From: Greg Kroah-Hartman Date: Sun, 30 May 2021 10:55:07 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.4.271~94 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7fab872d134cbb2d664c394726e6a801e4df86e8;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: iio-adc-ad7793-add-missing-error-code-in-ad7793_setup.patch mei-request-autosuspend-after-sending-rx-flow-control.patch misc-uss720-fix-memory-leak-in-uss720_probe.patch staging-iio-cdc-ad7746-avoid-overwrite-of-num_channels.patch thunderbolt-dma_port-fix-nvm-read-buffer-bounds-and-offset-issue.patch usb-trancevibrator-fix-control-request-direction.patch --- diff --git a/queue-4.14/iio-adc-ad7793-add-missing-error-code-in-ad7793_setup.patch b/queue-4.14/iio-adc-ad7793-add-missing-error-code-in-ad7793_setup.patch new file mode 100644 index 00000000000..84ae2c2eefe --- /dev/null +++ b/queue-4.14/iio-adc-ad7793-add-missing-error-code-in-ad7793_setup.patch @@ -0,0 +1,30 @@ +From 4ed243b1da169bcbc1ec5507867e56250c5f1ff9 Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Fri, 14 May 2021 16:02:54 +0800 +Subject: iio: adc: ad7793: Add missing error code in ad7793_setup() + +From: YueHaibing + +commit 4ed243b1da169bcbc1ec5507867e56250c5f1ff9 upstream. + +Set error code while device ID query failed. + +Fixes: 88bc30548aae ("IIO: ADC: New driver for AD7792/AD7793 3 Channel SPI ADC") +Signed-off-by: YueHaibing +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/ad7793.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/adc/ad7793.c ++++ b/drivers/iio/adc/ad7793.c +@@ -279,6 +279,7 @@ static int ad7793_setup(struct iio_dev * + id &= AD7793_ID_MASK; + + if (id != st->chip_info->id) { ++ ret = -ENODEV; + dev_err(&st->sd.spi->dev, "device ID query failed\n"); + goto out; + } diff --git a/queue-4.14/mei-request-autosuspend-after-sending-rx-flow-control.patch b/queue-4.14/mei-request-autosuspend-after-sending-rx-flow-control.patch new file mode 100644 index 00000000000..5293a8d35a9 --- /dev/null +++ b/queue-4.14/mei-request-autosuspend-after-sending-rx-flow-control.patch @@ -0,0 +1,34 @@ +From bbf0a94744edfeee298e4a9ab6fd694d639a5cdf Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Wed, 26 May 2021 22:33:34 +0300 +Subject: mei: request autosuspend after sending rx flow control + +From: Alexander Usyskin + +commit bbf0a94744edfeee298e4a9ab6fd694d639a5cdf upstream. + +A rx flow control waiting in the control queue may block autosuspend. +Re-request autosuspend after flow control been sent to unblock +the transition to the low power state. + +Cc: +Signed-off-by: Alexander Usyskin +Signed-off-by: Tomas Winkler +Link: https://lore.kernel.org/r/20210526193334.445759-1-tomas.winkler@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/mei/interrupt.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/misc/mei/interrupt.c ++++ b/drivers/misc/mei/interrupt.c +@@ -220,6 +220,9 @@ static int mei_cl_irq_read(struct mei_cl + return ret; + } + ++ pm_runtime_mark_last_busy(dev->dev); ++ pm_request_autosuspend(dev->dev); ++ + list_move_tail(&cb->list, &cl->rd_pending); + + return 0; diff --git a/queue-4.14/misc-uss720-fix-memory-leak-in-uss720_probe.patch b/queue-4.14/misc-uss720-fix-memory-leak-in-uss720_probe.patch new file mode 100644 index 00000000000..3573cb97d82 --- /dev/null +++ b/queue-4.14/misc-uss720-fix-memory-leak-in-uss720_probe.patch @@ -0,0 +1,52 @@ +From dcb4b8ad6a448532d8b681b5d1a7036210b622de Mon Sep 17 00:00:00 2001 +From: Dongliang Mu +Date: Fri, 14 May 2021 20:43:48 +0800 +Subject: misc/uss720: fix memory leak in uss720_probe + +From: Dongliang Mu + +commit dcb4b8ad6a448532d8b681b5d1a7036210b622de upstream. + +uss720_probe forgets to decrease the refcount of usbdev in uss720_probe. +Fix this by decreasing the refcount of usbdev by usb_put_dev. + +BUG: memory leak +unreferenced object 0xffff888101113800 (size 2048): + comm "kworker/0:1", pid 7, jiffies 4294956777 (age 28.870s) + hex dump (first 32 bytes): + ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00 ....1........... + 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ................ + backtrace: + [] kmalloc include/linux/slab.h:554 [inline] + [] kzalloc include/linux/slab.h:684 [inline] + [] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582 + [] hub_port_connect drivers/usb/core/hub.c:5129 [inline] + [] hub_port_connect_change drivers/usb/core/hub.c:5363 [inline] + [] port_event drivers/usb/core/hub.c:5509 [inline] + [] hub_event+0x1171/0x20c0 drivers/usb/core/hub.c:5591 + [] process_one_work+0x2c9/0x600 kernel/workqueue.c:2275 + [] worker_thread+0x59/0x5d0 kernel/workqueue.c:2421 + [] kthread+0x178/0x1b0 kernel/kthread.c:292 + [] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 + +Fixes: 0f36163d3abe ("[PATCH] usb: fix uss720 schedule with interrupts off") +Cc: stable +Reported-by: syzbot+636c58f40a86b4a879e7@syzkaller.appspotmail.com +Signed-off-by: Dongliang Mu +Link: https://lore.kernel.org/r/20210514124348.6587-1-mudongliangabcd@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/misc/uss720.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/misc/uss720.c ++++ b/drivers/usb/misc/uss720.c +@@ -749,6 +749,7 @@ static int uss720_probe(struct usb_inter + parport_announce_port(pp); + + usb_set_intfdata(intf, pp); ++ usb_put_dev(usbdev); + return 0; + + probe_abort: diff --git a/queue-4.14/series b/queue-4.14/series index 1d3404be47e..adf484393f2 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -17,3 +17,9 @@ mac80211-check-defrag-pn-against-current-frame.patch ath10k-validate-first-subframe-of-a-msdu-before-processing-the-list.patch dm-snapshot-properly-fix-a-crash-when-an-origin-has-no-snapshots.patch kgdb-fix-gcc-11-warnings-harder.patch +misc-uss720-fix-memory-leak-in-uss720_probe.patch +thunderbolt-dma_port-fix-nvm-read-buffer-bounds-and-offset-issue.patch +mei-request-autosuspend-after-sending-rx-flow-control.patch +staging-iio-cdc-ad7746-avoid-overwrite-of-num_channels.patch +iio-adc-ad7793-add-missing-error-code-in-ad7793_setup.patch +usb-trancevibrator-fix-control-request-direction.patch diff --git a/queue-4.14/staging-iio-cdc-ad7746-avoid-overwrite-of-num_channels.patch b/queue-4.14/staging-iio-cdc-ad7746-avoid-overwrite-of-num_channels.patch new file mode 100644 index 00000000000..922c9d16af4 --- /dev/null +++ b/queue-4.14/staging-iio-cdc-ad7746-avoid-overwrite-of-num_channels.patch @@ -0,0 +1,33 @@ +From 04f5b9f539ce314f758d919a14dc7a669f3b7838 Mon Sep 17 00:00:00 2001 +From: Lucas Stankus +Date: Tue, 11 May 2021 17:54:18 -0300 +Subject: staging: iio: cdc: ad7746: avoid overwrite of num_channels + +From: Lucas Stankus + +commit 04f5b9f539ce314f758d919a14dc7a669f3b7838 upstream. + +AD7745 devices don't have the CIN2 pins and therefore can't handle related +channels. Forcing the number of AD7746 channels may lead to enabling more +channels than what the hardware actually supports. +Avoid num_channels being overwritten after first assignment. + +Signed-off-by: Lucas Stankus +Fixes: 83e416f458d53 ("staging: iio: adc: Replace, rewrite ad7745 from scratch.") +Signed-off-by: Jonathan Cameron +Cc: +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/iio/cdc/ad7746.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/staging/iio/cdc/ad7746.c ++++ b/drivers/staging/iio/cdc/ad7746.c +@@ -703,7 +703,6 @@ static int ad7746_probe(struct i2c_clien + indio_dev->num_channels = ARRAY_SIZE(ad7746_channels); + else + indio_dev->num_channels = ARRAY_SIZE(ad7746_channels) - 2; +- indio_dev->num_channels = ARRAY_SIZE(ad7746_channels); + indio_dev->modes = INDIO_DIRECT_MODE; + + if (pdata) { diff --git a/queue-4.14/thunderbolt-dma_port-fix-nvm-read-buffer-bounds-and-offset-issue.patch b/queue-4.14/thunderbolt-dma_port-fix-nvm-read-buffer-bounds-and-offset-issue.patch new file mode 100644 index 00000000000..8ae0247dc6e --- /dev/null +++ b/queue-4.14/thunderbolt-dma_port-fix-nvm-read-buffer-bounds-and-offset-issue.patch @@ -0,0 +1,63 @@ +From b106776080a1cf953a1b2fd50cb2a995db4732be Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Tue, 27 Apr 2021 15:48:29 +0300 +Subject: thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue + +From: Mathias Nyman + +commit b106776080a1cf953a1b2fd50cb2a995db4732be upstream. + +Up to 64 bytes of data can be read from NVM in one go. Read address +must be dword aligned. Data is read into a local buffer. + +If caller asks to read data starting at an unaligned address then full +dword is anyway read from NVM into a local buffer. Data is then copied +from the local buffer starting at the unaligned offset to the caller +buffer. + +In cases where asked data length + unaligned offset is over 64 bytes +we need to make sure we don't read past the 64 bytes in the local +buffer when copying to caller buffer, and make sure that we don't +skip copying unaligned offset bytes from local buffer anymore after +the first round of 64 byte NVM data read. + +Fixes: 3e13676862f9 ("thunderbolt: Add support for DMA configuration based mailbox") +Cc: stable@vger.kernel.org +Signed-off-by: Mathias Nyman +Signed-off-by: Mika Westerberg +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thunderbolt/dma_port.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/thunderbolt/dma_port.c ++++ b/drivers/thunderbolt/dma_port.c +@@ -369,15 +369,15 @@ int dma_port_flash_read(struct tb_dma_po + void *buf, size_t size) + { + unsigned int retries = DMA_PORT_RETRIES; +- unsigned int offset; +- +- offset = address & 3; +- address = address & ~3; + + do { +- u32 nbytes = min_t(u32, size, MAIL_DATA_DWORDS * 4); ++ unsigned int offset; ++ size_t nbytes; + int ret; + ++ offset = address & 3; ++ nbytes = min_t(size_t, size + offset, MAIL_DATA_DWORDS * 4); ++ + ret = dma_port_flash_read_block(dma, address, dma->buf, + ALIGN(nbytes, 4)); + if (ret) { +@@ -389,6 +389,7 @@ int dma_port_flash_read(struct tb_dma_po + return ret; + } + ++ nbytes -= offset; + memcpy(buf, dma->buf + offset, nbytes); + + size -= nbytes; diff --git a/queue-4.14/usb-trancevibrator-fix-control-request-direction.patch b/queue-4.14/usb-trancevibrator-fix-control-request-direction.patch new file mode 100644 index 00000000000..1453e7429dc --- /dev/null +++ b/queue-4.14/usb-trancevibrator-fix-control-request-direction.patch @@ -0,0 +1,39 @@ +From 746e4acf87bcacf1406e05ef24a0b7139147c63e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 21 May 2021 15:31:09 +0200 +Subject: USB: trancevibrator: fix control-request direction + +From: Johan Hovold + +commit 746e4acf87bcacf1406e05ef24a0b7139147c63e upstream. + +The direction of the pipe argument must match the request-type direction +bit or control requests may fail depending on the host-controller-driver +implementation. + +Fix the set-speed request which erroneously used USB_DIR_IN and update +the default timeout argument to match (same value). + +Fixes: 5638e4d92e77 ("USB: add PlayStation 2 Trance Vibrator driver") +Cc: stable@vger.kernel.org # 2.6.19 +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210521133109.17396-1-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/misc/trancevibrator.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/misc/trancevibrator.c ++++ b/drivers/usb/misc/trancevibrator.c +@@ -72,9 +72,9 @@ static ssize_t set_speed(struct device * + /* Set speed */ + retval = usb_control_msg(tv->udev, usb_sndctrlpipe(tv->udev, 0), + 0x01, /* vendor request: set speed */ +- USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_OTHER, ++ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER, + tv->speed, /* speed value */ +- 0, NULL, 0, USB_CTRL_GET_TIMEOUT); ++ 0, NULL, 0, USB_CTRL_SET_TIMEOUT); + if (retval) { + tv->speed = old; + dev_dbg(&tv->udev->dev, "retval = %d\n", retval);