linux.git/drivers/usb, branch v4.5-rc2

Merge tag 'usb-serial-4.5-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus

2016-01-28T16:32:42+00:00

Johan writes:

USB-serial fixes for v4.5-rc2

Here are two fixes of crashes in the visor driver that could be
triggered using bad (malicious) descriptors, a fix for two memory leaks
in the new mxu11x0 driver, and an interface-blacklist fix for the option
driver.

Included are also some new device ids.

Signed-off-by: Johan Hovold

USB: option: fix Cinterion AHxx enumeration

2016-01-25T12:32:53+00:00

In certain kernel configurations where the cdc_ether and option drivers
are compiled as modules there can occur a race condition in enumeration.
This causes the option driver to enumerate the ethernet(wwan) interface
as usb-serial interfaces.

usb-devices output for the modem:
T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  5 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=1e2d ProdID=0055 Rev=00.00
S:  Manufacturer=Cinterion
S:  Product=AHx
C:  #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=10mA
I:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
I:  If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether

Signed-off-by: John Ernberg 
Fixes: 1941138e1c02 ("USB: added support for Cinterion's products...")
Cc: stable 	# v3.9: 8ff10bdb14a52
Signed-off-by: Johan Hovold

USB: mxu11x0: fix memory leak on usb_serial private data

2016-01-25T11:47:47+00:00

On nominal execution, private data allocated on port_probe and attach
are never freed. Add port_remove and release callbacks to free them
respectively.

Signed-off-by: Mathieu OTHACEHE 
Signed-off-by: Johan Hovold

USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable

2016-01-25T10:52:58+00:00

Harald Linden reports that the ftdi_sio driver works properly for the
Yaesu SCU-18 cable if the device ids are added to the driver.  So let's
add them.

Reported-by: Harald Linden 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Johan Hovold

USB: serial: option: Adding support for Telit LE922

2016-01-25T10:43:14+00:00

This patch adds support for two PIDs of LE922.

Signed-off-by: Daniele Palmas 
Cc: stable 
Signed-off-by: Johan Hovold

USB: serial: visor: fix crash on detecting device without write_urbs

2016-01-25T10:40:45+00:00

The visor driver crashes in clie_5_attach() when a specially crafted USB
device without bulk-out endpoint is detected. This fix adds a check that
the device has proper configuration expected by the driver.

Reported-by: Ralf Spenneberg 
Signed-off-by: Vladis Dronov 
Fixes: cfb8da8f69b8 ("USB: visor: fix initialisation of UX50/TH55 devices")
Cc: stable 
Signed-off-by: Johan Hovold

USB: visor: fix null-deref at probe

2016-01-25T10:36:41+00:00

Fix null-pointer dereference at probe should a (malicious) Treo device
lack the expected endpoints.

Specifically, the Treo port-setup hack was dereferencing the bulk-in and
interrupt-in urbs without first making sure they had been allocated by
core.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable 
Signed-off-by: Johan Hovold

USB: cp210x: add ID for IAI USB to RS485 adaptor

2016-01-25T09:57:55+00:00

Added the USB serial console device ID for IAI Corp. RCB-CV-USB
USB to RS485 adaptor.

Signed-off-by: Peter Dedecker 
Cc: stable 
Signed-off-by: Johan Hovold

usb: hub: do not clear BOS field during reset device

2016-01-25T05:06:21+00:00

In function usb_reset_and_verify_device, the old BOS descriptor may
still be used before allocating a new one. (usb_unlocked_disable_lpm
function uses it under the situation that it fails to disable lpm.)
So we cannot set the udev->bos to NULL before that, just keep what it
was. It will be overwrite when allocating a new one.

Crash log:
BUG: unable to handle kernel NULL pointer dereference at
0000000000000010
IP: [] usb_enable_link_state+0x2d/0x2f0
Call Trace:
[] ? usb_set_lpm_timeout+0x12b/0x140
[] usb_enable_lpm+0x81/0xa0
[] usb_disable_lpm+0xa8/0xc0
[] usb_unlocked_disable_lpm+0x2c/0x50
[] usb_reset_and_verify_device+0xc3/0x710
[] ? usb_sg_wait+0x13d/0x190
[] usb_reset_device+0x133/0x280
[] usb_stor_port_reset+0x61/0x70
[] usb_stor_invoke_transport+0x88/0x520

Signed-off-by: Du, Changbin 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

cdc-acm:exclude Samsung phone 04e8:685d

2016-01-25T05:06:21+00:00

This phone needs to be handled by a specialised firmware tool
and is reported to crash irrevocably if cdc-acm takes it.

Signed-off-by: Oliver Neukum 
CC: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman