From: Greg Kroah-Hartman Date: Sun, 27 Jun 2021 14:25:51 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v5.12.14~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b1a71a5e67c3982dba91db76a5dbf95494aefe39;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: i2c-robotfuzz-osif-fix-control-request-directions.patch --- diff --git a/queue-4.4/i2c-robotfuzz-osif-fix-control-request-directions.patch b/queue-4.4/i2c-robotfuzz-osif-fix-control-request-directions.patch new file mode 100644 index 00000000000..9935fca9615 --- /dev/null +++ b/queue-4.4/i2c-robotfuzz-osif-fix-control-request-directions.patch @@ -0,0 +1,50 @@ +From 4ca070ef0dd885616ef294d269a9bf8e3b258e1a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 24 May 2021 11:09:12 +0200 +Subject: i2c: robotfuzz-osif: fix control-request directions + +From: Johan Hovold + +commit 4ca070ef0dd885616ef294d269a9bf8e3b258e1a upstream. + +The direction of the pipe argument must match the request-type direction +bit or control requests may fail depending on the host-controller-driver +implementation. + +Control transfers without a data stage are treated as OUT requests by +the USB stack and should be using usb_sndctrlpipe(). Failing to do so +will now trigger a warning. + +Fix the OSIFI2C_SET_BIT_RATE and OSIFI2C_STOP requests which erroneously +used the osif_usb_read() helper and set the IN direction bit. + +Reported-by: syzbot+9d7dadd15b8819d73f41@syzkaller.appspotmail.com +Fixes: 83e53a8f120f ("i2c: Add bus driver for for OSIF USB i2c device.") +Cc: stable@vger.kernel.org # 3.14 +Signed-off-by: Johan Hovold +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-robotfuzz-osif.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/i2c/busses/i2c-robotfuzz-osif.c ++++ b/drivers/i2c/busses/i2c-robotfuzz-osif.c +@@ -89,7 +89,7 @@ static int osif_xfer(struct i2c_adapter + } + } + +- ret = osif_usb_read(adapter, OSIFI2C_STOP, 0, 0, NULL, 0); ++ ret = osif_usb_write(adapter, OSIFI2C_STOP, 0, 0, NULL, 0); + if (ret) { + dev_err(&adapter->dev, "failure sending STOP\n"); + return -EREMOTEIO; +@@ -159,7 +159,7 @@ static int osif_probe(struct usb_interfa + * Set bus frequency. The frequency is: + * 120,000,000 / ( 16 + 2 * div * 4^prescale). + * Using dev = 52, prescale = 0 give 100KHz */ +- ret = osif_usb_read(&priv->adapter, OSIFI2C_SET_BIT_RATE, 52, 0, ++ ret = osif_usb_write(&priv->adapter, OSIFI2C_SET_BIT_RATE, 52, 0, + NULL, 0); + if (ret) { + dev_err(&interface->dev, "failure sending bit rate"); diff --git a/queue-4.4/series b/queue-4.4/series index 8475227714e..ee56d43d27a 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -53,3 +53,4 @@ sh_eth-avoid-memcpy-over-reading-of-eth_ss_stats.patch r8169-avoid-memcpy-over-reading-of-eth_ss_stats.patch net-ll_temac-avoid-ndo_start_xmit-returning-netdev_t.patch nilfs2-fix-memory-leak-in-nilfs_sysfs_delete_device_.patch +i2c-robotfuzz-osif-fix-control-request-directions.patch