kernel_replicant_linux/drivers/net/usb, branch replicant-11

net: usb: sipc_hsic: fix crash

2022-02-08T08:50:48+00:00

If the device is disconnected, we need to make sure that ep->in_urb is
not used otherwise we can have a use after free:
    ------------[ cut here ]------------
    WARNING: CPU: 2 PID: 5464 at lib/refcount.c:28 refcount_warn_saturate+0x60/0x134
    refcount_t: underflow; use-after-free.
    CPU: 2 PID: 5464 Comm: ipc-modem Not tainted 5.10.70-977921-g2f5a453af3fc-dirty #77
    Hardware name: Samsung Exynos (Flattened Device Tree)
    Backtrace:
    [] (dump_backtrace) from [] (show_stack+0x18/0x1c)
     r7:00000009 r6:60000013 r5:00000000 r4:c0eae790
    [] (show_stack) from [] (dump_stack+0x90/0xac)
    [] (dump_stack) from [] (__warn+0xac/0xd4)
     r7:00000009 r6:c3355c34 r5:00000000 r4:00000009
    [] (__warn) from [] (warn_slowpath_fmt+0x80/0xbc)
     r6:c03d282c r5:0000001c r4:c0bbea9c
    [] (warn_slowpath_fmt) from [] (refcount_warn_saturate+0x60/0x134)
     r8:c0e95dd0 r7:00000000 r6:00000000 r5:c0e95d98 r4:c5327d80
    [] (refcount_warn_saturate) from [] (usb_free_urb+0x6c/0x70)
    [] (usb_free_urb) from [] (sipc_disconnect+0x60/0x68)
     r5:c0e95d98 r4:c5327c40
    [] (sipc_disconnect) from [] (usb_unbind_interface+0x8c/0x1e4)
     r7:00000000 r6:c3564800 r5:00000000 r4:c3564020
    [] (usb_unbind_interface) from [] (device_release_driver_internal+0xc0/0x1b0)
     r10:c35648bc r9:c0beeea9 r8:c0eb5780 r7:00000000 r6:c0e95dd0 r5:00000000
     r4:c3564020
    [] (device_release_driver_internal) from [] (device_release_driver+0x18/0x1c)
     r7:00000000 r6:c0e96124 r5:c1c39030 r4:c3564020
    [] (device_release_driver) from [] (bus_remove_device+0xe4/0x120)
    [] (bus_remove_device) from [] (device_del+0x19c/0x370)
     r7:00000000 r6:c3564878 r5:c0e8e8f4 r4:c3564020
    [] (device_del) from [] (usb_disable_device+0x158/0x19c)
     r10:c35648bc r9:c0beeea9 r8:c0eb5780 r7:00000000 r6:00000000 r5:c3564000
     r4:c3564800
    [] (usb_disable_device) from [] (usb_disconnect+0x98/0x1dc)
     r9:c34cc800 r8:00000000 r7:00000000 r6:c3564878 r5:00000000 r4:c3564800
    [] (usb_disconnect) from [] (usb_disconnect+0x1bc/0x1dc)
     r10:c34cccbc r9:c3355e20 r8:00000000 r7:c35cec00 r6:c34ccc78 r5:00000001
     r4:c34ccc00
    [] (usb_disconnect) from [] (usb_remove_hcd+0xd0/0x1d4)
     r10:00000004 r9:c3354000 r8:00000000 r7:c161d454 r6:00000001 r5:c2c44cc0
     r4:c2c44c00
    [] (usb_remove_hcd) from [] (store_ehci_power+0x84/0x18c)
     r6:00000002 r5:c161d410 r4:c2c44c00
    [] (store_ehci_power) from [] (dev_attr_store+0x1c/0x28)
     r8:c33c1710 r7:c3355f00 r6:c33c1700 r5:c3d0d4c0 r4:c05dc51c
    [] (dev_attr_store) from [] (sysfs_kf_write+0x40/0x4c)
     r5:c3d0d4c0 r4:c04bc31c
    [] (sysfs_kf_write) from [] (kernfs_fop_write_iter+0xec/0x1ac)
     r5:c3d0d4c0 r4:00000002
    [] (kernfs_fop_write_iter) from [] (vfs_write+0x1a8/0x204)
     r8:beb948d8 r7:00000000 r6:c3355f58 r5:c367b600 r4:00000002
    [] (vfs_write) from [] (ksys_write+0x7c/0xd0)
     r8:00000002 r7:c3355f64 r6:c3355f58 r5:beb948d8 r4:c367b600
    [] (ksys_write) from [] (sys_write+0x10/0x14)
     r8:c0100264 r7:00000004 r6:00000000 r5:beb948d8 r4:00000004
    [] (sys_write) from [] (__sys_trace_return+0x0/0x1c)
    Exception stack(0xc3355fa8 to 0xc3355ff0)
    5fa0:                   00000004 beb948d8 00000004 beb948d8 00000002 00000000
    5fc0: 00000004 beb948d8 00000000 00000004 b6f40550 b6c32328 00452960 00464000
    5fe0: b6eed0ac beb948c0 b6ecc028 b6f01100
    ---[ end trace 9e1c4c0c71f8dda6 ]---

Signed-off-by: Denis 'GNUtoo' Carikli

net: usb: sipc_hsic: style cleanup

2022-02-08T08:49:55+00:00

Signed-off-by: Denis 'GNUtoo' Carikli

net: usb: sipc_hsic: disconnect: remove usb_driver_release_interface

2022-02-07T14:41:04+00:00

usb_driver_release_interface does nothing when called from disconnect().

Signed-off-by: Denis 'GNUtoo' Carikli

net: usb: add Samsung IPC-over-HSIC driver

2021-11-25T10:05:04+00:00

net: hso: fix muxed tty registration

2021-09-30T08:11:01+00:00

commit e8f69b16ee776da88589b5271e3f46020efc8f6c upstream.

If resource allocation and registration fail for a muxed tty device
(e.g. if there are no more minor numbers) the driver should not try to
deregister the never-registered (or already-deregistered) tty.

Fix up the error handling to avoid dereferencing a NULL pointer when
attempting to remove the character device.

Fixes: 72dc1c096c70 ("HSO: add option hso driver")
Cc: stable@vger.kernel.org	# 2.6.27
Signed-off-by: Johan Hovold 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: hso: add failure handler for add_net_device

2021-09-22T10:28:05+00:00

[ Upstream commit ecdc28defc46af476566fffd9e5cb4495a2f176e ]

If the network devices connected to the system beyond
HSO_MAX_NET_DEVICES. add_net_device() in hso_create_net_device()
will be failed for the network_table is full. It will lead to
business failure which rely on network_table, for example,
hso_suspend() and hso_resume(). It will also lead to memory leak
because resource release process can not search the hso_device
object from network_table in hso_free_interface().

Add failure handler for add_net_device() in hso_create_net_device()
to solve the above problems.

Fixes: 72dc1c096c70 ("HSO: add option hso driver")
Signed-off-by: Ziyang Xuan 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920

2021-09-22T10:28:01+00:00

[ Upstream commit aabbdc67f3485b5db27ab4eba01e5fbf1ffea62c ]

Add quirk CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE for Telit LN920
0x1061 composition in order to avoid bind error.

Signed-off-by: Daniele Palmas 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

net: usb: pegasus: fixes of set_register(s) return value evaluation;

2021-09-03T08:09:23+00:00

[ Upstream commit ffc9c3ebb4af870a121da99826e9ccb63dc8b3d7 ]

- restore the behavior in enable_net_traffic() to avoid regressions - Jakub
    Kicinski;
  - hurried up and removed redundant assignment in pegasus_open() before yet
    another checker complains;

Fixes: 8a160e2e9aeb ("net: usb: pegasus: Check the return value of get_geristers() and friends;")
Reported-by: Jakub Kicinski 
Signed-off-by: Petko Manolov 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

r8152: fix writing USB_BP2_EN

2021-08-26T12:35:51+00:00

[ Upstream commit a876a33d2a1102f99fc782fefb784f4dd4841d8c ]

The register of USB_BP2_EN is 16 bits, so we should use
ocp_write_word(), not ocp_write_byte().

Fixes: 9370f2d05a2a ("support request_firmware for RTL8153")
Signed-off-by: Hayes Wang 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

net: usb: lan78xx: don't modify phy_device state concurrently

2021-08-26T12:35:38+00:00

[ Upstream commit 6b67d4d63edece1033972214704c04f36c5be89a ]

Currently phy_device state could be left in inconsistent state shown
by following alert message[1]. This is because phy_read_status could
be called concurrently from lan78xx_delayedwork, phy_state_machine and
__ethtool_get_link. Fix this by making sure that phy_device state is
updated atomically.

[1] lan78xx 1-1.1.1:1.0 eth0: No phy led trigger registered for speed(-1)

Signed-off-by: Ivan T. Ivanov 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin