From: Greg Kroah-Hartman Date: Mon, 22 Feb 2021 10:20:47 +0000 (+0100) Subject: 5.11-stable patches X-Git-Tag: v5.11.1~1^2~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1149a3e91fd327ce6b0cc17beac0166cd43bc156;p=thirdparty%2Fkernel%2Fstable-queue.git 5.11-stable patches added patches: bluetooth-btusb-always-fallback-to-alt-1-for-wbs.patch tty-protect-tty_write-from-odd-low-level-tty-disciplines.patch --- diff --git a/queue-5.11/bluetooth-btusb-always-fallback-to-alt-1-for-wbs.patch b/queue-5.11/bluetooth-btusb-always-fallback-to-alt-1-for-wbs.patch new file mode 100644 index 00000000000..461407d32ba --- /dev/null +++ b/queue-5.11/bluetooth-btusb-always-fallback-to-alt-1-for-wbs.patch @@ -0,0 +1,100 @@ +From 517b693351a2d04f3af1fc0e506ac7e1346094de Mon Sep 17 00:00:00 2001 +From: Trent Piepho +Date: Wed, 9 Dec 2020 17:20:03 -0800 +Subject: Bluetooth: btusb: Always fallback to alt 1 for WBS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Trent Piepho + +commit 517b693351a2d04f3af1fc0e506ac7e1346094de upstream. + +When alt mode 6 is not available, fallback to the kernel <= 5.7 behavior +of always using alt mode 1. + +Prior to kernel 5.8, btusb would always use alt mode 1 for WBS (Wide +Band Speech aka mSBC aka transparent SCO). In commit baac6276c0a9 +("Bluetooth: btusb: handle mSBC audio over USB Endpoints") this +was changed to use alt mode 6, which is the recommended mode in the +Bluetooth spec (Specifications of the Bluetooth System, v5.0, Vol 4.B +§2.2.1). However, many if not most BT USB adapters do not support alt +mode 6. In fact, I have been unable to find any which do. + +In kernel 5.8, this was changed to use alt mode 6, and if not available, +use alt mode 0. But mode 0 has a zero byte max packet length and can +not possibly work. It is just there as a zero-bandwidth dummy mode to +work around a USB flaw that would prevent device enumeration if +insufficient bandwidth were available for the lowest isoc mode +supported. + +In effect, WBS was broken for all USB-BT adapters that do not support +alt 6, which appears to nearly all of them. + +Then in commit 461f95f04f19 ("Bluetooth: btusb: USB alternate setting 1 for +WBS") the 5.7 behavior was restored, but only for Realtek adapters. + +I've tested a Broadcom BRCM20702A and CSR 8510 adapter, both work with +the 5.7 behavior and do not with the 5.8. + +So get rid of the Realtek specific flag and use the 5.7 behavior for all +adapters as a fallback when alt 6 is not available. This was the +kernel's behavior prior to 5.8 and I can find no adapters for which it +is not correct. And even if there is an adapter for which this does not +work, the current behavior would be to fall back to alt 0, which can not +possibly work either, and so is no better. + +Signed-off-by: Trent Piepho +Signed-off-by: Marcel Holtmann +Cc: Salvatore Bonaccorso +Cc: Sjoerd Simons +Cc: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 20 ++++++-------------- + 1 file changed, 6 insertions(+), 14 deletions(-) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -506,7 +506,6 @@ static const struct dmi_system_id btusb_ + #define BTUSB_HW_RESET_ACTIVE 12 + #define BTUSB_TX_WAIT_VND_EVT 13 + #define BTUSB_WAKEUP_DISABLE 14 +-#define BTUSB_USE_ALT1_FOR_WBS 15 + + struct btusb_data { + struct hci_dev *hdev; +@@ -1736,15 +1735,12 @@ static void btusb_work(struct work_struc + new_alts = data->sco_num; + } + } else if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_TRANSP) { +- /* Check if Alt 6 is supported for Transparent audio */ +- if (btusb_find_altsetting(data, 6)) { +- data->usb_alt6_packet_flow = true; +- new_alts = 6; +- } else if (test_bit(BTUSB_USE_ALT1_FOR_WBS, &data->flags)) { +- new_alts = 1; +- } else { +- bt_dev_err(hdev, "Device does not support ALT setting 6"); +- } ++ /* Bluetooth USB spec recommends alt 6 (63 bytes), but ++ * many adapters do not support it. Alt 1 appears to ++ * work for all adapters that do not have alt 6, and ++ * which work with WBS at all. ++ */ ++ new_alts = btusb_find_altsetting(data, 6) ? 6 : 1; + } + + if (btusb_switch_alt_setting(hdev, new_alts) < 0) +@@ -4548,10 +4544,6 @@ static int btusb_probe(struct usb_interf + * (DEVICE_REMOTE_WAKEUP) + */ + set_bit(BTUSB_WAKEUP_DISABLE, &data->flags); +- if (btusb_find_altsetting(data, 1)) +- set_bit(BTUSB_USE_ALT1_FOR_WBS, &data->flags); +- else +- bt_dev_err(hdev, "Device does not support ALT setting 1"); + } + + if (!reset) diff --git a/queue-5.11/series b/queue-5.11/series index 4e4a359cbd7..0c85c4e604c 100644 --- a/queue-5.11/series +++ b/queue-5.11/series @@ -7,3 +7,5 @@ xen-blkback-don-t-handle-error-by-bug.patch xen-netback-don-t-handle-error-by-bug.patch xen-scsiback-don-t-handle-error-by-bug.patch xen-blkback-fix-error-handling-in-xen_blkbk_map.patch +tty-protect-tty_write-from-odd-low-level-tty-disciplines.patch +bluetooth-btusb-always-fallback-to-alt-1-for-wbs.patch diff --git a/queue-5.11/tty-protect-tty_write-from-odd-low-level-tty-disciplines.patch b/queue-5.11/tty-protect-tty_write-from-odd-low-level-tty-disciplines.patch new file mode 100644 index 00000000000..cf0708a4feb --- /dev/null +++ b/queue-5.11/tty-protect-tty_write-from-odd-low-level-tty-disciplines.patch @@ -0,0 +1,46 @@ +From 3342ff2698e9720f4040cc458a2744b2b32f5c3a Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Sat, 20 Feb 2021 21:15:00 -0800 +Subject: tty: protect tty_write from odd low-level tty disciplines + +From: Linus Torvalds + +commit 3342ff2698e9720f4040cc458a2744b2b32f5c3a upstream. + +Al root-caused a new warning from syzbot to the ttyprintk tty driver +returning a write count larger than the data the tty layer actually gave +it. Which confused the tty write code mightily, and with the new +iov_iter based code, caused a WARNING in iov_iter_revert(). + +syzbot correctly bisected the source of the new warning to commit +9bb48c82aced ("tty: implement write_iter"), but the oddity goes back +much further, it just didn't get caught by anything before. + +Reported-by: syzbot+3d2c27c2b7dc2a94814d@syzkaller.appspotmail.com +Fixes: 9bb48c82aced ("tty: implement write_iter") +Debugged-by: Al Viro +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/tty_io.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -962,11 +962,14 @@ static inline ssize_t do_tty_write( + if (ret <= 0) + break; + ++ written += ret; ++ if (ret > size) ++ break; ++ + /* FIXME! Have Al check this! */ + if (ret != size) + iov_iter_revert(from, size-ret); + +- written += ret; + count -= ret; + if (!count) + break;