]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
3.18-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 19 Aug 2018 16:47:24 +0000 (18:47 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 19 Aug 2018 16:47:24 +0000 (18:47 +0200)
added patches:
alsa-cs5535audio-fix-invalid-endian-conversion.patch
alsa-memalloc-don-t-exceed-over-the-requested-size.patch
alsa-seq-fix-poll-error-return.patch
alsa-virmidi-fix-too-long-output-trigger-loop.patch
alsa-vx222-fix-invalid-endian-conversions.patch
alsa-vxpocket-fix-invalid-endian-conversions.patch
serial-8250_dw-always-set-baud-rate-in-dw8250_set_termios.patch
usb-option-add-support-for-dw5821e.patch
usb-serial-sierra-fix-potential-deadlock-at-close.patch

queue-3.18/alsa-cs5535audio-fix-invalid-endian-conversion.patch [new file with mode: 0644]
queue-3.18/alsa-memalloc-don-t-exceed-over-the-requested-size.patch [new file with mode: 0644]
queue-3.18/alsa-seq-fix-poll-error-return.patch [new file with mode: 0644]
queue-3.18/alsa-virmidi-fix-too-long-output-trigger-loop.patch [new file with mode: 0644]
queue-3.18/alsa-vx222-fix-invalid-endian-conversions.patch [new file with mode: 0644]
queue-3.18/alsa-vxpocket-fix-invalid-endian-conversions.patch [new file with mode: 0644]
queue-3.18/serial-8250_dw-always-set-baud-rate-in-dw8250_set_termios.patch [new file with mode: 0644]
queue-3.18/series
queue-3.18/usb-option-add-support-for-dw5821e.patch [new file with mode: 0644]
queue-3.18/usb-serial-sierra-fix-potential-deadlock-at-close.patch [new file with mode: 0644]

diff --git a/queue-3.18/alsa-cs5535audio-fix-invalid-endian-conversion.patch b/queue-3.18/alsa-cs5535audio-fix-invalid-endian-conversion.patch
new file mode 100644 (file)
index 0000000..5d1f3da
--- /dev/null
@@ -0,0 +1,53 @@
+From 69756930f2de0457d51db7d505a1e4f40e9fd116 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 25 Jul 2018 17:59:26 +0200
+Subject: ALSA: cs5535audio: Fix invalid endian conversion
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 69756930f2de0457d51db7d505a1e4f40e9fd116 upstream.
+
+One place in cs5535audio_build_dma_packets() does an extra conversion
+via cpu_to_le32(); namely jmpprd_addr is passed to setup_prd() ops,
+which writes the value via cs_writel().  That is, the callback does
+the conversion by itself, and we don't need to convert beforehand.
+
+This patch fixes that bogus conversion.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/cs5535audio/cs5535audio.h     |    6 +++---
+ sound/pci/cs5535audio/cs5535audio_pcm.c |    4 ++--
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/sound/pci/cs5535audio/cs5535audio.h
++++ b/sound/pci/cs5535audio/cs5535audio.h
+@@ -66,9 +66,9 @@ struct cs5535audio_dma_ops {
+ };
+ struct cs5535audio_dma_desc {
+-      u32 addr;
+-      u16 size;
+-      u16 ctlreserved;
++      __le32 addr;
++      __le16 size;
++      __le16 ctlreserved;
+ };
+ struct cs5535audio_dma {
+--- a/sound/pci/cs5535audio/cs5535audio_pcm.c
++++ b/sound/pci/cs5535audio/cs5535audio_pcm.c
+@@ -158,8 +158,8 @@ static int cs5535audio_build_dma_packets
+       lastdesc->addr = cpu_to_le32((u32) dma->desc_buf.addr);
+       lastdesc->size = 0;
+       lastdesc->ctlreserved = cpu_to_le16(PRD_JMP);
+-      jmpprd_addr = cpu_to_le32(lastdesc->addr +
+-                                (sizeof(struct cs5535audio_dma_desc)*periods));
++      jmpprd_addr = (u32)dma->desc_buf.addr +
++              sizeof(struct cs5535audio_dma_desc) * periods;
+       dma->substream = substream;
+       dma->period_bytes = period_bytes;
diff --git a/queue-3.18/alsa-memalloc-don-t-exceed-over-the-requested-size.patch b/queue-3.18/alsa-memalloc-don-t-exceed-over-the-requested-size.patch
new file mode 100644 (file)
index 0000000..98ed1dc
--- /dev/null
@@ -0,0 +1,51 @@
+From dfef01e150824b0e6da750cacda8958188d29aea Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 19 Jul 2018 11:01:04 +0200
+Subject: ALSA: memalloc: Don't exceed over the requested size
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit dfef01e150824b0e6da750cacda8958188d29aea upstream.
+
+snd_dma_alloc_pages_fallback() tries to allocate pages again when the
+allocation fails with reduced size.  But the first try actually
+*increases* the size to power-of-two, which may give back a larger
+chunk than the requested size.  This confuses the callers, e.g. sgbuf
+assumes that the size is equal or less, and it may result in a bad
+loop due to the underflow and eventually lead to Oops.
+
+The code of this function seems incorrectly assuming the usage of
+get_order().  We need to decrease at first, then align to
+power-of-two.
+
+Reported-and-tested-by: he, bo <bo.he@intel.com>
+Reported-by: zhang jun <jun.zhang@intel.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/memalloc.c |    8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/sound/core/memalloc.c
++++ b/sound/core/memalloc.c
+@@ -239,16 +239,12 @@ int snd_dma_alloc_pages_fallback(int typ
+       int err;
+       while ((err = snd_dma_alloc_pages(type, device, size, dmab)) < 0) {
+-              size_t aligned_size;
+               if (err != -ENOMEM)
+                       return err;
+               if (size <= PAGE_SIZE)
+                       return -ENOMEM;
+-              aligned_size = PAGE_SIZE << get_order(size);
+-              if (size != aligned_size)
+-                      size = aligned_size;
+-              else
+-                      size >>= 1;
++              size >>= 1;
++              size = PAGE_SIZE << get_order(size);
+       }
+       if (! dmab->area)
+               return -ENOMEM;
diff --git a/queue-3.18/alsa-seq-fix-poll-error-return.patch b/queue-3.18/alsa-seq-fix-poll-error-return.patch
new file mode 100644 (file)
index 0000000..7f8f610
--- /dev/null
@@ -0,0 +1,46 @@
+From a49a71f6e25da2acc637fcd31e73debd96ca18f8 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 25 Jul 2018 16:34:12 +0200
+Subject: ALSA: seq: Fix poll() error return
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit a49a71f6e25da2acc637fcd31e73debd96ca18f8 upstream.
+
+The sanity checks in ALSA sequencer and OSS sequencer emulation codes
+return falsely -ENXIO from poll callback.  They should be EPOLLERR
+instead.
+
+This was caught thanks to the recent change to the return value.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/seq/oss/seq_oss.c   |    2 +-
+ sound/core/seq/seq_clientmgr.c |    2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/core/seq/oss/seq_oss.c
++++ b/sound/core/seq/oss/seq_oss.c
+@@ -194,7 +194,7 @@ odev_poll(struct file *file, poll_table
+       struct seq_oss_devinfo *dp;
+       dp = file->private_data;
+       if (snd_BUG_ON(!dp))
+-              return -ENXIO;
++              return EPOLLERR;
+       return snd_seq_oss_poll(dp, file, wait);
+ }
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -1110,7 +1110,7 @@ static unsigned int snd_seq_poll(struct
+       /* check client structures are in place */
+       if (snd_BUG_ON(!client))
+-              return -ENXIO;
++              return EPOLLERR;
+       if ((snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_INPUT) &&
+           client->data.user.fifo) {
diff --git a/queue-3.18/alsa-virmidi-fix-too-long-output-trigger-loop.patch b/queue-3.18/alsa-virmidi-fix-too-long-output-trigger-loop.patch
new file mode 100644 (file)
index 0000000..5bcf4ba
--- /dev/null
@@ -0,0 +1,55 @@
+From 50e9ffb1996a5d11ff5040a266585bad4ceeca0a Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 26 Jul 2018 14:27:59 +0200
+Subject: ALSA: virmidi: Fix too long output trigger loop
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 50e9ffb1996a5d11ff5040a266585bad4ceeca0a upstream.
+
+The virmidi output trigger tries to parse the all available bytes and
+process sequencer events as much as possible.  In a normal situation,
+this is supposed to be relatively short, but a program may give a huge
+buffer and it'll take a long time in a single spin lock, which may
+eventually lead to a soft lockup.
+
+This patch simply adds a workaround, a cond_resched() call in the loop
+if applicable.  A better solution would be to move the event processor
+into a work, but let's put a duct-tape quickly at first.
+
+Reported-and-tested-by: Dae R. Jeong <threeearcat@gmail.com>
+Reported-by: syzbot+619d9f40141d826b097e@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/seq/seq_virmidi.c |   10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/sound/core/seq/seq_virmidi.c
++++ b/sound/core/seq/seq_virmidi.c
+@@ -163,6 +163,7 @@ static void snd_virmidi_output_trigger(s
+       int count, res;
+       unsigned char buf[32], *pbuf;
+       unsigned long flags;
++      bool check_resched = !in_atomic();
+       if (up) {
+               vmidi->trigger = 1;
+@@ -200,6 +201,15 @@ static void snd_virmidi_output_trigger(s
+                                       vmidi->event.type = SNDRV_SEQ_EVENT_NONE;
+                               }
+                       }
++                      if (!check_resched)
++                              continue;
++                      /* do temporary unlock & cond_resched() for avoiding
++                       * CPU soft lockup, which may happen via a write from
++                       * a huge rawmidi buffer
++                       */
++                      spin_unlock_irqrestore(&substream->runtime->lock, flags);
++                      cond_resched();
++                      spin_lock_irqsave(&substream->runtime->lock, flags);
+               }
+       out:
+               spin_unlock_irqrestore(&substream->runtime->lock, flags);
diff --git a/queue-3.18/alsa-vx222-fix-invalid-endian-conversions.patch b/queue-3.18/alsa-vx222-fix-invalid-endian-conversions.patch
new file mode 100644 (file)
index 0000000..edb361f
--- /dev/null
@@ -0,0 +1,62 @@
+From fff71a4c050ba46e305d910c837b99ba1728135e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 25 Jul 2018 17:10:11 +0200
+Subject: ALSA: vx222: Fix invalid endian conversions
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit fff71a4c050ba46e305d910c837b99ba1728135e upstream.
+
+The endian conversions used in vx2_dma_read() and vx2_dma_write() are
+superfluous and even wrong on big-endian machines, as inl() and outl()
+already do conversions.  Kill them.
+
+Spotted by sparse, a warning like:
+  sound/pci/vx222/vx222_ops.c:278:30: warning: incorrect type in argument 1 (different base types)
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/vx222/vx222_ops.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/sound/pci/vx222/vx222_ops.c
++++ b/sound/pci/vx222/vx222_ops.c
+@@ -270,7 +270,7 @@ static void vx2_dma_write(struct vx_core
+               length >>= 2; /* in 32bit words */
+               /* Transfer using pseudo-dma. */
+               for (; length > 0; length--) {
+-                      outl(cpu_to_le32(*addr), port);
++                      outl(*addr, port);
+                       addr++;
+               }
+               addr = (u32 *)runtime->dma_area;
+@@ -280,7 +280,7 @@ static void vx2_dma_write(struct vx_core
+       count >>= 2; /* in 32bit words */
+       /* Transfer using pseudo-dma. */
+       for (; count > 0; count--) {
+-              outl(cpu_to_le32(*addr), port);
++              outl(*addr, port);
+               addr++;
+       }
+@@ -308,7 +308,7 @@ static void vx2_dma_read(struct vx_core
+               length >>= 2; /* in 32bit words */
+               /* Transfer using pseudo-dma. */
+               for (; length > 0; length--)
+-                      *addr++ = le32_to_cpu(inl(port));
++                      *addr++ = inl(port);
+               addr = (u32 *)runtime->dma_area;
+               pipe->hw_ptr = 0;
+       }
+@@ -316,7 +316,7 @@ static void vx2_dma_read(struct vx_core
+       count >>= 2; /* in 32bit words */
+       /* Transfer using pseudo-dma. */
+       for (; count > 0; count--)
+-              *addr++ = le32_to_cpu(inl(port));
++              *addr++ = inl(port);
+       vx2_release_pseudo_dma(chip);
+ }
diff --git a/queue-3.18/alsa-vxpocket-fix-invalid-endian-conversions.patch b/queue-3.18/alsa-vxpocket-fix-invalid-endian-conversions.patch
new file mode 100644 (file)
index 0000000..0da2768
--- /dev/null
@@ -0,0 +1,65 @@
+From 3acd3e3bab95ec3622ff98da313290ee823a0f68 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 25 Jul 2018 17:11:38 +0200
+Subject: ALSA: vxpocket: Fix invalid endian conversions
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 3acd3e3bab95ec3622ff98da313290ee823a0f68 upstream.
+
+The endian conversions used in vxp_dma_read() and vxp_dma_write() are
+superfluous and even wrong on big-endian machines, as inw() and outw()
+already do conversions.  Kill them.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pcmcia/vx/vxp_ops.c |   10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/sound/pcmcia/vx/vxp_ops.c
++++ b/sound/pcmcia/vx/vxp_ops.c
+@@ -375,7 +375,7 @@ static void vxp_dma_write(struct vx_core
+               length >>= 1; /* in 16bit words */
+               /* Transfer using pseudo-dma. */
+               for (; length > 0; length--) {
+-                      outw(cpu_to_le16(*addr), port);
++                      outw(*addr, port);
+                       addr++;
+               }
+               addr = (unsigned short *)runtime->dma_area;
+@@ -385,7 +385,7 @@ static void vxp_dma_write(struct vx_core
+       count >>= 1; /* in 16bit words */
+       /* Transfer using pseudo-dma. */
+       for (; count > 0; count--) {
+-              outw(cpu_to_le16(*addr), port);
++              outw(*addr, port);
+               addr++;
+       }
+       vx_release_pseudo_dma(chip);
+@@ -417,7 +417,7 @@ static void vxp_dma_read(struct vx_core
+               length >>= 1; /* in 16bit words */
+               /* Transfer using pseudo-dma. */
+               for (; length > 0; length--)
+-                      *addr++ = le16_to_cpu(inw(port));
++                      *addr++ = inw(port);
+               addr = (unsigned short *)runtime->dma_area;
+               pipe->hw_ptr = 0;
+       }
+@@ -425,12 +425,12 @@ static void vxp_dma_read(struct vx_core
+       count >>= 1; /* in 16bit words */
+       /* Transfer using pseudo-dma. */
+       for (; count > 1; count--)
+-              *addr++ = le16_to_cpu(inw(port));
++              *addr++ = inw(port);
+       /* Disable DMA */
+       pchip->regDIALOG &= ~VXP_DLG_DMAREAD_SEL_MASK;
+       vx_outb(chip, DIALOG, pchip->regDIALOG);
+       /* Read the last word (16 bits) */
+-      *addr = le16_to_cpu(inw(port));
++      *addr = inw(port);
+       /* Disable 16-bit accesses */
+       pchip->regDIALOG &= ~VXP_DLG_DMA16_SEL_MASK;
+       vx_outb(chip, DIALOG, pchip->regDIALOG);
diff --git a/queue-3.18/serial-8250_dw-always-set-baud-rate-in-dw8250_set_termios.patch b/queue-3.18/serial-8250_dw-always-set-baud-rate-in-dw8250_set_termios.patch
new file mode 100644 (file)
index 0000000..ead9192
--- /dev/null
@@ -0,0 +1,48 @@
+From dfcab6ba573445c703235ab6c83758eec12d7f28 Mon Sep 17 00:00:00 2001
+From: Chen Hu <hu1.chen@intel.com>
+Date: Fri, 27 Jul 2018 18:32:41 +0800
+Subject: serial: 8250_dw: always set baud rate in dw8250_set_termios
+
+From: Chen Hu <hu1.chen@intel.com>
+
+commit dfcab6ba573445c703235ab6c83758eec12d7f28 upstream.
+
+dw8250_set_termios() doesn't set baud rate if the arg "old ktermios" is
+NULL. This happens during resume.
+Call Trace:
+...
+[   54.928108] dw8250_set_termios+0x162/0x170
+[   54.928114] serial8250_set_termios+0x17/0x20
+[   54.928117] uart_change_speed+0x64/0x160
+[   54.928119] uart_resume_port
+...
+
+So the baud rate is not restored after S3 and breaks the apps who use
+UART, for example, console and bluetooth etc.
+
+We address this issue by setting the baud rate irrespective of arg
+"old", just like the drivers for other 8250 IPs. This is tested with
+Intel Broxton platform.
+
+Signed-off-by: Chen Hu <hu1.chen@intel.com>
+Fixes: 4e26b134bd17 ("serial: 8250_dw: clock rate handling for all ACPI platforms")
+Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Cc: stable <stable@vger.kernel.org>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_dw.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/8250/8250_dw.c
++++ b/drivers/tty/serial/8250/8250_dw.c
+@@ -202,7 +202,7 @@ static void dw8250_set_termios(struct ua
+       unsigned int rate;
+       int ret;
+-      if (IS_ERR(d->clk) || !old)
++      if (IS_ERR(d->clk))
+               goto out;
+       /* Not requesting clock rates below 1.8432Mhz */
index 0dbf9381d0185d540a5525ae3fc364dccff897f7..77eeb4c2ec76147c3a674af7a31ab2d8462886c5 100644 (file)
@@ -4,3 +4,12 @@ llc-use-refcount_inc_not_zero-for-llc_sap_find.patch
 net_sched-fix-missing-res-info-when-create-new-tc_index-filter.patch
 net_sched-fix-null-pointer-dereference-when-delete-tcindex-filter.patch
 vsock-split-dwork-to-avoid-reinitializations.patch
+alsa-vx222-fix-invalid-endian-conversions.patch
+alsa-virmidi-fix-too-long-output-trigger-loop.patch
+alsa-cs5535audio-fix-invalid-endian-conversion.patch
+alsa-memalloc-don-t-exceed-over-the-requested-size.patch
+alsa-vxpocket-fix-invalid-endian-conversions.patch
+alsa-seq-fix-poll-error-return.patch
+usb-serial-sierra-fix-potential-deadlock-at-close.patch
+usb-option-add-support-for-dw5821e.patch
+serial-8250_dw-always-set-baud-rate-in-dw8250_set_termios.patch
diff --git a/queue-3.18/usb-option-add-support-for-dw5821e.patch b/queue-3.18/usb-option-add-support-for-dw5821e.patch
new file mode 100644 (file)
index 0000000..708ac23
--- /dev/null
@@ -0,0 +1,72 @@
+From 7bab01ecc6c43da882333c6db39741cb43677004 Mon Sep 17 00:00:00 2001
+From: Aleksander Morgado <aleksander@aleksander.es>
+Date: Tue, 24 Jul 2018 01:34:01 +0200
+Subject: USB: option: add support for DW5821e
+
+From: Aleksander Morgado <aleksander@aleksander.es>
+
+commit 7bab01ecc6c43da882333c6db39741cb43677004 upstream.
+
+The device exposes AT, NMEA and DIAG ports in both USB configurations.
+
+The patch explicitly ignores interfaces 0 and 1, as they're bound to
+other drivers already; and also interface 6, which is a GNSS interface
+for which we don't have a driver yet.
+
+T:  Bus=01 Lev=03 Prnt=04 Port=00 Cnt=01 Dev#= 18 Spd=480 MxCh= 0
+D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  2
+P:  Vendor=413c ProdID=81d7 Rev=03.18
+S:  Manufacturer=DELL
+S:  Product=DW5821e Snapdragon X20 LTE
+S:  SerialNumber=0123456789ABCDEF
+C:  #Ifs= 7 Cfg#= 2 Atr=a0 MxPwr=500mA
+I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I:  If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I:  If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I:  If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+
+T:  Bus=01 Lev=03 Prnt=04 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0
+D:  Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  2
+P:  Vendor=413c ProdID=81d7 Rev=03.18
+S:  Manufacturer=DELL
+S:  Product=DW5821e Snapdragon X20 LTE
+S:  SerialNumber=0123456789ABCDEF
+C:  #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
+I:  If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+I:  If#= 1 Alt= 0 #EPs= 1 Cls=03(HID  ) Sub=00 Prot=00 Driver=usbhid
+I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I:  If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I:  If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+
+Signed-off-by: Aleksander Morgado <aleksander@aleksander.es>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -199,6 +199,8 @@ static void option_instat_callback(struc
+ #define DELL_PRODUCT_5800_V2_MINICARD_VZW     0x8196  /* Novatel E362 */
+ #define DELL_PRODUCT_5804_MINICARD_ATT                0x819b  /* Novatel E371 */
++#define DELL_PRODUCT_5821E                    0x81d7
++
+ #define KYOCERA_VENDOR_ID                     0x0c88
+ #define KYOCERA_PRODUCT_KPC650                        0x17da
+ #define KYOCERA_PRODUCT_KPC680                        0x180a
+@@ -1153,6 +1155,8 @@ static const struct usb_device_id option
+       { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5800_MINICARD_VZW, 0xff, 0xff, 0xff) },
+       { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5800_V2_MINICARD_VZW, 0xff, 0xff, 0xff) },
+       { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5804_MINICARD_ATT, 0xff, 0xff, 0xff) },
++      { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5821E),
++        .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
+       { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) },   /* ADU-E100, ADU-310 */
+       { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
+       { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) },
diff --git a/queue-3.18/usb-serial-sierra-fix-potential-deadlock-at-close.patch b/queue-3.18/usb-serial-sierra-fix-potential-deadlock-at-close.patch
new file mode 100644 (file)
index 0000000..f8c163b
--- /dev/null
@@ -0,0 +1,40 @@
+From e60870012e5a35b1506d7b376fddfb30e9da0b27 Mon Sep 17 00:00:00 2001
+From: John Ogness <john.ogness@linutronix.de>
+Date: Sun, 24 Jun 2018 00:32:11 +0200
+Subject: USB: serial: sierra: fix potential deadlock at close
+
+From: John Ogness <john.ogness@linutronix.de>
+
+commit e60870012e5a35b1506d7b376fddfb30e9da0b27 upstream.
+
+The portdata spinlock can be taken in interrupt context (via
+sierra_outdat_callback()).
+Disable interrupts when taking the portdata spinlock when discarding
+deferred URBs during close to prevent a possible deadlock.
+
+Fixes: 014333f77c0b ("USB: sierra: fix urb and memory leak on disconnect")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+[ johan: amend commit message and add fixes and stable tags ]
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/sierra.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -790,9 +790,9 @@ static void sierra_close(struct usb_seri
+               kfree(urb->transfer_buffer);
+               usb_free_urb(urb);
+               usb_autopm_put_interface_async(serial->interface);
+-              spin_lock(&portdata->lock);
++              spin_lock_irq(&portdata->lock);
+               portdata->outstanding_urbs--;
+-              spin_unlock(&portdata->lock);
++              spin_unlock_irq(&portdata->lock);
+       }
+       sierra_stop_rx_urbs(port);