]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.10-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 11 Jan 2021 07:36:44 +0000 (08:36 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 11 Jan 2021 07:36:44 +0000 (08:36 +0100)
added patches:
crypto-asym_tpm-correct-zero-out-potential-secrets.patch
crypto-ecdh-avoid-buffer-overflow-in-ecdh_set_secret.patch
powerpc-32s-fix-rtas-machine-check-with-vmap-stack.patch
powerpc-handle-.text.-hot-unlikely-.-in-linker-script.patch
staging-comedi-return-efault-if-copy_to_user-fails.patch
staging-mt7621-dma-fix-a-resource-leak-in-an-error-handling-path.patch
usb-cdc-acm-blacklist-another-ir-droid-device.patch
usb-cdc-wdm-fix-use-after-free-in-service_outstanding_interrupt.patch
usb-gadget-enable-super-speed-plus.patch
usb-typec-intel_pmc_mux-configure-hpd-first-for-hpd-irq-request.patch

queue-5.10/crypto-asym_tpm-correct-zero-out-potential-secrets.patch [new file with mode: 0644]
queue-5.10/crypto-ecdh-avoid-buffer-overflow-in-ecdh_set_secret.patch [new file with mode: 0644]
queue-5.10/powerpc-32s-fix-rtas-machine-check-with-vmap-stack.patch [new file with mode: 0644]
queue-5.10/powerpc-handle-.text.-hot-unlikely-.-in-linker-script.patch [new file with mode: 0644]
queue-5.10/series
queue-5.10/staging-comedi-return-efault-if-copy_to_user-fails.patch [new file with mode: 0644]
queue-5.10/staging-mt7621-dma-fix-a-resource-leak-in-an-error-handling-path.patch [new file with mode: 0644]
queue-5.10/usb-cdc-acm-blacklist-another-ir-droid-device.patch [new file with mode: 0644]
queue-5.10/usb-cdc-wdm-fix-use-after-free-in-service_outstanding_interrupt.patch [new file with mode: 0644]
queue-5.10/usb-gadget-enable-super-speed-plus.patch [new file with mode: 0644]
queue-5.10/usb-typec-intel_pmc_mux-configure-hpd-first-for-hpd-irq-request.patch [new file with mode: 0644]

diff --git a/queue-5.10/crypto-asym_tpm-correct-zero-out-potential-secrets.patch b/queue-5.10/crypto-asym_tpm-correct-zero-out-potential-secrets.patch
new file mode 100644 (file)
index 0000000..0daf7f0
--- /dev/null
@@ -0,0 +1,35 @@
+From f93274ef0fe972c120c96b3207f8fce376231a60 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Fri, 4 Dec 2020 09:01:36 +0100
+Subject: crypto: asym_tpm: correct zero out potential secrets
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit f93274ef0fe972c120c96b3207f8fce376231a60 upstream.
+
+The function derive_pub_key() should be calling memzero_explicit()
+instead of memset() in case the complier decides to optimize away the
+call to memset() because it "knows" no one is going to touch the memory
+anymore.
+
+Cc: stable <stable@vger.kernel.org>
+Reported-by: Ilil Blum Shem-Tov <ilil.blum.shem-tov@intel.com>
+Tested-by: Ilil Blum Shem-Tov <ilil.blum.shem-tov@intel.com>
+Link: https://lore.kernel.org/r/X8ns4AfwjKudpyfe@kroah.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ crypto/asymmetric_keys/asym_tpm.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/crypto/asymmetric_keys/asym_tpm.c
++++ b/crypto/asymmetric_keys/asym_tpm.c
+@@ -354,7 +354,7 @@ static uint32_t derive_pub_key(const voi
+       memcpy(cur, e, sizeof(e));
+       cur += sizeof(e);
+       /* Zero parameters to satisfy set_pub_key ABI. */
+-      memset(cur, 0, SETKEY_PARAMS_SIZE);
++      memzero_explicit(cur, SETKEY_PARAMS_SIZE);
+       return cur - buf;
+ }
diff --git a/queue-5.10/crypto-ecdh-avoid-buffer-overflow-in-ecdh_set_secret.patch b/queue-5.10/crypto-ecdh-avoid-buffer-overflow-in-ecdh_set_secret.patch
new file mode 100644 (file)
index 0000000..fa2d4d6
--- /dev/null
@@ -0,0 +1,41 @@
+From 0aa171e9b267ce7c52d3a3df7bc9c1fc0203dec5 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Sat, 2 Jan 2021 14:59:09 +0100
+Subject: crypto: ecdh - avoid buffer overflow in ecdh_set_secret()
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+commit 0aa171e9b267ce7c52d3a3df7bc9c1fc0203dec5 upstream.
+
+Pavel reports that commit 17858b140bf4 ("crypto: ecdh - avoid unaligned
+accesses in ecdh_set_secret()") fixes one problem but introduces another:
+the unconditional memcpy() introduced by that commit may overflow the
+target buffer if the source data is invalid, which could be the result of
+intentional tampering.
+
+So check params.key_size explicitly against the size of the target buffer
+before validating the key further.
+
+Fixes: 17858b140bf4 ("crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()")
+Reported-by: Pavel Machek <pavel@denx.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ crypto/ecdh.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/crypto/ecdh.c
++++ b/crypto/ecdh.c
+@@ -39,7 +39,8 @@ static int ecdh_set_secret(struct crypto
+       struct ecdh params;
+       unsigned int ndigits;
+-      if (crypto_ecdh_decode_key(buf, len, &params) < 0)
++      if (crypto_ecdh_decode_key(buf, len, &params) < 0 ||
++          params.key_size > sizeof(ctx->private_key))
+               return -EINVAL;
+       ndigits = ecdh_supported_curve(params.curve_id);
diff --git a/queue-5.10/powerpc-32s-fix-rtas-machine-check-with-vmap-stack.patch b/queue-5.10/powerpc-32s-fix-rtas-machine-check-with-vmap-stack.patch
new file mode 100644 (file)
index 0000000..953ece6
--- /dev/null
@@ -0,0 +1,49 @@
+From 98bf2d3f4970179c702ef64db658e0553bc6ef3a Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+Date: Tue, 22 Dec 2020 07:11:18 +0000
+Subject: powerpc/32s: Fix RTAS machine check with VMAP stack
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+commit 98bf2d3f4970179c702ef64db658e0553bc6ef3a upstream.
+
+When we have VMAP stack, exception prolog 1 sets r1, not r11.
+
+When it is not an RTAS machine check, don't trash r1 because it is
+needed by prolog 1.
+
+Fixes: da7bb43ab9da ("powerpc/32: Fix vmap stack - Properly set r1 before activating MMU")
+Fixes: d2e006036082 ("powerpc/32: Use SPRN_SPRG_SCRATCH2 in exception prologs")
+Cc: stable@vger.kernel.org # v5.10+
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+[mpe: Squash in fixup for RTAS machine check from Christophe]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/bc77d61d1c18940e456a2dee464f1e2eda65a3f0.1608621048.git.christophe.leroy@csgroup.eu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/head_book3s_32.S |    9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/powerpc/kernel/head_book3s_32.S
++++ b/arch/powerpc/kernel/head_book3s_32.S
+@@ -262,10 +262,19 @@ __secondary_hold_acknowledge:
+ MachineCheck:
+       EXCEPTION_PROLOG_0
+ #ifdef CONFIG_PPC_CHRP
++#ifdef CONFIG_VMAP_STACK
++      mtspr   SPRN_SPRG_SCRATCH2,r1
++      mfspr   r1, SPRN_SPRG_THREAD
++      lwz     r1, RTAS_SP(r1)
++      cmpwi   cr1, r1, 0
++      bne     cr1, 7f
++      mfspr   r1, SPRN_SPRG_SCRATCH2
++#else
+       mfspr   r11, SPRN_SPRG_THREAD
+       lwz     r11, RTAS_SP(r11)
+       cmpwi   cr1, r11, 0
+       bne     cr1, 7f
++#endif
+ #endif /* CONFIG_PPC_CHRP */
+       EXCEPTION_PROLOG_1 for_rtas=1
+ 7:    EXCEPTION_PROLOG_2
diff --git a/queue-5.10/powerpc-handle-.text.-hot-unlikely-.-in-linker-script.patch b/queue-5.10/powerpc-handle-.text.-hot-unlikely-.-in-linker-script.patch
new file mode 100644 (file)
index 0000000..82d662e
--- /dev/null
@@ -0,0 +1,57 @@
+From 3ce47d95b7346dcafd9bed3556a8d072cb2b8571 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Mon, 4 Jan 2021 13:59:53 -0700
+Subject: powerpc: Handle .text.{hot,unlikely}.* in linker script
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+commit 3ce47d95b7346dcafd9bed3556a8d072cb2b8571 upstream.
+
+Commit eff8728fe698 ("vmlinux.lds.h: Add PGO and AutoFDO input
+sections") added ".text.unlikely.*" and ".text.hot.*" due to an LLVM
+change [1].
+
+After another LLVM change [2], these sections are seen in some PowerPC
+builds, where there is a orphan section warning then build failure:
+
+$ make -skj"$(nproc)" \
+       ARCH=powerpc CROSS_COMPILE=powerpc64le-linux-gnu- LLVM=1 O=out \
+       distclean powernv_defconfig zImage.epapr
+ld.lld: warning: kernel/built-in.a(panic.o):(.text.unlikely.) is being placed in '.text.unlikely.'
+...
+ld.lld: warning: address (0xc000000000009314) of section .text is not a multiple of alignment (256)
+...
+ERROR: start_text address is c000000000009400, should be c000000000008000
+ERROR: try to enable LD_HEAD_STUB_CATCH config option
+ERROR: see comments in arch/powerpc/tools/head_check.sh
+...
+
+Explicitly handle these sections like in the main linker script so
+there is no more build failure.
+
+[1]: https://reviews.llvm.org/D79600
+[2]: https://reviews.llvm.org/D92493
+
+Fixes: 83a092cf95f2 ("powerpc: Link warning for orphan sections")
+Cc: stable@vger.kernel.org
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://github.com/ClangBuiltLinux/linux/issues/1218
+Link: https://lore.kernel.org/r/20210104205952.1399409-1-natechancellor@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/vmlinux.lds.S |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/kernel/vmlinux.lds.S
++++ b/arch/powerpc/kernel/vmlinux.lds.S
+@@ -85,7 +85,7 @@ SECTIONS
+               ALIGN_FUNCTION();
+ #endif
+               /* careful! __ftr_alt_* sections need to be close to .text */
+-              *(.text.hot TEXT_MAIN .text.fixup .text.unlikely .fixup __ftr_alt_* .ref.text);
++              *(.text.hot .text.hot.* TEXT_MAIN .text.fixup .text.unlikely .text.unlikely.* .fixup __ftr_alt_* .ref.text);
+ #ifdef CONFIG_PPC64
+               *(.tramp.ftrace.text);
+ #endif
index 0baa9b37dc95d514df8bbf1763197ea95d09c71d..103a2b6a633a40fb388f4d577aabd7fa728ee4c7 100644 (file)
@@ -69,3 +69,13 @@ kbuild-don-t-hardcode-depmod-path.patch
 bluetooth-revert-hci_h5-close-serdev-device-and-free-hu-in-h5_close.patch
 scsi-block-remove-rqf_preempt-and-blk_mq_req_preempt.patch
 scsi-block-do-not-accept-any-requests-while-suspende.patch
+crypto-ecdh-avoid-buffer-overflow-in-ecdh_set_secret.patch
+crypto-asym_tpm-correct-zero-out-potential-secrets.patch
+powerpc-32s-fix-rtas-machine-check-with-vmap-stack.patch
+powerpc-handle-.text.-hot-unlikely-.-in-linker-script.patch
+staging-comedi-return-efault-if-copy_to_user-fails.patch
+staging-mt7621-dma-fix-a-resource-leak-in-an-error-handling-path.patch
+usb-gadget-enable-super-speed-plus.patch
+usb-cdc-acm-blacklist-another-ir-droid-device.patch
+usb-cdc-wdm-fix-use-after-free-in-service_outstanding_interrupt.patch
+usb-typec-intel_pmc_mux-configure-hpd-first-for-hpd-irq-request.patch
diff --git a/queue-5.10/staging-comedi-return-efault-if-copy_to_user-fails.patch b/queue-5.10/staging-comedi-return-efault-if-copy_to_user-fails.patch
new file mode 100644 (file)
index 0000000..57f5ff1
--- /dev/null
@@ -0,0 +1,35 @@
+From cab36da4bf1a35739b091b73714a39a1bbd02b05 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 2 Dec 2020 09:43:49 +0300
+Subject: Staging: comedi: Return -EFAULT if copy_to_user() fails
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit cab36da4bf1a35739b091b73714a39a1bbd02b05 upstream.
+
+Return -EFAULT on error instead of the number of bytes remaining to be
+copied.
+
+Fixes: bac42fb21259 ("comedi: get rid of compat_alloc_user_space() mess in COMEDI_CMD{,TEST} compat")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/X8c3pfwFy2jpy4BP@mwanda
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/comedi_fops.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -2987,7 +2987,9 @@ static int put_compat_cmd(struct comedi3
+       v32.chanlist_len = cmd->chanlist_len;
+       v32.data = ptr_to_compat(cmd->data);
+       v32.data_len = cmd->data_len;
+-      return copy_to_user(cmd32, &v32, sizeof(v32));
++      if (copy_to_user(cmd32, &v32, sizeof(v32)))
++              return -EFAULT;
++      return 0;
+ }
+ /* Handle 32-bit COMEDI_CMD ioctl. */
diff --git a/queue-5.10/staging-mt7621-dma-fix-a-resource-leak-in-an-error-handling-path.patch b/queue-5.10/staging-mt7621-dma-fix-a-resource-leak-in-an-error-handling-path.patch
new file mode 100644 (file)
index 0000000..cf3f8bb
--- /dev/null
@@ -0,0 +1,43 @@
+From d887d6104adeb94d1b926936ea21f07367f0ff9f Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sun, 13 Dec 2020 16:35:13 +0100
+Subject: staging: mt7621-dma: Fix a resource leak in an error handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit d887d6104adeb94d1b926936ea21f07367f0ff9f upstream.
+
+If an error occurs after calling 'mtk_hsdma_init()', it must be undone by
+a corresponding call to 'mtk_hsdma_uninit()' as already done in the
+remove function.
+
+Fixes: 0853c7a53eb3 ("staging: mt7621-dma: ralink: add rt2880 dma engine")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201213153513.138723-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/mt7621-dma/mtk-hsdma.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/mt7621-dma/mtk-hsdma.c
++++ b/drivers/staging/mt7621-dma/mtk-hsdma.c
+@@ -712,7 +712,7 @@ static int mtk_hsdma_probe(struct platfo
+       ret = dma_async_device_register(dd);
+       if (ret) {
+               dev_err(&pdev->dev, "failed to register dma device\n");
+-              return ret;
++              goto err_uninit_hsdma;
+       }
+       ret = of_dma_controller_register(pdev->dev.of_node,
+@@ -728,6 +728,8 @@ static int mtk_hsdma_probe(struct platfo
+ err_unregister:
+       dma_async_device_unregister(dd);
++err_uninit_hsdma:
++      mtk_hsdma_uninit(hsdma);
+       return ret;
+ }
diff --git a/queue-5.10/usb-cdc-acm-blacklist-another-ir-droid-device.patch b/queue-5.10/usb-cdc-acm-blacklist-another-ir-droid-device.patch
new file mode 100644 (file)
index 0000000..ed6ec1f
--- /dev/null
@@ -0,0 +1,35 @@
+From 0ffc76539e6e8d28114f95ac25c167c37b5191b3 Mon Sep 17 00:00:00 2001
+From: Sean Young <sean@mess.org>
+Date: Sun, 27 Dec 2020 13:45:02 +0000
+Subject: USB: cdc-acm: blacklist another IR Droid device
+
+From: Sean Young <sean@mess.org>
+
+commit 0ffc76539e6e8d28114f95ac25c167c37b5191b3 upstream.
+
+This device is supported by the IR Toy driver.
+
+Reported-by: Georgi Bakalski <georgi.bakalski@gmail.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20201227134502.4548-2-sean@mess.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-acm.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1895,6 +1895,10 @@ static const struct usb_device_id acm_id
+       { USB_DEVICE(0x04d8, 0xfd08),
+       .driver_info = IGNORE_DEVICE,
+       },
++
++      { USB_DEVICE(0x04d8, 0xf58b),
++      .driver_info = IGNORE_DEVICE,
++      },
+ #endif
+       /*Samsung phone in firmware update mode */
diff --git a/queue-5.10/usb-cdc-wdm-fix-use-after-free-in-service_outstanding_interrupt.patch b/queue-5.10/usb-cdc-wdm-fix-use-after-free-in-service_outstanding_interrupt.patch
new file mode 100644 (file)
index 0000000..e67610d
--- /dev/null
@@ -0,0 +1,80 @@
+From 5e5ff0b4b6bcb4d17b7a26ec8bcfc7dd4651684f Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+Date: Sun, 20 Dec 2020 00:25:53 +0900
+Subject: USB: cdc-wdm: Fix use after free in service_outstanding_interrupt().
+
+From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+
+commit 5e5ff0b4b6bcb4d17b7a26ec8bcfc7dd4651684f upstream.
+
+syzbot is reporting UAF at usb_submit_urb() [1], for
+service_outstanding_interrupt() is not checking WDM_DISCONNECTING
+before calling usb_submit_urb(). Close the race by doing same checks
+wdm_read() does upon retry.
+
+Also, while wdm_read() checks WDM_DISCONNECTING with desc->rlock held,
+service_interrupt_work() does not hold desc->rlock. Thus, it is possible
+that usb_submit_urb() is called from service_outstanding_interrupt() from
+service_interrupt_work() after WDM_DISCONNECTING was set and kill_urbs()
+ from wdm_disconnect() completed. Thus, move kill_urbs() in
+wdm_disconnect() to after cancel_work_sync() (which makes sure that
+service_interrupt_work() is no longer running) completed.
+
+Although it seems to be safe to dereference desc->intf->dev in
+service_outstanding_interrupt() even if WDM_DISCONNECTING was already set
+because desc->rlock or cancel_work_sync() prevents wdm_disconnect() from
+reaching list_del() before service_outstanding_interrupt() completes,
+let's not emit error message if WDM_DISCONNECTING is set by
+wdm_disconnect() while usb_submit_urb() is in progress.
+
+[1] https://syzkaller.appspot.com/bug?extid=9e04e2df4a32fb661daf
+
+Reported-by: syzbot <syzbot+9e04e2df4a32fb661daf@syzkaller.appspotmail.com>
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/620e2ee0-b9a3-dbda-a25b-a93e0ed03ec5@i-love.sakura.ne.jp
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-wdm.c |   16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -465,13 +465,23 @@ static int service_outstanding_interrupt
+       if (!desc->resp_count || !--desc->resp_count)
+               goto out;
++      if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
++              rv = -ENODEV;
++              goto out;
++      }
++      if (test_bit(WDM_RESETTING, &desc->flags)) {
++              rv = -EIO;
++              goto out;
++      }
++
+       set_bit(WDM_RESPONDING, &desc->flags);
+       spin_unlock_irq(&desc->iuspin);
+       rv = usb_submit_urb(desc->response, GFP_KERNEL);
+       spin_lock_irq(&desc->iuspin);
+       if (rv) {
+-              dev_err(&desc->intf->dev,
+-                      "usb_submit_urb failed with result %d\n", rv);
++              if (!test_bit(WDM_DISCONNECTING, &desc->flags))
++                      dev_err(&desc->intf->dev,
++                              "usb_submit_urb failed with result %d\n", rv);
+               /* make sure the next notification trigger a submit */
+               clear_bit(WDM_RESPONDING, &desc->flags);
+@@ -1027,9 +1037,9 @@ static void wdm_disconnect(struct usb_in
+       wake_up_all(&desc->wait);
+       mutex_lock(&desc->rlock);
+       mutex_lock(&desc->wlock);
+-      kill_urbs(desc);
+       cancel_work_sync(&desc->rxwork);
+       cancel_work_sync(&desc->service_outs_intr);
++      kill_urbs(desc);
+       mutex_unlock(&desc->wlock);
+       mutex_unlock(&desc->rlock);
diff --git a/queue-5.10/usb-gadget-enable-super-speed-plus.patch b/queue-5.10/usb-gadget-enable-super-speed-plus.patch
new file mode 100644 (file)
index 0000000..5dddc71
--- /dev/null
@@ -0,0 +1,52 @@
+From e2459108b5a0604c4b472cae2b3cb8d3444c77fb Mon Sep 17 00:00:00 2001
+From: "taehyun.cho" <taehyun.cho@samsung.com>
+Date: Thu, 7 Jan 2021 00:46:25 +0900
+Subject: usb: gadget: enable super speed plus
+
+From: taehyun.cho <taehyun.cho@samsung.com>
+
+commit e2459108b5a0604c4b472cae2b3cb8d3444c77fb upstream.
+
+Enable Super speed plus in configfs to support USB3.1 Gen2.
+This ensures that when a USB gadget is plugged in, it is
+enumerated as Gen 2 and connected at 10 Gbps if the host and
+cable are capable of it.
+
+Many in-tree gadget functions (fs, midi, acm, ncm, mass_storage,
+etc.) already have SuperSpeed Plus support.
+
+Tested: plugged gadget into Linux host and saw:
+[284907.385986] usb 8-2: new SuperSpeedPlus Gen 2 USB device number 3 using xhci_hcd
+
+Tested-by: Lorenzo Colitti <lorenzo@google.com>
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: taehyun.cho <taehyun.cho@samsung.com>
+Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
+Link: https://lore.kernel.org/r/20210106154625.2801030-1-lorenzo@google.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/configfs.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -1536,7 +1536,7 @@ static const struct usb_gadget_driver co
+       .suspend        = configfs_composite_suspend,
+       .resume         = configfs_composite_resume,
+-      .max_speed      = USB_SPEED_SUPER,
++      .max_speed      = USB_SPEED_SUPER_PLUS,
+       .driver = {
+               .owner          = THIS_MODULE,
+               .name           = "configfs-gadget",
+@@ -1576,7 +1576,7 @@ static struct config_group *gadgets_make
+       gi->composite.unbind = configfs_do_nothing;
+       gi->composite.suspend = NULL;
+       gi->composite.resume = NULL;
+-      gi->composite.max_speed = USB_SPEED_SUPER;
++      gi->composite.max_speed = USB_SPEED_SUPER_PLUS;
+       spin_lock_init(&gi->spinlock);
+       mutex_init(&gi->lock);
diff --git a/queue-5.10/usb-typec-intel_pmc_mux-configure-hpd-first-for-hpd-irq-request.patch b/queue-5.10/usb-typec-intel_pmc_mux-configure-hpd-first-for-hpd-irq-request.patch
new file mode 100644 (file)
index 0000000..79f27a9
--- /dev/null
@@ -0,0 +1,56 @@
+From 0f041b8592daaaea46e91a8ebb3b47e6e0171fd8 Mon Sep 17 00:00:00 2001
+From: Madhusudanarao Amara <madhusudanarao.amara@intel.com>
+Date: Wed, 16 Dec 2020 19:39:18 +0530
+Subject: usb: typec: intel_pmc_mux: Configure HPD first for HPD+IRQ request
+
+From: Madhusudanarao Amara <madhusudanarao.amara@intel.com>
+
+commit 0f041b8592daaaea46e91a8ebb3b47e6e0171fd8 upstream.
+
+Warm reboot scenarios some times type C Mux driver gets Mux configuration
+request as HPD=1,IRQ=1. In that scenario typeC Mux driver need to configure
+Mux as follows as per IOM requirement:
+ (1). Confgiure Mux HPD = 1, IRQ = 0
+ (2). Configure Mux with HPD = 1, IRQ = 1
+
+IOM expects TypeC Mux configuration as follows:
+ (1). HPD=1, IRQ=0
+ (2). HPD=1, IRQ=1
+if IOM gets mux config request (2) without configuring (1), it will ignore
+the request. The impact of this is there is no DP_alt mode display.
+
+Fixes: 43d596e32276 ("usb: typec: intel_pmc_mux: Check the port status before connect")
+Cc: stable@vger.kernel.org
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Madhusudanarao Amara <madhusudanarao.amara@intel.com>
+Link: https://lore.kernel.org/r/20201216140918.49197-1-madhusudanarao.amara@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/typec/mux/intel_pmc_mux.c |   11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/usb/typec/mux/intel_pmc_mux.c
++++ b/drivers/usb/typec/mux/intel_pmc_mux.c
+@@ -202,10 +202,21 @@ static int
+ pmc_usb_mux_dp_hpd(struct pmc_usb_port *port, struct typec_displayport_data *dp)
+ {
+       u8 msg[2] = { };
++      int ret;
+       msg[0] = PMC_USB_DP_HPD;
+       msg[0] |= port->usb3_port << PMC_USB_MSG_USB3_PORT_SHIFT;
++      /* Configure HPD first if HPD,IRQ comes together */
++      if (!IOM_PORT_HPD_ASSERTED(port->iom_status) &&
++          dp->status & DP_STATUS_IRQ_HPD &&
++          dp->status & DP_STATUS_HPD_STATE) {
++              msg[1] = PMC_USB_DP_HPD_LVL;
++              ret = pmc_usb_command(port, msg, sizeof(msg));
++              if (ret)
++                      return ret;
++      }
++
+       if (dp->status & DP_STATUS_IRQ_HPD)
+               msg[1] = PMC_USB_DP_HPD_IRQ;