From: Sasha Levin Date: Wed, 7 Feb 2024 16:25:09 +0000 (-0500) Subject: Fixes for 4.19 X-Git-Tag: v6.1.78~72 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=25bff0425ccb3ed272d6d845145e1f2bf6a2fe60;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/dmaengine-fix-is_slave_direction-return-false-when-d.patch b/queue-4.19/dmaengine-fix-is_slave_direction-return-false-when-d.patch new file mode 100644 index 00000000000..8d83ef14a2e --- /dev/null +++ b/queue-4.19/dmaengine-fix-is_slave_direction-return-false-when-d.patch @@ -0,0 +1,37 @@ +From d6159e2aa70fecca2d755ecdbba0e983bcdd7059 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jan 2024 12:28:41 -0500 +Subject: dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV + +From: Frank Li + +[ Upstream commit a22fe1d6dec7e98535b97249fdc95c2be79120bb ] + +is_slave_direction() should return true when direction is DMA_DEV_TO_DEV. + +Fixes: 49920bc66984 ("dmaengine: add new enum dma_transfer_direction") +Signed-off-by: Frank Li +Link: https://lore.kernel.org/r/20240123172842.3764529-1-Frank.Li@nxp.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + include/linux/dmaengine.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h +index 50128c36f0b4..6e869419ab17 100644 +--- a/include/linux/dmaengine.h ++++ b/include/linux/dmaengine.h +@@ -827,7 +827,8 @@ static inline int dmaengine_slave_config(struct dma_chan *chan, + + static inline bool is_slave_direction(enum dma_transfer_direction direction) + { +- return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM); ++ return (direction == DMA_MEM_TO_DEV) || (direction == DMA_DEV_TO_MEM) || ++ (direction == DMA_DEV_TO_DEV); + } + + static inline struct dma_async_tx_descriptor *dmaengine_prep_slave_single( +-- +2.43.0 + diff --git a/queue-4.19/phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch b/queue-4.19/phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch new file mode 100644 index 00000000000..31b9c3e9974 --- /dev/null +++ b/queue-4.19/phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch @@ -0,0 +1,75 @@ +From 92fae91fbd5421398d0a4a3dddaae5990b4046ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jan 2024 14:05:54 +0200 +Subject: phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP + +From: Tony Lindgren + +[ Upstream commit 7104ba0f1958adb250319e68a15eff89ec4fd36d ] + +If the external phy working together with phy-omap-usb2 does not implement +send_srp(), we may still attempt to call it. This can happen on an idle +Ethernet gadget triggering a wakeup for example: + +configfs-gadget.g1 gadget.0: ECM Suspend +configfs-gadget.g1 gadget.0: Port suspended. Triggering wakeup +... +Unable to handle kernel NULL pointer dereference at virtual address +00000000 when execute +... +PC is at 0x0 +LR is at musb_gadget_wakeup+0x1d4/0x254 [musb_hdrc] +... +musb_gadget_wakeup [musb_hdrc] from usb_gadget_wakeup+0x1c/0x3c [udc_core] +usb_gadget_wakeup [udc_core] from eth_start_xmit+0x3b0/0x3d4 [u_ether] +eth_start_xmit [u_ether] from dev_hard_start_xmit+0x94/0x24c +dev_hard_start_xmit from sch_direct_xmit+0x104/0x2e4 +sch_direct_xmit from __dev_queue_xmit+0x334/0xd88 +__dev_queue_xmit from arp_solicit+0xf0/0x268 +arp_solicit from neigh_probe+0x54/0x7c +neigh_probe from __neigh_event_send+0x22c/0x47c +__neigh_event_send from neigh_resolve_output+0x14c/0x1c0 +neigh_resolve_output from ip_finish_output2+0x1c8/0x628 +ip_finish_output2 from ip_send_skb+0x40/0xd8 +ip_send_skb from udp_send_skb+0x124/0x340 +udp_send_skb from udp_sendmsg+0x780/0x984 +udp_sendmsg from __sys_sendto+0xd8/0x158 +__sys_sendto from ret_fast_syscall+0x0/0x58 + +Let's fix the issue by checking for send_srp() and set_vbus() before +calling them. For USB peripheral only cases these both could be NULL. + +Fixes: 657b306a7bdf ("usb: phy: add a new driver for omap usb2 phy") +Signed-off-by: Tony Lindgren +Link: https://lore.kernel.org/r/20240128120556.8848-1-tony@atomide.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/phy-omap-usb2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/ti/phy-omap-usb2.c b/drivers/phy/ti/phy-omap-usb2.c +index fe909fd8144f..ae94e1e66bcc 100644 +--- a/drivers/phy/ti/phy-omap-usb2.c ++++ b/drivers/phy/ti/phy-omap-usb2.c +@@ -64,7 +64,7 @@ static int omap_usb_set_vbus(struct usb_otg *otg, bool enabled) + { + struct omap_usb *phy = phy_to_omapusb(otg->usb_phy); + +- if (!phy->comparator) ++ if (!phy->comparator || !phy->comparator->set_vbus) + return -ENODEV; + + return phy->comparator->set_vbus(phy->comparator, enabled); +@@ -74,7 +74,7 @@ static int omap_usb_start_srp(struct usb_otg *otg) + { + struct omap_usb *phy = phy_to_omapusb(otg->usb_phy); + +- if (!phy->comparator) ++ if (!phy->comparator || !phy->comparator->start_srp) + return -ENODEV; + + return phy->comparator->start_srp(phy->comparator); +-- +2.43.0 + diff --git a/queue-4.19/series b/queue-4.19/series index eb9f515ec40..896c1539a15 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -143,3 +143,5 @@ hid-apple-add-support-for-the-2021-magic-keyboard.patch hid-apple-swap-the-fn-and-left-control-keys-on-apple-keyboards.patch hid-apple-add-2021-magic-keyboard-fn-key-mapping.patch bonding-remove-print-in-bond_verify_device_path.patch +dmaengine-fix-is_slave_direction-return-false-when-d.patch +phy-ti-phy-omap-usb2-fix-null-pointer-dereference-fo.patch