From: Greg Kroah-Hartman Date: Mon, 12 May 2025 10:42:59 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v5.15.183~36 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=32660958d633519c6b4a1523c2b2c1be40644cb2;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: usb-typec-tcpm-delay-snk_try_wait_debounce-to-src_trywait-transition.patch usb-typec-ucsi-displayport-fix-null-pointer-access.patch usb-usbtmc-fix-erroneous-generic_read-ioctl-return.patch usb-usbtmc-fix-erroneous-get_stb-ioctl-error-returns.patch usb-usbtmc-fix-erroneous-wait_srq-ioctl-return.patch usb-usbtmc-use-interruptible-sleep-in-usbtmc_read.patch --- diff --git a/queue-5.10/series b/queue-5.10/series index 4b2d0fd853..127454c0cb 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -68,3 +68,9 @@ ocfs2-implement-handshaking-with-ocfs2-recovery-thread.patch ocfs2-stop-quota-recovery-before-disabling-quotas.patch usb-gadget-tegra-xudc-ack-st_rc-after-clearing-ctrl_run.patch usb-host-tegra-prevent-host-controller-crash-when-otg-port-is-used.patch +usb-typec-tcpm-delay-snk_try_wait_debounce-to-src_trywait-transition.patch +usb-typec-ucsi-displayport-fix-null-pointer-access.patch +usb-usbtmc-use-interruptible-sleep-in-usbtmc_read.patch +usb-usbtmc-fix-erroneous-get_stb-ioctl-error-returns.patch +usb-usbtmc-fix-erroneous-wait_srq-ioctl-return.patch +usb-usbtmc-fix-erroneous-generic_read-ioctl-return.patch diff --git a/queue-5.10/usb-typec-tcpm-delay-snk_try_wait_debounce-to-src_trywait-transition.patch b/queue-5.10/usb-typec-tcpm-delay-snk_try_wait_debounce-to-src_trywait-transition.patch new file mode 100644 index 0000000000..e1f1e1ec7c --- /dev/null +++ b/queue-5.10/usb-typec-tcpm-delay-snk_try_wait_debounce-to-src_trywait-transition.patch @@ -0,0 +1,44 @@ +From e918d3959b5ae0e793b8f815ce62240e10ba03a4 Mon Sep 17 00:00:00 2001 +From: RD Babiera +Date: Tue, 29 Apr 2025 23:47:01 +0000 +Subject: usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition + +From: RD Babiera + +commit e918d3959b5ae0e793b8f815ce62240e10ba03a4 upstream. + +This patch fixes Type-C Compliance Test TD 4.7.6 - Try.SNK DRP Connect +SNKAS. + +The compliance tester moves into SNK_UNATTACHED during toggling and +expects the PUT to apply Rp after tPDDebounce of detection. If the port +is in SNK_TRY_WAIT_DEBOUNCE, it will move into SRC_TRYWAIT immediately +and apply Rp. This violates TD 4.7.5.V.3, where the tester confirms that +the PUT attaches Rp after the transitions to Unattached.SNK for +tPDDebounce. + +Change the tcpm_set_state delay between SNK_TRY_WAIT_DEBOUNCE and +SRC_TRYWAIT to tPDDebounce. + +Fixes: a0a3e04e6b2c ("staging: typec: tcpm: Check for Rp for tPDDebounce") +Cc: stable +Signed-off-by: RD Babiera +Reviewed-by: Badhri Jagan Sridharan +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20250429234703.3748506-2-rdbabiera@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -4019,7 +4019,7 @@ static void _tcpm_cc_change(struct tcpm_ + case SNK_TRY_WAIT_DEBOUNCE: + if (!tcpm_port_is_sink(port)) { + port->max_wait = 0; +- tcpm_set_state(port, SRC_TRYWAIT, 0); ++ tcpm_set_state(port, SRC_TRYWAIT, PD_T_PD_DEBOUNCE); + } + break; + case SRC_TRY_WAIT: diff --git a/queue-5.10/usb-typec-ucsi-displayport-fix-null-pointer-access.patch b/queue-5.10/usb-typec-ucsi-displayport-fix-null-pointer-access.patch new file mode 100644 index 0000000000..e15859fc63 --- /dev/null +++ b/queue-5.10/usb-typec-ucsi-displayport-fix-null-pointer-access.patch @@ -0,0 +1,35 @@ +From 312d79669e71283d05c05cc49a1a31e59e3d9e0e Mon Sep 17 00:00:00 2001 +From: Andrei Kuchynski +Date: Thu, 24 Apr 2025 08:44:29 +0000 +Subject: usb: typec: ucsi: displayport: Fix NULL pointer access + +From: Andrei Kuchynski + +commit 312d79669e71283d05c05cc49a1a31e59e3d9e0e upstream. + +This patch ensures that the UCSI driver waits for all pending tasks in the +ucsi_displayport_work workqueue to finish executing before proceeding with +the partner removal. + +Cc: stable +Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode") +Signed-off-by: Andrei Kuchynski +Reviewed-by: Heikki Krogerus +Reviewed-by: Benson Leung +Link: https://lore.kernel.org/r/20250424084429.3220757-3-akuchynski@chromium.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/displayport.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/typec/ucsi/displayport.c ++++ b/drivers/usb/typec/ucsi/displayport.c +@@ -270,6 +270,8 @@ void ucsi_displayport_remove_partner(str + if (!dp) + return; + ++ cancel_work_sync(&dp->work); ++ + dp->data.conf = 0; + dp->data.status = 0; + dp->initialized = false; diff --git a/queue-5.10/usb-usbtmc-fix-erroneous-generic_read-ioctl-return.patch b/queue-5.10/usb-usbtmc-fix-erroneous-generic_read-ioctl-return.patch new file mode 100644 index 0000000000..2530718adb --- /dev/null +++ b/queue-5.10/usb-usbtmc-fix-erroneous-generic_read-ioctl-return.patch @@ -0,0 +1,66 @@ +From 4e77d3ec7c7c0d9535ccf1138827cb9bb5480b9b Mon Sep 17 00:00:00 2001 +From: Dave Penkler +Date: Fri, 2 May 2025 09:09:41 +0200 +Subject: usb: usbtmc: Fix erroneous generic_read ioctl return + +From: Dave Penkler + +commit 4e77d3ec7c7c0d9535ccf1138827cb9bb5480b9b upstream. + +wait_event_interruptible_timeout returns a long +The return value was being assigned to an int causing an integer overflow +when the remaining jiffies > INT_MAX which resulted in random error +returns. + +Use a long return value, converting to the int ioctl return only on error. + +Fixes: bb99794a4792 ("usb: usbtmc: Add ioctl for vendor specific read") +Cc: stable@vger.kernel.org +Signed-off-by: Dave Penkler +Link: https://lore.kernel.org/r/20250502070941.31819-4-dpenkler@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/usbtmc.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -803,6 +803,7 @@ static ssize_t usbtmc_generic_read(struc + unsigned long expire; + int bufcount = 1; + int again = 0; ++ long wait_rv; + + /* mutex already locked */ + +@@ -915,19 +916,24 @@ static ssize_t usbtmc_generic_read(struc + if (!(flags & USBTMC_FLAG_ASYNC)) { + dev_dbg(dev, "%s: before wait time %lu\n", + __func__, expire); +- retval = wait_event_interruptible_timeout( ++ wait_rv = wait_event_interruptible_timeout( + file_data->wait_bulk_in, + usbtmc_do_transfer(file_data), + expire); + +- dev_dbg(dev, "%s: wait returned %d\n", +- __func__, retval); ++ dev_dbg(dev, "%s: wait returned %ld\n", ++ __func__, wait_rv); + +- if (retval <= 0) { +- if (retval == 0) +- retval = -ETIMEDOUT; ++ if (wait_rv < 0) { ++ retval = wait_rv; + goto error; + } ++ ++ if (wait_rv == 0) { ++ retval = -ETIMEDOUT; ++ goto error; ++ } ++ + } + + urb = usb_get_from_anchor(&file_data->in_anchor); diff --git a/queue-5.10/usb-usbtmc-fix-erroneous-get_stb-ioctl-error-returns.patch b/queue-5.10/usb-usbtmc-fix-erroneous-get_stb-ioctl-error-returns.patch new file mode 100644 index 0000000000..02c01468b2 --- /dev/null +++ b/queue-5.10/usb-usbtmc-fix-erroneous-get_stb-ioctl-error-returns.patch @@ -0,0 +1,70 @@ +From cac01bd178d6a2a23727f138d647ce1a0e8a73a1 Mon Sep 17 00:00:00 2001 +From: Dave Penkler +Date: Fri, 2 May 2025 09:09:39 +0200 +Subject: usb: usbtmc: Fix erroneous get_stb ioctl error returns + +From: Dave Penkler + +commit cac01bd178d6a2a23727f138d647ce1a0e8a73a1 upstream. + +wait_event_interruptible_timeout returns a long +The return was being assigned to an int causing an integer overflow when +the remaining jiffies > INT_MAX resulting in random error returns. + +Use a long return value and convert to int ioctl return only on error. + +When the return value of wait_event_interruptible_timeout was <= INT_MAX +the number of remaining jiffies was returned which has no meaning for the +user. Return 0 on success. + +Reported-by: Michael Katzmann +Fixes: dbf3e7f654c0 ("Implement an ioctl to support the USMTMC-USB488 READ_STATUS_BYTE operation.") +Cc: stable@vger.kernel.org +Signed-off-by: Dave Penkler +Link: https://lore.kernel.org/r/20250502070941.31819-2-dpenkler@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/usbtmc.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -485,6 +485,7 @@ static int usbtmc488_ioctl_read_stb(stru + u8 tag; + __u8 stb; + int rv; ++ long wait_rv; + + dev_dbg(dev, "Enter ioctl_read_stb iin_ep_present: %d\n", + data->iin_ep_present); +@@ -527,16 +528,17 @@ static int usbtmc488_ioctl_read_stb(stru + } + + if (data->iin_ep_present) { +- rv = wait_event_interruptible_timeout( ++ wait_rv = wait_event_interruptible_timeout( + data->waitq, + atomic_read(&data->iin_data_valid) != 0, + file_data->timeout); +- if (rv < 0) { +- dev_dbg(dev, "wait interrupted %d\n", rv); ++ if (wait_rv < 0) { ++ dev_dbg(dev, "wait interrupted %ld\n", wait_rv); ++ rv = wait_rv; + goto exit; + } + +- if (rv == 0) { ++ if (wait_rv == 0) { + dev_dbg(dev, "wait timed out\n"); + rv = -ETIMEDOUT; + goto exit; +@@ -556,6 +558,8 @@ static int usbtmc488_ioctl_read_stb(stru + rv = put_user(stb, (__u8 __user *)arg); + dev_dbg(dev, "stb:0x%02x received %d\n", (unsigned int)stb, rv); + ++ rv = 0; ++ + exit: + /* bump interrupt bTag */ + data->iin_bTag += 1; diff --git a/queue-5.10/usb-usbtmc-fix-erroneous-wait_srq-ioctl-return.patch b/queue-5.10/usb-usbtmc-fix-erroneous-wait_srq-ioctl-return.patch new file mode 100644 index 0000000000..d2c8b9b043 --- /dev/null +++ b/queue-5.10/usb-usbtmc-fix-erroneous-wait_srq-ioctl-return.patch @@ -0,0 +1,74 @@ +From a9747c9b8b59ab4207effd20eb91a890acb44e16 Mon Sep 17 00:00:00 2001 +From: Dave Penkler +Date: Fri, 2 May 2025 09:09:40 +0200 +Subject: usb: usbtmc: Fix erroneous wait_srq ioctl return + +From: Dave Penkler + +commit a9747c9b8b59ab4207effd20eb91a890acb44e16 upstream. + +wait_event_interruptible_timeout returns a long +The return was being assigned to an int causing an integer overflow when +the remaining jiffies > INT_MAX resulting in random error returns. + +Use a long return value, converting to the int ioctl return only on +error. + +Fixes: 739240a9f6ac ("usb: usbtmc: Add ioctl USBTMC488_IOCTL_WAIT_SRQ") +Cc: stable@vger.kernel.org +Signed-off-by: Dave Penkler +Link: https://lore.kernel.org/r/20250502070941.31819-3-dpenkler@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/usbtmc.c | 23 +++++++++++------------ + 1 file changed, 11 insertions(+), 12 deletions(-) + +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -576,9 +576,9 @@ static int usbtmc488_ioctl_wait_srq(stru + { + struct usbtmc_device_data *data = file_data->data; + struct device *dev = &data->intf->dev; +- int rv; + u32 timeout; + unsigned long expire; ++ long wait_rv; + + if (!data->iin_ep_present) { + dev_dbg(dev, "no interrupt endpoint present\n"); +@@ -592,25 +592,24 @@ static int usbtmc488_ioctl_wait_srq(stru + + mutex_unlock(&data->io_mutex); + +- rv = wait_event_interruptible_timeout( +- data->waitq, +- atomic_read(&file_data->srq_asserted) != 0 || +- atomic_read(&file_data->closing), +- expire); ++ wait_rv = wait_event_interruptible_timeout( ++ data->waitq, ++ atomic_read(&file_data->srq_asserted) != 0 || ++ atomic_read(&file_data->closing), ++ expire); + + mutex_lock(&data->io_mutex); + + /* Note! disconnect or close could be called in the meantime */ + if (atomic_read(&file_data->closing) || data->zombie) +- rv = -ENODEV; ++ return -ENODEV; + +- if (rv < 0) { +- /* dev can be invalid now! */ +- pr_debug("%s - wait interrupted %d\n", __func__, rv); +- return rv; ++ if (wait_rv < 0) { ++ dev_dbg(dev, "%s - wait interrupted %ld\n", __func__, wait_rv); ++ return wait_rv; + } + +- if (rv == 0) { ++ if (wait_rv == 0) { + dev_dbg(dev, "%s - wait timed out\n", __func__); + return -ETIMEDOUT; + } diff --git a/queue-5.10/usb-usbtmc-use-interruptible-sleep-in-usbtmc_read.patch b/queue-5.10/usb-usbtmc-use-interruptible-sleep-in-usbtmc_read.patch new file mode 100644 index 0000000000..9ea88c85db --- /dev/null +++ b/queue-5.10/usb-usbtmc-use-interruptible-sleep-in-usbtmc_read.patch @@ -0,0 +1,46 @@ +From 054c5145540e5ad5b80adf23a5e3e2fc281fb8aa Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 30 Apr 2025 15:48:10 +0200 +Subject: USB: usbtmc: use interruptible sleep in usbtmc_read + +From: Oliver Neukum + +commit 054c5145540e5ad5b80adf23a5e3e2fc281fb8aa upstream. + +usbtmc_read() calls usbtmc_generic_read() +which uses interruptible sleep, but usbtmc_read() +itself uses uninterruptble sleep for mutual exclusion +between threads. That makes no sense. +Both should use interruptible sleep. + +Fixes: 5b775f672cc99 ("USB: add USB test and measurement class driver") +Cc: stable +Signed-off-by: Oliver Neukum +Link: https://lore.kernel.org/r/20250430134810.226015-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/usbtmc.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -1350,7 +1350,10 @@ static ssize_t usbtmc_read(struct file * + if (!buffer) + return -ENOMEM; + +- mutex_lock(&data->io_mutex); ++ retval = mutex_lock_interruptible(&data->io_mutex); ++ if (retval < 0) ++ goto exit_nolock; ++ + if (data->zombie) { + retval = -ENODEV; + goto exit; +@@ -1473,6 +1476,7 @@ static ssize_t usbtmc_read(struct file * + + exit: + mutex_unlock(&data->io_mutex); ++exit_nolock: + kfree(buffer); + return retval; + }