linux-stable.git/drivers/usb/serial, branch master Linux kernel stable tree Merge tag 'usb-serial-7.3-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next 2026-08-14T01:25:23+00:00 Greg Kroah-Hartman gregkh@linuxfoundation.org 2026-08-14T01:25:23+00:00 05abeffcc27ec965391e21f9029bc14dc1dd18e9 Johan writes: USB serial updates for 7.3-rc1 Here are the USB serial updates for 7.3-rc1, including: - fix digi_acceleport port registration order - stop digi_acceleport I/O when ports are closed - fix digi_acceleport OOB port dev_printk() - fix metro-usb unthrottle race - fix option slab OOB read with malicious devices - add support for a new class of Prolific PL256X devices Included are also various clean ups. All have been in linux-next with no reported issues. * tag 'usb-serial-7.3-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: pl2303: add support for PL256X multi-port devices USB: serial: option: fix slab OOB read in interrupt URB callback USB: serial: keyspan_pda: drop unused driver data usb-serial pointer USB: serial: metro-usb: drop redundant initialisations USB: serial: metro-usb: fix unthrottle race USB: serial: metro-usb: replace unnecessary atomic allocation USB: serial: digi_acceleport: fix oob port dev_printk() USB: serial: digi_acceleport: clean up inb command submission USB: serial: digi_acceleport: clean up write completion USB: serial: digi_acceleport: clean up xfer buf length expression USB: serial: digi_acceleport: drop unused in-buf define USB: serial: digi_acceleport: stop OOB I/O when not in use USB: serial: digi_acceleport: drop redundant driver data sanity checks USB: serial: digi_acceleport: clean up declarations and whitespace USB: serial: digi_acceleport: add oob port helper USB: serial: digi_acceleport: always stop write urb on close USB: serial: digi_acceleport: drop unused wait queue USB: serial: digi_acceleport: fix port registration order USB: serial: digi_acceleport: do not log stopping of urbs as errors 
Johan writes:

USB serial updates for 7.3-rc1

Here are the USB serial updates for 7.3-rc1, including:

 - fix digi_acceleport port registration order
 - stop digi_acceleport I/O when ports are closed
 - fix digi_acceleport OOB port dev_printk()
 - fix metro-usb unthrottle race
 - fix option slab OOB read with malicious devices
 - add support for a new class of Prolific PL256X devices

Included are also various clean ups.

All have been in linux-next with no reported issues.

* tag 'usb-serial-7.3-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial:
  USB: serial: pl2303: add support for PL256X multi-port devices
  USB: serial: option: fix slab OOB read in interrupt URB callback
  USB: serial: keyspan_pda: drop unused driver data usb-serial pointer
  USB: serial: metro-usb: drop redundant initialisations
  USB: serial: metro-usb: fix unthrottle race
  USB: serial: metro-usb: replace unnecessary atomic allocation
  USB: serial: digi_acceleport: fix oob port dev_printk()
  USB: serial: digi_acceleport: clean up inb command submission
  USB: serial: digi_acceleport: clean up write completion
  USB: serial: digi_acceleport: clean up xfer buf length expression
  USB: serial: digi_acceleport: drop unused in-buf define
  USB: serial: digi_acceleport: stop OOB I/O when not in use
  USB: serial: digi_acceleport: drop redundant driver data sanity checks
  USB: serial: digi_acceleport: clean up declarations and whitespace
  USB: serial: digi_acceleport: add oob port helper
  USB: serial: digi_acceleport: always stop write urb on close
  USB: serial: digi_acceleport: drop unused wait queue
  USB: serial: digi_acceleport: fix port registration order
  USB: serial: digi_acceleport: do not log stopping of urbs as errors
Merge tag 'usb-serial-7.2-rc7' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next 2026-08-14T01:24:34+00:00 Greg Kroah-Hartman gregkh@linuxfoundation.org 2026-08-14T01:24:34+00:00 248fe6d163caae06b498cd9e68e2f16950b57ebb Johan writes: USB serial fixes for 7.2-rc7 Here is a fix for a long-standing issue in the spcp8x5 driver which syzbot just started hitting and a change adding lockdep annotation to digi_acceleport to suppress a false positive deadlock warning. Note that only the digi_acceleport commit has been in linux-next (and with no reported issues). * tag 'usb-serial-7.2-rc7' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: spcp8x5: drop broken carrier detect support USB: serial: digi_acceleport: add port lock nesting annotation 
Johan writes:

USB serial fixes for 7.2-rc7

Here is a fix for a long-standing issue in the spcp8x5 driver which
syzbot just started hitting and a change adding lockdep annotation to
digi_acceleport to suppress a false positive deadlock warning.

Note that only the digi_acceleport commit has been in linux-next (and
with no reported issues).

* tag 'usb-serial-7.2-rc7' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial:
  USB: serial: spcp8x5: drop broken carrier detect support
  USB: serial: digi_acceleport: add port lock nesting annotation
USB: serial: spcp8x5: drop broken carrier detect support 2026-08-07T14:41:58+00:00 Johan Hovold johan@kernel.org 2026-08-06T13:52:48+00:00 d37186bd95a07e334447f47274a38a311dad2172 The driver does not support modem status notifications and instead used to fetch the modem status once at open() and subsequently operate on and report stale state. As part of fixing this, a call to fetch the status was added to carrier_raised(), which does not work as that callback must not sleep (e.g. unlike tiocmget()). Drop the broken carrier detect support. Fixes: e1ed212d8593 ("USB: spcp8x5: add proper modem-status support") Cc: stable@vger.kernel.org # 3.10 Reported-by: syzbot+3b514b87202742f22c44@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/6a73cea2.01d0871a.3a0d52.000d.GAE@google.com Signed-off-by: Johan Hovold <johan@kernel.org> 
The driver does not support modem status notifications and instead used
to fetch the modem status once at open() and subsequently operate on and
report stale state.

As part of fixing this, a call to fetch the status was added to
carrier_raised(), which does not work as that callback must not sleep
(e.g. unlike tiocmget()).

Drop the broken carrier detect support.

Fixes: e1ed212d8593 ("USB: spcp8x5: add proper modem-status support")
Cc: stable@vger.kernel.org	# 3.10
Reported-by: syzbot+3b514b87202742f22c44@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/6a73cea2.01d0871a.3a0d52.000d.GAE@google.com
Signed-off-by: Johan Hovold <johan@kernel.org>
USB: serial: pl2303: add support for PL256X multi-port devices 2026-08-03T08:48:44+00:00 Charles Yeh charlesyeh522@gmail.com 2026-07-21T11:24:40+00:00 15734de99517b0c81a1a5a3bccaff4593ef8d953 Prolific PL256X devices are multi-port USB-to-UART controllers, including the PL2533, PL2543 and PL2565 variants. These devices use vendor requests that differ from those used by the existing TYPE_HX and TYPE_HXN devices. They also require a separate UART reset request and use a port-specific register for configuring flow control. Add a new TYPE_MP device type and select the appropriate vendor requests, reset operation and flow-control register for PL256X devices. Store the USB interface number so that requests can be directed to the corresponding UART port. Detect the supported PL256X variants using bcdDevice before issuing any legacy vendor requests, as PL256X devices do not accept those requests. PL256X devices support baud rates up to 24 Mbps and do not use divisor encoding. Signed-off-by: Charles Yeh <charlesyeh522@gmail.com> Link: https://lore.kernel.org/all/CAAZvQQ6O4p35Xs2hVYaoJxD4D7U0YonsdweuPh6W8RQVhvoUNw@mail.gmail.com/ Signed-off-by: Johan Hovold <johan@kernel.org> 
Prolific PL256X devices are multi-port USB-to-UART controllers,
including the PL2533, PL2543 and PL2565 variants.

These devices use vendor requests that differ from those used by the
existing TYPE_HX and TYPE_HXN devices. They also require a separate UART
reset request and use a port-specific register for configuring flow
control.

Add a new TYPE_MP device type and select the appropriate vendor requests,
reset operation and flow-control register for PL256X devices. Store the
USB interface number so that requests can be directed to the corresponding
UART port.

Detect the supported PL256X variants using bcdDevice before issuing any
legacy vendor requests, as PL256X devices do not accept those requests.

PL256X devices support baud rates up to 24 Mbps and do not use divisor
encoding.

Signed-off-by: Charles Yeh <charlesyeh522@gmail.com>
Link: https://lore.kernel.org/all/CAAZvQQ6O4p35Xs2hVYaoJxD4D7U0YonsdweuPh6W8RQVhvoUNw@mail.gmail.com/
Signed-off-by: Johan Hovold <johan@kernel.org>
USB: serial: digi_acceleport: add port lock nesting annotation 2026-08-03T06:37:13+00:00 Johan Hovold johan@kernel.org 2026-08-01T12:58:27+00:00 177b48f840c79dbee24c59e311e1f463cf462737 The driver takes the driver port lock of both the OOB port and the port itself when setting the modem control signals, which confuses lockdep. Mark the OOB port lock as belonging to a separate subclass to suppress false positive lockdep deadlock warnings. Reported-by: syzbot+2051460e19471eeb42c3@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/6a6cd832.1aa927e4.17d4bf.0007.GAE@google.com/ Signed-off-by: Johan Hovold <johan@kernel.org> 
The driver takes the driver port lock of both the OOB port and the port
itself when setting the modem control signals, which confuses lockdep.

Mark the OOB port lock as belonging to a separate subclass to suppress
false positive lockdep deadlock warnings.

Reported-by: syzbot+2051460e19471eeb42c3@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/6a6cd832.1aa927e4.17d4bf.0007.GAE@google.com/
Signed-off-by: Johan Hovold <johan@kernel.org>
USB: serial: option: fix slab OOB read in interrupt URB callback 2026-07-31T13:23:53+00:00 Jiale Yao yaojiale02@163.com 2026-07-25T16:27:51+00:00 885d802f544ca7bfa8f3984d94233cce715bb6b3 The interrupt URB buffer is allocated in setup_port_interrupt_in() based on the endpoint's wMaxPacketSize: buffer_size = usb_endpoint_maxp(epd); port->interrupt_in_buffer = kmalloc(buffer_size, GFP_KERNEL); When a USB device declares wMaxPacketSize = 8 on its interrupt IN endpoint, the buffer is allocated from kmalloc-8 cache (exactly 8 bytes). If the device sends a short packet (actual_length < wMaxPacketSize), the URB completes with status == 0 and the callback proceeds to read: data[sizeof(struct usb_ctrlrequest)] which evaluates to data[8], accessing 1 byte beyond the allocated 8-byte buffer. This results in a slab out-of-bounds read. Fix this by adding the missing bounds check: first verify that the actual length is large enough to contain the struct usb_ctrlrequest header before accessing req_pkt->bRequestType and req_pkt->bRequest, and then verify that there is an additional byte for the modem signal state before reading data[sizeof(struct usb_ctrlrequest)] inside the conditional. Use sizeof(*req_pkt) instead of sizeof(struct usb_ctrlrequest) for consistency. Assisted-by: Claude:deepseek-v4-pro Signed-off-by: Jiale Yao <yaojiale02@163.com> Fixes: 58cfe9113e48 ("[PATCH] USB: add Option Card driver") Cc: stable@vger.kernel.org # v2.6.12 [ johan: use dev_err(); split signals declaration and initialisation ] Signed-off-by: Johan Hovold <johan@kernel.org> 
The interrupt URB buffer is allocated in setup_port_interrupt_in() based
on the endpoint's wMaxPacketSize:

    buffer_size = usb_endpoint_maxp(epd);
    port->interrupt_in_buffer = kmalloc(buffer_size, GFP_KERNEL);

When a USB device declares wMaxPacketSize = 8 on its interrupt IN
endpoint, the buffer is allocated from kmalloc-8 cache (exactly
8 bytes).

If the device sends a short packet (actual_length < wMaxPacketSize),
the URB completes with status == 0 and the callback proceeds to read:

    data[sizeof(struct usb_ctrlrequest)]

which evaluates to data[8], accessing 1 byte beyond the allocated 8-byte
buffer. This results in a slab out-of-bounds read.

Fix this by adding the missing bounds check: first verify that the
actual length is large enough to contain the struct usb_ctrlrequest
header before accessing req_pkt->bRequestType and req_pkt->bRequest,
and then verify that there is an additional byte for the modem signal
state before reading data[sizeof(struct usb_ctrlrequest)] inside the
conditional.  Use sizeof(*req_pkt) instead of sizeof(struct
usb_ctrlrequest) for consistency.

Assisted-by: Claude:deepseek-v4-pro
Signed-off-by: Jiale Yao <yaojiale02@163.com>
Fixes: 58cfe9113e48 ("[PATCH] USB: add Option Card driver")
Cc: stable@vger.kernel.org	# v2.6.12
[ johan: use dev_err(); split signals declaration and initialisation ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Merge 7.2-rc5 into usb-next 2026-07-27T06:40:53+00:00 Greg Kroah-Hartman gregkh@linuxfoundation.org 2026-07-27T06:40:53+00:00 5d5fd841c34649f1b09220fe58e59dffd61c447d We need the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
We need the USB fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
USB: serial: io_edgeport: cap received transmit credits 2026-07-22T09:23:54+00:00 Sunho Park shpark061104@gmail.com 2026-07-14T10:42:30+00:00 faaddd811c5099f11a5f52e68a6b31a5898cda4f The interrupt-status packet reports transmit credits returned by the device. edge_interrupt_callback() adds the 16-bit value to txCredits without checking maxTxCredits. edge_write() uses txCredits minus the software FIFO count as the amount of data that fits. Since the FIFO is allocated with maxTxCredits bytes, txCredits exceeding maxTxCredits can cause OOB write in ring buffer. Cap accumulated credits at maxTxCredits. Conforming devices should never hit the cap. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Assisted-by: Codex:GPT-5 Signed-off-by: Sunho Park <shpark061104@gmail.com> Signed-off-by: Johan Hovold <johan@kernel.org> 
The interrupt-status packet reports transmit credits returned by the
device. edge_interrupt_callback() adds the 16-bit value to txCredits
without checking maxTxCredits.

edge_write() uses txCredits minus the software FIFO count as the amount
of data that fits. Since the FIFO is allocated with maxTxCredits bytes,
txCredits exceeding maxTxCredits can cause OOB write in ring buffer.

Cap accumulated credits at maxTxCredits. Conforming devices should never
hit the cap.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Sunho Park <shpark061104@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
USB: serial: option: add TDTECH MT5710-CN 2026-07-21T12:53:40+00:00 Chukun Pan amadeus@jmu.edu.cn 2026-07-08T10:00:01+00:00 55645e4f3c6022ffb160ad3617d2b624eaa38501 Add support for the TDTECH MT5710-CN (5G redcap) module based on the Huawei HiSilicon Balong chip. T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=3466 ProdID=3301 Rev=ff.ff S: Manufacturer=TD Tech Ltd. S: Product=TDTECH MT571X S: SerialNumber=0123456789ABCDEF C:* #Ifs= 6 Cfg#= 1 Atr=c0 MxPwr= 0mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0d Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0d Prot=00 Driver=cdc_ncm E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncm I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncm E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=13 Driver=option E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=12 Driver=option E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=1c Driver=option E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=14 Driver=option E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Interface: ECM / NCM + DIAG + AT + SERIAL + GPS Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn> Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold <johan@kernel.org> 
Add support for the TDTECH MT5710-CN (5G redcap) module based on the
Huawei HiSilicon Balong chip.

T:  Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=  3 Spd=480  MxCh= 0
D:  Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=3466 ProdID=3301 Rev=ff.ff
S:  Manufacturer=TD Tech Ltd.
S:  Product=TDTECH MT571X
S:  SerialNumber=0123456789ABCDEF
C:* #Ifs= 6 Cfg#= 1 Atr=c0 MxPwr=  0mA
A:  FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0d Prot=00
I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0d Prot=00 Driver=cdc_ncm
E:  Ad=82(I) Atr=03(Int.) MxPS=  16 Ivl=32ms
I:  If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncm
I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=01 Driver=cdc_ncm
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=13 Driver=option
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=12 Driver=option
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=1c Driver=option
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=14 Driver=option
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

Interface: ECM / NCM + DIAG + AT + SERIAL + GPS

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
USB: serial: io_ti: reject oversized boot-mode firmware 2026-07-20T14:35:40+00:00 Pengpeng Hou pengpeng@iscas.ac.cn 2026-07-20T11:48:17+00:00 6fcd91ce2a0787cd4bdf6a0b3cd4884566a3cdba do_boot_mode() copies the firmware payload, excluding its four-byte prefix, into a fixed 15.5 KiB staging buffer. check_fw_sanity() already proves that the image contains its seven-byte header and validates the declared image length and checksum, but it does not impose this boot-mode destination limit. Reject images whose payload does not fit before allocating and filling the staging buffer. Fixes: d12b219a228e ("edgeport-ti: use request_firmware()") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Johan Hovold <johan@kernel.org> 
do_boot_mode() copies the firmware payload, excluding its four-byte prefix,
into a fixed 15.5 KiB staging buffer. check_fw_sanity() already proves that
the image contains its seven-byte header and validates the declared image
length and checksum, but it does not impose this boot-mode destination
limit.

Reject images whose payload does not fit before allocating and filling the
staging buffer.

Fixes: d12b219a228e ("edgeport-ti: use request_firmware()")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Johan Hovold <johan@kernel.org>