From: Sasha Levin Date: Mon, 7 Nov 2022 04:04:24 +0000 (-0500) Subject: Fixes for 5.4 X-Git-Tag: v4.9.333~77 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e2d3c0cc6161c004c5bb49827b3bd74735ce8048;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/hid-saitek-add-madcatz-variant-of-mmo7-mouse-device-.patch b/queue-5.4/hid-saitek-add-madcatz-variant-of-mmo7-mouse-device-.patch new file mode 100644 index 00000000000..421a09d6f82 --- /dev/null +++ b/queue-5.4/hid-saitek-add-madcatz-variant-of-mmo7-mouse-device-.patch @@ -0,0 +1,61 @@ +From af0d317a47e92801e86e59018ff5567d5e5aff07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Oct 2022 19:51:23 +0100 +Subject: HID: saitek: add madcatz variant of MMO7 mouse device ID + +From: Samuel Bailey + +[ Upstream commit 79425b297f56bd481c6e97700a9a4e44c7bcfa35 ] + +The MadCatz variant of the MMO7 mouse has the ID 0738:1713 and the same +quirks as the Saitek variant. + +Signed-off-by: Samuel Bailey +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-quirks.c | 1 + + drivers/hid/hid-saitek.c | 2 ++ + 3 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index c587a77d493c..d6cd94cad571 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -818,6 +818,7 @@ + #define USB_DEVICE_ID_MADCATZ_BEATPAD 0x4540 + #define USB_DEVICE_ID_MADCATZ_RAT5 0x1705 + #define USB_DEVICE_ID_MADCATZ_RAT9 0x1709 ++#define USB_DEVICE_ID_MADCATZ_MMO7 0x1713 + + #define USB_VENDOR_ID_MCC 0x09db + #define USB_DEVICE_ID_MCC_PMD1024LS 0x0076 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 45eba224cdc7..89e236b71ddf 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -615,6 +615,7 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_MMO7) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT5) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_RAT9) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_MMO7) }, + #endif + #if IS_ENABLED(CONFIG_HID_SAMSUNG) + { HID_USB_DEVICE(USB_VENDOR_ID_SAMSUNG, USB_DEVICE_ID_SAMSUNG_IR_REMOTE) }, +diff --git a/drivers/hid/hid-saitek.c b/drivers/hid/hid-saitek.c +index c7bf14c01960..b84e975977c4 100644 +--- a/drivers/hid/hid-saitek.c ++++ b/drivers/hid/hid-saitek.c +@@ -187,6 +187,8 @@ static const struct hid_device_id saitek_devices[] = { + .driver_data = SAITEK_RELEASE_MODE_RAT7 }, + { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_MMO7), + .driver_data = SAITEK_RELEASE_MODE_MMO7 }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MADCATZ, USB_DEVICE_ID_MADCATZ_MMO7), ++ .driver_data = SAITEK_RELEASE_MODE_MMO7 }, + { } + }; + +-- +2.35.1 + diff --git a/queue-5.4/i2c-xiic-add-platform-module-alias.patch b/queue-5.4/i2c-xiic-add-platform-module-alias.patch new file mode 100644 index 00000000000..f0866d37681 --- /dev/null +++ b/queue-5.4/i2c-xiic-add-platform-module-alias.patch @@ -0,0 +1,38 @@ +From 3f2105dd454c649e165aeb769a2d91530b72048c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 16:03:37 +0200 +Subject: i2c: xiic: Add platform module alias +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martin Tůma + +[ Upstream commit b8caf0a0e04583fb71e21495bef84509182227ea ] + +The missing "platform" alias is required for the mgb4 v4l2 driver to load +the i2c controller driver when probing the HW. + +Signed-off-by: Martin Tůma +Acked-by: Michal Simek +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-xiic.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index a48bee59dcde..c92ea6990ec6 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -884,6 +884,7 @@ static struct platform_driver xiic_i2c_driver = { + + module_platform_driver(xiic_i2c_driver); + ++MODULE_ALIAS("platform:" DRIVER_NAME); + MODULE_AUTHOR("info@mocean-labs.com"); + MODULE_DESCRIPTION("Xilinx I2C bus driver"); + MODULE_LICENSE("GPL v2"); +-- +2.35.1 + diff --git a/queue-5.4/media-cros-ec-cec-limit-msg.len-to-cec_max_msg_size.patch b/queue-5.4/media-cros-ec-cec-limit-msg.len-to-cec_max_msg_size.patch new file mode 100644 index 00000000000..57f371cf032 --- /dev/null +++ b/queue-5.4/media-cros-ec-cec-limit-msg.len-to-cec_max_msg_size.patch @@ -0,0 +1,35 @@ +From 8a80314f7a563749fb13571038023169e6d5fd42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 09:06:19 +0200 +Subject: media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE + +From: Hans Verkuil + +[ Upstream commit 2dc73b48665411a08c4e5f0f823dea8510761603 ] + +I expect that the hardware will have limited this to 16, but just in +case it hasn't, check for this corner case. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/cros-ec-cec/cros-ec-cec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/cros-ec-cec/cros-ec-cec.c b/drivers/media/platform/cros-ec-cec/cros-ec-cec.c +index 31390ce2dbf2..ae274a7aa3a9 100644 +--- a/drivers/media/platform/cros-ec-cec/cros-ec-cec.c ++++ b/drivers/media/platform/cros-ec-cec/cros-ec-cec.c +@@ -45,6 +45,8 @@ static void handle_cec_message(struct cros_ec_cec *cros_ec_cec) + uint8_t *cec_message = cros_ec->event_data.data.cec_message; + unsigned int len = cros_ec->event_size; + ++ if (len > CEC_MAX_MSG_SIZE) ++ len = CEC_MAX_MSG_SIZE; + cros_ec_cec->rx_msg.len = len; + memcpy(cros_ec_cec->rx_msg.msg, cec_message, len); + +-- +2.35.1 + diff --git a/queue-5.4/media-dvb-frontends-drxk-initialize-err-to-0.patch b/queue-5.4/media-dvb-frontends-drxk-initialize-err-to-0.patch new file mode 100644 index 00000000000..939089f091e --- /dev/null +++ b/queue-5.4/media-dvb-frontends-drxk-initialize-err-to-0.patch @@ -0,0 +1,42 @@ +From 7f44c23a419fec20422e18259b2be71a274a2557 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Aug 2022 07:59:24 +0200 +Subject: media: dvb-frontends/drxk: initialize err to 0 + +From: Hans Verkuil + +[ Upstream commit 20694e96ca089ce6693c2348f8f628ee621e4e74 ] + +Fix a compiler warning: + +drivers/media/dvb-frontends/drxk_hard.c: In function 'drxk_read_ucblocks': +drivers/media/dvb-frontends/drxk_hard.c:6673:21: warning: 'err' may be used uninitialized [-Wmaybe-uninitialized] + 6673 | *ucblocks = (u32) err; + | ^~~~~~~~~ +drivers/media/dvb-frontends/drxk_hard.c:6663:13: note: 'err' was declared here + 6663 | u16 err; + | ^~~ + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-frontends/drxk_hard.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/dvb-frontends/drxk_hard.c b/drivers/media/dvb-frontends/drxk_hard.c +index 0a4875b391d9..2dccc9d0be12 100644 +--- a/drivers/media/dvb-frontends/drxk_hard.c ++++ b/drivers/media/dvb-frontends/drxk_hard.c +@@ -6684,7 +6684,7 @@ static int drxk_read_snr(struct dvb_frontend *fe, u16 *snr) + static int drxk_read_ucblocks(struct dvb_frontend *fe, u32 *ucblocks) + { + struct drxk_state *state = fe->demodulator_priv; +- u16 err; ++ u16 err = 0; + + dprintk(1, "\n"); + +-- +2.35.1 + diff --git a/queue-5.4/media-meson-vdec-fix-possible-refcount-leak-in-vdec_.patch b/queue-5.4/media-meson-vdec-fix-possible-refcount-leak-in-vdec_.patch new file mode 100644 index 00000000000..5eff6dbea88 --- /dev/null +++ b/queue-5.4/media-meson-vdec-fix-possible-refcount-leak-in-vdec_.patch @@ -0,0 +1,43 @@ +From 4661a7712926ae89e82d144e0e459182094bb2a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Sep 2022 09:46:30 +0200 +Subject: media: meson: vdec: fix possible refcount leak in vdec_probe() + +From: Hangyu Hua + +[ Upstream commit 7718999356234d9cc6a11b4641bb773928f1390f ] + +v4l2_device_unregister need to be called to put the refcount got by +v4l2_device_register when vdec_probe fails or vdec_remove is called. + +Signed-off-by: Hangyu Hua +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/meson/vdec/vdec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c +index 8dd1396909d7..a242bbe23ba2 100644 +--- a/drivers/staging/media/meson/vdec/vdec.c ++++ b/drivers/staging/media/meson/vdec/vdec.c +@@ -1074,6 +1074,7 @@ static int vdec_probe(struct platform_device *pdev) + + err_vdev_release: + video_device_release(vdev); ++ v4l2_device_unregister(&core->v4l2_dev); + return ret; + } + +@@ -1082,6 +1083,7 @@ static int vdec_remove(struct platform_device *pdev) + struct amvdec_core *core = platform_get_drvdata(pdev); + + video_unregister_device(core->vdev_dec); ++ v4l2_device_unregister(&core->v4l2_dev); + + return 0; + } +-- +2.35.1 + diff --git a/queue-5.4/media-s5p_cec-limit-msg.len-to-cec_max_msg_size.patch b/queue-5.4/media-s5p_cec-limit-msg.len-to-cec_max_msg_size.patch new file mode 100644 index 00000000000..6e76ec01cdb --- /dev/null +++ b/queue-5.4/media-s5p_cec-limit-msg.len-to-cec_max_msg_size.patch @@ -0,0 +1,35 @@ +From 417fd4944f1e1f3550a284f2d850e8b1ab62187f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 09:02:42 +0200 +Subject: media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE + +From: Hans Verkuil + +[ Upstream commit 93f65ce036863893c164ca410938e0968964b26c ] + +I expect that the hardware will have limited this to 16, but just in +case it hasn't, check for this corner case. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/s5p-cec/s5p_cec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/s5p-cec/s5p_cec.c b/drivers/media/platform/s5p-cec/s5p_cec.c +index 828792b854f5..0c668d4a3daa 100644 +--- a/drivers/media/platform/s5p-cec/s5p_cec.c ++++ b/drivers/media/platform/s5p-cec/s5p_cec.c +@@ -115,6 +115,8 @@ static irqreturn_t s5p_cec_irq_handler(int irq, void *priv) + dev_dbg(cec->dev, "Buffer overrun (worker did not process previous message)\n"); + cec->rx = STATE_BUSY; + cec->msg.len = status >> 24; ++ if (cec->msg.len > CEC_MAX_MSG_SIZE) ++ cec->msg.len = CEC_MAX_MSG_SIZE; + cec->msg.rx_status = CEC_RX_STATUS_OK; + s5p_cec_get_rx_buf(cec, cec->msg.len, + cec->msg.msg); +-- +2.35.1 + diff --git a/queue-5.4/scsi-core-restrict-legal-sdev_state-transitions-via-.patch b/queue-5.4/scsi-core-restrict-legal-sdev_state-transitions-via-.patch new file mode 100644 index 00000000000..fe3dac102ce --- /dev/null +++ b/queue-5.4/scsi-core-restrict-legal-sdev_state-transitions-via-.patch @@ -0,0 +1,54 @@ +From 491850c6a5a7a8a223f73135eb65de35d4d0abec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Sep 2022 18:02:42 -0600 +Subject: scsi: core: Restrict legal sdev_state transitions via sysfs + +From: Uday Shankar + +[ Upstream commit 2331ce6126be8864b39490e705286b66e2344aac ] + +Userspace can currently write to sysfs to transition sdev_state to RUNNING +or OFFLINE from any source state. This causes issues because proper +transitioning out of some states involves steps besides just changing +sdev_state, so allowing userspace to change sdev_state regardless of the +source state can result in inconsistencies; e.g. with ISCSI we can end up +with sdev_state == SDEV_RUNNING while the device queue is quiesced. Any +task attempting I/O on the device will then hang, and in more recent +kernels, iscsid will hang as well. + +More detail about this bug is provided in my first attempt: + +https://groups.google.com/g/open-iscsi/c/PNKca4HgPDs/m/CXaDkntOAQAJ + +Link: https://lore.kernel.org/r/20220924000241.2967323-1-ushankar@purestorage.com +Signed-off-by: Uday Shankar +Suggested-by: Mike Christie +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_sysfs.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index 6faf1d6451b0..530b14685fd7 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -795,6 +795,14 @@ store_state_field(struct device *dev, struct device_attribute *attr, + } + + mutex_lock(&sdev->state_mutex); ++ switch (sdev->sdev_state) { ++ case SDEV_RUNNING: ++ case SDEV_OFFLINE: ++ break; ++ default: ++ mutex_unlock(&sdev->state_mutex); ++ return -EINVAL; ++ } + if (sdev->sdev_state == SDEV_RUNNING && state == SDEV_RUNNING) { + ret = 0; + } else { +-- +2.35.1 + diff --git a/queue-5.4/series b/queue-5.4/series index 9e3d812a4a7..046cceb483e 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -27,3 +27,10 @@ bluetooth-l2cap-fix-use-after-free-in-l2cap_conn_del.patch net-mdio-fix-undefined-behavior-in-bit-shift-for-__m.patch net-neigh-fix-null-ptr-deref-in-neigh_table_clear.patch ipv6-fix-warning-in-ip6_route_net_exit_late.patch +media-s5p_cec-limit-msg.len-to-cec_max_msg_size.patch +media-cros-ec-cec-limit-msg.len-to-cec_max_msg_size.patch +media-dvb-frontends-drxk-initialize-err-to-0.patch +media-meson-vdec-fix-possible-refcount-leak-in-vdec_.patch +scsi-core-restrict-legal-sdev_state-transitions-via-.patch +hid-saitek-add-madcatz-variant-of-mmo7-mouse-device-.patch +i2c-xiic-add-platform-module-alias.patch