From: Greg Kroah-Hartman Date: Mon, 8 Nov 2021 12:32:02 +0000 (+0100) Subject: 5.15-stable patches X-Git-Tag: v4.4.292~23 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=97cdf69382aa637cbbad97d249ccf0bbc5ebe646;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: revert-proc-wchan-use-printk-format-instead-of-lookup_symbol_name.patch usb-gadget-mark-usb_fsl_qe-broken-on-64-bit.patch usb-musb-balance-list-entry-in-musb_gadget_queue.patch usb-storage-add-compatibility-quirk-flags-for-iodd-2531-2541.patch --- diff --git a/queue-5.15/revert-proc-wchan-use-printk-format-instead-of-lookup_symbol_name.patch b/queue-5.15/revert-proc-wchan-use-printk-format-instead-of-lookup_symbol_name.patch new file mode 100644 index 00000000000..de0573c852f --- /dev/null +++ b/queue-5.15/revert-proc-wchan-use-printk-format-instead-of-lookup_symbol_name.patch @@ -0,0 +1,66 @@ +From 54354c6a9f7fd5572d2b9ec108117c4f376d4d23 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Wed, 29 Sep 2021 15:02:13 -0700 +Subject: Revert "proc/wchan: use printk format instead of lookup_symbol_name()" + +From: Kees Cook + +commit 54354c6a9f7fd5572d2b9ec108117c4f376d4d23 upstream. + +This reverts commit 152c432b128cb043fc107e8f211195fe94b2159c. + +When a kernel address couldn't be symbolized for /proc/$pid/wchan, it +would leak the raw value, a potential information exposure. This is a +regression compared to the safer pre-v5.12 behavior. + +Reported-by: kernel test robot +Reported-by: Vito Caputo +Reported-by: Jann Horn +Signed-off-by: Kees Cook +Signed-off-by: Peter Zijlstra (Intel) +Cc: stable@vger.kernel.org +Link: https://lkml.kernel.org/r/20211008111626.090829198@infradead.org +Signed-off-by: Greg Kroah-Hartman +--- + fs/proc/base.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -67,6 +67,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -386,17 +387,19 @@ static int proc_pid_wchan(struct seq_fil + struct pid *pid, struct task_struct *task) + { + unsigned long wchan; ++ char symname[KSYM_NAME_LEN]; + +- if (ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) +- wchan = get_wchan(task); +- else +- wchan = 0; +- +- if (wchan) +- seq_printf(m, "%ps", (void *) wchan); +- else +- seq_putc(m, '0'); ++ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) ++ goto print0; + ++ wchan = get_wchan(task); ++ if (wchan && !lookup_symbol_name(wchan, symname)) { ++ seq_puts(m, symname); ++ return 0; ++ } ++ ++print0: ++ seq_putc(m, '0'); + return 0; + } + #endif /* CONFIG_KALLSYMS */ diff --git a/queue-5.15/series b/queue-5.15/series index cedac7bfc5b..bbcb8e6a126 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -1,3 +1,7 @@ kvm-x86-avoid-warning-with-wbitwise-instead-of-logical.patch revert-x86-kvm-fix-vcpu-id-indexed-array-sizes.patch usb-ehci-handshake-cmd_run-instead-of-sts_halt.patch +usb-gadget-mark-usb_fsl_qe-broken-on-64-bit.patch +usb-musb-balance-list-entry-in-musb_gadget_queue.patch +usb-storage-add-compatibility-quirk-flags-for-iodd-2531-2541.patch +revert-proc-wchan-use-printk-format-instead-of-lookup_symbol_name.patch diff --git a/queue-5.15/usb-gadget-mark-usb_fsl_qe-broken-on-64-bit.patch b/queue-5.15/usb-gadget-mark-usb_fsl_qe-broken-on-64-bit.patch new file mode 100644 index 00000000000..504e571c801 --- /dev/null +++ b/queue-5.15/usb-gadget-mark-usb_fsl_qe-broken-on-64-bit.patch @@ -0,0 +1,50 @@ +From a0548b26901f082684ad1fb3ba397d2de3a1406a Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Wed, 27 Oct 2021 10:08:49 +0200 +Subject: usb: gadget: Mark USB_FSL_QE broken on 64-bit +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +commit a0548b26901f082684ad1fb3ba397d2de3a1406a upstream. + +On 64-bit: + + drivers/usb/gadget/udc/fsl_qe_udc.c: In function ‘qe_ep0_rx’: + drivers/usb/gadget/udc/fsl_qe_udc.c:842:13: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast] + 842 | vaddr = (u32)phys_to_virt(in_be32(&bd->buf)); + | ^ + In file included from drivers/usb/gadget/udc/fsl_qe_udc.c:41: + drivers/usb/gadget/udc/fsl_qe_udc.c:843:28: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast] + 843 | frame_set_data(pframe, (u8 *)vaddr); + | ^ + +The driver assumes physical and virtual addresses are 32-bit, hence it +cannot work on 64-bit platforms. + +Acked-by: Li Yang +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20211027080849.3276289-1-geert@linux-m68k.org +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig +index 8c614bb86c66..69394dc1cdfb 100644 +--- a/drivers/usb/gadget/udc/Kconfig ++++ b/drivers/usb/gadget/udc/Kconfig +@@ -330,6 +330,7 @@ config USB_AMD5536UDC + config USB_FSL_QE + tristate "Freescale QE/CPM USB Device Controller" + depends on FSL_SOC && (QUICC_ENGINE || CPM) ++ depends on !64BIT || BROKEN + help + Some of Freescale PowerPC processors have a Full Speed + QE/CPM2 USB controller, which support device mode with 4 +-- +2.33.1 + diff --git a/queue-5.15/usb-musb-balance-list-entry-in-musb_gadget_queue.patch b/queue-5.15/usb-musb-balance-list-entry-in-musb_gadget_queue.patch new file mode 100644 index 00000000000..7e959ab5db2 --- /dev/null +++ b/queue-5.15/usb-musb-balance-list-entry-in-musb_gadget_queue.patch @@ -0,0 +1,42 @@ +From 21b5fcdccb32ff09b6b63d4a83c037150665a83f Mon Sep 17 00:00:00 2001 +From: Viraj Shah +Date: Thu, 21 Oct 2021 11:36:44 +0200 +Subject: usb: musb: Balance list entry in musb_gadget_queue + +From: Viraj Shah + +commit 21b5fcdccb32ff09b6b63d4a83c037150665a83f upstream. + +musb_gadget_queue() adds the passed request to musb_ep::req_list. If the +endpoint is idle and it is the first request then it invokes +musb_queue_resume_work(). If the function returns an error then the +error is passed to the caller without any clean-up and the request +remains enqueued on the list. If the caller enqueues the request again +then the list corrupts. + +Remove the request from the list on error. + +Fixes: ea2f35c01d5ea ("usb: musb: Fix sleeping function called from invalid context for hdrc glue") +Cc: stable +Signed-off-by: Viraj Shah +Link: https://lore.kernel.org/r/20211021093644.4734-1-viraj.shah@linutronix.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/musb/musb_gadget.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/musb/musb_gadget.c ++++ b/drivers/usb/musb/musb_gadget.c +@@ -1247,9 +1247,11 @@ static int musb_gadget_queue(struct usb_ + status = musb_queue_resume_work(musb, + musb_ep_restart_resume_work, + request); +- if (status < 0) ++ if (status < 0) { + dev_err(musb->controller, "%s resume work: %i\n", + __func__, status); ++ list_del(&request->list); ++ } + } + + unlock: diff --git a/queue-5.15/usb-storage-add-compatibility-quirk-flags-for-iodd-2531-2541.patch b/queue-5.15/usb-storage-add-compatibility-quirk-flags-for-iodd-2531-2541.patch new file mode 100644 index 00000000000..4dee47aca4e --- /dev/null +++ b/queue-5.15/usb-storage-add-compatibility-quirk-flags-for-iodd-2531-2541.patch @@ -0,0 +1,43 @@ +From 05c8f1b67e67dcd786ae3fe44492bbc617b4bd12 Mon Sep 17 00:00:00 2001 +From: James Buren +Date: Wed, 13 Oct 2021 20:55:04 -0500 +Subject: usb-storage: Add compatibility quirk flags for iODD 2531/2541 + +From: James Buren + +commit 05c8f1b67e67dcd786ae3fe44492bbc617b4bd12 upstream. + +These drive enclosures have firmware bugs that make it impossible to mount +a new virtual ISO image after Linux ejects the old one if the device is +locked by Linux. Windows bypasses this problem by the fact that they do +not lock the device. Add a quirk to disable device locking for these +drive enclosures. + +Acked-by: Alan Stern +Signed-off-by: James Buren +Cc: stable +Link: https://lore.kernel.org/r/20211014015504.2695089-1-braewoods+lkml@braewoods.net +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/storage/unusual_devs.h | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -407,6 +407,16 @@ UNUSUAL_DEV( 0x04b8, 0x0602, 0x0110, 0x + USB_SC_SCSI, USB_PR_BULK, NULL, US_FL_SINGLE_LUN), + + /* ++ * Reported by James Buren ++ * Virtual ISOs cannot be remounted if ejected while the device is locked ++ * Disable locking to mimic Windows behavior that bypasses the issue ++ */ ++UNUSUAL_DEV( 0x04c5, 0x2028, 0x0001, 0x0001, ++ "iODD", ++ "2531/2541", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE), ++ ++/* + * Not sure who reported this originally but + * Pavel Machek reported that the extra US_FL_SINGLE_LUN + * flag be added */