5.10-stable patches

added patches:
	usb-serial-pl2303-add-device-id-for-macrosilicon-ms3020.patch
	usb-usbtmc-prevent-kernel-usb-infoleak.patch

diff --git a/queue-5.10/series b/queue-5.10/series
index 8353c723a15d6acfbc1260d876facab84a0244f3..8891918db137f5443598a2095798695d8f61cc9b 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -54,3 +54,5 @@ ftrace-fix-possible-use-after-free-issue-in-ftrace_location.patch
 gpiolib-cdev-ignore-reconfiguration-without-direction.patch
 cgroup-move-rcu_head-up-near-the-top-of-cgroup_root.patch
 usb-dwc3-fix-a-typo-in-field-name.patch
+usb-serial-pl2303-add-device-id-for-macrosilicon-ms3020.patch
+usb-usbtmc-prevent-kernel-usb-infoleak.patch

diff --git a/queue-5.10/usb-serial-pl2303-add-device-id-for-macrosilicon-ms3020.patch b/queue-5.10/usb-serial-pl2303-add-device-id-for-macrosilicon-ms3020.patch
new file mode 100644 (file)
index 0000000..2ec3fc0
--- /dev/null
+++ b/queue-5.10/usb-serial-pl2303-add-device-id-for-macrosilicon-ms3020.patch
@@ -0,0 +1,41 @@
+From 7d47d22444bb7dc1b6d768904a22070ef35e1fc0 Mon Sep 17 00:00:00 2001
+From: Junhao Xie <bigfoot@classfun.cn>
+Date: Tue, 3 Sep 2024 23:06:38 +0800
+Subject: USB: serial: pl2303: add device id for Macrosilicon MS3020
+
+From: Junhao Xie <bigfoot@classfun.cn>
+
+commit 7d47d22444bb7dc1b6d768904a22070ef35e1fc0 upstream.
+
+Add the device id for the Macrosilicon MS3020 which is a
+PL2303HXN based device.
+
+Signed-off-by: Junhao Xie <bigfoot@classfun.cn>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/pl2303.c |    1 +
+ drivers/usb/serial/pl2303.h |    4 ++++
+ 2 files changed, 5 insertions(+)
+
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -118,6 +118,7 @@ static const struct usb_device_id id_tab
+       { USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) },
+       { USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) },
+       { USB_DEVICE(IBM_VENDOR_ID, IBM_PRODUCT_ID) },
++      { USB_DEVICE(MACROSILICON_VENDOR_ID, MACROSILICON_MS3020_PRODUCT_ID) },
+       { }                                     /* Terminating entry */
+ };
+ 
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -171,3 +171,7 @@
+ /* Allied Telesis VT-Kit3 */
+ #define AT_VENDOR_ID          0x0caa
+ #define AT_VTKIT3_PRODUCT_ID  0x3001
++
++/* Macrosilicon MS3020 */
++#define MACROSILICON_VENDOR_ID                0x345f
++#define MACROSILICON_MS3020_PRODUCT_ID        0x3020

diff --git a/queue-5.10/usb-usbtmc-prevent-kernel-usb-infoleak.patch b/queue-5.10/usb-usbtmc-prevent-kernel-usb-infoleak.patch
new file mode 100644 (file)
index 0000000..7e658cd
--- /dev/null
+++ b/queue-5.10/usb-usbtmc-prevent-kernel-usb-infoleak.patch
@@ -0,0 +1,34 @@
+From 625fa77151f00c1bd00d34d60d6f2e710b3f9aad Mon Sep 17 00:00:00 2001
+From: Edward Adam Davis <eadavis@qq.com>
+Date: Sun, 8 Sep 2024 17:17:41 +0800
+Subject: USB: usbtmc: prevent kernel-usb-infoleak
+
+From: Edward Adam Davis <eadavis@qq.com>
+
+commit 625fa77151f00c1bd00d34d60d6f2e710b3f9aad upstream.
+
+The syzbot reported a kernel-usb-infoleak in usbtmc_write,
+we need to clear the structure before filling fields.
+
+Fixes: 4ddc645f40e9 ("usb: usbtmc: Add ioctl for vendor specific write")
+Reported-and-tested-by: syzbot+9d34f80f841e948c3fdb@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=9d34f80f841e948c3fdb
+Signed-off-by: Edward Adam Davis <eadavis@qq.com>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/tencent_9649AA6EC56EDECCA8A7D106C792D1C66B06@qq.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/usbtmc.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -724,7 +724,7 @@ static struct urb *usbtmc_create_urb(voi
+       if (!urb)
+               return NULL;
+ 
+-      dmabuf = kmalloc(bufsize, GFP_KERNEL);
++      dmabuf = kzalloc(bufsize, GFP_KERNEL);
+       if (!dmabuf) {
+               usb_free_urb(urb);
+               return NULL;