6.6-stable patches

added patches:
	drm-amd-display-check-dce_hwseq-before-dereferencing-it.patch
	hid-usbhid-paper-over-wrong-bnumdescriptor-field.patch

diff --git a/queue-6.6/drm-amd-display-check-dce_hwseq-before-dereferencing-it.patch b/queue-6.6/drm-amd-display-check-dce_hwseq-before-dereferencing-it.patch
new file mode 100644 (file)
index 0000000..fb9145a
--- /dev/null
+++ b/queue-6.6/drm-amd-display-check-dce_hwseq-before-dereferencing-it.patch
@@ -0,0 +1,39 @@
+From b669507b637eb6b1aaecf347f193efccc65d756e Mon Sep 17 00:00:00 2001
+From: Alex Hung <alex.hung@amd.com>
+Date: Tue, 3 Jun 2025 18:30:55 -0600
+Subject: drm/amd/display: Check dce_hwseq before dereferencing it
+
+From: Alex Hung <alex.hung@amd.com>
+
+commit b669507b637eb6b1aaecf347f193efccc65d756e upstream.
+
+[WHAT]
+
+hws was checked for null earlier in dce110_blank_stream, indicating hws
+can be null, and should be checked whenever it is used.
+
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 79db43611ff61280b6de58ce1305e0b2ecf675ad)
+Cc: stable@vger.kernel.org
+Signed-off-by: Rahul Sharma <black.hawk@163.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+@@ -1228,7 +1228,7 @@ void dce110_blank_stream(struct pipe_ctx
+       struct dce_hwseq *hws = link->dc->hwseq;
+ 
+       if (link->local_sink && link->local_sink->sink_signal == SIGNAL_TYPE_EDP) {
+-              if (!link->skip_implict_edp_power_control)
++              if (!link->skip_implict_edp_power_control && hws)
+                       hws->funcs.edp_backlight_control(link, false);
+               link->dc->hwss.set_abm_immediate_disable(pipe_ctx);
+       }

diff --git a/queue-6.6/hid-usbhid-paper-over-wrong-bnumdescriptor-field.patch b/queue-6.6/hid-usbhid-paper-over-wrong-bnumdescriptor-field.patch
new file mode 100644 (file)
index 0000000..3a8218d
--- /dev/null
+++ b/queue-6.6/hid-usbhid-paper-over-wrong-bnumdescriptor-field.patch
@@ -0,0 +1,55 @@
+From f28beb69c51517aec7067dfb2074e7c751542384 Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <bentiss@kernel.org>
+Date: Mon, 15 Dec 2025 12:57:21 +0100
+Subject: HID: usbhid: paper over wrong bNumDescriptor field
+
+From: Benjamin Tissoires <bentiss@kernel.org>
+
+commit f28beb69c51517aec7067dfb2074e7c751542384 upstream.
+
+Some faulty devices (ZWO EFWmini) have a wrong optional HID class
+descriptor count compared to the provided length.
+
+Given that we plainly ignore those optional descriptor, we can attempt
+to fix the provided number so we do not lock out those devices.
+
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Cc: Salvatore Bonaccorso <carnil@debian.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/usbhid/hid-core.c |   17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/hid/usbhid/hid-core.c
++++ b/drivers/hid/usbhid/hid-core.c
+@@ -983,6 +983,7 @@ static int usbhid_parse(struct hid_devic
+       struct usb_device *dev = interface_to_usbdev (intf);
+       struct hid_descriptor *hdesc;
+       struct hid_class_descriptor *hcdesc;
++      __u8 fixed_opt_descriptors_size;
+       u32 quirks = 0;
+       unsigned int rsize = 0;
+       char *rdesc;
+@@ -1013,7 +1014,21 @@ static int usbhid_parse(struct hid_devic
+                             (hdesc->bNumDescriptors - 1) * sizeof(*hcdesc)) {
+               dbg_hid("hid descriptor invalid, bLen=%hhu bNum=%hhu\n",
+                       hdesc->bLength, hdesc->bNumDescriptors);
+-              return -EINVAL;
++
++              /*
++               * Some devices may expose a wrong number of descriptors compared
++               * to the provided length.
++               * However, we ignore the optional hid class descriptors entirely
++               * so we can safely recompute the proper field.
++               */
++              if (hdesc->bLength >= sizeof(*hdesc)) {
++                      fixed_opt_descriptors_size = hdesc->bLength - sizeof(*hdesc);
++
++                      hid_warn(intf, "fixing wrong optional hid class descriptors count\n");
++                      hdesc->bNumDescriptors = fixed_opt_descriptors_size / sizeof(*hcdesc) + 1;
++              } else {
++                      return -EINVAL;
++              }
+       }
+ 
+       hid->version = le16_to_cpu(hdesc->bcdHID);

diff --git a/queue-6.6/series b/queue-6.6/series
index daed5f935a36f76475a29298137aa2733efc1f1e..d19fbbc5d4ffa0423ba3e7a6cabc535e12386d1d 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -40,3 +40,5 @@ phy-stm32-usphyc-fix-off-by-one-in-probe.patch
 phy-broadcom-ns-usb3-fix-wvoid-pointer-to-enum-cast-.patch
 dmaengine-omap-dma-fix-dma_pool-resource-leak-in-err.patch
 i2c-qcom-geni-make-sure-i2c-hub-controllers-can-t-us.patch
+hid-usbhid-paper-over-wrong-bnumdescriptor-field.patch
+drm-amd-display-check-dce_hwseq-before-dereferencing-it.patch