From: Greg Kroah-Hartman Date: Tue, 20 Jan 2026 11:07:51 +0000 (+0100) Subject: 6.6-stable patches X-Git-Tag: v6.12.67~26 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=40e80fc1286a525e9e5d0905de45bfd70f02dcd2;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: drm-amd-display-check-dce_hwseq-before-dereferencing-it.patch hid-usbhid-paper-over-wrong-bnumdescriptor-field.patch --- diff --git a/queue-6.6/drm-amd-display-check-dce_hwseq-before-dereferencing-it.patch b/queue-6.6/drm-amd-display-check-dce_hwseq-before-dereferencing-it.patch new file mode 100644 index 0000000000..fb9145a820 --- /dev/null +++ b/queue-6.6/drm-amd-display-check-dce_hwseq-before-dereferencing-it.patch @@ -0,0 +1,39 @@ +From b669507b637eb6b1aaecf347f193efccc65d756e Mon Sep 17 00:00:00 2001 +From: Alex Hung +Date: Tue, 3 Jun 2025 18:30:55 -0600 +Subject: drm/amd/display: Check dce_hwseq before dereferencing it + +From: Alex Hung + +commit b669507b637eb6b1aaecf347f193efccc65d756e upstream. + +[WHAT] + +hws was checked for null earlier in dce110_blank_stream, indicating hws +can be null, and should be checked whenever it is used. + +Cc: Mario Limonciello +Cc: Alex Deucher +Reviewed-by: Aurabindo Pillai +Signed-off-by: Alex Hung +Signed-off-by: Aurabindo Pillai +Signed-off-by: Alex Deucher +(cherry picked from commit 79db43611ff61280b6de58ce1305e0b2ecf675ad) +Cc: stable@vger.kernel.org +Signed-off-by: Rahul Sharma +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +@@ -1228,7 +1228,7 @@ void dce110_blank_stream(struct pipe_ctx + struct dce_hwseq *hws = link->dc->hwseq; + + if (link->local_sink && link->local_sink->sink_signal == SIGNAL_TYPE_EDP) { +- if (!link->skip_implict_edp_power_control) ++ if (!link->skip_implict_edp_power_control && hws) + hws->funcs.edp_backlight_control(link, false); + link->dc->hwss.set_abm_immediate_disable(pipe_ctx); + } diff --git a/queue-6.6/hid-usbhid-paper-over-wrong-bnumdescriptor-field.patch b/queue-6.6/hid-usbhid-paper-over-wrong-bnumdescriptor-field.patch new file mode 100644 index 0000000000..3a8218d6a0 --- /dev/null +++ b/queue-6.6/hid-usbhid-paper-over-wrong-bnumdescriptor-field.patch @@ -0,0 +1,55 @@ +From f28beb69c51517aec7067dfb2074e7c751542384 Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Mon, 15 Dec 2025 12:57:21 +0100 +Subject: HID: usbhid: paper over wrong bNumDescriptor field + +From: Benjamin Tissoires + +commit f28beb69c51517aec7067dfb2074e7c751542384 upstream. + +Some faulty devices (ZWO EFWmini) have a wrong optional HID class +descriptor count compared to the provided length. + +Given that we plainly ignore those optional descriptor, we can attempt +to fix the provided number so we do not lock out those devices. + +Signed-off-by: Benjamin Tissoires +Cc: Salvatore Bonaccorso +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/usbhid/hid-core.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +--- a/drivers/hid/usbhid/hid-core.c ++++ b/drivers/hid/usbhid/hid-core.c +@@ -983,6 +983,7 @@ static int usbhid_parse(struct hid_devic + struct usb_device *dev = interface_to_usbdev (intf); + struct hid_descriptor *hdesc; + struct hid_class_descriptor *hcdesc; ++ __u8 fixed_opt_descriptors_size; + u32 quirks = 0; + unsigned int rsize = 0; + char *rdesc; +@@ -1013,7 +1014,21 @@ static int usbhid_parse(struct hid_devic + (hdesc->bNumDescriptors - 1) * sizeof(*hcdesc)) { + dbg_hid("hid descriptor invalid, bLen=%hhu bNum=%hhu\n", + hdesc->bLength, hdesc->bNumDescriptors); +- return -EINVAL; ++ ++ /* ++ * Some devices may expose a wrong number of descriptors compared ++ * to the provided length. ++ * However, we ignore the optional hid class descriptors entirely ++ * so we can safely recompute the proper field. ++ */ ++ if (hdesc->bLength >= sizeof(*hdesc)) { ++ fixed_opt_descriptors_size = hdesc->bLength - sizeof(*hdesc); ++ ++ hid_warn(intf, "fixing wrong optional hid class descriptors count\n"); ++ hdesc->bNumDescriptors = fixed_opt_descriptors_size / sizeof(*hcdesc) + 1; ++ } else { ++ return -EINVAL; ++ } + } + + hid->version = le16_to_cpu(hdesc->bcdHID); diff --git a/queue-6.6/series b/queue-6.6/series index daed5f935a..d19fbbc5d4 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -40,3 +40,5 @@ phy-stm32-usphyc-fix-off-by-one-in-probe.patch phy-broadcom-ns-usb3-fix-wvoid-pointer-to-enum-cast-.patch dmaengine-omap-dma-fix-dma_pool-resource-leak-in-err.patch i2c-qcom-geni-make-sure-i2c-hub-controllers-can-t-us.patch +hid-usbhid-paper-over-wrong-bnumdescriptor-field.patch +drm-amd-display-check-dce_hwseq-before-dereferencing-it.patch