From: Greg Kroah-Hartman Date: Tue, 25 Feb 2020 20:47:27 +0000 (+0100) Subject: 4.14-stable patches X-Git-Tag: v4.4.215~90 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=de03e58def6b884ef23f926af768bb615b63c25a;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: thunderbolt-prevent-crash-if-non-active-nvmem-file-is-read.patch usb-misc-iowarrior-add-support-for-2-oemed-devices.patch usb-misc-iowarrior-add-support-for-the-100-device.patch usb-misc-iowarrior-add-support-for-the-28-and-28l-devices.patch --- diff --git a/queue-4.14/series b/queue-4.14/series index 46ecaf63c9e..4bf4199942a 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -168,3 +168,7 @@ net-dsa-tag_qca-make-sure-there-is-headroom-for-tag.patch net-sched-matchall-add-missing-validation-of-tca_matchall_flags.patch net-sched-flower-add-missing-validation-of-tca_flower_flags.patch net-smc-fix-leak-of-kernel-memory-to-user-space.patch +thunderbolt-prevent-crash-if-non-active-nvmem-file-is-read.patch +usb-misc-iowarrior-add-support-for-2-oemed-devices.patch +usb-misc-iowarrior-add-support-for-the-28-and-28l-devices.patch +usb-misc-iowarrior-add-support-for-the-100-device.patch diff --git a/queue-4.14/thunderbolt-prevent-crash-if-non-active-nvmem-file-is-read.patch b/queue-4.14/thunderbolt-prevent-crash-if-non-active-nvmem-file-is-read.patch new file mode 100644 index 00000000000..f6776074d68 --- /dev/null +++ b/queue-4.14/thunderbolt-prevent-crash-if-non-active-nvmem-file-is-read.patch @@ -0,0 +1,63 @@ +From 03cd45d2e219301880cabc357e3cf478a500080f Mon Sep 17 00:00:00 2001 +From: Mika Westerberg +Date: Thu, 13 Feb 2020 12:56:04 +0300 +Subject: thunderbolt: Prevent crash if non-active NVMem file is read + +From: Mika Westerberg + +commit 03cd45d2e219301880cabc357e3cf478a500080f upstream. + +The driver does not populate .reg_read callback for the non-active NVMem +because the file is supposed to be write-only. However, it turns out +NVMem subsystem does not yet support this and expects that the .reg_read +callback is provided. If user reads the binary attribute it triggers +NULL pointer dereference like this one: + + BUG: kernel NULL pointer dereference, address: 0000000000000000 + ... + Call Trace: + bin_attr_nvmem_read+0x64/0x80 + kernfs_fop_read+0xa7/0x180 + vfs_read+0xbd/0x170 + ksys_read+0x5a/0xd0 + do_syscall_64+0x43/0x150 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fix this in the driver by providing .reg_read callback that always +returns an error. + +Reported-by: Nicholas Johnson +Fixes: e6b245ccd524 ("thunderbolt: Add support for host and device NVM firmware upgrade") +Signed-off-by: Mika Westerberg +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20200213095604.1074-1-mika.westerberg@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/thunderbolt/switch.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/thunderbolt/switch.c ++++ b/drivers/thunderbolt/switch.c +@@ -240,6 +240,12 @@ static int tb_switch_nvm_read(void *priv + return dma_port_flash_read(sw->dma_port, offset, val, bytes); + } + ++static int tb_switch_nvm_no_read(void *priv, unsigned int offset, void *val, ++ size_t bytes) ++{ ++ return -EPERM; ++} ++ + static int tb_switch_nvm_write(void *priv, unsigned int offset, void *val, + size_t bytes) + { +@@ -285,6 +291,7 @@ static struct nvmem_device *register_nvm + config.read_only = true; + } else { + config.name = "nvm_non_active"; ++ config.reg_read = tb_switch_nvm_no_read; + config.reg_write = tb_switch_nvm_write; + config.root_only = true; + } diff --git a/queue-4.14/usb-misc-iowarrior-add-support-for-2-oemed-devices.patch b/queue-4.14/usb-misc-iowarrior-add-support-for-2-oemed-devices.patch new file mode 100644 index 00000000000..31b37f6b29a --- /dev/null +++ b/queue-4.14/usb-misc-iowarrior-add-support-for-2-oemed-devices.patch @@ -0,0 +1,87 @@ +From 461d8deb26a7d70254bc0391feb4fd8a95e674e8 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Tue, 11 Feb 2020 20:04:21 -0800 +Subject: USB: misc: iowarrior: add support for 2 OEMed devices + +From: Greg Kroah-Hartman + +commit 461d8deb26a7d70254bc0391feb4fd8a95e674e8 upstream. + +Add support for two OEM devices that are identical to existing +IO-Warrior devices, except for the USB device id. + +Cc: Christoph Jung +Cc: stable +Link: https://lore.kernel.org/r/20200212040422.2991-1-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/iowarrior.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +--- a/drivers/usb/misc/iowarrior.c ++++ b/drivers/usb/misc/iowarrior.c +@@ -33,6 +33,10 @@ + /* full speed iowarrior */ + #define USB_DEVICE_ID_CODEMERCS_IOW56 0x1503 + ++/* OEMed devices */ ++#define USB_DEVICE_ID_CODEMERCS_IOW24SAG 0x158a ++#define USB_DEVICE_ID_CODEMERCS_IOW56AM 0x158b ++ + /* Get a minor range for your devices from the usb maintainer */ + #ifdef CONFIG_USB_DYNAMIC_MINORS + #define IOWARRIOR_MINOR_BASE 0 +@@ -137,6 +141,8 @@ static const struct usb_device_id iowarr + {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOWPV1)}, + {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOWPV2)}, + {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW56)}, ++ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW24SAG)}, ++ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW56AM)}, + {} /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, iowarrior_ids); +@@ -364,6 +370,7 @@ static ssize_t iowarrior_write(struct fi + } + switch (dev->product_id) { + case USB_DEVICE_ID_CODEMERCS_IOW24: ++ case USB_DEVICE_ID_CODEMERCS_IOW24SAG: + case USB_DEVICE_ID_CODEMERCS_IOWPV1: + case USB_DEVICE_ID_CODEMERCS_IOWPV2: + case USB_DEVICE_ID_CODEMERCS_IOW40: +@@ -378,6 +385,7 @@ static ssize_t iowarrior_write(struct fi + goto exit; + break; + case USB_DEVICE_ID_CODEMERCS_IOW56: ++ case USB_DEVICE_ID_CODEMERCS_IOW56AM: + /* The IOW56 uses asynchronous IO and more urbs */ + if (atomic_read(&dev->write_busy) == MAX_WRITES_IN_FLIGHT) { + /* Wait until we are below the limit for submitted urbs */ +@@ -502,6 +510,7 @@ static long iowarrior_ioctl(struct file + switch (cmd) { + case IOW_WRITE: + if (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW24 || ++ dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW24SAG || + dev->product_id == USB_DEVICE_ID_CODEMERCS_IOWPV1 || + dev->product_id == USB_DEVICE_ID_CODEMERCS_IOWPV2 || + dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW40) { +@@ -786,7 +795,8 @@ static int iowarrior_probe(struct usb_in + goto error; + } + +- if (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) { ++ if ((dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) || ++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM)) { + res = usb_find_last_int_out_endpoint(iface_desc, + &dev->int_out_endpoint); + if (res) { +@@ -799,7 +809,8 @@ static int iowarrior_probe(struct usb_in + /* we have to check the report_size often, so remember it in the endianness suitable for our machine */ + dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint); + if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) && +- (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56)) ++ ((dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) || ++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM))) + /* IOWarrior56 has wMaxPacketSize different from report size */ + dev->report_size = 7; + diff --git a/queue-4.14/usb-misc-iowarrior-add-support-for-the-100-device.patch b/queue-4.14/usb-misc-iowarrior-add-support-for-the-100-device.patch new file mode 100644 index 00000000000..2371c4f8d54 --- /dev/null +++ b/queue-4.14/usb-misc-iowarrior-add-support-for-the-100-device.patch @@ -0,0 +1,67 @@ +From bab5417f5f0118ce914bc5b2f8381e959e891155 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Fri, 14 Feb 2020 08:11:48 -0800 +Subject: USB: misc: iowarrior: add support for the 100 device + +From: Greg Kroah-Hartman + +commit bab5417f5f0118ce914bc5b2f8381e959e891155 upstream. + +Add a new device id for the 100 devie. It has 4 interfaces like the 28 +and 28L devices but a larger endpoint so more I/O pins. + +Cc: Christoph Jung +Cc: stable +Link: https://lore.kernel.org/r/20200214161148.GA3963518@kroah.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/iowarrior.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/usb/misc/iowarrior.c ++++ b/drivers/usb/misc/iowarrior.c +@@ -35,6 +35,7 @@ + /* fuller speed iowarrior */ + #define USB_DEVICE_ID_CODEMERCS_IOW28 0x1504 + #define USB_DEVICE_ID_CODEMERCS_IOW28L 0x1505 ++#define USB_DEVICE_ID_CODEMERCS_IOW100 0x1506 + + /* OEMed devices */ + #define USB_DEVICE_ID_CODEMERCS_IOW24SAG 0x158a +@@ -148,6 +149,7 @@ static const struct usb_device_id iowarr + {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW56AM)}, + {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW28)}, + {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW28L)}, ++ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW100)}, + {} /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, iowarrior_ids); +@@ -393,6 +395,7 @@ static ssize_t iowarrior_write(struct fi + case USB_DEVICE_ID_CODEMERCS_IOW56AM: + case USB_DEVICE_ID_CODEMERCS_IOW28: + case USB_DEVICE_ID_CODEMERCS_IOW28L: ++ case USB_DEVICE_ID_CODEMERCS_IOW100: + /* The IOW56 uses asynchronous IO and more urbs */ + if (atomic_read(&dev->write_busy) == MAX_WRITES_IN_FLIGHT) { + /* Wait until we are below the limit for submitted urbs */ +@@ -805,7 +808,8 @@ static int iowarrior_probe(struct usb_in + if ((dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) || + (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM) || + (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28) || +- (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28L)) { ++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28L) || ++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW100)) { + res = usb_find_last_int_out_endpoint(iface_desc, + &dev->int_out_endpoint); + if (res) { +@@ -821,7 +825,8 @@ static int iowarrior_probe(struct usb_in + ((dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) || + (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM) || + (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28) || +- (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28L))) ++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28L) || ++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW100))) + /* IOWarrior56 has wMaxPacketSize different from report size */ + dev->report_size = 7; + diff --git a/queue-4.14/usb-misc-iowarrior-add-support-for-the-28-and-28l-devices.patch b/queue-4.14/usb-misc-iowarrior-add-support-for-the-28-and-28l-devices.patch new file mode 100644 index 00000000000..2300debf46b --- /dev/null +++ b/queue-4.14/usb-misc-iowarrior-add-support-for-the-28-and-28l-devices.patch @@ -0,0 +1,74 @@ +From 5f6f8da2d7b5a431d3f391d0d73ace8edfb42af7 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Tue, 11 Feb 2020 20:04:22 -0800 +Subject: USB: misc: iowarrior: add support for the 28 and 28L devices + +From: Greg Kroah-Hartman + +commit 5f6f8da2d7b5a431d3f391d0d73ace8edfb42af7 upstream. + +Add new device ids for the 28 and 28L devices. These have 4 interfaces +instead of 2, but the driver binds the same, so the driver changes are +minimal. + +Cc: Christoph Jung +Cc: stable +Link: https://lore.kernel.org/r/20200212040422.2991-2-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/iowarrior.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +--- a/drivers/usb/misc/iowarrior.c ++++ b/drivers/usb/misc/iowarrior.c +@@ -32,6 +32,9 @@ + #define USB_DEVICE_ID_CODEMERCS_IOWPV2 0x1512 + /* full speed iowarrior */ + #define USB_DEVICE_ID_CODEMERCS_IOW56 0x1503 ++/* fuller speed iowarrior */ ++#define USB_DEVICE_ID_CODEMERCS_IOW28 0x1504 ++#define USB_DEVICE_ID_CODEMERCS_IOW28L 0x1505 + + /* OEMed devices */ + #define USB_DEVICE_ID_CODEMERCS_IOW24SAG 0x158a +@@ -143,6 +146,8 @@ static const struct usb_device_id iowarr + {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW56)}, + {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW24SAG)}, + {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW56AM)}, ++ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW28)}, ++ {USB_DEVICE(USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW28L)}, + {} /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, iowarrior_ids); +@@ -386,6 +391,8 @@ static ssize_t iowarrior_write(struct fi + break; + case USB_DEVICE_ID_CODEMERCS_IOW56: + case USB_DEVICE_ID_CODEMERCS_IOW56AM: ++ case USB_DEVICE_ID_CODEMERCS_IOW28: ++ case USB_DEVICE_ID_CODEMERCS_IOW28L: + /* The IOW56 uses asynchronous IO and more urbs */ + if (atomic_read(&dev->write_busy) == MAX_WRITES_IN_FLIGHT) { + /* Wait until we are below the limit for submitted urbs */ +@@ -796,7 +803,9 @@ static int iowarrior_probe(struct usb_in + } + + if ((dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) || +- (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM)) { ++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM) || ++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28) || ++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28L)) { + res = usb_find_last_int_out_endpoint(iface_desc, + &dev->int_out_endpoint); + if (res) { +@@ -810,7 +819,9 @@ static int iowarrior_probe(struct usb_in + dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint); + if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) && + ((dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) || +- (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM))) ++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM) || ++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28) || ++ (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28L))) + /* IOWarrior56 has wMaxPacketSize different from report size */ + dev->report_size = 7; +