net-sched-matchall-add-missing-validation-of-tca_matchall_flags.patch
net-sched-flower-add-missing-validation-of-tca_flower_flags.patch
net-smc-fix-leak-of-kernel-memory-to-user-space.patch
+thunderbolt-prevent-crash-if-non-active-nvmem-file-is-read.patch
+usb-misc-iowarrior-add-support-for-2-oemed-devices.patch
+usb-misc-iowarrior-add-support-for-the-28-and-28l-devices.patch
+usb-misc-iowarrior-add-support-for-the-100-device.patch
--- /dev/null
+From 03cd45d2e219301880cabc357e3cf478a500080f Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Thu, 13 Feb 2020 12:56:04 +0300
+Subject: thunderbolt: Prevent crash if non-active NVMem file is read
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit 03cd45d2e219301880cabc357e3cf478a500080f upstream.
+
+The driver does not populate .reg_read callback for the non-active NVMem
+because the file is supposed to be write-only. However, it turns out
+NVMem subsystem does not yet support this and expects that the .reg_read
+callback is provided. If user reads the binary attribute it triggers
+NULL pointer dereference like this one:
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000000
+ ...
+ Call Trace:
+ bin_attr_nvmem_read+0x64/0x80
+ kernfs_fop_read+0xa7/0x180
+ vfs_read+0xbd/0x170
+ ksys_read+0x5a/0xd0
+ do_syscall_64+0x43/0x150
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fix this in the driver by providing .reg_read callback that always
+returns an error.
+
+Reported-by: Nicholas Johnson <nicholas.johnson-opensource@outlook.com.au>
+Fixes: e6b245ccd524 ("thunderbolt: Add support for host and device NVM firmware upgrade")
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200213095604.1074-1-mika.westerberg@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/thunderbolt/switch.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/thunderbolt/switch.c
++++ b/drivers/thunderbolt/switch.c
+@@ -240,6 +240,12 @@ static int tb_switch_nvm_read(void *priv
+ return dma_port_flash_read(sw->dma_port, offset, val, bytes);
+ }
+
++static int tb_switch_nvm_no_read(void *priv, unsigned int offset, void *val,
++ size_t bytes)
++{
++ return -EPERM;
++}
++
+ static int tb_switch_nvm_write(void *priv, unsigned int offset, void *val,
+ size_t bytes)
+ {
+@@ -285,6 +291,7 @@ static struct nvmem_device *register_nvm
+ config.read_only = true;
+ } else {
+ config.name = "nvm_non_active";
++ config.reg_read = tb_switch_nvm_no_read;
+ config.reg_write = tb_switch_nvm_write;
+ config.root_only = true;
+ }
--- /dev/null
+From 461d8deb26a7d70254bc0391feb4fd8a95e674e8 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Tue, 11 Feb 2020 20:04:21 -0800
+Subject: USB: misc: iowarrior: add support for 2 OEMed devices
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 461d8deb26a7d70254bc0391feb4fd8a95e674e8 upstream.
+
+Add support for two OEM devices that are identical to existing
+IO-Warrior devices, except for the USB device id.
+
+Cc: Christoph Jung <jung@codemercs.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200212040422.2991-1-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/misc/iowarrior.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/misc/iowarrior.c
++++ b/drivers/usb/misc/iowarrior.c
+@@ -33,6 +33,10 @@
+ /* full speed iowarrior */
+ #define USB_DEVICE_ID_CODEMERCS_IOW56 0x1503
+
++/* OEMed devices */
++#define USB_DEVICE_ID_CODEMERCS_IOW24SAG 0x158a
++#define USB_DEVICE_ID_CODEMERCS_IOW56AM 0x158b
++
+ /* Get a minor range for your devices from the usb maintainer */
+ #ifdef CONFIG_USB_DYNAMIC_MINORS
+ #define IOWARRIOR_MINOR_BASE 0
+@@ -137,6 +141,8 @@ static const struct usb_device_id iowarr
+ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOWPV1)},
+ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOWPV2)},
+ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW56)},
++ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW24SAG)},
++ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW56AM)},
+ {} /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, iowarrior_ids);
+@@ -364,6 +370,7 @@ static ssize_t iowarrior_write(struct fi
+ }
+ switch (dev->product_id) {
+ case USB_DEVICE_ID_CODEMERCS_IOW24:
++ case USB_DEVICE_ID_CODEMERCS_IOW24SAG:
+ case USB_DEVICE_ID_CODEMERCS_IOWPV1:
+ case USB_DEVICE_ID_CODEMERCS_IOWPV2:
+ case USB_DEVICE_ID_CODEMERCS_IOW40:
+@@ -378,6 +385,7 @@ static ssize_t iowarrior_write(struct fi
+ goto exit;
+ break;
+ case USB_DEVICE_ID_CODEMERCS_IOW56:
++ case USB_DEVICE_ID_CODEMERCS_IOW56AM:
+ /* The IOW56 uses asynchronous IO and more urbs */
+ if (atomic_read(&dev->write_busy) == MAX_WRITES_IN_FLIGHT) {
+ /* Wait until we are below the limit for submitted urbs */
+@@ -502,6 +510,7 @@ static long iowarrior_ioctl(struct file
+ switch (cmd) {
+ case IOW_WRITE:
+ if (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW24 ||
++ dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW24SAG ||
+ dev->product_id == USB_DEVICE_ID_CODEMERCS_IOWPV1 ||
+ dev->product_id == USB_DEVICE_ID_CODEMERCS_IOWPV2 ||
+ dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW40) {
+@@ -786,7 +795,8 @@ static int iowarrior_probe(struct usb_in
+ goto error;
+ }
+
+- if (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) {
++ if ((dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) ||
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM)) {
+ res = usb_find_last_int_out_endpoint(iface_desc,
+ &dev->int_out_endpoint);
+ if (res) {
+@@ -799,7 +809,8 @@ static int iowarrior_probe(struct usb_in
+ /* we have to check the report_size often, so remember it in the endianness suitable for our machine */
+ dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint);
+ if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) &&
+- (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56))
++ ((dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) ||
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM)))
+ /* IOWarrior56 has wMaxPacketSize different from report size */
+ dev->report_size = 7;
+
--- /dev/null
+From bab5417f5f0118ce914bc5b2f8381e959e891155 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Fri, 14 Feb 2020 08:11:48 -0800
+Subject: USB: misc: iowarrior: add support for the 100 device
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit bab5417f5f0118ce914bc5b2f8381e959e891155 upstream.
+
+Add a new device id for the 100 devie. It has 4 interfaces like the 28
+and 28L devices but a larger endpoint so more I/O pins.
+
+Cc: Christoph Jung <jung@codemercs.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200214161148.GA3963518@kroah.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/misc/iowarrior.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/misc/iowarrior.c
++++ b/drivers/usb/misc/iowarrior.c
+@@ -35,6 +35,7 @@
+ /* fuller speed iowarrior */
+ #define USB_DEVICE_ID_CODEMERCS_IOW28 0x1504
+ #define USB_DEVICE_ID_CODEMERCS_IOW28L 0x1505
++#define USB_DEVICE_ID_CODEMERCS_IOW100 0x1506
+
+ /* OEMed devices */
+ #define USB_DEVICE_ID_CODEMERCS_IOW24SAG 0x158a
+@@ -148,6 +149,7 @@ static const struct usb_device_id iowarr
+ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW56AM)},
+ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW28)},
+ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW28L)},
++ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW100)},
+ {} /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, iowarrior_ids);
+@@ -393,6 +395,7 @@ static ssize_t iowarrior_write(struct fi
+ case USB_DEVICE_ID_CODEMERCS_IOW56AM:
+ case USB_DEVICE_ID_CODEMERCS_IOW28:
+ case USB_DEVICE_ID_CODEMERCS_IOW28L:
++ case USB_DEVICE_ID_CODEMERCS_IOW100:
+ /* The IOW56 uses asynchronous IO and more urbs */
+ if (atomic_read(&dev->write_busy) == MAX_WRITES_IN_FLIGHT) {
+ /* Wait until we are below the limit for submitted urbs */
+@@ -805,7 +808,8 @@ static int iowarrior_probe(struct usb_in
+ if ((dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) ||
+ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM) ||
+ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28) ||
+- (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28L)) {
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28L) ||
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW100)) {
+ res = usb_find_last_int_out_endpoint(iface_desc,
+ &dev->int_out_endpoint);
+ if (res) {
+@@ -821,7 +825,8 @@ static int iowarrior_probe(struct usb_in
+ ((dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) ||
+ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM) ||
+ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28) ||
+- (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28L)))
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28L) ||
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW100)))
+ /* IOWarrior56 has wMaxPacketSize different from report size */
+ dev->report_size = 7;
+
--- /dev/null
+From 5f6f8da2d7b5a431d3f391d0d73ace8edfb42af7 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Tue, 11 Feb 2020 20:04:22 -0800
+Subject: USB: misc: iowarrior: add support for the 28 and 28L devices
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 5f6f8da2d7b5a431d3f391d0d73ace8edfb42af7 upstream.
+
+Add new device ids for the 28 and 28L devices. These have 4 interfaces
+instead of 2, but the driver binds the same, so the driver changes are
+minimal.
+
+Cc: Christoph Jung <jung@codemercs.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200212040422.2991-2-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/misc/iowarrior.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/misc/iowarrior.c
++++ b/drivers/usb/misc/iowarrior.c
+@@ -32,6 +32,9 @@
+ #define USB_DEVICE_ID_CODEMERCS_IOWPV2 0x1512
+ /* full speed iowarrior */
+ #define USB_DEVICE_ID_CODEMERCS_IOW56 0x1503
++/* fuller speed iowarrior */
++#define USB_DEVICE_ID_CODEMERCS_IOW28 0x1504
++#define USB_DEVICE_ID_CODEMERCS_IOW28L 0x1505
+
+ /* OEMed devices */
+ #define USB_DEVICE_ID_CODEMERCS_IOW24SAG 0x158a
+@@ -143,6 +146,8 @@ static const struct usb_device_id iowarr
+ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW56)},
+ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW24SAG)},
+ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW56AM)},
++ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW28)},
++ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW28L)},
+ {} /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, iowarrior_ids);
+@@ -386,6 +391,8 @@ static ssize_t iowarrior_write(struct fi
+ break;
+ case USB_DEVICE_ID_CODEMERCS_IOW56:
+ case USB_DEVICE_ID_CODEMERCS_IOW56AM:
++ case USB_DEVICE_ID_CODEMERCS_IOW28:
++ case USB_DEVICE_ID_CODEMERCS_IOW28L:
+ /* The IOW56 uses asynchronous IO and more urbs */
+ if (atomic_read(&dev->write_busy) == MAX_WRITES_IN_FLIGHT) {
+ /* Wait until we are below the limit for submitted urbs */
+@@ -796,7 +803,9 @@ static int iowarrior_probe(struct usb_in
+ }
+
+ if ((dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) ||
+- (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM)) {
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM) ||
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28) ||
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28L)) {
+ res = usb_find_last_int_out_endpoint(iface_desc,
+ &dev->int_out_endpoint);
+ if (res) {
+@@ -810,7 +819,9 @@ static int iowarrior_probe(struct usb_in
+ dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint);
+ if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) &&
+ ((dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) ||
+- (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM)))
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM) ||
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28) ||
++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28L)))
+ /* IOWarrior56 has wMaxPacketSize different from report size */
+ dev->report_size = 7;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
