From 78fff780eac9df1bb71c8bd56fa415318b90a22e Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 8 Jul 2025 17:15:30 +0200 Subject: [PATCH] 5.15-stable patches added patches: i2c-designware-fix-an-initialization-issue.patch logitech-c-270-even-more-broken.patch --- ...signware-fix-an-initialization-issue.patch | 39 +++++++++++++++++++ .../logitech-c-270-even-more-broken.patch | 32 +++++++++++++++ queue-5.15/series | 2 + 3 files changed, 73 insertions(+) create mode 100644 queue-5.15/i2c-designware-fix-an-initialization-issue.patch create mode 100644 queue-5.15/logitech-c-270-even-more-broken.patch diff --git a/queue-5.15/i2c-designware-fix-an-initialization-issue.patch b/queue-5.15/i2c-designware-fix-an-initialization-issue.patch new file mode 100644 index 0000000000..6b5e9ea1e5 --- /dev/null +++ b/queue-5.15/i2c-designware-fix-an-initialization-issue.patch @@ -0,0 +1,39 @@ +From 3d30048958e0d43425f6d4e76565e6249fa71050 Mon Sep 17 00:00:00 2001 +From: "Michael J. Ruhl" +Date: Fri, 27 Jun 2025 10:35:11 -0400 +Subject: i2c/designware: Fix an initialization issue + +From: Michael J. Ruhl + +commit 3d30048958e0d43425f6d4e76565e6249fa71050 upstream. + +The i2c_dw_xfer_init() function requires msgs and msg_write_idx from the +dev context to be initialized. + +amd_i2c_dw_xfer_quirk() inits msgs and msgs_num, but not msg_write_idx. + +This could allow an out of bounds access (of msgs). + +Initialize msg_write_idx before calling i2c_dw_xfer_init(). + +Reviewed-by: Andy Shevchenko +Fixes: 17631e8ca2d3 ("i2c: designware: Add driver support for AMD NAVI GPU") +Cc: # v5.13+ +Signed-off-by: Michael J. Ruhl +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20250627143511.489570-1-michael.j.ruhl@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-designware-master.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/i2c/busses/i2c-designware-master.c ++++ b/drivers/i2c/busses/i2c-designware-master.c +@@ -298,6 +298,7 @@ static int amd_i2c_dw_xfer_quirk(struct + + dev->msgs = msgs; + dev->msgs_num = num_msgs; ++ dev->msg_write_idx = 0; + i2c_dw_xfer_init(dev); + i2c_dw_disable_int(dev); + diff --git a/queue-5.15/logitech-c-270-even-more-broken.patch b/queue-5.15/logitech-c-270-even-more-broken.patch new file mode 100644 index 0000000000..1178752f1e --- /dev/null +++ b/queue-5.15/logitech-c-270-even-more-broken.patch @@ -0,0 +1,32 @@ +From cee4392a57e14a799fbdee193bc4c0de65b29521 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 5 Jun 2025 14:28:45 +0200 +Subject: Logitech C-270 even more broken + +From: Oliver Neukum + +commit cee4392a57e14a799fbdee193bc4c0de65b29521 upstream. + +Some varieties of this device don't work with +RESET_RESUME alone. + +Signed-off-by: Oliver Neukum +Cc: stable +Link: https://lore.kernel.org/r/20250605122852.1440382-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -224,7 +224,8 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x046a, 0x0023), .driver_info = USB_QUIRK_RESET_RESUME }, + + /* Logitech HD Webcam C270 */ +- { USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME | ++ USB_QUIRK_NO_LPM}, + + /* Logitech HD Pro Webcams C920, C920-C, C922, C925e and C930e */ + { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT }, diff --git a/queue-5.15/series b/queue-5.15/series index 9da2c5a960..a2990b6945 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -149,3 +149,5 @@ platform-x86-dell-wmi-sysman-fix-class-device-unregi.patch xhci-dbctty-disable-echo-flag-by-default.patch xhci-dbc-flush-queued-requests-before-stopping-dbc.patch usb-cdnsp-do-not-disable-slot-for-disabled-slot.patch +i2c-designware-fix-an-initialization-issue.patch +logitech-c-270-even-more-broken.patch -- 2.47.2