Fixes for 4.19

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-4.19/dmaengine-fix-is_slave_direction-return-false-when-d.patch b/queue-4.19/dmaengine-fix-is_slave_direction-return-false-when-d.patch
new file mode 100644 (file)
index 0000000..8d83ef1
--- /dev/null
+++ b/queue-4.19/dmaengine-fix-is_slave_direction-return-false-when-d.patch
@@ -0,0 +1,37 @@
+From d6159e2aa70fecca2d755ecdbba0e983bcdd7059 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jan 2024 12:28:41 -0500
+Subject: dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV
+
+From: Frank Li <Frank.Li@nxp.com>
+
+[ Upstream commit a22fe1d6dec7e98535b97249fdc95c2be79120bb ]
+
+is_slave_direction() should return true when direction is DMA_DEV_TO_DEV.
+
+Fixes: 49920bc66984 ("dmaengine: add new enum dma_transfer_direction")
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Link: https://lore.kernel.org/r/20240123172842.3764529-1-Frank.Li@nxp.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/dmaengine.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
+index 50128c36f0b4..6e869419ab17 100644
+--- a/include/linux/dmaengine.h
++++ b/include/linux/dmaengine.h
+@@ -827,7 +827,8 @@ static inline int dmaengine_slave_config(struct dma_chan *chan,
+ 
+ static inline bool is_slave_direction(enum dma_transfer_direction direction)
+ {
+-      return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM);
++      return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM) ||
++             (direction == DMA_DEV_TO_DEV);
+ }
+ 
+ static inline struct dma_async_tx_descriptor *dmaengine_prep_slave_single(
+-- 
+2.43.0
+

diff --git a/queue-4.19/phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch b/queue-4.19/phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch
new file mode 100644 (file)
index 0000000..31b9c3e
--- /dev/null
+++ b/queue-4.19/phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch
@@ -0,0 +1,75 @@
+From 92fae91fbd5421398d0a4a3dddaae5990b4046ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Jan 2024 14:05:54 +0200
+Subject: phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 7104ba0f1958adb250319e68a15eff89ec4fd36d ]
+
+If the external phy working together with phy-omap-usb2 does not implement
+send_srp(), we may still attempt to call it. This can happen on an idle
+Ethernet gadget triggering a wakeup for example:
+
+configfs-gadget.g1 gadget.0: ECM Suspend
+configfs-gadget.g1 gadget.0: Port suspended. Triggering wakeup
+...
+Unable to handle kernel NULL pointer dereference at virtual address
+00000000 when execute
+...
+PC is at 0x0
+LR is at musb_gadget_wakeup+0x1d4/0x254 [musb_hdrc]
+...
+musb_gadget_wakeup [musb_hdrc] from usb_gadget_wakeup+0x1c/0x3c [udc_core]
+usb_gadget_wakeup [udc_core] from eth_start_xmit+0x3b0/0x3d4 [u_ether]
+eth_start_xmit [u_ether] from dev_hard_start_xmit+0x94/0x24c
+dev_hard_start_xmit from sch_direct_xmit+0x104/0x2e4
+sch_direct_xmit from __dev_queue_xmit+0x334/0xd88
+__dev_queue_xmit from arp_solicit+0xf0/0x268
+arp_solicit from neigh_probe+0x54/0x7c
+neigh_probe from __neigh_event_send+0x22c/0x47c
+__neigh_event_send from neigh_resolve_output+0x14c/0x1c0
+neigh_resolve_output from ip_finish_output2+0x1c8/0x628
+ip_finish_output2 from ip_send_skb+0x40/0xd8
+ip_send_skb from udp_send_skb+0x124/0x340
+udp_send_skb from udp_sendmsg+0x780/0x984
+udp_sendmsg from __sys_sendto+0xd8/0x158
+__sys_sendto from ret_fast_syscall+0x0/0x58
+
+Let's fix the issue by checking for send_srp() and set_vbus() before
+calling them. For USB peripheral only cases these both could be NULL.
+
+Fixes: 657b306a7bdf ("usb: phy: add a new driver for omap usb2 phy")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20240128120556.8848-1-tony@atomide.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/ti/phy-omap-usb2.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/ti/phy-omap-usb2.c b/drivers/phy/ti/phy-omap-usb2.c
+index fe909fd8144f..ae94e1e66bcc 100644
+--- a/drivers/phy/ti/phy-omap-usb2.c
++++ b/drivers/phy/ti/phy-omap-usb2.c
+@@ -64,7 +64,7 @@ static int omap_usb_set_vbus(struct usb_otg *otg, bool enabled)
+ {
+       struct omap_usb *phy = phy_to_omapusb(otg->usb_phy);
+ 
+-      if (!phy->comparator)
++      if (!phy->comparator || !phy->comparator->set_vbus)
+               return -ENODEV;
+ 
+       return phy->comparator->set_vbus(phy->comparator, enabled);
+@@ -74,7 +74,7 @@ static int omap_usb_start_srp(struct usb_otg *otg)
+ {
+       struct omap_usb *phy = phy_to_omapusb(otg->usb_phy);
+ 
+-      if (!phy->comparator)
++      if (!phy->comparator || !phy->comparator->start_srp)
+               return -ENODEV;
+ 
+       return phy->comparator->start_srp(phy->comparator);
+-- 
+2.43.0
+

diff --git a/queue-4.19/series b/queue-4.19/series
index eb9f515ec40b069845924b5b450aea8ffce753b7..896c1539a157375d8688d7116ae4554031d0751c 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -143,3 +143,5 @@ hid-apple-add-support-for-the-2021-magic-keyboard.patch
 hid-apple-swap-the-fn-and-left-control-keys-on-apple-keyboards.patch
 hid-apple-add-2021-magic-keyboard-fn-key-mapping.patch
 bonding-remove-print-in-bond_verify_device_path.patch
+dmaengine-fix-is_slave_direction-return-false-when-d.patch
+phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch