From: Greg Kroah-Hartman Date: Thu, 28 Dec 2023 11:08:54 +0000 (+0000) Subject: 6.6-stable patches X-Git-Tag: v6.1.70~29 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=912d32f798bac258c107a99d17c84586a435ab4a;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: alsa-hda-realtek-add-quirk-for-asus-rog-gv302xa.patch alsa-hda-tas2781-select-program-0-conf-0-by-default.patch asoc-tas2781-check-the-validity-of-prm_no-cfg_no.patch bluetooth-add-more-enc-key-size-check.patch bluetooth-af_bluetooth-fix-use-after-free-in-bt_sock_recvmsg.patch bluetooth-hci_event-fix-not-checking-if-hci_op_inquiry-has-been-sent.patch bluetooth-l2cap-send-reject-on-command-corrupted-request.patch bluetooth-mgmt-smp-fix-address-type-when-using-smp-over-bredr-le.patch net-usb-ax88179_178a-avoid-failed-operations-when-device-is-disconnected.patch usb-fotg210-hcd-delete-an-incorrect-bounds-test.patch usb-serial-ftdi_sio-update-actisense-pids-constant-names.patch usb-serial-option-add-foxconn-t99w265-with-new-baseline.patch usb-serial-option-add-quectel-eg912y-module-support.patch usb-serial-option-add-quectel-rm500q-r13-firmware-support.patch usb-typec-ucsi-fix-gpio-based-orientation-detection.patch wifi-cfg80211-add-my-certificate.patch wifi-cfg80211-fix-certs-build-to-not-depend-on-file-order.patch wifi-mt76-fix-crash-with-wed-rx-support-enabled.patch --- diff --git a/queue-6.6/alsa-hda-realtek-add-quirk-for-asus-rog-gv302xa.patch b/queue-6.6/alsa-hda-realtek-add-quirk-for-asus-rog-gv302xa.patch new file mode 100644 index 00000000000..f66845d5b6d --- /dev/null +++ b/queue-6.6/alsa-hda-realtek-add-quirk-for-asus-rog-gv302xa.patch @@ -0,0 +1,33 @@ +From 02a460adfc4920d4da775fb59ab3e54036daef22 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Cl=C3=A9ment=20Villeret?= +Date: Thu, 14 Dec 2023 21:36:32 +0100 +Subject: ALSA: hda/realtek: Add quirk for ASUS ROG GV302XA +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Villeret + +commit 02a460adfc4920d4da775fb59ab3e54036daef22 upstream. + +Asus ROG Flowx13 (GV302XA) seems require same patch as others asus products + +Signed-off-by: Clément Villeret +Cc: +Link: https://lore.kernel.org/r/0a27bf4b-3056-49ac-9651-ebd7f3e36328@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9864,6 +9864,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x1483, "ASUS GU603V", ALC285_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1493, "ASUS GV601V", ALC285_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A), ++ SND_PCI_QUIRK(0x1043, 0x1533, "ASUS GV302XA", ALC287_FIXUP_CS35L41_I2C_2), + SND_PCI_QUIRK(0x1043, 0x1573, "ASUS GZ301V", ALC285_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK), + SND_PCI_QUIRK(0x1043, 0x1663, "ASUS GU603ZV", ALC285_FIXUP_ASUS_HEADSET_MIC), diff --git a/queue-6.6/alsa-hda-tas2781-select-program-0-conf-0-by-default.patch b/queue-6.6/alsa-hda-tas2781-select-program-0-conf-0-by-default.patch new file mode 100644 index 00000000000..0a9830dfe41 --- /dev/null +++ b/queue-6.6/alsa-hda-tas2781-select-program-0-conf-0-by-default.patch @@ -0,0 +1,46 @@ +From ec1de5c214eb5a892fdb7c450748249d5e2840f5 Mon Sep 17 00:00:00 2001 +From: Gergo Koteles +Date: Fri, 15 Dec 2023 00:33:27 +0100 +Subject: ALSA: hda/tas2781: select program 0, conf 0 by default + +From: Gergo Koteles + +commit ec1de5c214eb5a892fdb7c450748249d5e2840f5 upstream. + +Currently, cur_prog/cur_conf remains at the default value (-1), while +program 0 has been loaded into the amplifiers. + +In the playback hook, tasdevice_tuning_switch tries to restore the +cur_prog/cur_conf. In the runtime_resume/system_resume, +tasdevice_prmg_load tries to load the cur_prog as well. + +Set cur_prog and cur_conf to 0 if available in the firmware. + +Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver") +CC: stable@vger.kernel.org +Signed-off-by: Gergo Koteles +Link: https://lore.kernel.org/r/038add0bdca1f979cc7abcce8f24cbcd3544084b.1702596646.git.soyer@irl.hu +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/tas2781_hda_i2c.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/pci/hda/tas2781_hda_i2c.c b/sound/pci/hda/tas2781_hda_i2c.c +index 63a90c7e8976..2fb1a7037c82 100644 +--- a/sound/pci/hda/tas2781_hda_i2c.c ++++ b/sound/pci/hda/tas2781_hda_i2c.c +@@ -543,6 +543,10 @@ static void tasdev_fw_ready(const struct firmware *fmw, void *context) + + tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK; + tasdevice_prmg_load(tas_priv, 0); ++ if (tas_priv->fmw->nr_programs > 0) ++ tas_priv->cur_prog = 0; ++ if (tas_priv->fmw->nr_configurations > 0) ++ tas_priv->cur_conf = 0; + + /* If calibrated data occurs error, dsp will still works with default + * calibrated data inside algo. +-- +2.43.0 + diff --git a/queue-6.6/asoc-tas2781-check-the-validity-of-prm_no-cfg_no.patch b/queue-6.6/asoc-tas2781-check-the-validity-of-prm_no-cfg_no.patch new file mode 100644 index 00000000000..0fd0f20305c --- /dev/null +++ b/queue-6.6/asoc-tas2781-check-the-validity-of-prm_no-cfg_no.patch @@ -0,0 +1,98 @@ +From f32c80d34249e1cfb2e647ab3c8ef38a460c787f Mon Sep 17 00:00:00 2001 +From: Gergo Koteles +Date: Thu, 14 Dec 2023 23:04:44 +0100 +Subject: ASoC: tas2781: check the validity of prm_no/cfg_no + +From: Gergo Koteles + +commit f32c80d34249e1cfb2e647ab3c8ef38a460c787f upstream. + +Add additional checks for program/config numbers to avoid loading from +invalid addresses. + +If prm_no/cfg_no is negative, skip uploading program/config. + +The tas2781-hda driver caused a NULL pointer dereference after loading +module, and before first runtime_suspend. + +the state was: +tas_priv->cur_conf = -1; +tas_priv->tasdevice[i].cur_conf = 0; +program = &(tas_fmw->programs[-1]); + +BUG: kernel NULL pointer dereference, address: 0000000000000010 +Call Trace: + + ? __die+0x23/0x70 + ? page_fault_oops+0x171/0x4e0 + ? vprintk_emit+0x175/0x2b0 + ? exc_page_fault+0x7f/0x180 + ? asm_exc_page_fault+0x26/0x30 + ? tasdevice_load_block_kernel+0x21/0x310 [snd_soc_tas2781_fmwlib] + tasdevice_select_tuningprm_cfg+0x268/0x3a0 [snd_soc_tas2781_fmwlib] + tasdevice_tuning_switch+0x69/0x710 [snd_soc_tas2781_fmwlib] + tas2781_hda_playback_hook+0xd4/0x110 [snd_hda_scodec_tas2781_i2c] + +Fixes: 915f5eadebd2 ("ASoC: tas2781: firmware lib") +CC: +Signed-off-by: Gergo Koteles +Link: https://msgid.link/r/523780155bfdca9bc0acd39efc79ed039454818d.1702591356.git.soyer@irl.hu +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/codecs/tas2781-fmwlib.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/sound/soc/codecs/tas2781-fmwlib.c ++++ b/sound/soc/codecs/tas2781-fmwlib.c +@@ -2219,11 +2219,11 @@ int tasdevice_select_tuningprm_cfg(void + goto out; + } + +- conf = &(tas_fmw->configs[cfg_no]); + for (i = 0, prog_status = 0; i < tas_priv->ndev; i++) { + if (cfg_info[rca_conf_no]->active_dev & (1 << i)) { +- if (tas_priv->tasdevice[i].cur_prog != prm_no +- || tas_priv->force_fwload_status) { ++ if (prm_no >= 0 ++ && (tas_priv->tasdevice[i].cur_prog != prm_no ++ || tas_priv->force_fwload_status)) { + tas_priv->tasdevice[i].cur_conf = -1; + tas_priv->tasdevice[i].is_loading = true; + prog_status++; +@@ -2258,7 +2258,8 @@ int tasdevice_select_tuningprm_cfg(void + } + + for (i = 0, status = 0; i < tas_priv->ndev; i++) { +- if (tas_priv->tasdevice[i].cur_conf != cfg_no ++ if (cfg_no >= 0 ++ && tas_priv->tasdevice[i].cur_conf != cfg_no + && (cfg_info[rca_conf_no]->active_dev & (1 << i)) + && (tas_priv->tasdevice[i].is_loaderr == false)) { + status++; +@@ -2268,6 +2269,7 @@ int tasdevice_select_tuningprm_cfg(void + } + + if (status) { ++ conf = &(tas_fmw->configs[cfg_no]); + status = 0; + tasdevice_load_data(tas_priv, &(conf->dev_data)); + for (i = 0; i < tas_priv->ndev; i++) { +@@ -2311,7 +2313,7 @@ int tasdevice_prmg_load(void *context, i + } + + for (i = 0, prog_status = 0; i < tas_priv->ndev; i++) { +- if (tas_priv->tasdevice[i].cur_prog != prm_no) { ++ if (prm_no >= 0 && tas_priv->tasdevice[i].cur_prog != prm_no) { + tas_priv->tasdevice[i].cur_conf = -1; + tas_priv->tasdevice[i].is_loading = true; + prog_status++; +@@ -2356,7 +2358,7 @@ int tasdevice_prmg_calibdata_load(void * + } + + for (i = 0, prog_status = 0; i < tas_priv->ndev; i++) { +- if (tas_priv->tasdevice[i].cur_prog != prm_no) { ++ if (prm_no >= 0 && tas_priv->tasdevice[i].cur_prog != prm_no) { + tas_priv->tasdevice[i].cur_conf = -1; + tas_priv->tasdevice[i].is_loading = true; + prog_status++; diff --git a/queue-6.6/bluetooth-add-more-enc-key-size-check.patch b/queue-6.6/bluetooth-add-more-enc-key-size-check.patch new file mode 100644 index 00000000000..317fd6033e9 --- /dev/null +++ b/queue-6.6/bluetooth-add-more-enc-key-size-check.patch @@ -0,0 +1,115 @@ +From 04a342cc49a8522e99c9b3346371c329d841dcd2 Mon Sep 17 00:00:00 2001 +From: Alex Lu +Date: Tue, 12 Dec 2023 10:30:34 +0800 +Subject: Bluetooth: Add more enc key size check + +From: Alex Lu + +commit 04a342cc49a8522e99c9b3346371c329d841dcd2 upstream. + +When we are slave role and receives l2cap conn req when encryption has +started, we should check the enc key size to avoid KNOB attack or BLUFFS +attack. +From SIG recommendation, implementations are advised to reject +service-level connections on an encrypted baseband link with key +strengths below 7 octets. +A simple and clear way to achieve this is to place the enc key size +check in hci_cc_read_enc_key_size() + +The btmon log below shows the case that lacks enc key size check. + +> HCI Event: Connect Request (0x04) plen 10 + Address: BB:22:33:44:55:99 (OUI BB-22-33) + Class: 0x480104 + Major class: Computer (desktop, notebook, PDA, organizers) + Minor class: Desktop workstation + Capturing (Scanner, Microphone) + Telephony (Cordless telephony, Modem, Headset) + Link type: ACL (0x01) +< HCI Command: Accept Connection Request (0x01|0x0009) plen 7 + Address: BB:22:33:44:55:99 (OUI BB-22-33) + Role: Peripheral (0x01) +> HCI Event: Command Status (0x0f) plen 4 + Accept Connection Request (0x01|0x0009) ncmd 2 + Status: Success (0x00) +> HCI Event: Connect Complete (0x03) plen 11 + Status: Success (0x00) + Handle: 1 + Address: BB:22:33:44:55:99 (OUI BB-22-33) + Link type: ACL (0x01) + Encryption: Disabled (0x00) +... + +> HCI Event: Encryption Change (0x08) plen 4 + Status: Success (0x00) + Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33) + Encryption: Enabled with E0 (0x01) +< HCI Command: Read Encryption Key Size (0x05|0x0008) plen 2 + Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33) +> HCI Event: Command Complete (0x0e) plen 7 + Read Encryption Key Size (0x05|0x0008) ncmd 2 + Status: Success (0x00) + Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33) + Key size: 6 +// We should check the enc key size +... + +> ACL Data RX: Handle 1 flags 0x02 dlen 12 + L2CAP: Connection Request (0x02) ident 3 len 4 + PSM: 25 (0x0019) + Source CID: 64 +< ACL Data TX: Handle 1 flags 0x00 dlen 16 + L2CAP: Connection Response (0x03) ident 3 len 8 + Destination CID: 64 + Source CID: 64 + Result: Connection pending (0x0001) + Status: Authorization pending (0x0002) +> HCI Event: Number of Completed Packets (0x13) plen 5 + Num handles: 1 + Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33) + Count: 1 + #35: len 16 (25 Kb/s) + Latency: 5 msec (2-7 msec ~4 msec) +< ACL Data TX: Handle 1 flags 0x00 dlen 16 + L2CAP: Connection Response (0x03) ident 3 len 8 + Destination CID: 64 + Source CID: 64 + Result: Connection successful (0x0000) + Status: No further information available (0x0000) + +Cc: stable@vger.kernel.org +Signed-off-by: Alex Lu +Signed-off-by: Max Chou +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/hci_event.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -750,9 +750,23 @@ static u8 hci_cc_read_enc_key_size(struc + } else { + conn->enc_key_size = rp->key_size; + status = 0; ++ ++ if (conn->enc_key_size < hdev->min_enc_key_size) { ++ /* As slave role, the conn->state has been set to ++ * BT_CONNECTED and l2cap conn req might not be received ++ * yet, at this moment the l2cap layer almost does ++ * nothing with the non-zero status. ++ * So we also clear encrypt related bits, and then the ++ * handler of l2cap conn req will get the right secure ++ * state at a later time. ++ */ ++ status = HCI_ERROR_AUTH_FAILURE; ++ clear_bit(HCI_CONN_ENCRYPT, &conn->flags); ++ clear_bit(HCI_CONN_AES_CCM, &conn->flags); ++ } + } + +- hci_encrypt_cfm(conn, 0); ++ hci_encrypt_cfm(conn, status); + + done: + hci_dev_unlock(hdev); diff --git a/queue-6.6/bluetooth-af_bluetooth-fix-use-after-free-in-bt_sock_recvmsg.patch b/queue-6.6/bluetooth-af_bluetooth-fix-use-after-free-in-bt_sock_recvmsg.patch new file mode 100644 index 00000000000..67bffe85c40 --- /dev/null +++ b/queue-6.6/bluetooth-af_bluetooth-fix-use-after-free-in-bt_sock_recvmsg.patch @@ -0,0 +1,55 @@ +From 2e07e8348ea454615e268222ae3fc240421be768 Mon Sep 17 00:00:00 2001 +From: Hyunwoo Kim +Date: Sat, 9 Dec 2023 05:55:18 -0500 +Subject: Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg + +From: Hyunwoo Kim + +commit 2e07e8348ea454615e268222ae3fc240421be768 upstream. + +This can cause a race with bt_sock_ioctl() because +bt_sock_recvmsg() gets the skb from sk->sk_receive_queue +and then frees it without holding lock_sock. +A use-after-free for a skb occurs with the following flow. +``` +bt_sock_recvmsg() -> skb_recv_datagram() -> skb_free_datagram() +bt_sock_ioctl() -> skb_peek() +``` +Add lock_sock to bt_sock_recvmsg() to fix this issue. + +Cc: stable@vger.kernel.org +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Hyunwoo Kim +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/af_bluetooth.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/net/bluetooth/af_bluetooth.c ++++ b/net/bluetooth/af_bluetooth.c +@@ -309,11 +309,14 @@ int bt_sock_recvmsg(struct socket *sock, + if (flags & MSG_OOB) + return -EOPNOTSUPP; + ++ lock_sock(sk); ++ + skb = skb_recv_datagram(sk, flags, &err); + if (!skb) { + if (sk->sk_shutdown & RCV_SHUTDOWN) +- return 0; ++ err = 0; + ++ release_sock(sk); + return err; + } + +@@ -343,6 +346,8 @@ int bt_sock_recvmsg(struct socket *sock, + + skb_free_datagram(sk, skb); + ++ release_sock(sk); ++ + if (flags & MSG_TRUNC) + copied = skblen; + diff --git a/queue-6.6/bluetooth-hci_event-fix-not-checking-if-hci_op_inquiry-has-been-sent.patch b/queue-6.6/bluetooth-hci_event-fix-not-checking-if-hci_op_inquiry-has-been-sent.patch new file mode 100644 index 00000000000..9fce9829741 --- /dev/null +++ b/queue-6.6/bluetooth-hci_event-fix-not-checking-if-hci_op_inquiry-has-been-sent.patch @@ -0,0 +1,34 @@ +From 99e67d46e5ff3c7c901af6009edec72d3d363be8 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Mon, 20 Nov 2023 10:04:39 -0500 +Subject: Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent + +From: Luiz Augusto von Dentz + +commit 99e67d46e5ff3c7c901af6009edec72d3d363be8 upstream. + +Before setting HCI_INQUIRY bit check if HCI_OP_INQUIRY was really sent +otherwise the controller maybe be generating invalid events or, more +likely, it is a result of fuzzing tools attempting to test the right +behavior of the stack when unexpected events are generated. + +Cc: stable@vger.kernel.org +Link: https://bugzilla.kernel.org/show_bug.cgi?id=218151 +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/hci_event.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -2305,7 +2305,8 @@ static void hci_cs_inquiry(struct hci_de + return; + } + +- set_bit(HCI_INQUIRY, &hdev->flags); ++ if (hci_sent_cmd_data(hdev, HCI_OP_INQUIRY)) ++ set_bit(HCI_INQUIRY, &hdev->flags); + } + + static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status) diff --git a/queue-6.6/bluetooth-l2cap-send-reject-on-command-corrupted-request.patch b/queue-6.6/bluetooth-l2cap-send-reject-on-command-corrupted-request.patch new file mode 100644 index 00000000000..f6c926b6fff --- /dev/null +++ b/queue-6.6/bluetooth-l2cap-send-reject-on-command-corrupted-request.patch @@ -0,0 +1,73 @@ +From 78b99eb1faa7371bf9c534690f26a71b6996622d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Danis?= +Date: Fri, 8 Dec 2023 18:41:50 +0100 +Subject: Bluetooth: L2CAP: Send reject on command corrupted request +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Frédéric Danis + +commit 78b99eb1faa7371bf9c534690f26a71b6996622d upstream. + +L2CAP/COS/CED/BI-02-C PTS test send a malformed L2CAP signaling packet +with 2 commands in it (a connection request and an unknown command) and +expect to get a connection response packet and a command reject packet. +The second is currently not sent. + +Cc: stable@vger.kernel.org +Signed-off-by: Frédéric Danis +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/l2cap_core.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -6492,6 +6492,14 @@ drop: + kfree_skb(skb); + } + ++static inline void l2cap_sig_send_rej(struct l2cap_conn *conn, u16 ident) ++{ ++ struct l2cap_cmd_rej_unk rej; ++ ++ rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); ++ l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej); ++} ++ + static inline void l2cap_sig_channel(struct l2cap_conn *conn, + struct sk_buff *skb) + { +@@ -6517,23 +6525,24 @@ static inline void l2cap_sig_channel(str + + if (len > skb->len || !cmd->ident) { + BT_DBG("corrupted command"); ++ l2cap_sig_send_rej(conn, cmd->ident); + break; + } + + err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data); + if (err) { +- struct l2cap_cmd_rej_unk rej; +- + BT_ERR("Wrong link type (%d)", err); +- +- rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); +- l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ, +- sizeof(rej), &rej); ++ l2cap_sig_send_rej(conn, cmd->ident); + } + + skb_pull(skb, len); + } + ++ if (skb->len > 0) { ++ BT_DBG("corrupted command"); ++ l2cap_sig_send_rej(conn, 0); ++ } ++ + drop: + kfree_skb(skb); + } diff --git a/queue-6.6/bluetooth-mgmt-smp-fix-address-type-when-using-smp-over-bredr-le.patch b/queue-6.6/bluetooth-mgmt-smp-fix-address-type-when-using-smp-over-bredr-le.patch new file mode 100644 index 00000000000..d3dda1b5d75 --- /dev/null +++ b/queue-6.6/bluetooth-mgmt-smp-fix-address-type-when-using-smp-over-bredr-le.patch @@ -0,0 +1,256 @@ +From 59b047bc98084f8af2c41483e4d68a5adf2fa7f7 Mon Sep 17 00:00:00 2001 +From: Xiao Yao +Date: Tue, 12 Dec 2023 00:27:18 +0800 +Subject: Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE + +From: Xiao Yao + +commit 59b047bc98084f8af2c41483e4d68a5adf2fa7f7 upstream. + +If two Bluetooth devices both support BR/EDR and BLE, and also +support Secure Connections, then they only need to pair once. +The LTK generated during the LE pairing process may be converted +into a BR/EDR link key for BR/EDR transport, and conversely, a +link key generated during the BR/EDR SSP pairing process can be +converted into an LTK for LE transport. Hence, the link type of +the link key and LTK is not fixed, they can be either an LE LINK +or an ACL LINK. + +Currently, in the mgmt_new_irk/ltk/crsk/link_key functions, the +link type is fixed, which could lead to incorrect address types +being reported to the application layer. Therefore, it is necessary +to add link_type/addr_type to the smp_irk/ltk/crsk and link_key, +to ensure the generation of the correct address type. + +SMP over BREDR: +Before Fix: +> ACL Data RX: Handle 11 flags 0x02 dlen 12 + BR/EDR SMP: Identity Address Information (0x09) len 7 + Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) +@ MGMT Event: New Identity Resolving Key (0x0018) plen 30 + Random address: 00:00:00:00:00:00 (Non-Resolvable) + LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) +@ MGMT Event: New Long Term Key (0x000a) plen 37 + LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) + Key type: Authenticated key from P-256 (0x03) + +After Fix: +> ACL Data RX: Handle 11 flags 0x02 dlen 12 + BR/EDR SMP: Identity Address Information (0x09) len 7 + Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) +@ MGMT Event: New Identity Resolving Key (0x0018) plen 30 + Random address: 00:00:00:00:00:00 (Non-Resolvable) + BR/EDR Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) +@ MGMT Event: New Long Term Key (0x000a) plen 37 + BR/EDR Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) + Key type: Authenticated key from P-256 (0x03) + +SMP over LE: +Before Fix: +@ MGMT Event: New Identity Resolving Key (0x0018) plen 30 + Random address: 5F:5C:07:37:47:D5 (Resolvable) + LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) +@ MGMT Event: New Long Term Key (0x000a) plen 37 + LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) + Key type: Authenticated key from P-256 (0x03) +@ MGMT Event: New Link Key (0x0009) plen 26 + BR/EDR Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) + Key type: Authenticated Combination key from P-256 (0x08) + +After Fix: +@ MGMT Event: New Identity Resolving Key (0x0018) plen 30 + Random address: 5E:03:1C:00:38:21 (Resolvable) + LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) +@ MGMT Event: New Long Term Key (0x000a) plen 37 + LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) + Key type: Authenticated key from P-256 (0x03) +@ MGMT Event: New Link Key (0x0009) plen 26 + Store hint: Yes (0x01) + LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76) + Key type: Authenticated Combination key from P-256 (0x08) + +Cc: stable@vger.kernel.org +Signed-off-by: Xiao Yao +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + include/net/bluetooth/hci_core.h | 5 +++++ + net/bluetooth/mgmt.c | 25 ++++++++++++++++++------- + net/bluetooth/smp.c | 7 +++++++ + 3 files changed, 30 insertions(+), 7 deletions(-) + +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -189,6 +189,7 @@ struct blocked_key { + struct smp_csrk { + bdaddr_t bdaddr; + u8 bdaddr_type; ++ u8 link_type; + u8 type; + u8 val[16]; + }; +@@ -198,6 +199,7 @@ struct smp_ltk { + struct rcu_head rcu; + bdaddr_t bdaddr; + u8 bdaddr_type; ++ u8 link_type; + u8 authenticated; + u8 type; + u8 enc_size; +@@ -212,6 +214,7 @@ struct smp_irk { + bdaddr_t rpa; + bdaddr_t bdaddr; + u8 addr_type; ++ u8 link_type; + u8 val[16]; + }; + +@@ -219,6 +222,8 @@ struct link_key { + struct list_head list; + struct rcu_head rcu; + bdaddr_t bdaddr; ++ u8 bdaddr_type; ++ u8 link_type; + u8 type; + u8 val[HCI_LINK_KEY_SIZE]; + u8 pin_len; +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -2897,7 +2897,8 @@ static int load_link_keys(struct sock *s + for (i = 0; i < key_count; i++) { + struct mgmt_link_key_info *key = &cp->keys[i]; + +- if (key->addr.type != BDADDR_BREDR || key->type > 0x08) ++ /* Considering SMP over BREDR/LE, there is no need to check addr_type */ ++ if (key->type > 0x08) + return mgmt_cmd_status(sk, hdev->id, + MGMT_OP_LOAD_LINK_KEYS, + MGMT_STATUS_INVALID_PARAMS); +@@ -7130,6 +7131,7 @@ static int load_irks(struct sock *sk, st + + for (i = 0; i < irk_count; i++) { + struct mgmt_irk_info *irk = &cp->irks[i]; ++ u8 addr_type = le_addr_type(irk->addr.type); + + if (hci_is_blocked_key(hdev, + HCI_BLOCKED_KEY_TYPE_IRK, +@@ -7139,8 +7141,12 @@ static int load_irks(struct sock *sk, st + continue; + } + ++ /* When using SMP over BR/EDR, the addr type should be set to BREDR */ ++ if (irk->addr.type == BDADDR_BREDR) ++ addr_type = BDADDR_BREDR; ++ + hci_add_irk(hdev, &irk->addr.bdaddr, +- le_addr_type(irk->addr.type), irk->val, ++ addr_type, irk->val, + BDADDR_ANY); + } + +@@ -7221,6 +7227,7 @@ static int load_long_term_keys(struct so + for (i = 0; i < key_count; i++) { + struct mgmt_ltk_info *key = &cp->keys[i]; + u8 type, authenticated; ++ u8 addr_type = le_addr_type(key->addr.type); + + if (hci_is_blocked_key(hdev, + HCI_BLOCKED_KEY_TYPE_LTK, +@@ -7255,8 +7262,12 @@ static int load_long_term_keys(struct so + continue; + } + ++ /* When using SMP over BR/EDR, the addr type should be set to BREDR */ ++ if (key->addr.type == BDADDR_BREDR) ++ addr_type = BDADDR_BREDR; ++ + hci_add_ltk(hdev, &key->addr.bdaddr, +- le_addr_type(key->addr.type), type, authenticated, ++ addr_type, type, authenticated, + key->val, key->enc_size, key->ediv, key->rand); + } + +@@ -9523,7 +9534,7 @@ void mgmt_new_link_key(struct hci_dev *h + + ev.store_hint = persistent; + bacpy(&ev.key.addr.bdaddr, &key->bdaddr); +- ev.key.addr.type = BDADDR_BREDR; ++ ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type); + ev.key.type = key->type; + memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); + ev.key.pin_len = key->pin_len; +@@ -9574,7 +9585,7 @@ void mgmt_new_ltk(struct hci_dev *hdev, + ev.store_hint = persistent; + + bacpy(&ev.key.addr.bdaddr, &key->bdaddr); +- ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); ++ ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type); + ev.key.type = mgmt_ltk_type(key); + ev.key.enc_size = key->enc_size; + ev.key.ediv = key->ediv; +@@ -9603,7 +9614,7 @@ void mgmt_new_irk(struct hci_dev *hdev, + + bacpy(&ev.rpa, &irk->rpa); + bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); +- ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); ++ ev.irk.addr.type = link_to_bdaddr(irk->link_type, irk->addr_type); + memcpy(ev.irk.val, irk->val, sizeof(irk->val)); + + mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); +@@ -9632,7 +9643,7 @@ void mgmt_new_csrk(struct hci_dev *hdev, + ev.store_hint = persistent; + + bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); +- ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); ++ ev.key.addr.type = link_to_bdaddr(csrk->link_type, csrk->bdaddr_type); + ev.key.type = csrk->type; + memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); + +--- a/net/bluetooth/smp.c ++++ b/net/bluetooth/smp.c +@@ -1060,6 +1060,7 @@ static void smp_notify_keys(struct l2cap + } + + if (smp->remote_irk) { ++ smp->remote_irk->link_type = hcon->type; + mgmt_new_irk(hdev, smp->remote_irk, persistent); + + /* Now that user space can be considered to know the +@@ -1079,24 +1080,28 @@ static void smp_notify_keys(struct l2cap + } + + if (smp->csrk) { ++ smp->csrk->link_type = hcon->type; + smp->csrk->bdaddr_type = hcon->dst_type; + bacpy(&smp->csrk->bdaddr, &hcon->dst); + mgmt_new_csrk(hdev, smp->csrk, persistent); + } + + if (smp->responder_csrk) { ++ smp->responder_csrk->link_type = hcon->type; + smp->responder_csrk->bdaddr_type = hcon->dst_type; + bacpy(&smp->responder_csrk->bdaddr, &hcon->dst); + mgmt_new_csrk(hdev, smp->responder_csrk, persistent); + } + + if (smp->ltk) { ++ smp->ltk->link_type = hcon->type; + smp->ltk->bdaddr_type = hcon->dst_type; + bacpy(&smp->ltk->bdaddr, &hcon->dst); + mgmt_new_ltk(hdev, smp->ltk, persistent); + } + + if (smp->responder_ltk) { ++ smp->responder_ltk->link_type = hcon->type; + smp->responder_ltk->bdaddr_type = hcon->dst_type; + bacpy(&smp->responder_ltk->bdaddr, &hcon->dst); + mgmt_new_ltk(hdev, smp->responder_ltk, persistent); +@@ -1116,6 +1121,8 @@ static void smp_notify_keys(struct l2cap + key = hci_add_link_key(hdev, smp->conn->hcon, &hcon->dst, + smp->link_key, type, 0, &persistent); + if (key) { ++ key->link_type = hcon->type; ++ key->bdaddr_type = hcon->dst_type; + mgmt_new_link_key(hdev, key, persistent); + + /* Don't keep debug keys around if the relevant diff --git a/queue-6.6/net-usb-ax88179_178a-avoid-failed-operations-when-device-is-disconnected.patch b/queue-6.6/net-usb-ax88179_178a-avoid-failed-operations-when-device-is-disconnected.patch new file mode 100644 index 00000000000..da6af58b1cb --- /dev/null +++ b/queue-6.6/net-usb-ax88179_178a-avoid-failed-operations-when-device-is-disconnected.patch @@ -0,0 +1,114 @@ +From aef05e349bfd81c95adb4489639413fadbb74a83 Mon Sep 17 00:00:00 2001 +From: Jose Ignacio Tornos Martinez +Date: Thu, 7 Dec 2023 18:50:07 +0100 +Subject: net: usb: ax88179_178a: avoid failed operations when device is disconnected + +From: Jose Ignacio Tornos Martinez + +commit aef05e349bfd81c95adb4489639413fadbb74a83 upstream. + +When the device is disconnected we get the following messages showing +failed operations: +Nov 28 20:22:11 localhost kernel: usb 2-3: USB disconnect, device number 2 +Nov 28 20:22:11 localhost kernel: ax88179_178a 2-3:1.0 enp2s0u3: unregister 'ax88179_178a' usb-0000:02:00.0-3, ASIX AX88179 USB 3.0 Gigabit Ethernet +Nov 28 20:22:11 localhost kernel: ax88179_178a 2-3:1.0 enp2s0u3: Failed to read reg index 0x0002: -19 +Nov 28 20:22:11 localhost kernel: ax88179_178a 2-3:1.0 enp2s0u3: Failed to write reg index 0x0002: -19 +Nov 28 20:22:11 localhost kernel: ax88179_178a 2-3:1.0 enp2s0u3 (unregistered): Failed to write reg index 0x0002: -19 +Nov 28 20:22:11 localhost kernel: ax88179_178a 2-3:1.0 enp2s0u3 (unregistered): Failed to write reg index 0x0001: -19 +Nov 28 20:22:11 localhost kernel: ax88179_178a 2-3:1.0 enp2s0u3 (unregistered): Failed to write reg index 0x0002: -19 + +The reason is that although the device is detached, normal stop and +unbind operations are commanded from the driver. These operations are +not necessary in this situation, so avoid these logs when the device is +detached if the result of the operation is -ENODEV and if the new flag +informing about the disconnecting status is enabled. + +cc: +Fixes: e2ca90c276e1f ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver") +Signed-off-by: Jose Ignacio Tornos Martinez +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/20231207175007.263907-1-jtornosm@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/ax88179_178a.c | 23 ++++++++++++++++++++--- + 1 file changed, 20 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c +index 4ea0e155bb0d..5a1bf42ce156 100644 +--- a/drivers/net/usb/ax88179_178a.c ++++ b/drivers/net/usb/ax88179_178a.c +@@ -173,6 +173,7 @@ struct ax88179_data { + u8 in_pm; + u32 wol_supported; + u32 wolopts; ++ u8 disconnecting; + }; + + struct ax88179_int_data { +@@ -208,6 +209,7 @@ static int __ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, + { + int ret; + int (*fn)(struct usbnet *, u8, u8, u16, u16, void *, u16); ++ struct ax88179_data *ax179_data = dev->driver_priv; + + BUG_ON(!dev); + +@@ -219,7 +221,7 @@ static int __ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, + ret = fn(dev, cmd, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + value, index, data, size); + +- if (unlikely(ret < 0)) ++ if (unlikely((ret < 0) && !(ret == -ENODEV && ax179_data->disconnecting))) + netdev_warn(dev->net, "Failed to read reg index 0x%04x: %d\n", + index, ret); + +@@ -231,6 +233,7 @@ static int __ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, + { + int ret; + int (*fn)(struct usbnet *, u8, u8, u16, u16, const void *, u16); ++ struct ax88179_data *ax179_data = dev->driver_priv; + + BUG_ON(!dev); + +@@ -242,7 +245,7 @@ static int __ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index, + ret = fn(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + value, index, data, size); + +- if (unlikely(ret < 0)) ++ if (unlikely((ret < 0) && !(ret == -ENODEV && ax179_data->disconnecting))) + netdev_warn(dev->net, "Failed to write reg index 0x%04x: %d\n", + index, ret); + +@@ -492,6 +495,20 @@ static int ax88179_resume(struct usb_interface *intf) + return usbnet_resume(intf); + } + ++static void ax88179_disconnect(struct usb_interface *intf) ++{ ++ struct usbnet *dev = usb_get_intfdata(intf); ++ struct ax88179_data *ax179_data; ++ ++ if (!dev) ++ return; ++ ++ ax179_data = dev->driver_priv; ++ ax179_data->disconnecting = 1; ++ ++ usbnet_disconnect(intf); ++} ++ + static void + ax88179_get_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo) + { +@@ -1906,7 +1923,7 @@ static struct usb_driver ax88179_178a_driver = { + .suspend = ax88179_suspend, + .resume = ax88179_resume, + .reset_resume = ax88179_resume, +- .disconnect = usbnet_disconnect, ++ .disconnect = ax88179_disconnect, + .supports_autosuspend = 1, + .disable_hub_initiated_lpm = 1, + }; +-- +2.43.0 + diff --git a/queue-6.6/series b/queue-6.6/series index e1f00218f0e..f7726cef85e 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -96,3 +96,21 @@ iio-triggered-buffer-prevent-possible-freeing-of-wrong-buffer.patch alsa-usb-audio-increase-delay-in-motu-m-quirk.patch arm-dts-fix-occasional-boot-hang-for-am3-usb.patch usb-storage-add-quirk-for-incorrect-wp-on-kingston-dt-ultimate-3.0-g3.patch +wifi-mt76-fix-crash-with-wed-rx-support-enabled.patch +wifi-cfg80211-add-my-certificate.patch +wifi-cfg80211-fix-certs-build-to-not-depend-on-file-order.patch +usb-serial-ftdi_sio-update-actisense-pids-constant-names.patch +usb-serial-option-add-quectel-eg912y-module-support.patch +usb-serial-option-add-foxconn-t99w265-with-new-baseline.patch +usb-serial-option-add-quectel-rm500q-r13-firmware-support.patch +alsa-hda-tas2781-select-program-0-conf-0-by-default.patch +alsa-hda-realtek-add-quirk-for-asus-rog-gv302xa.patch +asoc-tas2781-check-the-validity-of-prm_no-cfg_no.patch +bluetooth-hci_event-fix-not-checking-if-hci_op_inquiry-has-been-sent.patch +bluetooth-af_bluetooth-fix-use-after-free-in-bt_sock_recvmsg.patch +bluetooth-l2cap-send-reject-on-command-corrupted-request.patch +bluetooth-mgmt-smp-fix-address-type-when-using-smp-over-bredr-le.patch +bluetooth-add-more-enc-key-size-check.patch +usb-typec-ucsi-fix-gpio-based-orientation-detection.patch +usb-fotg210-hcd-delete-an-incorrect-bounds-test.patch +net-usb-ax88179_178a-avoid-failed-operations-when-device-is-disconnected.patch diff --git a/queue-6.6/usb-fotg210-hcd-delete-an-incorrect-bounds-test.patch b/queue-6.6/usb-fotg210-hcd-delete-an-incorrect-bounds-test.patch new file mode 100644 index 00000000000..36377cc5e0b --- /dev/null +++ b/queue-6.6/usb-fotg210-hcd-delete-an-incorrect-bounds-test.patch @@ -0,0 +1,57 @@ +From 7fbcd195e2b8cc952e4aeaeb50867b798040314c Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 13 Dec 2023 16:22:43 +0300 +Subject: usb: fotg210-hcd: delete an incorrect bounds test + +From: Dan Carpenter + +commit 7fbcd195e2b8cc952e4aeaeb50867b798040314c upstream. + +Here "temp" is the number of characters that we have written and "size" +is the size of the buffer. The intent was clearly to say that if we have +written to the end of the buffer then stop. + +However, for that to work the comparison should have been done on the +original "size" value instead of the "size -= temp" value. Not only +will that not trigger when we want to, but there is a small chance that +it will trigger incorrectly before we want it to and we break from the +loop slightly earlier than intended. + +This code was recently changed from using snprintf() to scnprintf(). With +snprintf() we likely would have continued looping and passed a negative +size parameter to snprintf(). This would have triggered an annoying +WARN(). Now that we have converted to scnprintf() "size" will never +drop below 1 and there is no real need for this test. We could change +the condition to "if (temp <= 1) goto done;" but just deleting the test +is cleanest. + +Fixes: 7d50195f6c50 ("usb: host: Faraday fotg210-hcd driver") +Cc: stable +Signed-off-by: Dan Carpenter +Reviewed-by: Linus Walleij +Reviewed-by: Lee Jones +Link: https://lore.kernel.org/r/ZXmwIwHe35wGfgzu@suswa +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/fotg210/fotg210-hcd.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/usb/fotg210/fotg210-hcd.c ++++ b/drivers/usb/fotg210/fotg210-hcd.c +@@ -428,8 +428,6 @@ static void qh_lines(struct fotg210_hcd + temp = size; + size -= temp; + next += temp; +- if (temp == size) +- goto done; + } + + temp = snprintf(next, size, "\n"); +@@ -439,7 +437,6 @@ static void qh_lines(struct fotg210_hcd + size -= temp; + next += temp; + +-done: + *sizep = size; + *nextp = next; + } diff --git a/queue-6.6/usb-serial-ftdi_sio-update-actisense-pids-constant-names.patch b/queue-6.6/usb-serial-ftdi_sio-update-actisense-pids-constant-names.patch new file mode 100644 index 00000000000..56126869de4 --- /dev/null +++ b/queue-6.6/usb-serial-ftdi_sio-update-actisense-pids-constant-names.patch @@ -0,0 +1,51 @@ +From 513d88a88e0203188a38f4647dd08170aebd85df Mon Sep 17 00:00:00 2001 +From: Mark Glover +Date: Wed, 20 Dec 2023 13:57:40 +0000 +Subject: USB: serial: ftdi_sio: update Actisense PIDs constant names + +From: Mark Glover + +commit 513d88a88e0203188a38f4647dd08170aebd85df upstream. + +Update the constant names for unused USB PIDs (product identifiers) to +reflect the new products now using the PIDs. + +Signed-off-by: Mark Glover +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/ftdi_sio.c | 6 +++--- + drivers/usb/serial/ftdi_sio_ids.h | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1033,9 +1033,9 @@ static const struct usb_device_id id_tab + { USB_DEVICE(FTDI_VID, ACTISENSE_USG_PID) }, + { USB_DEVICE(FTDI_VID, ACTISENSE_NGT_PID) }, + { USB_DEVICE(FTDI_VID, ACTISENSE_NGW_PID) }, +- { USB_DEVICE(FTDI_VID, ACTISENSE_D9AC_PID) }, +- { USB_DEVICE(FTDI_VID, ACTISENSE_D9AD_PID) }, +- { USB_DEVICE(FTDI_VID, ACTISENSE_D9AE_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_UID_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_USA_PID) }, ++ { USB_DEVICE(FTDI_VID, ACTISENSE_NGX_PID) }, + { USB_DEVICE(FTDI_VID, ACTISENSE_D9AF_PID) }, + { USB_DEVICE(FTDI_VID, CHETCO_SEAGAUGE_PID) }, + { USB_DEVICE(FTDI_VID, CHETCO_SEASWITCH_PID) }, +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -1568,9 +1568,9 @@ + #define ACTISENSE_USG_PID 0xD9A9 /* USG USB Serial Adapter */ + #define ACTISENSE_NGT_PID 0xD9AA /* NGT NMEA2000 Interface */ + #define ACTISENSE_NGW_PID 0xD9AB /* NGW NMEA2000 Gateway */ +-#define ACTISENSE_D9AC_PID 0xD9AC /* Actisense Reserved */ +-#define ACTISENSE_D9AD_PID 0xD9AD /* Actisense Reserved */ +-#define ACTISENSE_D9AE_PID 0xD9AE /* Actisense Reserved */ ++#define ACTISENSE_UID_PID 0xD9AC /* USB Isolating Device */ ++#define ACTISENSE_USA_PID 0xD9AD /* USB to Serial Adapter */ ++#define ACTISENSE_NGX_PID 0xD9AE /* NGX NMEA2000 Gateway */ + #define ACTISENSE_D9AF_PID 0xD9AF /* Actisense Reserved */ + #define CHETCO_SEAGAUGE_PID 0xA548 /* SeaGauge USB Adapter */ + #define CHETCO_SEASWITCH_PID 0xA549 /* SeaSwitch USB Adapter */ diff --git a/queue-6.6/usb-serial-option-add-foxconn-t99w265-with-new-baseline.patch b/queue-6.6/usb-serial-option-add-foxconn-t99w265-with-new-baseline.patch new file mode 100644 index 00000000000..95cd2044d04 --- /dev/null +++ b/queue-6.6/usb-serial-option-add-foxconn-t99w265-with-new-baseline.patch @@ -0,0 +1,48 @@ +From 13fde9ac23ca8c6d1ac13cc9eefe1f1ac3ee30a4 Mon Sep 17 00:00:00 2001 +From: Slark Xiao +Date: Fri, 1 Dec 2023 10:09:50 +0800 +Subject: USB: serial: option: add Foxconn T99W265 with new baseline + +From: Slark Xiao + +commit 13fde9ac23ca8c6d1ac13cc9eefe1f1ac3ee30a4 upstream. + +This ID was added based on latest SDX12 code base line, and we +made some changes with previous 0489:e0db. + +Test evidence as below: +T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 2 +P: Vendor=0489 ProdID=e0da Rev=05.04 +S: Manufacturer=Qualcomm +S: Product=Qualcomm Snapdragon X12 +S: SerialNumber=2bda65fb +C: #Ifs= 6 Cfg#= 2 Atr=a0 MxPwr=896mA +I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +I: If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) + +0&1: MBIM, 2: Modem, 3:GNSS, 4:Diag, 5:ADB + +Signed-off-by: Slark Xiao +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2244,6 +2244,8 @@ static const struct usb_device_id option + .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, + { USB_DEVICE(0x0489, 0xe0b5), /* Foxconn T77W968 ESIM */ + .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0da, 0xff), /* Foxconn T99W265 MBIM variant */ ++ .driver_info = RSVD(3) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0db, 0xff), /* Foxconn T99W265 MBIM */ + .driver_info = RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0ee, 0xff), /* Foxconn T99W368 MBIM */ diff --git a/queue-6.6/usb-serial-option-add-quectel-eg912y-module-support.patch b/queue-6.6/usb-serial-option-add-quectel-eg912y-module-support.patch new file mode 100644 index 00000000000..f11cd62059d --- /dev/null +++ b/queue-6.6/usb-serial-option-add-quectel-eg912y-module-support.patch @@ -0,0 +1,65 @@ +From 6d79d9434c69bb8ffa8a631050eb0ad6b83d3e90 Mon Sep 17 00:00:00 2001 +From: Alper Ak +Date: Tue, 8 Aug 2023 13:51:58 +0300 +Subject: USB: serial: option: add Quectel EG912Y module support + +From: Alper Ak + +commit 6d79d9434c69bb8ffa8a631050eb0ad6b83d3e90 upstream. + +Add Quectel EG912Y "DIAG, AT, MODEM" + +0x6001: ECM / RNDIS + DIAG + AT + MODEM + +T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2c7c ProdID=6001 Rev= 3.18 +S: Manufacturer=Android +S: Product=Android +S: SerialNumber=0000 +C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=06 Prot=00 +I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms +I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=88(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Signed-off-by: Alper Ak +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -272,6 +272,7 @@ static void option_instat_callback(struc + #define QUECTEL_PRODUCT_RM500Q 0x0800 + #define QUECTEL_PRODUCT_RM520N 0x0801 + #define QUECTEL_PRODUCT_EC200U 0x0901 ++#define QUECTEL_PRODUCT_EG912Y 0x6001 + #define QUECTEL_PRODUCT_EC200S_CN 0x6002 + #define QUECTEL_PRODUCT_EC200A 0x6005 + #define QUECTEL_PRODUCT_EM061K_LWW 0x6008 +@@ -1244,6 +1245,7 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200U, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG912Y, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) }, + + { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, diff --git a/queue-6.6/usb-serial-option-add-quectel-rm500q-r13-firmware-support.patch b/queue-6.6/usb-serial-option-add-quectel-rm500q-r13-firmware-support.patch new file mode 100644 index 00000000000..14dd810befe --- /dev/null +++ b/queue-6.6/usb-serial-option-add-quectel-rm500q-r13-firmware-support.patch @@ -0,0 +1,57 @@ +From 06f22cd6635bdae7d73566fca9879b2026a08e00 Mon Sep 17 00:00:00 2001 +From: Reinhard Speyerer +Date: Tue, 12 Dec 2023 18:15:38 +0100 +Subject: USB: serial: option: add Quectel RM500Q R13 firmware support + +From: Reinhard Speyerer + +commit 06f22cd6635bdae7d73566fca9879b2026a08e00 upstream. + +Add support for Quectel RM500Q R13 firmware which uses Prot=40 for the +NMEA port: + +T: Bus=02 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 8 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 +P: Vendor=2c7c ProdID=0800 Rev= 4.14 +S: Manufacturer=Quectel +S: Product=RM500Q-AE +S: SerialNumber=xxxxxxxx +C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=896mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +Signed-off-by: Reinhard Speyerer +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1233,6 +1233,7 @@ static const struct usb_device_id option + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, 0x0700, 0xff), /* BG95 */ + .driver_info = RSVD(3) | ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x30) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10), + .driver_info = ZLP }, diff --git a/queue-6.6/usb-typec-ucsi-fix-gpio-based-orientation-detection.patch b/queue-6.6/usb-typec-ucsi-fix-gpio-based-orientation-detection.patch new file mode 100644 index 00000000000..153961367db --- /dev/null +++ b/queue-6.6/usb-typec-ucsi-fix-gpio-based-orientation-detection.patch @@ -0,0 +1,36 @@ +From c994cb596bf7ef5928f06331c76f46e071b16f09 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 8 Dec 2023 13:36:02 +0100 +Subject: usb: typec: ucsi: fix gpio-based orientation detection + +From: Johan Hovold + +commit c994cb596bf7ef5928f06331c76f46e071b16f09 upstream. + +Fix the recently added connector sanity check which was off by one and +prevented orientation notifications from being handled correctly for the +second port when using GPIOs to determine orientation. + +Fixes: c6165ed2f425 ("usb: ucsi: glink: use the connector orientation GPIO to provide switch events") +Cc: stable +Cc: Neil Armstrong +Signed-off-by: Johan Hovold +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20231208123603.29957-1-johan+linaro@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi_glink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/typec/ucsi/ucsi_glink.c ++++ b/drivers/usb/typec/ucsi/ucsi_glink.c +@@ -228,7 +228,7 @@ static void pmic_glink_ucsi_notify(struc + + con_num = UCSI_CCI_CONNECTOR(cci); + if (con_num) { +- if (con_num < PMIC_GLINK_MAX_PORTS && ++ if (con_num <= PMIC_GLINK_MAX_PORTS && + ucsi->port_orientation[con_num - 1]) { + int orientation = gpiod_get_value(ucsi->port_orientation[con_num - 1]); + diff --git a/queue-6.6/wifi-cfg80211-add-my-certificate.patch b/queue-6.6/wifi-cfg80211-add-my-certificate.patch new file mode 100644 index 00000000000..c77d7d0a58a --- /dev/null +++ b/queue-6.6/wifi-cfg80211-add-my-certificate.patch @@ -0,0 +1,123 @@ +From fb768d3b13ffa325b7e84480d488ac799c9d2cd7 Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Thu, 7 Dec 2023 21:20:50 +0800 +Subject: wifi: cfg80211: Add my certificate + +From: Chen-Yu Tsai + +commit fb768d3b13ffa325b7e84480d488ac799c9d2cd7 upstream. + +As announced [1][2], I have taken over maintainership of the +wireless-regdb project. + +Add my certificate so that newer releases are valid to the kernel. +Seth's certificate should be kept around for awhile, at least until +a few new releases by me happen. + +This should also be applied to stable trees so that stable kernels +can utilize newly released database binaries. + +[1] https://lore.kernel.org/linux-wireless/CAGb2v657baNMPKU3QADijx7hZa=GUcSv2LEDdn6N=QQaFX8r-g@mail.gmail.com/ +[2] https://lore.kernel.org/linux-wireless/ZWmRR5ul7EDfxCan@wens.tw/ + +Cc: stable@vger.kernel.org +Signed-off-by: Chen-Yu Tsai +Acked-by: Seth Forshee +Link: https://msgid.link/ZXHGsqs34qZyzZng@wens.tw +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/wireless/certs/wens.hex | 87 ++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 87 insertions(+) + create mode 100644 net/wireless/certs/wens.hex + +--- /dev/null ++++ b/net/wireless/certs/wens.hex +@@ -0,0 +1,87 @@ ++/* Chen-Yu Tsai's regdb certificate */ ++0x30, 0x82, 0x02, 0xa7, 0x30, 0x82, 0x01, 0x8f, ++0x02, 0x14, 0x61, 0xc0, 0x38, 0x65, 0x1a, 0xab, ++0xdc, 0xf9, 0x4b, 0xd0, 0xac, 0x7f, 0xf0, 0x6c, ++0x72, 0x48, 0xdb, 0x18, 0xc6, 0x00, 0x30, 0x0d, ++0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, ++0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x0f, 0x31, ++0x0d, 0x30, 0x0b, 0x06, 0x03, 0x55, 0x04, 0x03, ++0x0c, 0x04, 0x77, 0x65, 0x6e, 0x73, 0x30, 0x20, ++0x17, 0x0d, 0x32, 0x33, 0x31, 0x32, 0x30, 0x31, ++0x30, 0x37, 0x34, 0x31, 0x31, 0x34, 0x5a, 0x18, ++0x0f, 0x32, 0x31, 0x32, 0x33, 0x31, 0x31, 0x30, ++0x37, 0x30, 0x37, 0x34, 0x31, 0x31, 0x34, 0x5a, ++0x30, 0x0f, 0x31, 0x0d, 0x30, 0x0b, 0x06, 0x03, ++0x55, 0x04, 0x03, 0x0c, 0x04, 0x77, 0x65, 0x6e, ++0x73, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, ++0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, ++0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, ++0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, ++0x01, 0x00, 0xa9, 0x7a, 0x2c, 0x78, 0x4d, 0xa7, ++0x19, 0x2d, 0x32, 0x52, 0xa0, 0x2e, 0x6c, 0xef, ++0x88, 0x7f, 0x15, 0xc5, 0xb6, 0x69, 0x54, 0x16, ++0x43, 0x14, 0x79, 0x53, 0xb7, 0xae, 0x88, 0xfe, ++0xc0, 0xb7, 0x5d, 0x47, 0x8e, 0x1a, 0xe1, 0xef, ++0xb3, 0x90, 0x86, 0xda, 0xd3, 0x64, 0x81, 0x1f, ++0xce, 0x5d, 0x9e, 0x4b, 0x6e, 0x58, 0x02, 0x3e, ++0xb2, 0x6f, 0x5e, 0x42, 0x47, 0x41, 0xf4, 0x2c, ++0xb8, 0xa8, 0xd4, 0xaa, 0xc0, 0x0e, 0xe6, 0x48, ++0xf0, 0xa8, 0xce, 0xcb, 0x08, 0xae, 0x37, 0xaf, ++0xf6, 0x40, 0x39, 0xcb, 0x55, 0x6f, 0x5b, 0x4f, ++0x85, 0x34, 0xe6, 0x69, 0x10, 0x50, 0x72, 0x5e, ++0x4e, 0x9d, 0x4c, 0xba, 0x38, 0x36, 0x0d, 0xce, ++0x73, 0x38, 0xd7, 0x27, 0x02, 0x2a, 0x79, 0x03, ++0xe1, 0xac, 0xcf, 0xb0, 0x27, 0x85, 0x86, 0x93, ++0x17, 0xab, 0xec, 0x42, 0x77, 0x37, 0x65, 0x8a, ++0x44, 0xcb, 0xd6, 0x42, 0x93, 0x92, 0x13, 0xe3, ++0x39, 0x45, 0xc5, 0x6e, 0x00, 0x4a, 0x7f, 0xcb, ++0x42, 0x17, 0x2b, 0x25, 0x8c, 0xb8, 0x17, 0x3b, ++0x15, 0x36, 0x59, 0xde, 0x42, 0xce, 0x21, 0xe6, ++0xb6, 0xc7, 0x6e, 0x5e, 0x26, 0x1f, 0xf7, 0x8a, ++0x57, 0x9e, 0xa5, 0x96, 0x72, 0xb7, 0x02, 0x32, ++0xeb, 0x07, 0x2b, 0x73, 0xe2, 0x4f, 0x66, 0x58, ++0x9a, 0xeb, 0x0f, 0x07, 0xb6, 0xab, 0x50, 0x8b, ++0xc3, 0x8f, 0x17, 0xfa, 0x0a, 0x99, 0xc2, 0x16, ++0x25, 0xbf, 0x2d, 0x6b, 0x1a, 0xaa, 0xe6, 0x3e, ++0x5f, 0xeb, 0x6d, 0x9b, 0x5d, 0x4d, 0x42, 0x83, ++0x2d, 0x39, 0xb8, 0xc9, 0xac, 0xdb, 0x3a, 0x91, ++0x50, 0xdf, 0xbb, 0xb1, 0x76, 0x6d, 0x15, 0x73, ++0xfd, 0xc6, 0xe6, 0x6b, 0x71, 0x9e, 0x67, 0x36, ++0x22, 0x83, 0x79, 0xb1, 0xd6, 0xb8, 0x84, 0x52, ++0xaf, 0x96, 0x5b, 0xc3, 0x63, 0x02, 0x4e, 0x78, ++0x70, 0x57, 0x02, 0x03, 0x01, 0x00, 0x01, 0x30, ++0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, ++0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, ++0x01, 0x01, 0x00, 0x24, 0x28, 0xee, 0x22, 0x74, ++0x7f, 0x7c, 0xfa, 0x6c, 0x1f, 0xb3, 0x18, 0xd1, ++0xc2, 0x3d, 0x7d, 0x29, 0x42, 0x88, 0xad, 0x82, ++0xa5, 0xb1, 0x8a, 0x05, 0xd0, 0xec, 0x5c, 0x91, ++0x20, 0xf6, 0x82, 0xfd, 0xd5, 0x67, 0x60, 0x5f, ++0x31, 0xf5, 0xbd, 0x88, 0x91, 0x70, 0xbd, 0xb8, ++0xb9, 0x8c, 0x88, 0xfe, 0x53, 0xc9, 0x54, 0x9b, ++0x43, 0xc4, 0x7a, 0x43, 0x74, 0x6b, 0xdd, 0xb0, ++0xb1, 0x3b, 0x33, 0x45, 0x46, 0x78, 0xa3, 0x1c, ++0xef, 0x54, 0x68, 0xf7, 0x85, 0x9c, 0xe4, 0x51, ++0x6f, 0x06, 0xaf, 0x81, 0xdb, 0x2a, 0x7b, 0x7b, ++0x6f, 0xa8, 0x9c, 0x67, 0xd8, 0xcb, 0xc9, 0x91, ++0x40, 0x00, 0xae, 0xd9, 0xa1, 0x9f, 0xdd, 0xa6, ++0x43, 0x0e, 0x28, 0x7b, 0xaa, 0x1b, 0xe9, 0x84, ++0xdb, 0x76, 0x64, 0x42, 0x70, 0xc9, 0xc0, 0xeb, ++0xae, 0x84, 0x11, 0x16, 0x68, 0x4e, 0x84, 0x9e, ++0x7e, 0x92, 0x36, 0xee, 0x1c, 0x3b, 0x08, 0x63, ++0xeb, 0x79, 0x84, 0x15, 0x08, 0x9d, 0xaf, 0xc8, ++0x9a, 0xc7, 0x34, 0xd3, 0x94, 0x4b, 0xd1, 0x28, ++0x97, 0xbe, 0xd1, 0x45, 0x75, 0xdc, 0x35, 0x62, ++0xac, 0x1d, 0x1f, 0xb7, 0xb7, 0x15, 0x87, 0xc8, ++0x98, 0xc0, 0x24, 0x31, 0x56, 0x8d, 0xed, 0xdb, ++0x06, 0xc6, 0x46, 0xbf, 0x4b, 0x6d, 0xa6, 0xd5, ++0xab, 0xcc, 0x60, 0xfc, 0xe5, 0x37, 0xb6, 0x53, ++0x7d, 0x58, 0x95, 0xa9, 0x56, 0xc7, 0xf7, 0xee, ++0xc3, 0xa0, 0x76, 0xf7, 0x65, 0x4d, 0x53, 0xfa, ++0xff, 0x5f, 0x76, 0x33, 0x5a, 0x08, 0xfa, 0x86, ++0x92, 0x5a, 0x13, 0xfa, 0x1a, 0xfc, 0xf2, 0x1b, ++0x8c, 0x7f, 0x42, 0x6d, 0xb7, 0x7e, 0xb7, 0xb4, ++0xf0, 0xc7, 0x83, 0xbb, 0xa2, 0x81, 0x03, 0x2d, ++0xd4, 0x2a, 0x63, 0x3f, 0xf7, 0x31, 0x2e, 0x40, ++0x33, 0x5c, 0x46, 0xbc, 0x9b, 0xc1, 0x05, 0xa5, ++0x45, 0x4e, 0xc3 diff --git a/queue-6.6/wifi-cfg80211-fix-certs-build-to-not-depend-on-file-order.patch b/queue-6.6/wifi-cfg80211-fix-certs-build-to-not-depend-on-file-order.patch new file mode 100644 index 00000000000..9d370cf4d6f --- /dev/null +++ b/queue-6.6/wifi-cfg80211-fix-certs-build-to-not-depend-on-file-order.patch @@ -0,0 +1,32 @@ +From 3c2a8ebe3fe66a5f77d4c164a0bea8e2ff37b455 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Thu, 14 Dec 2023 09:08:16 +0100 +Subject: wifi: cfg80211: fix certs build to not depend on file order + +From: Johannes Berg + +commit 3c2a8ebe3fe66a5f77d4c164a0bea8e2ff37b455 upstream. + +The file for the new certificate (Chen-Yu Tsai's) didn't +end with a comma, so depending on the file order in the +build rule, we'd end up with invalid C when concatenating +the (now two) certificates. Fix that. + +Cc: stable@vger.kernel.org +Reported-by: Biju Das +Reported-by: Naresh Kamboju +Fixes: fb768d3b13ff ("wifi: cfg80211: Add my certificate") +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/wireless/certs/wens.hex | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/wireless/certs/wens.hex ++++ b/net/wireless/certs/wens.hex +@@ -84,4 +84,4 @@ + 0xf0, 0xc7, 0x83, 0xbb, 0xa2, 0x81, 0x03, 0x2d, + 0xd4, 0x2a, 0x63, 0x3f, 0xf7, 0x31, 0x2e, 0x40, + 0x33, 0x5c, 0x46, 0xbc, 0x9b, 0xc1, 0x05, 0xa5, +-0x45, 0x4e, 0xc3 ++0x45, 0x4e, 0xc3, diff --git a/queue-6.6/wifi-mt76-fix-crash-with-wed-rx-support-enabled.patch b/queue-6.6/wifi-mt76-fix-crash-with-wed-rx-support-enabled.patch new file mode 100644 index 00000000000..70602b86f2a --- /dev/null +++ b/queue-6.6/wifi-mt76-fix-crash-with-wed-rx-support-enabled.patch @@ -0,0 +1,72 @@ +From cd607f2cbbbec90682b2f6d6b85e1525d0f43b19 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Fri, 8 Dec 2023 08:50:04 +0100 +Subject: wifi: mt76: fix crash with WED rx support enabled + +From: Felix Fietkau + +commit cd607f2cbbbec90682b2f6d6b85e1525d0f43b19 upstream. + +If WED rx is enabled, rx buffers are added to a buffer pool that can be +filled from multiple page pools. Because buffers freed from rx poll are +not guaranteed to belong to the processed queue's page pool, lockless +caching must not be used in this case. + +Cc: stable@vger.kernel.org +Fixes: 2f5c3c77fc9b ("wifi: mt76: switch to page_pool allocator") +Signed-off-by: Felix Fietkau +Acked-by: Lorenzo Bianconi +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20231208075004.69843-1-nbd@nbd.name +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mediatek/mt76/dma.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/mediatek/mt76/dma.c ++++ b/drivers/net/wireless/mediatek/mt76/dma.c +@@ -776,7 +776,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev, + + static void + mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data, +- int len, bool more, u32 info) ++ int len, bool more, u32 info, bool allow_direct) + { + struct sk_buff *skb = q->rx_head; + struct skb_shared_info *shinfo = skb_shinfo(skb); +@@ -788,7 +788,7 @@ mt76_add_fragment(struct mt76_dev *dev, + + skb_add_rx_frag(skb, nr_frags, page, offset, len, q->buf_size); + } else { +- mt76_put_page_pool_buf(data, true); ++ mt76_put_page_pool_buf(data, allow_direct); + } + + if (more) +@@ -808,6 +808,7 @@ mt76_dma_rx_process(struct mt76_dev *dev + struct sk_buff *skb; + unsigned char *data; + bool check_ddone = false; ++ bool allow_direct = !mt76_queue_is_wed_rx(q); + bool more; + + if (IS_ENABLED(CONFIG_NET_MEDIATEK_SOC_WED) && +@@ -848,7 +849,8 @@ mt76_dma_rx_process(struct mt76_dev *dev + } + + if (q->rx_head) { +- mt76_add_fragment(dev, q, data, len, more, info); ++ mt76_add_fragment(dev, q, data, len, more, info, ++ allow_direct); + continue; + } + +@@ -877,7 +879,7 @@ mt76_dma_rx_process(struct mt76_dev *dev + continue; + + free_frag: +- mt76_put_page_pool_buf(data, true); ++ mt76_put_page_pool_buf(data, allow_direct); + } + + mt76_dma_rx_fill(dev, q, true);