From: Greg Kroah-Hartman Date: Sun, 27 Jun 2021 14:26:33 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v5.12.14~17 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=92d020f89d995f1cd0be09e064ad86f0488a87d9;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: i2c-robotfuzz-osif-fix-control-request-directions.patch --- diff --git a/queue-4.19/i2c-robotfuzz-osif-fix-control-request-directions.patch b/queue-4.19/i2c-robotfuzz-osif-fix-control-request-directions.patch new file mode 100644 index 00000000000..17201ba7ac6 --- /dev/null +++ b/queue-4.19/i2c-robotfuzz-osif-fix-control-request-directions.patch @@ -0,0 +1,50 @@ +From 4ca070ef0dd885616ef294d269a9bf8e3b258e1a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 24 May 2021 11:09:12 +0200 +Subject: i2c: robotfuzz-osif: fix control-request directions + +From: Johan Hovold + +commit 4ca070ef0dd885616ef294d269a9bf8e3b258e1a upstream. + +The direction of the pipe argument must match the request-type direction +bit or control requests may fail depending on the host-controller-driver +implementation. + +Control transfers without a data stage are treated as OUT requests by +the USB stack and should be using usb_sndctrlpipe(). Failing to do so +will now trigger a warning. + +Fix the OSIFI2C_SET_BIT_RATE and OSIFI2C_STOP requests which erroneously +used the osif_usb_read() helper and set the IN direction bit. + +Reported-by: syzbot+9d7dadd15b8819d73f41@syzkaller.appspotmail.com +Fixes: 83e53a8f120f ("i2c: Add bus driver for for OSIF USB i2c device.") +Cc: stable@vger.kernel.org # 3.14 +Signed-off-by: Johan Hovold +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-robotfuzz-osif.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/i2c/busses/i2c-robotfuzz-osif.c ++++ b/drivers/i2c/busses/i2c-robotfuzz-osif.c +@@ -86,7 +86,7 @@ static int osif_xfer(struct i2c_adapter + } + } + +- ret = osif_usb_read(adapter, OSIFI2C_STOP, 0, 0, NULL, 0); ++ ret = osif_usb_write(adapter, OSIFI2C_STOP, 0, 0, NULL, 0); + if (ret) { + dev_err(&adapter->dev, "failure sending STOP\n"); + return -EREMOTEIO; +@@ -156,7 +156,7 @@ static int osif_probe(struct usb_interfa + * Set bus frequency. The frequency is: + * 120,000,000 / ( 16 + 2 * div * 4^prescale). + * Using dev = 52, prescale = 0 give 100KHz */ +- ret = osif_usb_read(&priv->adapter, OSIFI2C_SET_BIT_RATE, 52, 0, ++ ret = osif_usb_write(&priv->adapter, OSIFI2C_SET_BIT_RATE, 52, 0, + NULL, 0); + if (ret) { + dev_err(&interface->dev, "failure sending bit rate"); diff --git a/queue-4.19/series b/queue-4.19/series index 35cdcba0f57..625dae2bc7b 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -105,3 +105,4 @@ pci-add-amd-rs690-quirk-to-enable-64-bit-dma.patch net-ll_temac-avoid-ndo_start_xmit-returning-netdev_t.patch pinctrl-stm32-fix-the-reported-number-of-gpio-lines-.patch nilfs2-fix-memory-leak-in-nilfs_sysfs_delete_device_.patch +i2c-robotfuzz-osif-fix-control-request-directions.patch