From 97e58860dc13916f40baeed68202337746386a81 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 20 May 2025 12:43:57 +0200 Subject: [PATCH] 5.10-stable patches added patches: usb-typec-altmodes-displayport-create-sysfs-nodes-as-driver-s-default-device-attribute-group.patch usb-typec-fix-pm-usage-counter-imbalance-in-ucsi_ccg_sync_control.patch usb-typec-fix-potential-array-underflow-in-ucsi_ccg_sync_control.patch --- queue-5.10/series | 3 + ...ver-s-default-device-attribute-group.patch | 93 +++++++++++++++++++ ...r-imbalance-in-ucsi_ccg_sync_control.patch | 49 ++++++++++ ...y-underflow-in-ucsi_ccg_sync_control.patch | 49 ++++++++++ 4 files changed, 194 insertions(+) create mode 100644 queue-5.10/usb-typec-altmodes-displayport-create-sysfs-nodes-as-driver-s-default-device-attribute-group.patch create mode 100644 queue-5.10/usb-typec-fix-pm-usage-counter-imbalance-in-ucsi_ccg_sync_control.patch create mode 100644 queue-5.10/usb-typec-fix-potential-array-underflow-in-ucsi_ccg_sync_control.patch diff --git a/queue-5.10/series b/queue-5.10/series index 6d30c95220..31542be45a 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -104,3 +104,6 @@ dmaengine-ti-k3-udma-use-cap_mask-directly-from-dma_device-structure-instead-of- clocksource-i8253-use-raw_spinlock_irqsave-in-clockevent_i8253_disable.patch asoc-q6afe-clocks-fix-reprobing-of-the-driver.patch drm-vmwgfx-fix-a-deadlock-in-dma-buf-fence-polling.patch +usb-typec-altmodes-displayport-create-sysfs-nodes-as-driver-s-default-device-attribute-group.patch +usb-typec-fix-potential-array-underflow-in-ucsi_ccg_sync_control.patch +usb-typec-fix-pm-usage-counter-imbalance-in-ucsi_ccg_sync_control.patch diff --git a/queue-5.10/usb-typec-altmodes-displayport-create-sysfs-nodes-as-driver-s-default-device-attribute-group.patch b/queue-5.10/usb-typec-altmodes-displayport-create-sysfs-nodes-as-driver-s-default-device-attribute-group.patch new file mode 100644 index 0000000000..38d9e496f0 --- /dev/null +++ b/queue-5.10/usb-typec-altmodes-displayport-create-sysfs-nodes-as-driver-s-default-device-attribute-group.patch @@ -0,0 +1,93 @@ +From 165376f6b23e9a779850e750fb2eb06622e5a531 Mon Sep 17 00:00:00 2001 +From: RD Babiera +Date: Thu, 29 Feb 2024 00:11:02 +0000 +Subject: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group + +From: RD Babiera + +commit 165376f6b23e9a779850e750fb2eb06622e5a531 upstream. + +The DisplayPort driver's sysfs nodes may be present to the userspace before +typec_altmode_set_drvdata() completes in dp_altmode_probe. This means that +a sysfs read can trigger a NULL pointer error by deferencing dp->hpd in +hpd_show or dp->lock in pin_assignment_show, as dev_get_drvdata() returns +NULL in those cases. + +Remove manual sysfs node creation in favor of adding attribute group as +default for devices bound to the driver. The ATTRIBUTE_GROUPS() macro is +not used here otherwise the path to the sysfs nodes is no longer compliant +with the ABI. + +Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode") +Cc: stable@vger.kernel.org +Signed-off-by: RD Babiera +Link: https://lore.kernel.org/r/20240229001101.3889432-2-rdbabiera@google.com +[Minor conflict resolved due to code context change.] +Signed-off-by: Jianqi Ren +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/altmodes/displayport.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/usb/typec/altmodes/displayport.c ++++ b/drivers/usb/typec/altmodes/displayport.c +@@ -527,15 +527,20 @@ static ssize_t pin_assignment_show(struc + } + static DEVICE_ATTR_RW(pin_assignment); + +-static struct attribute *dp_altmode_attrs[] = { ++static struct attribute *displayport_attrs[] = { + &dev_attr_configuration.attr, + &dev_attr_pin_assignment.attr, + NULL + }; + +-static const struct attribute_group dp_altmode_group = { ++static const struct attribute_group displayport_group = { + .name = "displayport", +- .attrs = dp_altmode_attrs, ++ .attrs = displayport_attrs, ++}; ++ ++static const struct attribute_group *displayport_groups[] = { ++ &displayport_group, ++ NULL, + }; + + int dp_altmode_probe(struct typec_altmode *alt) +@@ -543,7 +548,6 @@ int dp_altmode_probe(struct typec_altmod + const struct typec_altmode *port = typec_altmode_get_partner(alt); + struct fwnode_handle *fwnode; + struct dp_altmode *dp; +- int ret; + + /* FIXME: Port can only be DFP_U. */ + +@@ -554,10 +558,6 @@ int dp_altmode_probe(struct typec_altmod + DP_CAP_PIN_ASSIGN_DFP_D(alt->vdo))) + return -ENODEV; + +- ret = sysfs_create_group(&alt->dev.kobj, &dp_altmode_group); +- if (ret) +- return ret; +- + dp = devm_kzalloc(&alt->dev, sizeof(*dp), GFP_KERNEL); + if (!dp) + return -ENOMEM; +@@ -588,7 +588,6 @@ void dp_altmode_remove(struct typec_altm + { + struct dp_altmode *dp = typec_altmode_get_drvdata(alt); + +- sysfs_remove_group(&alt->dev.kobj, &dp_altmode_group); + cancel_work_sync(&dp->work); + + if (dp->connector_fwnode) { +@@ -613,6 +612,7 @@ static struct typec_altmode_driver dp_al + .driver = { + .name = "typec_displayport", + .owner = THIS_MODULE, ++ .dev_groups = displayport_groups, + }, + }; + module_typec_altmode_driver(dp_altmode_driver); diff --git a/queue-5.10/usb-typec-fix-pm-usage-counter-imbalance-in-ucsi_ccg_sync_control.patch b/queue-5.10/usb-typec-fix-pm-usage-counter-imbalance-in-ucsi_ccg_sync_control.patch new file mode 100644 index 0000000000..9c7e5a845a --- /dev/null +++ b/queue-5.10/usb-typec-fix-pm-usage-counter-imbalance-in-ucsi_ccg_sync_control.patch @@ -0,0 +1,49 @@ +From b0e525d7a22ea350e75e2aec22e47fcfafa4cacd Mon Sep 17 00:00:00 2001 +From: GONG Ruiqi +Date: Tue, 7 Jan 2025 09:57:50 +0800 +Subject: usb: typec: fix pm usage counter imbalance in ucsi_ccg_sync_control() + +From: GONG Ruiqi + +commit b0e525d7a22ea350e75e2aec22e47fcfafa4cacd upstream. + +The error handling for the case `con_index == 0` should involve dropping +the pm usage counter, as ucsi_ccg_sync_control() gets it at the +beginning. Fix it. + +Cc: stable +Fixes: e56aac6e5a25 ("usb: typec: fix potential array underflow in ucsi_ccg_sync_control()") +Signed-off-by: GONG Ruiqi +Reviewed-by: Dan Carpenter +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20250107015750.2778646-1-gongruiqi1@huawei.com +Signed-off-by: Greg Kroah-Hartman +[Minor context change fixed.] +Signed-off-by: Bin Lan +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi_ccg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/typec/ucsi/ucsi_ccg.c ++++ b/drivers/usb/typec/ucsi/ucsi_ccg.c +@@ -575,7 +575,7 @@ static int ucsi_ccg_sync_write(struct uc + UCSI_CMD_CONNECTOR_MASK; + if (con_index == 0) { + ret = -EINVAL; +- goto unlock; ++ goto err_put; + } + con = &uc->ucsi->connector[con_index - 1]; + ucsi_ccg_update_set_new_cam_cmd(uc, con, (u64 *)val); +@@ -591,8 +591,8 @@ static int ucsi_ccg_sync_write(struct uc + + err_clear_bit: + clear_bit(DEV_CMD_PENDING, &uc->flags); ++err_put: + pm_runtime_put_sync(uc->dev); +-unlock: + mutex_unlock(&uc->lock); + + return ret; diff --git a/queue-5.10/usb-typec-fix-potential-array-underflow-in-ucsi_ccg_sync_control.patch b/queue-5.10/usb-typec-fix-potential-array-underflow-in-ucsi_ccg_sync_control.patch new file mode 100644 index 0000000000..8337443a80 --- /dev/null +++ b/queue-5.10/usb-typec-fix-potential-array-underflow-in-ucsi_ccg_sync_control.patch @@ -0,0 +1,49 @@ +From e56aac6e5a25630645607b6856d4b2a17b2311a5 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 11 Nov 2024 14:08:06 +0300 +Subject: usb: typec: fix potential array underflow in ucsi_ccg_sync_control() + +From: Dan Carpenter + +commit e56aac6e5a25630645607b6856d4b2a17b2311a5 upstream. + +The "command" variable can be controlled by the user via debugfs. The +worry is that if con_index is zero then "&uc->ucsi->connector[con_index +- 1]" would be an array underflow. + +Fixes: 170a6726d0e2 ("usb: typec: ucsi: add support for separate DP altmode devices") +Signed-off-by: Dan Carpenter +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/c69ef0b3-61b0-4dde-98dd-97b97f81d912@stanley.mountain +Signed-off-by: Greg Kroah-Hartman +[ The function ucsi_ccg_sync_write() is renamed to ucsi_ccg_sync_control() + in commit 13f2ec3115c8 ("usb: typec: ucsi:simplify command sending API"). + Apply this patch to ucsi_ccg_sync_write() in 6.1.y accordingly. ] +Signed-off-by: Bin Lan +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi_ccg.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/typec/ucsi/ucsi_ccg.c ++++ b/drivers/usb/typec/ucsi/ucsi_ccg.c +@@ -573,6 +573,10 @@ static int ucsi_ccg_sync_write(struct uc + uc->has_multiple_dp) { + con_index = (uc->last_cmd_sent >> 16) & + UCSI_CMD_CONNECTOR_MASK; ++ if (con_index == 0) { ++ ret = -EINVAL; ++ goto unlock; ++ } + con = &uc->ucsi->connector[con_index - 1]; + ucsi_ccg_update_set_new_cam_cmd(uc, con, (u64 *)val); + } +@@ -588,6 +592,7 @@ static int ucsi_ccg_sync_write(struct uc + err_clear_bit: + clear_bit(DEV_CMD_PENDING, &uc->flags); + pm_runtime_put_sync(uc->dev); ++unlock: + mutex_unlock(&uc->lock); + + return ret; -- 2.47.3