From: Greg Kroah-Hartman Date: Mon, 21 Sep 2020 12:00:43 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v4.4.237~31 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=815a178abdb0e4e851033dc25e81130b2561a5e4;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: alsa-hda-fixup-headset-for-asus-gx502-laptop.patch alsa-hda-realtek-the-mic-on-a-redmibook-doesn-t-work.patch drm-i915-filter-wake_flags-passed-to-default_wake_function.patch i2c-i801-fix-resume-bug.patch revert-alsa-hda-fix-silent-audio-output-and-corrupted.patch usb-quirks-add-usb_quirk_ignore_remote_wakeup-quirk-for-byd-zhaoxin-notebook.patch usb-typec-ucsi-prevent-mode-overrun.patch usb-uas-fix-disconnect-by-unplugging-a-hub.patch usblp-fix-race-between-disconnect-and-read.patch --- diff --git a/queue-5.4/alsa-hda-fixup-headset-for-asus-gx502-laptop.patch b/queue-5.4/alsa-hda-fixup-headset-for-asus-gx502-laptop.patch new file mode 100644 index 00000000000..348aa781170 --- /dev/null +++ b/queue-5.4/alsa-hda-fixup-headset-for-asus-gx502-laptop.patch @@ -0,0 +1,120 @@ +From c3cdf189276c2a63da62ee250615bd55e3fb680d Mon Sep 17 00:00:00 2001 +From: Luke D Jones +Date: Mon, 7 Sep 2020 20:19:59 +1200 +Subject: ALSA: hda: fixup headset for ASUS GX502 laptop + +From: Luke D Jones + +commit c3cdf189276c2a63da62ee250615bd55e3fb680d upstream. + +The GX502 requires a few steps to enable the headset i/o: pincfg, +verbs to enable and unmute the amp used for headpone out, and +a jacksense callback to toggle output via internal or jack using +a verb. + +Signed-off-by: Luke D Jones +Cc: +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208005 +Link: https://lore.kernel.org/r/20200907081959.56186-1-luke@ljones.dev +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 65 ++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 65 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5974,6 +5974,40 @@ static void alc_fixup_disable_mic_vref(s + snd_hda_codec_set_pin_target(codec, 0x19, PIN_VREFHIZ); + } + ++ ++static void alc294_gx502_toggle_output(struct hda_codec *codec, ++ struct hda_jack_callback *cb) ++{ ++ /* The Windows driver sets the codec up in a very different way where ++ * it appears to leave 0x10 = 0x8a20 set. For Linux we need to toggle it ++ */ ++ if (snd_hda_jack_detect_state(codec, 0x21) == HDA_JACK_PRESENT) ++ alc_write_coef_idx(codec, 0x10, 0x8a20); ++ else ++ alc_write_coef_idx(codec, 0x10, 0x0a20); ++} ++ ++static void alc294_fixup_gx502_hp(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ /* Pin 0x21: headphones/headset mic */ ++ if (!is_jack_detectable(codec, 0x21)) ++ return; ++ ++ switch (action) { ++ case HDA_FIXUP_ACT_PRE_PROBE: ++ snd_hda_jack_detect_enable_callback(codec, 0x21, ++ alc294_gx502_toggle_output); ++ break; ++ case HDA_FIXUP_ACT_INIT: ++ /* Make sure to start in a correct state, i.e. if ++ * headphones have been plugged in before powering up the system ++ */ ++ alc294_gx502_toggle_output(codec, NULL); ++ break; ++ } ++} ++ + static void alc285_fixup_hp_gpio_amp_init(struct hda_codec *codec, + const struct hda_fixup *fix, int action) + { +@@ -6154,6 +6188,9 @@ enum { + ALC285_FIXUP_THINKPAD_HEADSET_JACK, + ALC294_FIXUP_ASUS_HPE, + ALC294_FIXUP_ASUS_COEF_1B, ++ ALC294_FIXUP_ASUS_GX502_HP, ++ ALC294_FIXUP_ASUS_GX502_PINS, ++ ALC294_FIXUP_ASUS_GX502_VERBS, + ALC285_FIXUP_HP_GPIO_LED, + ALC285_FIXUP_HP_MUTE_LED, + ALC236_FIXUP_HP_MUTE_LED, +@@ -7319,6 +7356,33 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC + }, ++ [ALC294_FIXUP_ASUS_GX502_PINS] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x03a11050 }, /* front HP mic */ ++ { 0x1a, 0x01a11830 }, /* rear external mic */ ++ { 0x21, 0x03211020 }, /* front HP out */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC294_FIXUP_ASUS_GX502_VERBS ++ }, ++ [ALC294_FIXUP_ASUS_GX502_VERBS] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ /* set 0x15 to HP-OUT ctrl */ ++ { 0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, 0xc0 }, ++ /* unmute the 0x15 amp */ ++ { 0x15, AC_VERB_SET_AMP_GAIN_MUTE, 0xb000 }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC294_FIXUP_ASUS_GX502_HP ++ }, ++ [ALC294_FIXUP_ASUS_GX502_HP] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc294_fixup_gx502_hp, ++ }, + [ALC294_FIXUP_ASUS_COEF_1B] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +@@ -7692,6 +7756,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502), + SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401), ++ SND_PCI_QUIRK(0x1043, 0x1881, "ASUS Zephyrus S/M", ALC294_FIXUP_ASUS_GX502_PINS), + SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), + SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x834a, "ASUS S101", ALC269_FIXUP_STEREO_DMIC), diff --git a/queue-5.4/alsa-hda-realtek-the-mic-on-a-redmibook-doesn-t-work.patch b/queue-5.4/alsa-hda-realtek-the-mic-on-a-redmibook-doesn-t-work.patch new file mode 100644 index 00000000000..2131a145173 --- /dev/null +++ b/queue-5.4/alsa-hda-realtek-the-mic-on-a-redmibook-doesn-t-work.patch @@ -0,0 +1,71 @@ +From fc19d559b0d31b5b831fd468b10d7dadafc0d0ec Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Wed, 9 Sep 2020 10:00:41 +0800 +Subject: ALSA: hda/realtek - The Mic on a RedmiBook doesn't work + +From: Hui Wang + +commit fc19d559b0d31b5b831fd468b10d7dadafc0d0ec upstream. + +The Mic connects to the Nid 0x19, but the configuration of Nid 0x19 +is not defined to Mic, and also need to set the coeff to enable the +auto detection on the Nid 0x19. After this change, the Mic plugging +in or plugging out could be detected and could record the sound from +the Mic. + +And the coeff value is suggested by Kailang of Realtek. + +Cc: Kailang Yang +Cc: +Signed-off-by: Hui Wang +Link: https://lore.kernel.org/r/20200909020041.8967-1-hui.wang@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6209,6 +6209,7 @@ enum { + ALC269_FIXUP_LEMOTE_A1802, + ALC269_FIXUP_LEMOTE_A190X, + ALC256_FIXUP_INTEL_NUC8_RUGGED, ++ ALC255_FIXUP_XIAOMI_HEADSET_MIC, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -7572,6 +7573,16 @@ static const struct hda_fixup alc269_fix + .chained = true, + .chain_id = ALC269_FIXUP_HEADSET_MODE + }, ++ [ALC255_FIXUP_XIAOMI_HEADSET_MIC] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x45 }, ++ { 0x20, AC_VERB_SET_PROC_COEF, 0x5089 }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC289_FIXUP_ASUS_GA401 ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -7869,6 +7880,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1b35, 0x1236, "CZC TMI", ALC269_FIXUP_CZC_TMI), + SND_PCI_QUIRK(0x1b35, 0x1237, "CZC L101", ALC269_FIXUP_CZC_L101), + SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */ ++ SND_PCI_QUIRK(0x1d72, 0x1602, "RedmiBook", ALC255_FIXUP_XIAOMI_HEADSET_MIC), + SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x10ec, 0x118c, "Medion EE4254 MD62100", ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE), + SND_PCI_QUIRK(0x1c06, 0x2013, "Lemote A1802", ALC269_FIXUP_LEMOTE_A1802), +@@ -8046,6 +8058,7 @@ static const struct hda_model_fixup alc2 + {.id = ALC298_FIXUP_HUAWEI_MBX_STEREO, .name = "huawei-mbx-stereo"}, + {.id = ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, .name = "alc256-medion-headset"}, + {.id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc298-samsung-headphone"}, ++ {.id = ALC255_FIXUP_XIAOMI_HEADSET_MIC, .name = "alc255-xiaomi-headset"}, + {} + }; + #define ALC225_STANDARD_PINS \ diff --git a/queue-5.4/drm-i915-filter-wake_flags-passed-to-default_wake_function.patch b/queue-5.4/drm-i915-filter-wake_flags-passed-to-default_wake_function.patch new file mode 100644 index 00000000000..40e3f5e34f8 --- /dev/null +++ b/queue-5.4/drm-i915-filter-wake_flags-passed-to-default_wake_function.patch @@ -0,0 +1,57 @@ +From 20612303a0b45de748d31331407e84300c38e497 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Tue, 28 Jul 2020 16:21:44 +0100 +Subject: drm/i915: Filter wake_flags passed to default_wake_function + +From: Chris Wilson + +commit 20612303a0b45de748d31331407e84300c38e497 upstream. + +(NOTE: This is the minimal backportable fix, a full fix is being +developed at https://patchwork.freedesktop.org/patch/388048/) + +The flags passed to the wait_entry.func are passed onwards to +try_to_wake_up(), which has a very particular interpretation for its +wake_flags. In particular, beyond the published WF_SYNC, it has a few +internal flags as well. Since we passed the fence->error down the chain +via the flags argument, these ended up in the default_wake_function +confusing the kernel/sched. + +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2110 +Fixes: ef4688497512 ("drm/i915: Propagate fence errors") +Signed-off-by: Chris Wilson +Cc: Matthew Auld +Cc: # v5.4+ +Reviewed-by: Matthew Auld +Link: https://patchwork.freedesktop.org/patch/msgid/20200728152144.1100-1-chris@chris-wilson.co.uk +Signed-off-by: Rodrigo Vivi +[Joonas: Rebased and reordered into drm-intel-gt-next branch] +[Joonas: Added a note and link about more complete fix] +Signed-off-by: Joonas Lahtinen +(cherry picked from commit f4b3c395540aa3d4f5a6275c5bdd83ab89034806) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_sw_fence.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_sw_fence.c ++++ b/drivers/gpu/drm/i915/i915_sw_fence.c +@@ -158,9 +158,13 @@ static void __i915_sw_fence_wake_up_all( + + do { + list_for_each_entry_safe(pos, next, &x->head, entry) { +- pos->func(pos, +- TASK_NORMAL, fence->error, +- &extra); ++ int wake_flags; ++ ++ wake_flags = fence->error; ++ if (pos->func == autoremove_wake_function) ++ wake_flags = 0; ++ ++ pos->func(pos, TASK_NORMAL, wake_flags, &extra); + } + + if (list_empty(&extra)) diff --git a/queue-5.4/i2c-i801-fix-resume-bug.patch b/queue-5.4/i2c-i801-fix-resume-bug.patch new file mode 100644 index 00000000000..60714aa0460 --- /dev/null +++ b/queue-5.4/i2c-i801-fix-resume-bug.patch @@ -0,0 +1,73 @@ +From 66d402e2e9455cf0213c42b97f22a0493372d7cc Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Volker=20R=C3=BCmelin?= +Date: Tue, 1 Sep 2020 15:22:21 +0200 +Subject: i2c: i801: Fix resume bug +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Volker Rümelin + +commit 66d402e2e9455cf0213c42b97f22a0493372d7cc upstream. + +On suspend the original host configuration gets restored. The +resume routine has to undo this, otherwise the SMBus master +may be left in disabled state or in i2c mode. + +[JD: Rebased on v5.8, moved the write into i801_setup_hstcfg.] + +Signed-off-by: Volker Rümelin +Signed-off-by: Jean Delvare +Signed-off-by: Wolfram Sang +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-i801.c | 21 ++++++++++++++------- + 1 file changed, 14 insertions(+), 7 deletions(-) + +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -1688,6 +1688,16 @@ static inline int i801_acpi_probe(struct + static inline void i801_acpi_remove(struct i801_priv *priv) { } + #endif + ++static unsigned char i801_setup_hstcfg(struct i801_priv *priv) ++{ ++ unsigned char hstcfg = priv->original_hstcfg; ++ ++ hstcfg &= ~SMBHSTCFG_I2C_EN; /* SMBus timing */ ++ hstcfg |= SMBHSTCFG_HST_EN; ++ pci_write_config_byte(priv->pci_dev, SMBHSTCFG, hstcfg); ++ return hstcfg; ++} ++ + static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id) + { + unsigned char temp; +@@ -1804,14 +1814,10 @@ static int i801_probe(struct pci_dev *de + return err; + } + +- pci_read_config_byte(priv->pci_dev, SMBHSTCFG, &temp); +- priv->original_hstcfg = temp; +- temp &= ~SMBHSTCFG_I2C_EN; /* SMBus timing */ +- if (!(temp & SMBHSTCFG_HST_EN)) { ++ pci_read_config_byte(priv->pci_dev, SMBHSTCFG, &priv->original_hstcfg); ++ temp = i801_setup_hstcfg(priv); ++ if (!(priv->original_hstcfg & SMBHSTCFG_HST_EN)) + dev_info(&dev->dev, "Enabling SMBus device\n"); +- temp |= SMBHSTCFG_HST_EN; +- } +- pci_write_config_byte(priv->pci_dev, SMBHSTCFG, temp); + + if (temp & SMBHSTCFG_SMB_SMI_EN) { + dev_dbg(&dev->dev, "SMBus using interrupt SMI#\n"); +@@ -1937,6 +1943,7 @@ static int i801_resume(struct device *de + { + struct i801_priv *priv = dev_get_drvdata(dev); + ++ i801_setup_hstcfg(priv); + i801_enable_host_notify(&priv->adapter); + + return 0; diff --git a/queue-5.4/revert-alsa-hda-fix-silent-audio-output-and-corrupted.patch b/queue-5.4/revert-alsa-hda-fix-silent-audio-output-and-corrupted.patch new file mode 100644 index 00000000000..4296b0a2f57 --- /dev/null +++ b/queue-5.4/revert-alsa-hda-fix-silent-audio-output-and-corrupted.patch @@ -0,0 +1,31 @@ +From 0342d2342b24547ff8ec3e12f9148a9fd681481f Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Mon, 21 Sep 2020 13:55:28 +0200 +Subject: Revert "ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO" + +From: Greg Kroah-Hartman + +This reverts commit 982505615063873a896efce767c996792c3db00c which is +commit 15cbff3fbbc631952c346744f862fb294504b5e2 upstream. + +It causes know regressions and will be reverted in Linus's tree soon. + +Reported-by: Hans de Goede +Cc: Dan Crawford +Cc: Takashi Iwai +Link: https://lore.kernel.org/r/7efd2fe5-bf38-7f85-891a-eee3845d1493@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2466,7 +2466,6 @@ static const struct snd_pci_quirk alc882 + SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1462, 0x1293, "MSI-GP65", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD), +- SND_PCI_QUIRK(0x1462, 0x9c37, "MSI X570-A PRO", ALC1220_FIXUP_CLEVO_P950), + SND_PCI_QUIRK(0x1462, 0xda57, "MSI Z270-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS), + SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3), + SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX), diff --git a/queue-5.4/series b/queue-5.4/series index 3fa39d6fd13..a9813759d93 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -48,3 +48,12 @@ arm64-bpf-fix-branch-offset-in-jit.patch iommu-amd-fix-potential-entry-null-deref.patch i2c-mxs-use-mxs_dma_ctrl_wait4end-instead-of-dma_ctr.patch riscv-add-sfence.vma-after-early-page-table-changes.patch +drm-i915-filter-wake_flags-passed-to-default_wake_function.patch +usb-quirks-add-usb_quirk_ignore_remote_wakeup-quirk-for-byd-zhaoxin-notebook.patch +usb-uas-fix-disconnect-by-unplugging-a-hub.patch +usblp-fix-race-between-disconnect-and-read.patch +usb-typec-ucsi-prevent-mode-overrun.patch +i2c-i801-fix-resume-bug.patch +revert-alsa-hda-fix-silent-audio-output-and-corrupted.patch +alsa-hda-fixup-headset-for-asus-gx502-laptop.patch +alsa-hda-realtek-the-mic-on-a-redmibook-doesn-t-work.patch diff --git a/queue-5.4/usb-quirks-add-usb_quirk_ignore_remote_wakeup-quirk-for-byd-zhaoxin-notebook.patch b/queue-5.4/usb-quirks-add-usb_quirk_ignore_remote_wakeup-quirk-for-byd-zhaoxin-notebook.patch new file mode 100644 index 00000000000..0ae32637aa6 --- /dev/null +++ b/queue-5.4/usb-quirks-add-usb_quirk_ignore_remote_wakeup-quirk-for-byd-zhaoxin-notebook.patch @@ -0,0 +1,35 @@ +From bcea6dafeeef7d1a6a8320a249aabf981d63b881 Mon Sep 17 00:00:00 2001 +From: Penghao +Date: Mon, 7 Sep 2020 10:30:26 +0800 +Subject: USB: quirks: Add USB_QUIRK_IGNORE_REMOTE_WAKEUP quirk for BYD zhaoxin notebook + +From: Penghao + +commit bcea6dafeeef7d1a6a8320a249aabf981d63b881 upstream. + +Add a USB_QUIRK_IGNORE_REMOTE_WAKEUP quirk for the BYD zhaoxin notebook. +This notebook come with usb touchpad. And we would like to disable +touchpad wakeup on this notebook by default. + +Signed-off-by: Penghao +Cc: stable +Link: https://lore.kernel.org/r/20200907023026.28189-1-penghao@uniontech.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -397,6 +397,10 @@ static const struct usb_device_id usb_qu + /* Generic RTL8153 based ethernet adapters */ + { USB_DEVICE(0x0bda, 0x8153), .driver_info = USB_QUIRK_NO_LPM }, + ++ /* SONiX USB DEVICE Touchpad */ ++ { USB_DEVICE(0x0c45, 0x7056), .driver_info = ++ USB_QUIRK_IGNORE_REMOTE_WAKEUP }, ++ + /* Action Semiconductor flash disk */ + { USB_DEVICE(0x10d6, 0x2200), .driver_info = + USB_QUIRK_STRING_FETCH_255 }, diff --git a/queue-5.4/usb-typec-ucsi-prevent-mode-overrun.patch b/queue-5.4/usb-typec-ucsi-prevent-mode-overrun.patch new file mode 100644 index 00000000000..1c0b050d664 --- /dev/null +++ b/queue-5.4/usb-typec-ucsi-prevent-mode-overrun.patch @@ -0,0 +1,84 @@ +From 386e15a650447f53de3d2d8819ce9393f31650a4 Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Wed, 16 Sep 2020 12:00:34 +0300 +Subject: usb: typec: ucsi: Prevent mode overrun + +From: Heikki Krogerus + +commit 386e15a650447f53de3d2d8819ce9393f31650a4 upstream. + +Sometimes the embedded controller firmware does not +terminate the list of alternate modes that the partner +supports in its response to the GET_ALTERNATE_MODES command. +Instead the firmware returns the supported alternate modes +over and over again until the driver stops requesting them. + +If that happens, the number of modes for each alternate mode +will exceed the maximum 6 that is defined in the USB Power +Delivery specification. Making sure that can't happen by +adding a check for it. + +This fixes NULL pointer dereference that is caused by the +overrun. + +Fixes: ad74b8649beaf ("usb: typec: ucsi: Preliminary support for alternate modes") +Cc: stable@vger.kernel.org +Reported-by: Zwane Mwaikambo +Signed-off-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20200916090034.25119-3-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi.c | 22 ++++++++++++++++------ + 1 file changed, 16 insertions(+), 6 deletions(-) + +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -246,14 +246,18 @@ void ucsi_altmode_update_active(struct u + con->partner_altmode[i] == altmode); + } + +-static u8 ucsi_altmode_next_mode(struct typec_altmode **alt, u16 svid) ++static int ucsi_altmode_next_mode(struct typec_altmode **alt, u16 svid) + { + u8 mode = 1; + int i; + +- for (i = 0; alt[i]; i++) ++ for (i = 0; alt[i]; i++) { ++ if (i > MODE_DISCOVERY_MAX) ++ return -ERANGE; ++ + if (alt[i]->svid == svid) + mode++; ++ } + + return mode; + } +@@ -288,8 +292,11 @@ static int ucsi_register_altmode(struct + goto err; + } + +- desc->mode = ucsi_altmode_next_mode(con->port_altmode, +- desc->svid); ++ ret = ucsi_altmode_next_mode(con->port_altmode, desc->svid); ++ if (ret < 0) ++ return ret; ++ ++ desc->mode = ret; + + switch (desc->svid) { + case USB_TYPEC_DP_SID: +@@ -315,8 +322,11 @@ static int ucsi_register_altmode(struct + goto err; + } + +- desc->mode = ucsi_altmode_next_mode(con->partner_altmode, +- desc->svid); ++ ret = ucsi_altmode_next_mode(con->partner_altmode, desc->svid); ++ if (ret < 0) ++ return ret; ++ ++ desc->mode = ret; + + alt = typec_partner_register_altmode(con->partner, desc); + if (IS_ERR(alt)) { diff --git a/queue-5.4/usb-uas-fix-disconnect-by-unplugging-a-hub.patch b/queue-5.4/usb-uas-fix-disconnect-by-unplugging-a-hub.patch new file mode 100644 index 00000000000..ef17c782fb9 --- /dev/null +++ b/queue-5.4/usb-uas-fix-disconnect-by-unplugging-a-hub.patch @@ -0,0 +1,63 @@ +From 325b008723b2dd31de020e85ab9d2e9aa4637d35 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 16 Sep 2020 11:40:25 +0200 +Subject: USB: UAS: fix disconnect by unplugging a hub + +From: Oliver Neukum + +commit 325b008723b2dd31de020e85ab9d2e9aa4637d35 upstream. + +The SCSI layer can go into an ugly loop if you ignore that a device is +gone. You need to report an error in the command rather than in the +return value of the queue method. + +We need to specifically check for ENODEV. The issue goes back to the +introduction of the driver. + +Fixes: 115bb1ffa54c3 ("USB: Add UAS driver") +Signed-off-by: Oliver Neukum +Cc: stable +Link: https://lore.kernel.org/r/20200916094026.30085-2-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/uas.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -662,8 +662,7 @@ static int uas_queuecommand_lck(struct s + if (devinfo->resetting) { + cmnd->result = DID_ERROR << 16; + cmnd->scsi_done(cmnd); +- spin_unlock_irqrestore(&devinfo->lock, flags); +- return 0; ++ goto zombie; + } + + /* Find a free uas-tag */ +@@ -699,6 +698,16 @@ static int uas_queuecommand_lck(struct s + cmdinfo->state &= ~(SUBMIT_DATA_IN_URB | SUBMIT_DATA_OUT_URB); + + err = uas_submit_urbs(cmnd, devinfo); ++ /* ++ * in case of fatal errors the SCSI layer is peculiar ++ * a command that has finished is a success for the purpose ++ * of queueing, no matter how fatal the error ++ */ ++ if (err == -ENODEV) { ++ cmnd->result = DID_ERROR << 16; ++ cmnd->scsi_done(cmnd); ++ goto zombie; ++ } + if (err) { + /* If we did nothing, give up now */ + if (cmdinfo->state & SUBMIT_STATUS_URB) { +@@ -709,6 +718,7 @@ static int uas_queuecommand_lck(struct s + } + + devinfo->cmnd[idx] = cmnd; ++zombie: + spin_unlock_irqrestore(&devinfo->lock, flags); + return 0; + } diff --git a/queue-5.4/usblp-fix-race-between-disconnect-and-read.patch b/queue-5.4/usblp-fix-race-between-disconnect-and-read.patch new file mode 100644 index 00000000000..a537249bd14 --- /dev/null +++ b/queue-5.4/usblp-fix-race-between-disconnect-and-read.patch @@ -0,0 +1,36 @@ +From 9cdabcb3ef8c24ca3a456e4db7b012befb688e73 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 17 Sep 2020 12:34:27 +0200 +Subject: usblp: fix race between disconnect() and read() + +From: Oliver Neukum + +commit 9cdabcb3ef8c24ca3a456e4db7b012befb688e73 upstream. + +read() needs to check whether the device has been +disconnected before it tries to talk to the device. + +Signed-off-by: Oliver Neukum +Reported-by: syzbot+be5b5f86a162a6c281e6@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/20200917103427.15740-1-oneukum@suse.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/class/usblp.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/class/usblp.c ++++ b/drivers/usb/class/usblp.c +@@ -827,6 +827,11 @@ static ssize_t usblp_read(struct file *f + if (rv < 0) + return rv; + ++ if (!usblp->present) { ++ count = -ENODEV; ++ goto done; ++ } ++ + if ((avail = usblp->rstatus) < 0) { + printk(KERN_ERR "usblp%d: error %d reading from printer\n", + usblp->minor, (int)avail);