From: Greg Kroah-Hartman Date: Thu, 30 Jan 2025 11:44:42 +0000 (+0100) Subject: 6.6-stable patches X-Git-Tag: v6.13.1~18 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0556c4869f17d8c9d1dfdd282de9f44195e9a708;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: alsa-usb-audio-add-delay-quirk-for-usb-audio-device.patch input-atkbd-map-f23-key-to-support-default-copilot-shortcut.patch input-xpad-add-qh-electronics-vid-pid.patch input-xpad-add-support-for-nacon-evol-x-xbox-one-controller.patch input-xpad-add-support-for-nacon-pro-compact.patch input-xpad-add-support-for-wooting-two-he-arm.patch input-xpad-add-unofficial-xbox-360-wireless-receiver-clone.patch input-xpad-improve-name-of-8bitdo-controller-2dc8-3106.patch revert-usb-gadget-u_serial-disable-ep-before-setting-port-to-null-to-fix-the-crash-caused-by-port-being-null.patch usb-serial-quatech2-fix-null-ptr-deref-in-qt2_process_read_urb.patch --- diff --git a/queue-6.6/alsa-usb-audio-add-delay-quirk-for-usb-audio-device.patch b/queue-6.6/alsa-usb-audio-add-delay-quirk-for-usb-audio-device.patch new file mode 100644 index 0000000000..f4bea2f42c --- /dev/null +++ b/queue-6.6/alsa-usb-audio-add-delay-quirk-for-usb-audio-device.patch @@ -0,0 +1,37 @@ +From ad5b205f9e022b407d91f952faddd05718be2866 Mon Sep 17 00:00:00 2001 +From: Lianqin Hu +Date: Wed, 15 Jan 2025 09:32:35 +0000 +Subject: ALSA: usb-audio: Add delay quirk for USB Audio Device + +From: Lianqin Hu + +commit ad5b205f9e022b407d91f952faddd05718be2866 upstream. + +Audio control requests that sets sampling frequency sometimes fail on +this card. Adding delay between control messages eliminates that problem. + +usb 1-1: New USB device found, idVendor=0d8c, idProduct=0014 +usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 +usb 1-1: Product: USB Audio Device +usb 1-1: Manufacturer: C-Media Electronics Inc. + +Signed-off-by: Lianqin Hu +Cc: +Signed-off-by: Takashi Iwai +Link: https://patch.msgid.link/TYUPR06MB6217E94D922B9BF422A73F32D2192@TYUPR06MB6217.apcprd06.prod.outlook.com +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/quirks.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -2139,6 +2139,8 @@ static const struct usb_audio_quirk_flag + QUIRK_FLAG_CTL_MSG_DELAY_1M), + DEVICE_FLG(0x0c45, 0x6340, /* Sonix HD USB Camera */ + QUIRK_FLAG_GET_SAMPLE_RATE), ++ DEVICE_FLG(0x0d8c, 0x0014, /* USB Audio Device */ ++ QUIRK_FLAG_CTL_MSG_DELAY_1M), + DEVICE_FLG(0x0ecb, 0x205c, /* JBL Quantum610 Wireless */ + QUIRK_FLAG_FIXED_RATE), + DEVICE_FLG(0x0ecb, 0x2069, /* JBL Quantum810 Wireless */ diff --git a/queue-6.6/input-atkbd-map-f23-key-to-support-default-copilot-shortcut.patch b/queue-6.6/input-atkbd-map-f23-key-to-support-default-copilot-shortcut.patch new file mode 100644 index 0000000000..177f289446 --- /dev/null +++ b/queue-6.6/input-atkbd-map-f23-key-to-support-default-copilot-shortcut.patch @@ -0,0 +1,45 @@ +From 907bc9268a5a9f823ffa751957a5c1dd59f83f42 Mon Sep 17 00:00:00 2001 +From: Mark Pearson +Date: Mon, 20 Jan 2025 20:24:08 -0800 +Subject: Input: atkbd - map F23 key to support default copilot shortcut + +From: Mark Pearson + +commit 907bc9268a5a9f823ffa751957a5c1dd59f83f42 upstream. + +Microsoft defined Meta+Shift+F23 as the Copilot shortcut instead of a +dedicated keycode, and multiple vendors have their keyboards emit this +sequence in response to users pressing a dedicated "Copilot" key. +Unfortunately the default keymap table in atkbd does not map scancode +0x6e (F23) and so the key combination does not work even if userspace +is ready to handle it. + +Because this behavior is common between multiple vendors and the +scancode is currently unused map 0x6e to keycode 193 (KEY_F23) so that +key sequence is generated properly. + +MS documentation for the scan code: +https://learn.microsoft.com/en-us/windows/win32/inputdev/about-keyboard-input#scan-codes +Confirmed on Lenovo, HP and Dell machines by Canonical. +Tested on Lenovo T14s G6 AMD. + +Signed-off-by: Mark Pearson +Link: https://lore.kernel.org/r/20250107034554.25843-1-mpearson-lenovo@squebb.ca +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/keyboard/atkbd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/keyboard/atkbd.c ++++ b/drivers/input/keyboard/atkbd.c +@@ -89,7 +89,7 @@ static const unsigned short atkbd_set2_k + 0, 46, 45, 32, 18, 5, 4, 95, 0, 57, 47, 33, 20, 19, 6,183, + 0, 49, 48, 35, 34, 21, 7,184, 0, 0, 50, 36, 22, 8, 9,185, + 0, 51, 37, 23, 24, 11, 10, 0, 0, 52, 53, 38, 39, 25, 12, 0, +- 0, 89, 40, 0, 26, 13, 0, 0, 58, 54, 28, 27, 0, 43, 0, 85, ++ 0, 89, 40, 0, 26, 13, 0,193, 58, 54, 28, 27, 0, 43, 0, 85, + 0, 86, 91, 90, 92, 0, 14, 94, 0, 79,124, 75, 71,121, 0, 0, + 82, 83, 80, 76, 77, 72, 1, 69, 87, 78, 81, 74, 55, 73, 70, 99, + diff --git a/queue-6.6/input-xpad-add-qh-electronics-vid-pid.patch b/queue-6.6/input-xpad-add-qh-electronics-vid-pid.patch new file mode 100644 index 0000000000..88dc922c17 --- /dev/null +++ b/queue-6.6/input-xpad-add-qh-electronics-vid-pid.patch @@ -0,0 +1,39 @@ +From 92600f3295ff571890c981d886c6544030cc05f3 Mon Sep 17 00:00:00 2001 +From: "Pierre-Loup A. Griffais" +Date: Thu, 16 Jan 2025 10:29:53 -0800 +Subject: Input: xpad - add QH Electronics VID/PID + +From: Pierre-Loup A. Griffais + +commit 92600f3295ff571890c981d886c6544030cc05f3 upstream. + +Add support for QH Electronics Xbox 360-compatible controller + +Signed-off-by: Pierre-Loup A. Griffais +Signed-off-by: Vicki Pfau +Link: https://lore.kernel.org/r/20250116012518.3476735-1-vi@endrift.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -306,6 +306,7 @@ static const struct xpad_device { + { 0x1689, 0xfe00, "Razer Sabertooth", 0, XTYPE_XBOX360 }, + { 0x17ef, 0x6182, "Lenovo Legion Controller for Windows", 0, XTYPE_XBOX360 }, + { 0x1949, 0x041a, "Amazon Game Controller", 0, XTYPE_XBOX360 }, ++ { 0x1a86, 0xe310, "QH Electronics Controller", 0, XTYPE_XBOX360 }, + { 0x1bad, 0x0002, "Harmonix Rock Band Guitar", 0, XTYPE_XBOX360 }, + { 0x1bad, 0x0003, "Harmonix Rock Band Drumkit", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x1bad, 0x0130, "Ion Drum Rocker", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, +@@ -515,6 +516,7 @@ static const struct usb_device_id xpad_t + XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */ + XPAD_XBOX360_VENDOR(0x17ef), /* Lenovo */ + XPAD_XBOX360_VENDOR(0x1949), /* Amazon controllers */ ++ XPAD_XBOX360_VENDOR(0x1a86), /* QH Electronics */ + XPAD_XBOX360_VENDOR(0x1bad), /* Harmonix Rock Band guitar and drums */ + XPAD_XBOX360_VENDOR(0x20d6), /* PowerA controllers */ + XPAD_XBOXONE_VENDOR(0x20d6), /* PowerA controllers */ diff --git a/queue-6.6/input-xpad-add-support-for-nacon-evol-x-xbox-one-controller.patch b/queue-6.6/input-xpad-add-support-for-nacon-evol-x-xbox-one-controller.patch new file mode 100644 index 0000000000..c93975948b --- /dev/null +++ b/queue-6.6/input-xpad-add-support-for-nacon-evol-x-xbox-one-controller.patch @@ -0,0 +1,39 @@ +From 3a6e5ed2372bcb2a3c554fda32419efd91ff9b0c Mon Sep 17 00:00:00 2001 +From: Matheos Mattsson +Date: Fri, 17 Jan 2025 17:00:48 -0800 +Subject: Input: xpad - add support for Nacon Evol-X Xbox One Controller + +From: Matheos Mattsson + +commit 3a6e5ed2372bcb2a3c554fda32419efd91ff9b0c upstream. + +Add Nacon Evol-X Xbox One to the list of supported devices. + +Signed-off-by: Matheos Mattsson +Signed-off-by: Pavel Rojtberg +Link: https://lore.kernel.org/r/20250107192830.414709-9-rojtberg@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -385,6 +385,7 @@ static const struct xpad_device { + { 0x31e3, 0x1310, "Wooting 60HE (ARM)", 0, XTYPE_XBOX360 }, + { 0x3285, 0x0607, "Nacon GC-100", 0, XTYPE_XBOX360 }, + { 0x3285, 0x0646, "Nacon Pro Compact", 0, XTYPE_XBOXONE }, ++ { 0x3285, 0x0663, "Nacon Evol-X", 0, XTYPE_XBOXONE }, + { 0x3537, 0x1004, "GameSir T4 Kaleid", 0, XTYPE_XBOX360 }, + { 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX }, + { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX }, +@@ -532,6 +533,7 @@ static const struct usb_device_id xpad_t + XPAD_XBOX360_VENDOR(0x2f24), /* GameSir controllers */ + XPAD_XBOX360_VENDOR(0x31e3), /* Wooting Keyboards */ + XPAD_XBOX360_VENDOR(0x3285), /* Nacon GC-100 */ ++ XPAD_XBOXONE_VENDOR(0x3285), /* Nacon Evol-X */ + XPAD_XBOX360_VENDOR(0x3537), /* GameSir Controllers */ + XPAD_XBOXONE_VENDOR(0x3537), /* GameSir Controllers */ + { } diff --git a/queue-6.6/input-xpad-add-support-for-nacon-pro-compact.patch b/queue-6.6/input-xpad-add-support-for-nacon-pro-compact.patch new file mode 100644 index 0000000000..a6bd2319a1 --- /dev/null +++ b/queue-6.6/input-xpad-add-support-for-nacon-pro-compact.patch @@ -0,0 +1,33 @@ +From 1bba29603a2812e7b3dbb4ec1558ecb626ee933e Mon Sep 17 00:00:00 2001 +From: Nicolas Nobelis +Date: Sat, 16 Nov 2024 19:24:19 +0100 +Subject: Input: xpad - add support for Nacon Pro Compact + +From: Nicolas Nobelis + +commit 1bba29603a2812e7b3dbb4ec1558ecb626ee933e upstream. + +Add Nacon Pro Compact to the list of supported devices. These are the +ids of the "Colorlight" variant. The buttons, sticks and vibrations +work. The decorative LEDs on the other hand do not (they stay turned +off). + +Signed-off-by: Nicolas Nobelis +Link: https://lore.kernel.org/r/20241116182419.33833-1-nicolas@nobelis.eu +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -382,6 +382,7 @@ static const struct xpad_device { + { 0x31e3, 0x1300, "Wooting 60HE (AVR)", 0, XTYPE_XBOX360 }, + { 0x31e3, 0x1310, "Wooting 60HE (ARM)", 0, XTYPE_XBOX360 }, + { 0x3285, 0x0607, "Nacon GC-100", 0, XTYPE_XBOX360 }, ++ { 0x3285, 0x0646, "Nacon Pro Compact", 0, XTYPE_XBOXONE }, + { 0x3537, 0x1004, "GameSir T4 Kaleid", 0, XTYPE_XBOX360 }, + { 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX }, + { 0xffff, 0xffff, "Chinese-made Xbox Controller", 0, XTYPE_XBOX }, diff --git a/queue-6.6/input-xpad-add-support-for-wooting-two-he-arm.patch b/queue-6.6/input-xpad-add-support-for-wooting-two-he-arm.patch new file mode 100644 index 0000000000..6e125001be --- /dev/null +++ b/queue-6.6/input-xpad-add-support-for-wooting-two-he-arm.patch @@ -0,0 +1,31 @@ +From 222f3390c15c4452a9f7e26f5b7d9138e75d00d5 Mon Sep 17 00:00:00 2001 +From: Jack Greiner +Date: Fri, 17 Jan 2025 16:51:58 -0800 +Subject: Input: xpad - add support for wooting two he (arm) + +From: Jack Greiner + +commit 222f3390c15c4452a9f7e26f5b7d9138e75d00d5 upstream. + +Add Wooting Two HE (ARM) to the list of supported devices. + +Signed-off-by: Jack Greiner +Signed-off-by: Pavel Rojtberg +Link: https://lore.kernel.org/r/20250107192830.414709-3-rojtberg@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -381,6 +381,7 @@ static const struct xpad_device { + { 0x31e3, 0x1200, "Wooting Two", 0, XTYPE_XBOX360 }, + { 0x31e3, 0x1210, "Wooting Lekker", 0, XTYPE_XBOX360 }, + { 0x31e3, 0x1220, "Wooting Two HE", 0, XTYPE_XBOX360 }, ++ { 0x31e3, 0x1230, "Wooting Two HE (ARM)", 0, XTYPE_XBOX360 }, + { 0x31e3, 0x1300, "Wooting 60HE (AVR)", 0, XTYPE_XBOX360 }, + { 0x31e3, 0x1310, "Wooting 60HE (ARM)", 0, XTYPE_XBOX360 }, + { 0x3285, 0x0607, "Nacon GC-100", 0, XTYPE_XBOX360 }, diff --git a/queue-6.6/input-xpad-add-unofficial-xbox-360-wireless-receiver-clone.patch b/queue-6.6/input-xpad-add-unofficial-xbox-360-wireless-receiver-clone.patch new file mode 100644 index 0000000000..4ab28d7164 --- /dev/null +++ b/queue-6.6/input-xpad-add-unofficial-xbox-360-wireless-receiver-clone.patch @@ -0,0 +1,35 @@ +From e4940fe6322c851659c17852b671c6e7b1aa9f56 Mon Sep 17 00:00:00 2001 +From: Nilton Perim Neto +Date: Fri, 17 Jan 2025 09:34:18 -0800 +Subject: Input: xpad - add unofficial Xbox 360 wireless receiver clone + +From: Nilton Perim Neto + +commit e4940fe6322c851659c17852b671c6e7b1aa9f56 upstream. + +Although it mimics the Microsoft's VendorID, it is in fact a clone. +Taking into account that the original Microsoft Receiver is not being +manufactured anymore, this drive can solve dpad issues encontered by +those who still use the original 360 Wireless controller +but are using a receiver clone. + +Signed-off-by: Nilton Perim Neto +Signed-off-by: Pavel Rojtberg +Link: https://lore.kernel.org/r/20250107192830.414709-12-rojtberg@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -150,6 +150,7 @@ static const struct xpad_device { + { 0x045e, 0x028e, "Microsoft X-Box 360 pad", 0, XTYPE_XBOX360 }, + { 0x045e, 0x028f, "Microsoft X-Box 360 pad v2", 0, XTYPE_XBOX360 }, + { 0x045e, 0x0291, "Xbox 360 Wireless Receiver (XBOX)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W }, ++ { 0x045e, 0x02a9, "Xbox 360 Wireless Receiver (Unofficial)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W }, + { 0x045e, 0x02d1, "Microsoft X-Box One pad", 0, XTYPE_XBOXONE }, + { 0x045e, 0x02dd, "Microsoft X-Box One pad (Firmware 2015)", 0, XTYPE_XBOXONE }, + { 0x045e, 0x02e3, "Microsoft X-Box One Elite pad", MAP_PADDLES, XTYPE_XBOXONE }, diff --git a/queue-6.6/input-xpad-improve-name-of-8bitdo-controller-2dc8-3106.patch b/queue-6.6/input-xpad-improve-name-of-8bitdo-controller-2dc8-3106.patch new file mode 100644 index 0000000000..9cce0e3ca1 --- /dev/null +++ b/queue-6.6/input-xpad-improve-name-of-8bitdo-controller-2dc8-3106.patch @@ -0,0 +1,37 @@ +From 66372fa9936088bf29c4f47907efeff03c51a2c8 Mon Sep 17 00:00:00 2001 +From: Leonardo Brondani Schenkel +Date: Fri, 17 Jan 2025 16:46:11 -0800 +Subject: Input: xpad - improve name of 8BitDo controller 2dc8:3106 + +From: Leonardo Brondani Schenkel + +commit 66372fa9936088bf29c4f47907efeff03c51a2c8 upstream. + +8BitDo Pro 2 Wired Controller shares the same USB identifier +(2dc8:3106) as a different device, so amend name to reflect that and +reduce confusion as the user might think the controller was misdetected. + +Because Pro 2 Wired will not work in XTYPE_XBOXONE mode (button presses +won't register), tagging it as XTYPE_XBOX360 remains appropriate. + +Signed-off-by: Leonardo Brondani Schenkel +Signed-off-by: Pavel Rojtberg +Link: https://lore.kernel.org/r/20250107192830.414709-2-rojtberg@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -374,7 +374,7 @@ static const struct xpad_device { + { 0x294b, 0x3303, "Snakebyte GAMEPAD BASE X", 0, XTYPE_XBOXONE }, + { 0x294b, 0x3404, "Snakebyte GAMEPAD RGB X", 0, XTYPE_XBOXONE }, + { 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE }, +- { 0x2dc8, 0x3106, "8BitDo Pro 2 Wired Controller", 0, XTYPE_XBOX360 }, ++ { 0x2dc8, 0x3106, "8BitDo Ultimate Wireless / Pro 2 Wired Controller", 0, XTYPE_XBOX360 }, + { 0x2dc8, 0x310a, "8BitDo Ultimate 2C Wireless Controller", 0, XTYPE_XBOX360 }, + { 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE }, + { 0x31e3, 0x1100, "Wooting One", 0, XTYPE_XBOX360 }, diff --git a/queue-6.6/revert-usb-gadget-u_serial-disable-ep-before-setting-port-to-null-to-fix-the-crash-caused-by-port-being-null.patch b/queue-6.6/revert-usb-gadget-u_serial-disable-ep-before-setting-port-to-null-to-fix-the-crash-caused-by-port-being-null.patch new file mode 100644 index 0000000000..230449c61a --- /dev/null +++ b/queue-6.6/revert-usb-gadget-u_serial-disable-ep-before-setting-port-to-null-to-fix-the-crash-caused-by-port-being-null.patch @@ -0,0 +1,47 @@ +From 086fd062bc3883ae1ce4166cff5355db315ad879 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Fri, 17 Jan 2025 09:17:12 +0100 +Subject: Revert "usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null" + +From: Greg Kroah-Hartman + +commit 086fd062bc3883ae1ce4166cff5355db315ad879 upstream. + +This reverts commit 13014969cbf07f18d62ceea40bd8ca8ec9d36cec. + +It is reported to cause crashes on Tegra systems, so revert it for now. + +Link: https://lore.kernel.org/r/1037c1ad-9230-4181-b9c3-167dbaa47644@nvidia.com +Reported-by: Jon Hunter +Cc: stable +Cc: Lianqin Hu +Link: https://lore.kernel.org/r/2025011711-yippee-fever-a737@gregkh +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/u_serial.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/gadget/function/u_serial.c ++++ b/drivers/usb/gadget/function/u_serial.c +@@ -1398,10 +1398,6 @@ void gserial_disconnect(struct gserial * + /* REVISIT as above: how best to track this? */ + port->port_line_coding = gser->port_line_coding; + +- /* disable endpoints, aborting down any active I/O */ +- usb_ep_disable(gser->out); +- usb_ep_disable(gser->in); +- + port->port_usb = NULL; + gser->ioport = NULL; + if (port->port.count > 0) { +@@ -1413,6 +1409,10 @@ void gserial_disconnect(struct gserial * + spin_unlock(&port->port_lock); + spin_unlock_irqrestore(&serial_port_lock, flags); + ++ /* disable endpoints, aborting down any active I/O */ ++ usb_ep_disable(gser->out); ++ usb_ep_disable(gser->in); ++ + /* finally, free any unused/unusable I/O buffers */ + spin_lock_irqsave(&port->port_lock, flags); + if (port->port.count == 0) diff --git a/queue-6.6/series b/queue-6.6/series index e594b04538..1679bd72ad 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -32,3 +32,13 @@ ext4-fix-access-to-uninitialised-lock-in-fc-replay-path.patch ext4-filesystems-without-casefold-feature-cannot-be-mounted-with-siphash.patch ipv4-ip_tunnel-fix-suspicious-rcu-usage-warning-in-ip_tunnel_find.patch scsi-storvsc-ratelimit-warning-logs-to-prevent-vm-denial-of-service.patch +usb-serial-quatech2-fix-null-ptr-deref-in-qt2_process_read_urb.patch +revert-usb-gadget-u_serial-disable-ep-before-setting-port-to-null-to-fix-the-crash-caused-by-port-being-null.patch +alsa-usb-audio-add-delay-quirk-for-usb-audio-device.patch +input-xpad-add-support-for-nacon-pro-compact.patch +input-atkbd-map-f23-key-to-support-default-copilot-shortcut.patch +input-xpad-add-unofficial-xbox-360-wireless-receiver-clone.patch +input-xpad-add-qh-electronics-vid-pid.patch +input-xpad-improve-name-of-8bitdo-controller-2dc8-3106.patch +input-xpad-add-support-for-nacon-evol-x-xbox-one-controller.patch +input-xpad-add-support-for-wooting-two-he-arm.patch diff --git a/queue-6.6/usb-serial-quatech2-fix-null-ptr-deref-in-qt2_process_read_urb.patch b/queue-6.6/usb-serial-quatech2-fix-null-ptr-deref-in-qt2_process_read_urb.patch new file mode 100644 index 0000000000..6b8aa885b2 --- /dev/null +++ b/queue-6.6/usb-serial-quatech2-fix-null-ptr-deref-in-qt2_process_read_urb.patch @@ -0,0 +1,53 @@ +From 575a5adf48b06a2980c9eeffedf699ed5534fade Mon Sep 17 00:00:00 2001 +From: Qasim Ijaz +Date: Mon, 13 Jan 2025 18:00:34 +0000 +Subject: USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() + +From: Qasim Ijaz + +commit 575a5adf48b06a2980c9eeffedf699ed5534fade upstream. + +This patch addresses a null-ptr-deref in qt2_process_read_urb() due to +an incorrect bounds check in the following: + + if (newport > serial->num_ports) { + dev_err(&port->dev, + "%s - port change to invalid port: %i\n", + __func__, newport); + break; + } + +The condition doesn't account for the valid range of the serial->port +buffer, which is from 0 to serial->num_ports - 1. When newport is equal +to serial->num_ports, the assignment of "port" in the +following code is out-of-bounds and NULL: + + serial_priv->current_port = newport; + port = serial->port[serial_priv->current_port]; + +The fix checks if newport is greater than or equal to serial->num_ports +indicating it is out-of-bounds. + +Reported-by: syzbot +Closes: https://syzkaller.appspot.com/bug?extid=506479ebf12fe435d01a +Fixes: f7a33e608d9a ("USB: serial: add quatech2 usb to serial driver") +Cc: # 3.5 +Signed-off-by: Qasim Ijaz +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/quatech2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/serial/quatech2.c ++++ b/drivers/usb/serial/quatech2.c +@@ -503,7 +503,7 @@ static void qt2_process_read_urb(struct + + newport = *(ch + 3); + +- if (newport > serial->num_ports) { ++ if (newport >= serial->num_ports) { + dev_err(&port->dev, + "%s - port change to invalid port: %i\n", + __func__, newport);