From: Greg Kroah-Hartman Date: Sun, 27 Jun 2021 14:26:06 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v5.12.14~19 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7433c09108f4d0acc9d54ad5f10a00c4493818ab;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: i2c-robotfuzz-osif-fix-control-request-directions.patch --- diff --git a/queue-4.9/i2c-robotfuzz-osif-fix-control-request-directions.patch b/queue-4.9/i2c-robotfuzz-osif-fix-control-request-directions.patch new file mode 100644 index 00000000000..9935fca9615 --- /dev/null +++ b/queue-4.9/i2c-robotfuzz-osif-fix-control-request-directions.patch @@ -0,0 +1,50 @@ +From 4ca070ef0dd885616ef294d269a9bf8e3b258e1a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 24 May 2021 11:09:12 +0200 +Subject: i2c: robotfuzz-osif: fix control-request directions + +From: Johan Hovold + +commit 4ca070ef0dd885616ef294d269a9bf8e3b258e1a upstream. + +The direction of the pipe argument must match the request-type direction +bit or control requests may fail depending on the host-controller-driver +implementation. + +Control transfers without a data stage are treated as OUT requests by +the USB stack and should be using usb_sndctrlpipe(). Failing to do so +will now trigger a warning. + +Fix the OSIFI2C_SET_BIT_RATE and OSIFI2C_STOP requests which erroneously +used the osif_usb_read() helper and set the IN direction bit. + +Reported-by: syzbot+9d7dadd15b8819d73f41@syzkaller.appspotmail.com +Fixes: 83e53a8f120f ("i2c: Add bus driver for for OSIF USB i2c device.") +Cc: stable@vger.kernel.org # 3.14 +Signed-off-by: Johan Hovold +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-robotfuzz-osif.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/i2c/busses/i2c-robotfuzz-osif.c ++++ b/drivers/i2c/busses/i2c-robotfuzz-osif.c +@@ -89,7 +89,7 @@ static int osif_xfer(struct i2c_adapter + } + } + +- ret = osif_usb_read(adapter, OSIFI2C_STOP, 0, 0, NULL, 0); ++ ret = osif_usb_write(adapter, OSIFI2C_STOP, 0, 0, NULL, 0); + if (ret) { + dev_err(&adapter->dev, "failure sending STOP\n"); + return -EREMOTEIO; +@@ -159,7 +159,7 @@ static int osif_probe(struct usb_interfa + * Set bus frequency. The frequency is: + * 120,000,000 / ( 16 + 2 * div * 4^prescale). + * Using dev = 52, prescale = 0 give 100KHz */ +- ret = osif_usb_read(&priv->adapter, OSIFI2C_SET_BIT_RATE, 52, 0, ++ ret = osif_usb_write(&priv->adapter, OSIFI2C_SET_BIT_RATE, 52, 0, + NULL, 0); + if (ret) { + dev_err(&interface->dev, "failure sending bit rate"); diff --git a/queue-4.9/series b/queue-4.9/series index 26cb5f5404b..2231f169b47 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -67,3 +67,4 @@ r8169-avoid-memcpy-over-reading-of-eth_ss_stats.patch net-qed-fix-memcpy-overflow-of-qed_dcbx_params.patch net-ll_temac-avoid-ndo_start_xmit-returning-netdev_t.patch nilfs2-fix-memory-leak-in-nilfs_sysfs_delete_device_.patch +i2c-robotfuzz-osif-fix-control-request-directions.patch