From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Fri, 27 Sep 2024 12:15:36 +0000 (+0200)
Subject: 6.11-stable patches
X-Git-Tag: v6.1.112~3
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e6545aaf2c1d1c39bf03edb5225222e33ab5dddc;p=thirdparty%2Fkernel%2Fstable-queue.git

6.11-stable patches

added patches:
	usb-serial-pl2303-add-device-id-for-macrosilicon-ms3020.patch
	usb-usbtmc-prevent-kernel-usb-infoleak.patch
---

diff --git a/queue-6.11/series b/queue-6.11/series
index 090e9765dae..7288c3cf968 100644
--- a/queue-6.11/series
+++ b/queue-6.11/series
@@ -8,3 +8,5 @@ netfilter-nft_socket-fix-a-null-vs-is_err-bug-in-nft_socket_cgroup_subtree_level
 bluetooth-btintel_pcie-allocate-memory-for-driver-private-data.patch
 asoc-amd-acp-add-zsc-control-register-programming-sequence.patch
 nvme-pci-qdepth-1-quirk.patch
+usb-serial-pl2303-add-device-id-for-macrosilicon-ms3020.patch
+usb-usbtmc-prevent-kernel-usb-infoleak.patch
diff --git a/queue-6.11/usb-serial-pl2303-add-device-id-for-macrosilicon-ms3020.patch b/queue-6.11/usb-serial-pl2303-add-device-id-for-macrosilicon-ms3020.patch
new file mode 100644
index 00000000000..2ec3fc04b3b
--- /dev/null
+++ b/queue-6.11/usb-serial-pl2303-add-device-id-for-macrosilicon-ms3020.patch
@@ -0,0 +1,41 @@
+From 7d47d22444bb7dc1b6d768904a22070ef35e1fc0 Mon Sep 17 00:00:00 2001
+From: Junhao Xie <bigfoot@classfun.cn>
+Date: Tue, 3 Sep 2024 23:06:38 +0800
+Subject: USB: serial: pl2303: add device id for Macrosilicon MS3020
+
+From: Junhao Xie <bigfoot@classfun.cn>
+
+commit 7d47d22444bb7dc1b6d768904a22070ef35e1fc0 upstream.
+
+Add the device id for the Macrosilicon MS3020 which is a
+PL2303HXN based device.
+
+Signed-off-by: Junhao Xie <bigfoot@classfun.cn>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/pl2303.c |    1 +
+ drivers/usb/serial/pl2303.h |    4 ++++
+ 2 files changed, 5 insertions(+)
+
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -118,6 +118,7 @@ static const struct usb_device_id id_tab
+ 	{ USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) },
+ 	{ USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) },
+ 	{ USB_DEVICE(IBM_VENDOR_ID, IBM_PRODUCT_ID) },
++	{ USB_DEVICE(MACROSILICON_VENDOR_ID, MACROSILICON_MS3020_PRODUCT_ID) },
+ 	{ }					/* Terminating entry */
+ };
+ 
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -171,3 +171,7 @@
+ /* Allied Telesis VT-Kit3 */
+ #define AT_VENDOR_ID		0x0caa
+ #define AT_VTKIT3_PRODUCT_ID	0x3001
++
++/* Macrosilicon MS3020 */
++#define MACROSILICON_VENDOR_ID		0x345f
++#define MACROSILICON_MS3020_PRODUCT_ID	0x3020
diff --git a/queue-6.11/usb-usbtmc-prevent-kernel-usb-infoleak.patch b/queue-6.11/usb-usbtmc-prevent-kernel-usb-infoleak.patch
new file mode 100644
index 00000000000..0e200c0519a
--- /dev/null
+++ b/queue-6.11/usb-usbtmc-prevent-kernel-usb-infoleak.patch
@@ -0,0 +1,34 @@
+From 625fa77151f00c1bd00d34d60d6f2e710b3f9aad Mon Sep 17 00:00:00 2001
+From: Edward Adam Davis <eadavis@qq.com>
+Date: Sun, 8 Sep 2024 17:17:41 +0800
+Subject: USB: usbtmc: prevent kernel-usb-infoleak
+
+From: Edward Adam Davis <eadavis@qq.com>
+
+commit 625fa77151f00c1bd00d34d60d6f2e710b3f9aad upstream.
+
+The syzbot reported a kernel-usb-infoleak in usbtmc_write,
+we need to clear the structure before filling fields.
+
+Fixes: 4ddc645f40e9 ("usb: usbtmc: Add ioctl for vendor specific write")
+Reported-and-tested-by: syzbot+9d34f80f841e948c3fdb@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=9d34f80f841e948c3fdb
+Signed-off-by: Edward Adam Davis <eadavis@qq.com>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/tencent_9649AA6EC56EDECCA8A7D106C792D1C66B06@qq.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/usbtmc.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -754,7 +754,7 @@ static struct urb *usbtmc_create_urb(voi
+ 	if (!urb)
+ 		return NULL;
+ 
+-	dmabuf = kmalloc(bufsize, GFP_KERNEL);
++	dmabuf = kzalloc(bufsize, GFP_KERNEL);
+ 	if (!dmabuf) {
+ 		usb_free_urb(urb);
+ 		return NULL;