From: Greg Kroah-Hartman Date: Mon, 18 Aug 2025 10:07:14 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v6.12.43~41 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=666e3afdc9a0ffa9f1bee9b2808107902ddd7eaf;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: misc-rtsx-usb-ensure-mmc-child-device-is-active-when-card-is-present.patch usb-core-config-prevent-oob-read-in-ss-endpoint-companion-parsing.patch usb-typec-ucsi-update-power_supply-on-power-role-change.patch --- diff --git a/queue-5.10/misc-rtsx-usb-ensure-mmc-child-device-is-active-when-card-is-present.patch b/queue-5.10/misc-rtsx-usb-ensure-mmc-child-device-is-active-when-card-is-present.patch new file mode 100644 index 0000000000..39fa304eca --- /dev/null +++ b/queue-5.10/misc-rtsx-usb-ensure-mmc-child-device-is-active-when-card-is-present.patch @@ -0,0 +1,69 @@ +From 966c5cd72be8989c8a559ddef8e8ff07a37c5eb0 Mon Sep 17 00:00:00 2001 +From: Ricky Wu +Date: Fri, 11 Jul 2025 22:01:43 +0800 +Subject: misc: rtsx: usb: Ensure mmc child device is active when card is present + +From: Ricky Wu + +commit 966c5cd72be8989c8a559ddef8e8ff07a37c5eb0 upstream. + +When a card is present in the reader, the driver currently defers +autosuspend by returning -EAGAIN during the suspend callback to +trigger USB remote wakeup signaling. However, this does not guarantee +that the mmc child device has been resumed, which may cause issues if +it remains suspended while the card is accessible. +This patch ensures that all child devices, including the mmc host +controller, are explicitly resumed before returning -EAGAIN. This +fixes a corner case introduced by earlier remote wakeup handling, +improving reliability of runtime PM when a card is inserted. + +Fixes: 883a87ddf2f1 ("misc: rtsx_usb: Use USB remote wakeup signaling for card insertion detection") +Cc: stable@vger.kernel.org +Signed-off-by: Ricky Wu +Reviewed-by: Ulf Hansson +Link: https://lore.kernel.org/r/20250711140143.2105224-1-ricky_wu@realtek.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/cardreader/rtsx_usb.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +--- a/drivers/misc/cardreader/rtsx_usb.c ++++ b/drivers/misc/cardreader/rtsx_usb.c +@@ -698,6 +698,12 @@ static void rtsx_usb_disconnect(struct u + } + + #ifdef CONFIG_PM ++static int rtsx_usb_resume_child(struct device *dev, void *data) ++{ ++ pm_request_resume(dev); ++ return 0; ++} ++ + static int rtsx_usb_suspend(struct usb_interface *intf, pm_message_t message) + { + struct rtsx_ucr *ucr = +@@ -713,8 +719,10 @@ static int rtsx_usb_suspend(struct usb_i + mutex_unlock(&ucr->dev_mutex); + + /* Defer the autosuspend if card exists */ +- if (val & (SD_CD | MS_CD)) ++ if (val & (SD_CD | MS_CD)) { ++ device_for_each_child(&intf->dev, NULL, rtsx_usb_resume_child); + return -EAGAIN; ++ } + } else { + /* There is an ongoing operation*/ + return -EAGAIN; +@@ -724,12 +732,6 @@ static int rtsx_usb_suspend(struct usb_i + return 0; + } + +-static int rtsx_usb_resume_child(struct device *dev, void *data) +-{ +- pm_request_resume(dev); +- return 0; +-} +- + static int rtsx_usb_resume(struct usb_interface *intf) + { + device_for_each_child(&intf->dev, NULL, rtsx_usb_resume_child); diff --git a/queue-5.10/series b/queue-5.10/series index ba5eb5db28..ebc8cb4611 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -340,3 +340,6 @@ scsi-lpfc-remove-redundant-assignment-to-avoid-memor.patch asoc-soc-dai.c-add-missing-flag-check-at-snd_soc_pcm.patch asoc-fsl_sai-replace-regmap_write-with-regmap_update.patch drm-amdgpu-fix-incorrect-vm-flags-to-map-bo.patch +usb-core-config-prevent-oob-read-in-ss-endpoint-companion-parsing.patch +misc-rtsx-usb-ensure-mmc-child-device-is-active-when-card-is-present.patch +usb-typec-ucsi-update-power_supply-on-power-role-change.patch diff --git a/queue-5.10/usb-core-config-prevent-oob-read-in-ss-endpoint-companion-parsing.patch b/queue-5.10/usb-core-config-prevent-oob-read-in-ss-endpoint-companion-parsing.patch new file mode 100644 index 0000000000..935962757d --- /dev/null +++ b/queue-5.10/usb-core-config-prevent-oob-read-in-ss-endpoint-companion-parsing.patch @@ -0,0 +1,41 @@ +From cf16f408364efd8a68f39011a3b073c83a03612d Mon Sep 17 00:00:00 2001 +From: Xinyu Liu +Date: Mon, 30 Jun 2025 10:02:56 +0800 +Subject: usb: core: config: Prevent OOB read in SS endpoint companion parsing + +From: Xinyu Liu + +commit cf16f408364efd8a68f39011a3b073c83a03612d upstream. + +usb_parse_ss_endpoint_companion() checks descriptor type before length, +enabling a potentially odd read outside of the buffer size. + +Fix this up by checking the size first before looking at any of the +fields in the descriptor. + +Signed-off-by: Xinyu Liu +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/config.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -81,8 +81,14 @@ static void usb_parse_ss_endpoint_compan + */ + desc = (struct usb_ss_ep_comp_descriptor *) buffer; + +- if (desc->bDescriptorType != USB_DT_SS_ENDPOINT_COMP || +- size < USB_DT_SS_EP_COMP_SIZE) { ++ if (size < USB_DT_SS_EP_COMP_SIZE) { ++ dev_notice(ddev, ++ "invalid SuperSpeed endpoint companion descriptor " ++ "of length %d, skipping\n", size); ++ return; ++ } ++ ++ if (desc->bDescriptorType != USB_DT_SS_ENDPOINT_COMP) { + dev_notice(ddev, "No SuperSpeed endpoint companion for config %d " + " interface %d altsetting %d ep %d: " + "using minimum values\n", diff --git a/queue-5.10/usb-typec-ucsi-update-power_supply-on-power-role-change.patch b/queue-5.10/usb-typec-ucsi-update-power_supply-on-power-role-change.patch new file mode 100644 index 0000000000..d6ae4d2609 --- /dev/null +++ b/queue-5.10/usb-typec-ucsi-update-power_supply-on-power-role-change.patch @@ -0,0 +1,37 @@ +From 7616f006db07017ef5d4ae410fca99279aaca7aa Mon Sep 17 00:00:00 2001 +From: Myrrh Periwinkle +Date: Mon, 21 Jul 2025 13:32:51 +0700 +Subject: usb: typec: ucsi: Update power_supply on power role change + +From: Myrrh Periwinkle + +commit 7616f006db07017ef5d4ae410fca99279aaca7aa upstream. + +The current power direction of an USB-C port also influences the +power_supply's online status, so a power role change should also update +the power_supply. + +Fixes an issue on some systems where plugging in a normal USB device in +for the first time after a reboot will cause upower to erroneously +consider the system to be connected to AC power. + +Cc: stable +Fixes: 0e6371fbfba3 ("usb: typec: ucsi: Report power supply changes") +Signed-off-by: Myrrh Periwinkle +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20250721-fix-ucsi-pwr-dir-notify-v1-1-e53d5340cb38@qtmlabs.xyz +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -779,6 +779,7 @@ static void ucsi_handle_connector_change + + if (con->status.change & UCSI_CONSTAT_CONNECT_CHANGE) { + typec_set_pwr_role(con->port, role); ++ ucsi_port_psy_changed(con); + + switch (UCSI_CONSTAT_PARTNER_TYPE(con->status.flags)) { + case UCSI_CONSTAT_PARTNER_TYPE_UFP: