow-in-whiteheat_get_dtr_rts.patch +usb-serial-cp210x-add-pids-for-kamstrup-usb-meter-reader.patch +usb-serial-option-add-support-for-cinterion-mv32-wa-mv32-wb.patch +usb-serial-option-add-telit-0x1057-0x1058-0x1075-compositions.patch +usb-xhci-tegra-fix-pm-usage-reference-leak-of-tegra_xusb_unpowergate_partitions.patch +xhci-enable-runtime-pm-on-second-alderlake-controller.patch +xhci-stop-polling-roothubs-after-shutdown.patch +xhci-increase-usb-u3-u0-link-resume-timeout-from-100ms-to-500ms.patch diff --git a/queue-5.15/usb-mtu3-fix-usb-3.0-dual-role-switch-from-device-to-host.patch b/queue-5.15/usb-mtu3-fix-usb-3.0-dual-role-switch-from-device-to-host.patch new file mode 100644 index 00000000000..03f321b570c --- /dev/null +++ b/queue-5.15/usb-mtu3-fix-usb-3.0-dual-role-switch-from-device-to-host.patch @@ -0,0 +1,51 @@ +From 456244aeecd54249096362a173dfe06b82a5cafa Mon Sep 17 00:00:00 2001 +From: Macpaul Lin +Date: Tue, 19 Apr 2022 16:12:45 +0800 +Subject: usb: mtu3: fix USB 3.0 dual-role-switch from device to host + +From: Macpaul Lin + +commit 456244aeecd54249096362a173dfe06b82a5cafa upstream. + +Issue description: + When an OTG port has been switched to device role and then switch back + to host role again, the USB 3.0 Host (XHCI) will not be able to detect + "plug in event of a connected USB 2.0/1.0 ((Highspeed and Fullspeed) + devices until system reboot. + +Root cause and Solution: + There is a condition checking flag "ssusb->otg_switch.is_u3_drd" in + toggle_opstate(). At the end of role switch procedure, toggle_opstate() + will be called to set DC_SESSION and SOFT_CONN bit. If "is_u3_drd" was + set and switched the role to USB host 3.0, bit DC_SESSION and SOFT_CONN + will be skipped hence caused the port cannot detect connected USB 2.0 + (Highspeed and Fullspeed) devices. Simply remove the condition check to + solve this issue. + +Fixes: d0ed062a8b75 ("usb: mtu3: dual-role mode support") +Cc: stable@vger.kernel.org +Tested-by: Fabien Parent +Reviewed-by: Chunfeng Yun +Signed-off-by: Macpaul Lin +Signed-off-by: Tainping Fang +Link: https://lore.kernel.org/r/20220419081245.21015-1-macpaul.lin@mediatek.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/mtu3/mtu3_dr.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/usb/mtu3/mtu3_dr.c ++++ b/drivers/usb/mtu3/mtu3_dr.c +@@ -21,10 +21,8 @@ static inline struct ssusb_mtk *otg_sx_t + + static void toggle_opstate(struct ssusb_mtk *ssusb) + { +- if (!ssusb->otg_switch.is_u3_drd) { +- mtu3_setbits(ssusb->mac_base, U3D_DEVICE_CONTROL, DC_SESSION); +- mtu3_setbits(ssusb->mac_base, U3D_POWER_MANAGEMENT, SOFT_CONN); +- } ++ mtu3_setbits(ssusb->mac_base, U3D_DEVICE_CONTROL, DC_SESSION); ++ mtu3_setbits(ssusb->mac_base, U3D_POWER_MANAGEMENT, SOFT_CONN); + } + + /* only port0 supports dual-role mode */ diff --git a/queue-5.15/usb-quirks-add-a-realtek-card-reader.patch b/queue-5.15/usb-quirks-add-a-realtek-card-reader.patch new file mode 100644 index 00000000000..899688364e0 --- /dev/null +++ b/queue-5.15/usb-quirks-add-a-realtek-card-reader.patch @@ -0,0 +1,31 @@ +From 2a7ccf6bb6f147f64c025ad68f4255d8e1e0ce6d Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 14 Apr 2022 13:02:09 +0200 +Subject: USB: quirks: add a Realtek card reader + +From: Oliver Neukum + +commit 2a7ccf6bb6f147f64c025ad68f4255d8e1e0ce6d upstream. + +This device is reported to stall when enummerated. + +Cc: stable +Signed-off-by: Oliver Neukum +Link: https://lore.kernel.org/r/20220414110209.30924-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -404,6 +404,9 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x0b05, 0x17e0), .driver_info = + USB_QUIRK_IGNORE_REMOTE_WAKEUP }, + ++ /* Realtek Semiconductor Corp. Mass Storage Device (Multicard Reader)*/ ++ { USB_DEVICE(0x0bda, 0x0151), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS }, ++ + /* Realtek hub in Dell WD19 (Type-C) */ + { USB_DEVICE(0x0bda, 0x0487), .driver_info = USB_QUIRK_NO_LPM }, + diff --git a/queue-5.15/usb-quirks-add-string-quirk-for-vcom-device.patch b/queue-5.15/usb-quirks-add-string-quirk-for-vcom-device.patch new file mode 100644 index 00000000000..e3a39f24f3e --- /dev/null +++ b/queue-5.15/usb-quirks-add-string-quirk-for-vcom-device.patch @@ -0,0 +1,31 @@ +From ec547af8a9ea6441864bad34172676b5652ceb96 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 14 Apr 2022 14:31:52 +0200 +Subject: USB: quirks: add STRING quirk for VCOM device + +From: Oliver Neukum + +commit ec547af8a9ea6441864bad34172676b5652ceb96 upstream. + +This has been reported to stall if queried + +Cc: stable +Signed-off-by: Oliver Neukum +Link: https://lore.kernel.org/r/20220414123152.1700-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -510,6 +510,9 @@ static const struct usb_device_id usb_qu + /* DJI CineSSD */ + { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, + ++ /* VCOM device */ ++ { USB_DEVICE(0x4296, 0x7570), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS }, ++ + /* INTEL VALUE SSD */ + { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, + diff --git a/queue-5.15/usb-serial-cp210x-add-pids-for-kamstrup-usb-meter-reader.patch b/queue-5.15/usb-serial-cp210x-add-pids-for-kamstrup-usb-meter-reader.patch new file mode 100644 index 00000000000..a4c276c3b25 --- /dev/null +++ b/queue-5.15/usb-serial-cp210x-add-pids-for-kamstrup-usb-meter-reader.patch @@ -0,0 +1,38 @@ +From 35a923a0b329c343e9e81d79518e2937eba06fcd Mon Sep 17 00:00:00 2001 +From: Bruno Thomsen +Date: Thu, 14 Apr 2022 10:12:02 +0200 +Subject: USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader + +From: Bruno Thomsen + +commit 35a923a0b329c343e9e81d79518e2937eba06fcd upstream. + +Wireless reading of water and heat meters using 868 MHz wM-Bus mode C1. + +The two different product IDs allow detection of dongle antenna +solution: +- Internal antenna +- External antenna using SMA connector + +https://www.kamstrup.com/en-en/water-solutions/water-meter-reading/usb-meter-reader + +Signed-off-by: Bruno Thomsen +Link: https://lore.kernel.org/r/20220414081202.5591-1-bruno.thomsen@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/cp210x.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -194,6 +194,8 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x16DC, 0x0015) }, /* W-IE-NE-R Plein & Baus GmbH CML Control, Monitoring and Data Logger */ + { USB_DEVICE(0x17A8, 0x0001) }, /* Kamstrup Optical Eye/3-wire */ + { USB_DEVICE(0x17A8, 0x0005) }, /* Kamstrup M-Bus Master MultiPort 250D */ ++ { USB_DEVICE(0x17A8, 0x0101) }, /* Kamstrup 868 MHz wM-Bus C-Mode Meter Reader (Int Ant) */ ++ { USB_DEVICE(0x17A8, 0x0102) }, /* Kamstrup 868 MHz wM-Bus C-Mode Meter Reader (Ext Ant) */ + { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */ + { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ + { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ diff --git a/queue-5.15/usb-serial-option-add-support-for-cinterion-mv32-wa-mv32-wb.patch b/queue-5.15/usb-serial-option-add-support-for-cinterion-mv32-wa-mv32-wb.patch new file mode 100644 index 00000000000..7d1e3721bf1 --- /dev/null +++ b/queue-5.15/usb-serial-option-add-support-for-cinterion-mv32-wa-mv32-wb.patch @@ -0,0 +1,75 @@ +From b4a64ed6e7b857317070fcb9d87ff5d4a73be3e8 Mon Sep 17 00:00:00 2001 +From: Slark Xiao +Date: Thu, 14 Apr 2022 15:44:34 +0800 +Subject: USB: serial: option: add support for Cinterion MV32-WA/MV32-WB + +From: Slark Xiao + +commit b4a64ed6e7b857317070fcb9d87ff5d4a73be3e8 upstream. + +Add support for Cinterion device MV32-WA/MV32-WB. MV32-WA PID is +0x00F1, and MV32-WB PID is 0x00F2. + +Test evidence as below: +T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 4 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 +P: Vendor=1e2d ProdID=00f1 Rev=05.04 +S: Manufacturer=Cinterion +S: Product=Cinterion PID 0x00F1 USB Mobile Broadband +S: SerialNumber=78ada8c4 +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +I: If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option + +T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 +P: Vendor=1e2d ProdID=00f2 Rev=05.04 +S: Manufacturer=Cinterion +S: Product=Cinterion PID 0x00F2 USB Mobile Broadband +S: SerialNumber=cdd06a78 +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +I: If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option +I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option + +Interface 0&1: MBIM, 2:Modem, 3: GNSS, 4: NMEA, 5: Diag +GNSS port don't use serial driver. + +Signed-off-by: Slark Xiao +Link: https://lore.kernel.org/r/20220414074434.5699-1-slark_xiao@163.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -432,6 +432,8 @@ static void option_instat_callback(struc + #define CINTERION_PRODUCT_CLS8 0x00b0 + #define CINTERION_PRODUCT_MV31_MBIM 0x00b3 + #define CINTERION_PRODUCT_MV31_RMNET 0x00b7 ++#define CINTERION_PRODUCT_MV32_WA 0x00f1 ++#define CINTERION_PRODUCT_MV32_WB 0x00f2 + + /* Olivetti products */ + #define OLIVETTI_VENDOR_ID 0x0b3c +@@ -1969,6 +1971,10 @@ static const struct usb_device_id option + .driver_info = RSVD(3)}, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV31_RMNET, 0xff), + .driver_info = RSVD(0)}, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WA, 0xff), ++ .driver_info = RSVD(3)}, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_WB, 0xff), ++ .driver_info = RSVD(3)}, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), + .driver_info = RSVD(4) }, + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), diff --git a/queue-5.15/usb-serial-option-add-telit-0x1057-0x1058-0x1075-compositions.patch b/queue-5.15/usb-serial-option-add-telit-0x1057-0x1058-0x1075-compositions.patch new file mode 100644 index 00000000000..a4162998ef7 --- /dev/null +++ b/queue-5.15/usb-serial-option-add-telit-0x1057-0x1058-0x1075-compositions.patch @@ -0,0 +1,46 @@ +From f32c5a0423400e01f4d7c607949fa3a1f006e8fa Mon Sep 17 00:00:00 2001 +From: Daniele Palmas +Date: Wed, 6 Apr 2022 16:14:08 +0200 +Subject: USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions + +From: Daniele Palmas + +commit f32c5a0423400e01f4d7c607949fa3a1f006e8fa upstream. + +Add support for the following Telit FN980 and FN990 compositions: + +0x1057: tty, adb, rmnet, tty, tty, tty, tty, tty +0x1058: tty, adb, tty, tty, tty, tty, tty +0x1075: adb, tty + +Signed-off-by: Daniele Palmas +Link: https://lore.kernel.org/r/20220406141408.580669-1-dnlplm@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1219,6 +1219,10 @@ static const struct usb_device_id option + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1056, 0xff), /* Telit FD980 */ + .driver_info = NCTRL(2) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1057, 0xff), /* Telit FN980 */ ++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1058, 0xff), /* Telit FN980 (PCIe) */ ++ .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1060, 0xff), /* Telit LN920 (rmnet) */ + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1061, 0xff), /* Telit LN920 (MBIM) */ +@@ -1235,6 +1239,8 @@ static const struct usb_device_id option + .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff), /* Telit FN990 (ECM) */ + .driver_info = NCTRL(0) | RSVD(1) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN990 (PCIe) */ ++ .driver_info = RSVD(0) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), diff --git a/queue-5.15/usb-serial-whiteheat-fix-heap-overflow-in-whiteheat_get_dtr_rts.patch b/queue-5.15/usb-serial-whiteheat-fix-heap-overflow-in-whiteheat_get_dtr_rts.patch new file mode 100644 index 00000000000..0e2fc1fae17 --- /dev/null +++ b/queue-5.15/usb-serial-whiteheat-fix-heap-overflow-in-whiteheat_get_dtr_rts.patch @@ -0,0 +1,72 @@ +From e23e50e7acc8d8f16498e9c129db33e6a00e80eb Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Wed, 20 Apr 2022 17:12:34 -0700 +Subject: USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS + +From: Kees Cook + +commit e23e50e7acc8d8f16498e9c129db33e6a00e80eb upstream. + +The sizeof(struct whitehat_dr_info) can be 4 bytes under CONFIG_AEABI=n +due to "-mabi=apcs-gnu", even though it has a single u8: + +whiteheat_private { + __u8 mcr; /* 0 1 */ + + /* size: 4, cachelines: 1, members: 1 */ + /* padding: 3 */ + /* last cacheline: 4 bytes */ +}; + +The result is technically harmless, as both the source and the +destinations are currently the same allocation size (4 bytes) and don't +use their padding, but if anything were to ever be added after the +"mcr" member in "struct whiteheat_private", it would be overwritten. The +structs both have a single u8 "mcr" member, but are 4 bytes in padded +size. The memcpy() destination was explicitly targeting the u8 member +(size 1) with the length of the whole structure (size 4), triggering +the memcpy buffer overflow warning: + +In file included from include/linux/string.h:253, + from include/linux/bitmap.h:11, + from include/linux/cpumask.h:12, + from include/linux/smp.h:13, + from include/linux/lockdep.h:14, + from include/linux/spinlock.h:62, + from include/linux/mmzone.h:8, + from include/linux/gfp.h:6, + from include/linux/slab.h:15, + from drivers/usb/serial/whiteheat.c:17: +In function 'fortify_memcpy_chk', + inlined from 'firm_send_command' at drivers/usb/serial/whiteheat.c:587:4: +include/linux/fortify-string.h:328:25: warning: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning] + 328 | __write_overflow_field(p_size_field, size); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Instead, just assign the one byte directly. + +Reported-by: kernel test robot +Link: https://lore.kernel.org/lkml/202204142318.vDqjjSFn-lkp@intel.com +Cc: stable@vger.kernel.org +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20220421001234.2421107-1-keescook@chromium.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/whiteheat.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/usb/serial/whiteheat.c ++++ b/drivers/usb/serial/whiteheat.c +@@ -584,9 +584,8 @@ static int firm_send_command(struct usb_ + switch (command) { + case WHITEHEAT_GET_DTR_RTS: + info = usb_get_serial_port_data(port); +- memcpy(&info->mcr, command_info->result_buffer, +- sizeof(struct whiteheat_dr_info)); +- break; ++ info->mcr = command_info->result_buffer[0]; ++ break; + } + } + exit: diff --git a/queue-5.15/usb-xhci-tegra-fix-pm-usage-reference-leak-of-tegra_xusb_unpowergate_partitions.patch b/queue-5.15/usb-xhci-tegra-fix-pm-usage-reference-leak-of-tegra_xusb_unpowergate_partitions.patch new file mode 100644 index 00000000000..6c27edca81c --- /dev/null +++ b/queue-5.15/usb-xhci-tegra-fix-pm-usage-reference-leak-of-tegra_xusb_unpowergate_partitions.patch @@ -0,0 +1,42 @@ +From 8771039482d965bdc8cefd972bcabac2b76944a8 Mon Sep 17 00:00:00 2001 +From: zhangqilong +Date: Sat, 19 Mar 2022 10:38:22 +0800 +Subject: usb: xhci: tegra:Fix PM usage reference leak of tegra_xusb_unpowergate_partitions + +From: zhangqilong + +commit 8771039482d965bdc8cefd972bcabac2b76944a8 upstream. + +pm_runtime_get_sync will increment pm usage counter +even it failed. Forgetting to putting operation will +result in reference leak here. We fix it by replacing +it with pm_runtime_resume_and_get to keep usage counter +balanced. + +Fixes: 41a7426d25fa ("usb: xhci: tegra: Unlink power domain devices") +Cc: stable +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20220319023822.145641-1-zhangqilong3@huawei.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-tegra.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/host/xhci-tegra.c ++++ b/drivers/usb/host/xhci-tegra.c +@@ -1034,13 +1034,13 @@ static int tegra_xusb_unpowergate_partit + int rc; + + if (tegra->use_genpd) { +- rc = pm_runtime_get_sync(tegra->genpd_dev_ss); ++ rc = pm_runtime_resume_and_get(tegra->genpd_dev_ss); + if (rc < 0) { + dev_err(dev, "failed to enable XUSB SS partition\n"); + return rc; + } + +- rc = pm_runtime_get_sync(tegra->genpd_dev_host); ++ rc = pm_runtime_resume_and_get(tegra->genpd_dev_host); + if (rc < 0) { + dev_err(dev, "failed to enable XUSB Host partition\n"); + pm_runtime_put_sync(tegra->genpd_dev_ss); diff --git a/queue-5.15/xhci-enable-runtime-pm-on-second-alderlake-controller.patch b/queue-5.15/xhci-enable-runtime-pm-on-second-alderlake-controller.patch new file mode 100644 index 00000000000..75eb5da56e9 --- /dev/null +++ b/queue-5.15/xhci-enable-runtime-pm-on-second-alderlake-controller.patch @@ -0,0 +1,41 @@ +From d8bfe5091d6cc4b8b8395e4666979ae72a6069ca Mon Sep 17 00:00:00 2001 +From: Evan Green +Date: Fri, 8 Apr 2022 11:42:50 -0700 +Subject: xhci: Enable runtime PM on second Alderlake controller + +From: Evan Green + +commit d8bfe5091d6cc4b8b8395e4666979ae72a6069ca upstream. + +Alderlake has two XHCI controllers with PCI IDs 0x461e and 0x51ed. We +had previously added the quirk to default enable runtime PM for 0x461e, +now add it for 0x51ed as well. + +Signed-off-by: Evan Green +Cc: stable +Link: https://lore.kernel.org/r/20220408114225.1.Ibcff6b86ed4eacfe4c4bc89c90e18416f3900a3e@changeid +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-pci.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -59,6 +59,7 @@ + #define PCI_DEVICE_ID_INTEL_TIGER_LAKE_XHCI 0x9a13 + #define PCI_DEVICE_ID_INTEL_MAPLE_RIDGE_XHCI 0x1138 + #define PCI_DEVICE_ID_INTEL_ALDER_LAKE_XHCI 0x461e ++#define PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI 0x51ed + + #define PCI_DEVICE_ID_AMD_RENOIR_XHCI 0x1639 + #define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9 +@@ -266,7 +267,8 @@ static void xhci_pci_quirks(struct devic + pdev->device == PCI_DEVICE_ID_INTEL_ICE_LAKE_XHCI || + pdev->device == PCI_DEVICE_ID_INTEL_TIGER_LAKE_XHCI || + pdev->device == PCI_DEVICE_ID_INTEL_MAPLE_RIDGE_XHCI || +- pdev->device == PCI_DEVICE_ID_INTEL_ALDER_LAKE_XHCI)) ++ pdev->device == PCI_DEVICE_ID_INTEL_ALDER_LAKE_XHCI || ++ pdev->device == PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI)) + xhci->quirks |= XHCI_DEFAULT_PM_RUNTIME_ALLOW; + + if (pdev->vendor == PCI_VENDOR_ID_ETRON && diff --git a/queue-5.15/xhci-increase-usb-u3-u0-link-resume-timeout-from-100ms-to-500ms.patch b/queue-5.15/xhci-increase-usb-u3-u0-link-resume-timeout-from-100ms-to-500ms.patch new file mode 100644 index 00000000000..93f3f635119 --- /dev/null +++ b/queue-5.15/xhci-increase-usb-u3-u0-link-resume-timeout-from-100ms-to-500ms.patch @@ -0,0 +1,37 @@ +From 33597f0c48be0836854d43c577e35c8f8a765a7d Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Fri, 8 Apr 2022 16:48:23 +0300 +Subject: xhci: increase usb U3 -> U0 link resume timeout from 100ms to 500ms + +From: Mathias Nyman + +commit 33597f0c48be0836854d43c577e35c8f8a765a7d upstream. + +The first U3 wake signal by the host may be lost if the USB 3 connection is +tunneled over USB4, with a runtime suspended USB4 host, and firmware +implemented connection manager. + +Specs state the host must wait 100ms (tU3WakeupRetryDelay) before +resending a U3 wake signal if device doesn't respond, leading to U3 -> U0 +link transition times around 270ms in the tunneled case. + +Fixes: 0200b9f790b0 ("xhci: Wait until link state trainsits to U0 after setting USB_SS_PORT_LS_U0") +Cc: stable@vger.kernel.org +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20220408134823.2527272-4-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-hub.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -1434,7 +1434,7 @@ int xhci_hub_control(struct usb_hcd *hcd + } + spin_unlock_irqrestore(&xhci->lock, flags); + if (!wait_for_completion_timeout(&bus_state->u3exit_done[wIndex], +- msecs_to_jiffies(100))) ++ msecs_to_jiffies(500))) + xhci_dbg(xhci, "missing U0 port change event for port %d-%d\n", + hcd->self.busnum, wIndex + 1); + spin_lock_irqsave(&xhci->lock, flags); diff --git a/queue-5.15/xhci-stop-polling-roothubs-after-shutdown.patch b/queue-5.15/xhci-stop-polling-roothubs-after-shutdown.patch new file mode 100644 index 00000000000..877f50dbb41 --- /dev/null +++ b/queue-5.15/xhci-stop-polling-roothubs-after-shutdown.patch @@ -0,0 +1,49 @@ +From dc92944a014cd6a6f6c94299aaa36164dd2c238a Mon Sep 17 00:00:00 2001 +From: Henry Lin +Date: Fri, 8 Apr 2022 16:48:22 +0300 +Subject: xhci: stop polling roothubs after shutdown + +From: Henry Lin + +commit dc92944a014cd6a6f6c94299aaa36164dd2c238a upstream. + +While rebooting, XHCI controller and its bus device will be shut down +in order by .shutdown callback. Stopping roothubs polling in +xhci_shutdown() can prevent XHCI driver from accessing port status +after its bus device shutdown. + +Take PCIe XHCI controller as example, if XHCI driver doesn't stop roothubs +polling, XHCI driver may access PCIe BAR register for port status after +parent PCIe root port driver is shutdown and cause PCIe bus error. + +[check shared hcd exist before stopping its roothub polling -Mathias] + +Cc: stable@vger.kernel.org +Signed-off-by: Henry Lin +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20220408134823.2527272-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -778,6 +778,17 @@ void xhci_shutdown(struct usb_hcd *hcd) + if (xhci->quirks & XHCI_SPURIOUS_REBOOT) + usb_disable_xhci_ports(to_pci_dev(hcd->self.sysdev)); + ++ /* Don't poll the roothubs after shutdown. */ ++ xhci_dbg(xhci, "%s: stopping usb%d port polling.\n", ++ __func__, hcd->self.busnum); ++ clear_bit(HCD_FLAG_POLL_RH, &hcd->flags); ++ del_timer_sync(&hcd->rh_timer); ++ ++ if (xhci->shared_hcd) { ++ clear_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags); ++ del_timer_sync(&xhci->shared_hcd->rh_timer); ++ } ++ + spin_lock_irq(&xhci->lock); + xhci_halt(xhci); + /* Workaround for spurious wakeups at shutdown with HSW */ -- 2.47.3