5.4-stable patches

added patches:
	i2c-robotfuzz-osif-disable-zero-length-read-messages.patch
	i2c-tiny-usb-disable-zero-length-read-messages.patch

diff --git a/queue-5.4/i2c-robotfuzz-osif-disable-zero-length-read-messages.patch b/queue-5.4/i2c-robotfuzz-osif-disable-zero-length-read-messages.patch
new file mode 100644 (file)
index 0000000..5c4fb2b
--- /dev/null
+++ b/queue-5.4/i2c-robotfuzz-osif-disable-zero-length-read-messages.patch
@@ -0,0 +1,47 @@
+From 56ad91c1aa9c18064348edf69308080b03c9dc48 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Thu, 22 May 2025 08:42:35 +0200
+Subject: i2c: robotfuzz-osif: disable zero-length read messages
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+commit 56ad91c1aa9c18064348edf69308080b03c9dc48 upstream.
+
+This driver passes the length of an i2c_msg directly to
+usb_control_msg(). If the message is now a read and of length 0, it
+violates the USB protocol and a warning will be printed. Enable the
+I2C_AQ_NO_ZERO_LEN_READ quirk for this adapter thus forbidding 0-length
+read messages altogether.
+
+Fixes: 83e53a8f120f ("i2c: Add bus driver for for OSIF USB i2c device.")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Cc: <stable@vger.kernel.org> # v3.14+
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/20250522064234.3721-2-wsa+renesas@sang-engineering.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-robotfuzz-osif.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-robotfuzz-osif.c
++++ b/drivers/i2c/busses/i2c-robotfuzz-osif.c
+@@ -111,6 +111,11 @@ static u32 osif_func(struct i2c_adapter
+       return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
+ }
+ 
++/* prevent invalid 0-length usb_control_msg */
++static const struct i2c_adapter_quirks osif_quirks = {
++      .flags = I2C_AQ_NO_ZERO_LEN_READ,
++};
++
+ static const struct i2c_algorithm osif_algorithm = {
+       .master_xfer    = osif_xfer,
+       .functionality  = osif_func,
+@@ -143,6 +148,7 @@ static int osif_probe(struct usb_interfa
+ 
+       priv->adapter.owner = THIS_MODULE;
+       priv->adapter.class = I2C_CLASS_HWMON;
++      priv->adapter.quirks = &osif_quirks;
+       priv->adapter.algo = &osif_algorithm;
+       priv->adapter.algo_data = priv;
+       snprintf(priv->adapter.name, sizeof(priv->adapter.name),

diff --git a/queue-5.4/i2c-tiny-usb-disable-zero-length-read-messages.patch b/queue-5.4/i2c-tiny-usb-disable-zero-length-read-messages.patch
new file mode 100644 (file)
index 0000000..d959364
--- /dev/null
+++ b/queue-5.4/i2c-tiny-usb-disable-zero-length-read-messages.patch
@@ -0,0 +1,47 @@
+From cbdb25ccf7566eee0c2b945e35cb98baf9ed0aa6 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Thu, 22 May 2025 08:43:49 +0200
+Subject: i2c: tiny-usb: disable zero-length read messages
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+commit cbdb25ccf7566eee0c2b945e35cb98baf9ed0aa6 upstream.
+
+This driver passes the length of an i2c_msg directly to
+usb_control_msg(). If the message is now a read and of length 0, it
+violates the USB protocol and a warning will be printed. Enable the
+I2C_AQ_NO_ZERO_LEN_READ quirk for this adapter thus forbidding 0-length
+read messages altogether.
+
+Fixes: e8c76eed2ecd ("i2c: New i2c-tiny-usb bus driver")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Cc: <stable@vger.kernel.org> # v2.6.22+
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Link: https://lore.kernel.org/r/20250522064349.3823-2-wsa+renesas@sang-engineering.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i2c/busses/i2c-tiny-usb.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-tiny-usb.c
++++ b/drivers/i2c/busses/i2c-tiny-usb.c
+@@ -140,6 +140,11 @@ out:
+       return ret;
+ }
+ 
++/* prevent invalid 0-length usb_control_msg */
++static const struct i2c_adapter_quirks usb_quirks = {
++      .flags = I2C_AQ_NO_ZERO_LEN_READ,
++};
++
+ /* This is the actual algorithm we define */
+ static const struct i2c_algorithm usb_algorithm = {
+       .master_xfer    = usb_xfer,
+@@ -246,6 +251,7 @@ static int i2c_tiny_usb_probe(struct usb
+       /* setup i2c adapter description */
+       dev->adapter.owner = THIS_MODULE;
+       dev->adapter.class = I2C_CLASS_HWMON;
++      dev->adapter.quirks = &usb_quirks;
+       dev->adapter.algo = &usb_algorithm;
+       dev->adapter.algo_data = dev;
+       snprintf(dev->adapter.name, sizeof(dev->adapter.name),

diff --git a/queue-5.4/series b/queue-5.4/series
index 5694557513ed1c5ab4142d9e2c38aaa0655119ee..cda16c08df993a8bb638fd29707532571b8d22ee 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -39,3 +39,5 @@ asoc-codec-wcd9335-convert-to-gpio-descriptors.patch
 asoc-codecs-wcd9335-fix-missing-free-of-regulator-su.patch
 rdma-core-use-refcount_t-instead-of-atomic_t-on-refc.patch
 rdma-iwcm-fix-use-after-free-of-work-objects-after-c.patch
+i2c-tiny-usb-disable-zero-length-read-messages.patch
+i2c-robotfuzz-osif-disable-zero-length-read-messages.patch