From: Greg Kroah-Hartman Date: Mon, 31 Aug 2020 12:31:42 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v4.4.235~30 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5f8142f3573ea4b5fea0af6a0ba6ef41984d7040;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: usb-cdc-acm-rework-notification_buffer-resizing.patch usb-gadget-f_ncm-add-bounds-checks-to-ncm_unwrap_ntb.patch usb-gadget-u_f-add-overflow-checks-to-vla-macros.patch usb-gadget-u_f-unbreak-offset-calculation-in-vlas.patch usb-host-ohci-exynos-fix-error-handling-in-exynos_ohci_probe.patch usb-ignore-uas-for-jmicron-jms567-ata-atapi-bridge.patch usb-quirks-add-no-lpm-quirk-for-another-raydium-touchscreen.patch usb-quirks-ignore-duplicate-endpoint-on-sound-devices-mixpre-d.patch usb-storage-add-unusual_uas-entry-for-sony-psz-drives.patch usb-uas-add-quirk-for-pny-pro-elite.patch usb-yurex-fix-bad-gfp-argument.patch --- diff --git a/queue-5.4/series b/queue-5.4/series index 0f331902c03..aaca1ab4075 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -186,3 +186,14 @@ drm-amd-pm-correct-vega10-swctf-limit-setting.patch drm-amd-pm-correct-vega12-swctf-limit-setting.patch drm-amd-pm-correct-vega20-swctf-limit-setting.patch drm-amd-pm-correct-the-thermal-alert-temperature-limit-settings.patch +usb-yurex-fix-bad-gfp-argument.patch +usb-uas-add-quirk-for-pny-pro-elite.patch +usb-quirks-add-no-lpm-quirk-for-another-raydium-touchscreen.patch +usb-quirks-ignore-duplicate-endpoint-on-sound-devices-mixpre-d.patch +usb-ignore-uas-for-jmicron-jms567-ata-atapi-bridge.patch +usb-host-ohci-exynos-fix-error-handling-in-exynos_ohci_probe.patch +usb-gadget-u_f-add-overflow-checks-to-vla-macros.patch +usb-gadget-f_ncm-add-bounds-checks-to-ncm_unwrap_ntb.patch +usb-gadget-u_f-unbreak-offset-calculation-in-vlas.patch +usb-cdc-acm-rework-notification_buffer-resizing.patch +usb-storage-add-unusual_uas-entry-for-sony-psz-drives.patch diff --git a/queue-5.4/usb-cdc-acm-rework-notification_buffer-resizing.patch b/queue-5.4/usb-cdc-acm-rework-notification_buffer-resizing.patch new file mode 100644 index 00000000000..d4a40ef4f8c --- /dev/null +++ b/queue-5.4/usb-cdc-acm-rework-notification_buffer-resizing.patch @@ -0,0 +1,99 @@ +From f4b9d8a582f738c24ebeabce5cc15f4b8159d74e Mon Sep 17 00:00:00 2001 +From: Tom Rix +Date: Sat, 1 Aug 2020 08:21:54 -0700 +Subject: USB: cdc-acm: rework notification_buffer resizing + +From: Tom Rix + +commit f4b9d8a582f738c24ebeabce5cc15f4b8159d74e upstream. + +Clang static analysis reports this error + +cdc-acm.c:409:3: warning: Use of memory after it is freed + acm_process_notification(acm, (unsigned char *)dr); + +There are three problems, the first one is that dr is not reset + +The variable dr is set with + +if (acm->nb_index) + dr = (struct usb_cdc_notification *)acm->notification_buffer; + +But if the notification_buffer is too small it is resized with + + if (acm->nb_size) { + kfree(acm->notification_buffer); + acm->nb_size = 0; + } + alloc_size = roundup_pow_of_two(expected_size); + /* + * kmalloc ensures a valid notification_buffer after a + * use of kfree in case the previous allocation was too + * small. Final freeing is done on disconnect. + */ + acm->notification_buffer = + kmalloc(alloc_size, GFP_ATOMIC); + +dr should point to the new acm->notification_buffer. + +The second problem is any data in the notification_buffer is lost +when the pointer is freed. In the normal case, the current data +is accumulated in the notification_buffer here. + + memcpy(&acm->notification_buffer[acm->nb_index], + urb->transfer_buffer, copy_size); + +When a resize happens, anything before +notification_buffer[acm->nb_index] is garbage. + +The third problem is the acm->nb_index is not reset on a +resizing buffer error. + +So switch resizing to using krealloc and reassign dr and +reset nb_index. + +Fixes: ea2583529cd1 ("cdc-acm: reassemble fragmented notifications") +Signed-off-by: Tom Rix +Cc: stable +Acked-by: Oliver Neukum +Link: https://lore.kernel.org/r/20200801152154.20683-1-trix@redhat.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/cdc-acm.c | 22 ++++++++++------------ + 1 file changed, 10 insertions(+), 12 deletions(-) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -378,21 +378,19 @@ static void acm_ctrl_irq(struct urb *urb + if (current_size < expected_size) { + /* notification is transmitted fragmented, reassemble */ + if (acm->nb_size < expected_size) { +- if (acm->nb_size) { +- kfree(acm->notification_buffer); +- acm->nb_size = 0; +- } ++ u8 *new_buffer; + alloc_size = roundup_pow_of_two(expected_size); +- /* +- * kmalloc ensures a valid notification_buffer after a +- * use of kfree in case the previous allocation was too +- * small. Final freeing is done on disconnect. +- */ +- acm->notification_buffer = +- kmalloc(alloc_size, GFP_ATOMIC); +- if (!acm->notification_buffer) ++ /* Final freeing is done on disconnect. */ ++ new_buffer = krealloc(acm->notification_buffer, ++ alloc_size, GFP_ATOMIC); ++ if (!new_buffer) { ++ acm->nb_index = 0; + goto exit; ++ } ++ ++ acm->notification_buffer = new_buffer; + acm->nb_size = alloc_size; ++ dr = (struct usb_cdc_notification *)acm->notification_buffer; + } + + copy_size = min(current_size, diff --git a/queue-5.4/usb-gadget-f_ncm-add-bounds-checks-to-ncm_unwrap_ntb.patch b/queue-5.4/usb-gadget-f_ncm-add-bounds-checks-to-ncm_unwrap_ntb.patch new file mode 100644 index 00000000000..3a4a4814824 --- /dev/null +++ b/queue-5.4/usb-gadget-f_ncm-add-bounds-checks-to-ncm_unwrap_ntb.patch @@ -0,0 +1,178 @@ +From 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 Mon Sep 17 00:00:00 2001 +From: Brooke Basile +Date: Tue, 25 Aug 2020 09:07:27 -0400 +Subject: USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb() + +From: Brooke Basile + +commit 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 upstream. + +Some values extracted by ncm_unwrap_ntb() could possibly lead to several +different out of bounds reads of memory. Specifically the values passed +to netdev_alloc_skb_ip_align() need to be checked so that memory is not +overflowed. + +Resolve this by applying bounds checking to a number of different +indexes and lengths of the structure parsing logic. + +Reported-by: Ilja Van Sprundel +Signed-off-by: Brooke Basile +Acked-by: Felipe Balbi +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_ncm.c | 81 ++++++++++++++++++++++++++++++------ + 1 file changed, 69 insertions(+), 12 deletions(-) + +--- a/drivers/usb/gadget/function/f_ncm.c ++++ b/drivers/usb/gadget/function/f_ncm.c +@@ -1181,12 +1181,15 @@ static int ncm_unwrap_ntb(struct gether + int ndp_index; + unsigned dg_len, dg_len2; + unsigned ndp_len; ++ unsigned block_len; + struct sk_buff *skb2; + int ret = -EINVAL; +- unsigned max_size = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize); ++ unsigned ntb_max = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize); ++ unsigned frame_max = le16_to_cpu(ecm_desc.wMaxSegmentSize); + const struct ndp_parser_opts *opts = ncm->parser_opts; + unsigned crc_len = ncm->is_crc ? sizeof(uint32_t) : 0; + int dgram_counter; ++ bool ndp_after_header; + + /* dwSignature */ + if (get_unaligned_le32(tmp) != opts->nth_sign) { +@@ -1205,25 +1208,37 @@ static int ncm_unwrap_ntb(struct gether + } + tmp++; /* skip wSequence */ + ++ block_len = get_ncm(&tmp, opts->block_length); + /* (d)wBlockLength */ +- if (get_ncm(&tmp, opts->block_length) > max_size) { ++ if (block_len > ntb_max) { + INFO(port->func.config->cdev, "OUT size exceeded\n"); + goto err; + } + + ndp_index = get_ncm(&tmp, opts->ndp_index); ++ ndp_after_header = false; + + /* Run through all the NDP's in the NTB */ + do { +- /* NCM 3.2 */ +- if (((ndp_index % 4) != 0) && +- (ndp_index < opts->nth_size)) { ++ /* ++ * NCM 3.2 ++ * dwNdpIndex ++ */ ++ if (((ndp_index % 4) != 0) || ++ (ndp_index < opts->nth_size) || ++ (ndp_index > (block_len - ++ opts->ndp_size))) { + INFO(port->func.config->cdev, "Bad index: %#X\n", + ndp_index); + goto err; + } ++ if (ndp_index == opts->nth_size) ++ ndp_after_header = true; + +- /* walk through NDP */ ++ /* ++ * walk through NDP ++ * dwSignature ++ */ + tmp = (void *)(skb->data + ndp_index); + if (get_unaligned_le32(tmp) != ncm->ndp_sign) { + INFO(port->func.config->cdev, "Wrong NDP SIGN\n"); +@@ -1234,14 +1249,15 @@ static int ncm_unwrap_ntb(struct gether + ndp_len = get_unaligned_le16(tmp++); + /* + * NCM 3.3.1 ++ * wLength + * entry is 2 items + * item size is 16/32 bits, opts->dgram_item_len * 2 bytes + * minimal: struct usb_cdc_ncm_ndpX + normal entry + zero entry + * Each entry is a dgram index and a dgram length. + */ + if ((ndp_len < opts->ndp_size +- + 2 * 2 * (opts->dgram_item_len * 2)) +- || (ndp_len % opts->ndplen_align != 0)) { ++ + 2 * 2 * (opts->dgram_item_len * 2)) || ++ (ndp_len % opts->ndplen_align != 0)) { + INFO(port->func.config->cdev, "Bad NDP length: %#X\n", + ndp_len); + goto err; +@@ -1258,8 +1274,21 @@ static int ncm_unwrap_ntb(struct gether + + do { + index = index2; ++ /* wDatagramIndex[0] */ ++ if ((index < opts->nth_size) || ++ (index > block_len - opts->dpe_size)) { ++ INFO(port->func.config->cdev, ++ "Bad index: %#X\n", index); ++ goto err; ++ } ++ + dg_len = dg_len2; +- if (dg_len < 14 + crc_len) { /* ethernet hdr + crc */ ++ /* ++ * wDatagramLength[0] ++ * ethernet hdr + crc or larger than max frame size ++ */ ++ if ((dg_len < 14 + crc_len) || ++ (dg_len > frame_max)) { + INFO(port->func.config->cdev, + "Bad dgram length: %#X\n", dg_len); + goto err; +@@ -1283,6 +1312,37 @@ static int ncm_unwrap_ntb(struct gether + index2 = get_ncm(&tmp, opts->dgram_item_len); + dg_len2 = get_ncm(&tmp, opts->dgram_item_len); + ++ if (index2 == 0 || dg_len2 == 0) ++ break; ++ ++ /* wDatagramIndex[1] */ ++ if (ndp_after_header) { ++ if (index2 < opts->nth_size + opts->ndp_size) { ++ INFO(port->func.config->cdev, ++ "Bad index: %#X\n", index2); ++ goto err; ++ } ++ } else { ++ if (index2 < opts->nth_size + opts->dpe_size) { ++ INFO(port->func.config->cdev, ++ "Bad index: %#X\n", index2); ++ goto err; ++ } ++ } ++ if (index2 > block_len - opts->dpe_size) { ++ INFO(port->func.config->cdev, ++ "Bad index: %#X\n", index2); ++ goto err; ++ } ++ ++ /* wDatagramLength[1] */ ++ if ((dg_len2 < 14 + crc_len) || ++ (dg_len2 > frame_max)) { ++ INFO(port->func.config->cdev, ++ "Bad dgram length: %#X\n", dg_len); ++ goto err; ++ } ++ + /* + * Copy the data into a new skb. + * This ensures the truesize is correct +@@ -1299,9 +1359,6 @@ static int ncm_unwrap_ntb(struct gether + ndp_len -= 2 * (opts->dgram_item_len * 2); + + dgram_counter++; +- +- if (index2 == 0 || dg_len2 == 0) +- break; + } while (ndp_len > 2 * (opts->dgram_item_len * 2)); + } while (ndp_index); + diff --git a/queue-5.4/usb-gadget-u_f-add-overflow-checks-to-vla-macros.patch b/queue-5.4/usb-gadget-u_f-add-overflow-checks-to-vla-macros.patch new file mode 100644 index 00000000000..66b2843d241 --- /dev/null +++ b/queue-5.4/usb-gadget-u_f-add-overflow-checks-to-vla-macros.patch @@ -0,0 +1,85 @@ +From b1cd1b65afba95971fa457dfdb2c941c60d38c5b Mon Sep 17 00:00:00 2001 +From: Brooke Basile +Date: Tue, 25 Aug 2020 09:05:08 -0400 +Subject: USB: gadget: u_f: add overflow checks to VLA macros + +From: Brooke Basile + +commit b1cd1b65afba95971fa457dfdb2c941c60d38c5b upstream. + +size can potentially hold an overflowed value if its assigned expression +is left unchecked, leading to a smaller than needed allocation when +vla_group_size() is used by callers to allocate memory. +To fix this, add a test for saturation before declaring variables and an +overflow check to (n) * sizeof(type). +If the expression results in overflow, vla_group_size() will return SIZE_MAX. + +Reported-by: Ilja Van Sprundel +Suggested-by: Kees Cook +Signed-off-by: Brooke Basile +Acked-by: Felipe Balbi +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/u_f.h | 38 +++++++++++++++++++++++++++----------- + 1 file changed, 27 insertions(+), 11 deletions(-) + +--- a/drivers/usb/gadget/u_f.h ++++ b/drivers/usb/gadget/u_f.h +@@ -14,6 +14,7 @@ + #define __U_F_H__ + + #include ++#include + + /* Variable Length Array Macros **********************************************/ + #define vla_group(groupname) size_t groupname##__next = 0 +@@ -21,21 +22,36 @@ + + #define vla_item(groupname, type, name, n) \ + size_t groupname##_##name##__offset = ({ \ +- size_t align_mask = __alignof__(type) - 1; \ +- size_t offset = (groupname##__next + align_mask) & ~align_mask;\ +- size_t size = (n) * sizeof(type); \ +- groupname##__next = offset + size; \ ++ size_t offset = 0; \ ++ if (groupname##__next != SIZE_MAX) { \ ++ size_t align_mask = __alignof__(type) - 1; \ ++ size_t offset = (groupname##__next + align_mask) \ ++ & ~align_mask; \ ++ size_t size = array_size(n, sizeof(type)); \ ++ if (check_add_overflow(offset, size, \ ++ &groupname##__next)) { \ ++ groupname##__next = SIZE_MAX; \ ++ offset = 0; \ ++ } \ ++ } \ + offset; \ + }) + + #define vla_item_with_sz(groupname, type, name, n) \ +- size_t groupname##_##name##__sz = (n) * sizeof(type); \ +- size_t groupname##_##name##__offset = ({ \ +- size_t align_mask = __alignof__(type) - 1; \ +- size_t offset = (groupname##__next + align_mask) & ~align_mask;\ +- size_t size = groupname##_##name##__sz; \ +- groupname##__next = offset + size; \ +- offset; \ ++ size_t groupname##_##name##__sz = array_size(n, sizeof(type)); \ ++ size_t groupname##_##name##__offset = ({ \ ++ size_t offset = 0; \ ++ if (groupname##__next != SIZE_MAX) { \ ++ size_t align_mask = __alignof__(type) - 1; \ ++ size_t offset = (groupname##__next + align_mask) \ ++ & ~align_mask; \ ++ if (check_add_overflow(offset, groupname##_##name##__sz,\ ++ &groupname##__next)) { \ ++ groupname##__next = SIZE_MAX; \ ++ offset = 0; \ ++ } \ ++ } \ ++ offset; \ + }) + + #define vla_ptr(ptr, groupname, name) \ diff --git a/queue-5.4/usb-gadget-u_f-unbreak-offset-calculation-in-vlas.patch b/queue-5.4/usb-gadget-u_f-unbreak-offset-calculation-in-vlas.patch new file mode 100644 index 00000000000..4fc880659fc --- /dev/null +++ b/queue-5.4/usb-gadget-u_f-unbreak-offset-calculation-in-vlas.patch @@ -0,0 +1,51 @@ +From bfd08d06d978d0304eb6f7855b548aa2cd1c5486 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Wed, 26 Aug 2020 22:21:19 +0300 +Subject: USB: gadget: u_f: Unbreak offset calculation in VLAs + +From: Andy Shevchenko + +commit bfd08d06d978d0304eb6f7855b548aa2cd1c5486 upstream. + +Inadvertently the commit b1cd1b65afba ("USB: gadget: u_f: add overflow checks +to VLA macros") makes VLA macros to always return 0 due to different scope of +two variables of the same name. Obviously we need to have only one. + +Fixes: b1cd1b65afba ("USB: gadget: u_f: add overflow checks to VLA macros") +Reported-by: Marek Szyprowski +Tested-by: Marek Szyprowski +Signed-off-by: Andy Shevchenko +Cc: Brooke Basile +Cc: stable +Link: https://lore.kernel.org/r/20200826192119.56450-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/u_f.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/usb/gadget/u_f.h ++++ b/drivers/usb/gadget/u_f.h +@@ -25,9 +25,9 @@ + size_t offset = 0; \ + if (groupname##__next != SIZE_MAX) { \ + size_t align_mask = __alignof__(type) - 1; \ +- size_t offset = (groupname##__next + align_mask) \ +- & ~align_mask; \ + size_t size = array_size(n, sizeof(type)); \ ++ offset = (groupname##__next + align_mask) & \ ++ ~align_mask; \ + if (check_add_overflow(offset, size, \ + &groupname##__next)) { \ + groupname##__next = SIZE_MAX; \ +@@ -43,8 +43,8 @@ + size_t offset = 0; \ + if (groupname##__next != SIZE_MAX) { \ + size_t align_mask = __alignof__(type) - 1; \ +- size_t offset = (groupname##__next + align_mask) \ +- & ~align_mask; \ ++ offset = (groupname##__next + align_mask) & \ ++ ~align_mask; \ + if (check_add_overflow(offset, groupname##_##name##__sz,\ + &groupname##__next)) { \ + groupname##__next = SIZE_MAX; \ diff --git a/queue-5.4/usb-host-ohci-exynos-fix-error-handling-in-exynos_ohci_probe.patch b/queue-5.4/usb-host-ohci-exynos-fix-error-handling-in-exynos_ohci_probe.patch new file mode 100644 index 00000000000..9008119fd4f --- /dev/null +++ b/queue-5.4/usb-host-ohci-exynos-fix-error-handling-in-exynos_ohci_probe.patch @@ -0,0 +1,41 @@ +From 1d4169834628d18b2392a2da92b7fbf5e8e2ce89 Mon Sep 17 00:00:00 2001 +From: Tang Bin +Date: Wed, 26 Aug 2020 22:49:31 +0800 +Subject: usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe() + +From: Tang Bin + +commit 1d4169834628d18b2392a2da92b7fbf5e8e2ce89 upstream. + +If the function platform_get_irq() failed, the negative value +returned will not be detected here. So fix error handling in +exynos_ohci_probe(). And when get irq failed, the function +platform_get_irq() logs an error message, so remove redundant +message here. + +Fixes: 62194244cf87 ("USB: Add Samsung Exynos OHCI diver") +Signed-off-by: Zhang Shengju +Cc: stable +Signed-off-by: Tang Bin +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20200826144931.1828-1-tangbin@cmss.chinamobile.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/ohci-exynos.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/usb/host/ohci-exynos.c ++++ b/drivers/usb/host/ohci-exynos.c +@@ -171,9 +171,8 @@ static int exynos_ohci_probe(struct plat + hcd->rsrc_len = resource_size(res); + + irq = platform_get_irq(pdev, 0); +- if (!irq) { +- dev_err(&pdev->dev, "Failed to get IRQ\n"); +- err = -ENODEV; ++ if (irq < 0) { ++ err = irq; + goto fail_io; + } + diff --git a/queue-5.4/usb-ignore-uas-for-jmicron-jms567-ata-atapi-bridge.patch b/queue-5.4/usb-ignore-uas-for-jmicron-jms567-ata-atapi-bridge.patch new file mode 100644 index 00000000000..946547e5a60 --- /dev/null +++ b/queue-5.4/usb-ignore-uas-for-jmicron-jms567-ata-atapi-bridge.patch @@ -0,0 +1,37 @@ +From 9aa37788e7ebb3f489fb4b71ce07adadd444264a Mon Sep 17 00:00:00 2001 +From: Cyril Roelandt +Date: Tue, 25 Aug 2020 23:22:31 +0200 +Subject: USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge + +From: Cyril Roelandt + +commit 9aa37788e7ebb3f489fb4b71ce07adadd444264a upstream. + +This device does not support UAS properly and a similar entry already +exists in drivers/usb/storage/unusual_uas.h. Without this patch, +storage_probe() defers the handling of this device to UAS, which cannot +handle it either. + +Tested-by: Brice Goglin +Fixes: bc3bdb12bbb3 ("usb-storage: Disable UAS on JMicron SATA enclosure") +Acked-by: Alan Stern +CC: +Signed-off-by: Cyril Roelandt +Link: https://lore.kernel.org/r/20200825212231.46309-1-tipecaml@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_devs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2328,7 +2328,7 @@ UNUSUAL_DEV( 0x357d, 0x7788, 0x0114, 0x + "JMicron", + "USB to ATA/ATAPI Bridge", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, +- US_FL_BROKEN_FUA ), ++ US_FL_BROKEN_FUA | US_FL_IGNORE_UAS ), + + /* Reported by Andrey Rahmatullin */ + UNUSUAL_DEV( 0x4102, 0x1020, 0x0100, 0x0100, diff --git a/queue-5.4/usb-quirks-add-no-lpm-quirk-for-another-raydium-touchscreen.patch b/queue-5.4/usb-quirks-add-no-lpm-quirk-for-another-raydium-touchscreen.patch new file mode 100644 index 00000000000..80194e95991 --- /dev/null +++ b/queue-5.4/usb-quirks-add-no-lpm-quirk-for-another-raydium-touchscreen.patch @@ -0,0 +1,38 @@ +From 5967116e8358899ebaa22702d09b0af57fef23e1 Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Fri, 31 Jul 2020 13:16:20 +0800 +Subject: USB: quirks: Add no-lpm quirk for another Raydium touchscreen + +From: Kai-Heng Feng + +commit 5967116e8358899ebaa22702d09b0af57fef23e1 upstream. + +There's another Raydium touchscreen needs the no-lpm quirk: +[ 1.339149] usb 1-9: New USB device found, idVendor=2386, idProduct=350e, bcdDevice= 0.00 +[ 1.339150] usb 1-9: New USB device strings: Mfr=1, Product=2, SerialNumber=0 +[ 1.339151] usb 1-9: Product: Raydium Touch System +[ 1.339152] usb 1-9: Manufacturer: Raydium Corporation +... +[ 6.450497] usb 1-9: can't set config #1, error -110 + +BugLink: https://bugs.launchpad.net/bugs/1889446 +Signed-off-by: Kai-Heng Feng +Cc: stable +Link: https://lore.kernel.org/r/20200731051622.28643-1-kai.heng.feng@canonical.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -465,6 +465,8 @@ static const struct usb_device_id usb_qu + + { USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM }, + ++ { USB_DEVICE(0x2386, 0x350e), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* DJI CineSSD */ + { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, + diff --git a/queue-5.4/usb-quirks-ignore-duplicate-endpoint-on-sound-devices-mixpre-d.patch b/queue-5.4/usb-quirks-ignore-duplicate-endpoint-on-sound-devices-mixpre-d.patch new file mode 100644 index 00000000000..70341669248 --- /dev/null +++ b/queue-5.4/usb-quirks-ignore-duplicate-endpoint-on-sound-devices-mixpre-d.patch @@ -0,0 +1,53 @@ +From 068834a2773b6a12805105cfadbb3d4229fc6e0a Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 26 Aug 2020 15:46:24 -0400 +Subject: USB: quirks: Ignore duplicate endpoint on Sound Devices MixPre-D + +From: Alan Stern + +commit 068834a2773b6a12805105cfadbb3d4229fc6e0a upstream. + +The Sound Devices MixPre-D audio card suffers from the same defect +as the Sound Devices USBPre2: an endpoint shared between a normal +audio interface and a vendor-specific interface, in violation of the +USB spec. Since the USB core now treats duplicated endpoints as bugs +and ignores them, the audio endpoint isn't available and the card +can't be used for audio capture. + +Along the same lines as commit bdd1b147b802 ("USB: quirks: blacklist +duplicate ep on Sound Devices USBPre2"), this patch adds a quirks +entry saying to ignore ep5in for interface 1, leaving it available for +use with standard audio interface 2. + +Reported-and-tested-by: Jean-Christophe Barnoud +Signed-off-by: Alan Stern +CC: +Fixes: 3e4f8e21c4f2 ("USB: core: fix check for duplicate endpoints") +Link: https://lore.kernel.org/r/20200826194624.GA412633@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -370,6 +370,10 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x0926, 0x0202), .driver_info = + USB_QUIRK_ENDPOINT_BLACKLIST }, + ++ /* Sound Devices MixPre-D */ ++ { USB_DEVICE(0x0926, 0x0208), .driver_info = ++ USB_QUIRK_ENDPOINT_BLACKLIST }, ++ + /* Keytouch QWERTY Panel keyboard */ + { USB_DEVICE(0x0926, 0x3333), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, +@@ -511,6 +515,7 @@ static const struct usb_device_id usb_am + */ + static const struct usb_device_id usb_endpoint_blacklist[] = { + { USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0202, 1), .driver_info = 0x85 }, ++ { USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0208, 1), .driver_info = 0x85 }, + { } + }; + diff --git a/queue-5.4/usb-storage-add-unusual_uas-entry-for-sony-psz-drives.patch b/queue-5.4/usb-storage-add-unusual_uas-entry-for-sony-psz-drives.patch new file mode 100644 index 00000000000..adc63da755b --- /dev/null +++ b/queue-5.4/usb-storage-add-unusual_uas-entry-for-sony-psz-drives.patch @@ -0,0 +1,42 @@ +From 20934c0de13b49a072fb1e0ca79fe0fe0e40eae5 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 26 Aug 2020 10:32:29 -0400 +Subject: usb: storage: Add unusual_uas entry for Sony PSZ drives +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alan Stern + +commit 20934c0de13b49a072fb1e0ca79fe0fe0e40eae5 upstream. + +The PSZ-HA* family of USB disk drives from Sony can't handle the +REPORT OPCODES command when using the UAS protocol. This patch adds +an appropriate quirks entry. + +Reported-and-tested-by: Till Dörges +Signed-off-by: Alan Stern +CC: +Link: https://lore.kernel.org/r/20200826143229.GB400430@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_uas.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -28,6 +28,13 @@ + * and don't forget to CC: the USB development list + */ + ++/* Reported-by: Till Dörges */ ++UNUSUAL_DEV(0x054c, 0x087d, 0x0000, 0x9999, ++ "Sony", ++ "PSZ-HA*", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_REPORT_OPCODES), ++ + /* Reported-by: Julian Groß */ + UNUSUAL_DEV(0x059f, 0x105f, 0x0000, 0x9999, + "LaCie", diff --git a/queue-5.4/usb-uas-add-quirk-for-pny-pro-elite.patch b/queue-5.4/usb-uas-add-quirk-for-pny-pro-elite.patch new file mode 100644 index 00000000000..4e87b377b15 --- /dev/null +++ b/queue-5.4/usb-uas-add-quirk-for-pny-pro-elite.patch @@ -0,0 +1,39 @@ +From 9a469bc9f32dd33c7aac5744669d21a023a719cd Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Tue, 18 Aug 2020 19:27:47 -0700 +Subject: usb: uas: Add quirk for PNY Pro Elite + +From: Thinh Nguyen + +commit 9a469bc9f32dd33c7aac5744669d21a023a719cd upstream. + +PNY Pro Elite USB 3.1 Gen 2 device (SSD) doesn't respond to ATA_12 +pass-through command (i.e. it just hangs). If it doesn't support this +command, it should respond properly to the host. Let's just add a quirk +to be able to move forward with other operations. + +Cc: stable@vger.kernel.org +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/2b0585228b003eedcc82db84697b31477df152e0.1597803605.git.thinhn@synopsys.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/unusual_uas.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -80,6 +80,13 @@ UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x99 + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_BROKEN_FUA), + ++/* Reported-by: Thinh Nguyen */ ++UNUSUAL_DEV(0x154b, 0xf00d, 0x0000, 0x9999, ++ "PNY", ++ "Pro Elite SSD", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_ATA_1X), ++ + /* Reported-by: Hans de Goede */ + UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999, + "VIA", diff --git a/queue-5.4/usb-yurex-fix-bad-gfp-argument.patch b/queue-5.4/usb-yurex-fix-bad-gfp-argument.patch new file mode 100644 index 00000000000..86f97f5e81f --- /dev/null +++ b/queue-5.4/usb-yurex-fix-bad-gfp-argument.patch @@ -0,0 +1,72 @@ +From f176ede3a3bde5b398a6777a7f9ff091baa2d3ff Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 10 Aug 2020 14:29:54 -0400 +Subject: USB: yurex: Fix bad gfp argument + +From: Alan Stern + +commit f176ede3a3bde5b398a6777a7f9ff091baa2d3ff upstream. + +The syzbot fuzzer identified a bug in the yurex driver: It passes +GFP_KERNEL as a memory-allocation flag to usb_submit_urb() at a time +when its state is TASK_INTERRUPTIBLE, not TASK_RUNNING: + +do not call blocking ops when !TASK_RUNNING; state=1 set at [<00000000370c7c68>] prepare_to_wait+0xb1/0x2a0 kernel/sched/wait.c:247 +WARNING: CPU: 1 PID: 340 at kernel/sched/core.c:7253 __might_sleep+0x135/0x190 +kernel/sched/core.c:7253 +Kernel panic - not syncing: panic_on_warn set ... +CPU: 1 PID: 340 Comm: syz-executor677 Not tainted 5.8.0-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google +01/01/2011 +Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0xf6/0x16e lib/dump_stack.c:118 + panic+0x2aa/0x6e1 kernel/panic.c:231 + __warn.cold+0x20/0x50 kernel/panic.c:600 + report_bug+0x1bd/0x210 lib/bug.c:198 + handle_bug+0x41/0x80 arch/x86/kernel/traps.c:234 + exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254 + asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536 +RIP: 0010:__might_sleep+0x135/0x190 kernel/sched/core.c:7253 +Code: 65 48 8b 1c 25 40 ef 01 00 48 8d 7b 10 48 89 fe 48 c1 ee 03 80 3c 06 00 75 +2b 48 8b 73 10 48 c7 c7 e0 9e 06 86 e8 ed 12 f6 ff <0f> 0b e9 46 ff ff ff e8 1f +b2 4b 00 e9 29 ff ff ff e8 15 b2 4b 00 +RSP: 0018:ffff8881cdb77a28 EFLAGS: 00010282 +RAX: 0000000000000000 RBX: ffff8881c6458000 RCX: 0000000000000000 +RDX: ffff8881c6458000 RSI: ffffffff8129ec93 RDI: ffffed1039b6ef37 +RBP: ffffffff86fdade2 R08: 0000000000000001 R09: ffff8881db32f54f +R10: 0000000000000000 R11: 0000000030343354 R12: 00000000000001f2 +R13: 0000000000000000 R14: 0000000000000068 R15: ffffffff83c1b1aa + slab_pre_alloc_hook.constprop.0+0xea/0x200 mm/slab.h:498 + slab_alloc_node mm/slub.c:2816 [inline] + slab_alloc mm/slub.c:2900 [inline] + kmem_cache_alloc_trace+0x46/0x220 mm/slub.c:2917 + kmalloc include/linux/slab.h:554 [inline] + dummy_urb_enqueue+0x7a/0x880 drivers/usb/gadget/udc/dummy_hcd.c:1251 + usb_hcd_submit_urb+0x2b2/0x22d0 drivers/usb/core/hcd.c:1547 + usb_submit_urb+0xb4e/0x13e0 drivers/usb/core/urb.c:570 + yurex_write+0x3ea/0x820 drivers/usb/misc/yurex.c:495 + +This patch changes the call to use GFP_ATOMIC instead of GFP_KERNEL. + +Reported-and-tested-by: syzbot+c2c3302f9c601a4b1be2@syzkaller.appspotmail.com +Signed-off-by: Alan Stern +CC: +Link: https://lore.kernel.org/r/20200810182954.GB307778@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/yurex.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/misc/yurex.c ++++ b/drivers/usb/misc/yurex.c +@@ -492,7 +492,7 @@ static ssize_t yurex_write(struct file * + prepare_to_wait(&dev->waitq, &wait, TASK_INTERRUPTIBLE); + dev_dbg(&dev->interface->dev, "%s - submit %c\n", __func__, + dev->cntl_buffer[0]); +- retval = usb_submit_urb(dev->cntl_urb, GFP_KERNEL); ++ retval = usb_submit_urb(dev->cntl_urb, GFP_ATOMIC); + if (retval >= 0) + timeout = schedule_timeout(YUREX_WRITE_TIMEOUT); + finish_wait(&dev->waitq, &wait);