From: Greg Kroah-Hartman Date: Mon, 21 Jul 2025 10:17:47 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v6.1.147~85 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9d9c0e75a97caef32ac7302d5463078cb79067bb;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: hid-core-do-not-bypass-hid_hw_raw_request.patch hid-core-ensure-__hid_request-reserves-the-report-id-as-the-first-byte.patch hid-core-ensure-the-allocated-report-buffer-can-contain-the-reserved-report-id.patch i2c-stm32-fix-the-device-used-for-the-dma-map.patch input-xpad-set-correct-controller-type-for-acer-ngr200.patch pch_uart-fix-dma_sync_sg_for_device-nents-value.patch phy-tegra-xusb-fix-unbalanced-regulator-disable-in-utmi-phy-mode.patch series thunderbolt-fix-bit-masking-in-tb_dp_port_set_hops.patch usb-gadget-configfs-fix-oob-read-on-empty-string-write.patch usb-serial-ftdi_sio-add-support-for-ndi-emguide-gemini.patch usb-serial-option-add-foxconn-t99w640.patch usb-serial-option-add-telit-cinterion-fe910c04-ecm-composition.patch --- diff --git a/queue-5.10/hid-core-do-not-bypass-hid_hw_raw_request.patch b/queue-5.10/hid-core-do-not-bypass-hid_hw_raw_request.patch new file mode 100644 index 0000000000..b24e352070 --- /dev/null +++ b/queue-5.10/hid-core-do-not-bypass-hid_hw_raw_request.patch @@ -0,0 +1,35 @@ +From c2ca42f190b6714d6c481dfd3d9b62ea091c946b Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Thu, 10 Jul 2025 16:01:35 +0200 +Subject: HID: core: do not bypass hid_hw_raw_request + +From: Benjamin Tissoires + +commit c2ca42f190b6714d6c481dfd3d9b62ea091c946b upstream. + +hid_hw_raw_request() is actually useful to ensure the provided buffer +and length are valid. Directly calling in the low level transport driver +function bypassed those checks and allowed invalid paramto be used. + +Reported-by: Alan Stern +Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@rowland.harvard.edu/ +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20250710-report-size-null-v2-3-ccf922b7c4e5@kernel.org +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-core.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1750,8 +1750,7 @@ int __hid_request(struct hid_device *hid + if (reqtype == HID_REQ_SET_REPORT) + hid_output_report(report, data_buf); + +- ret = hid->ll_driver->raw_request(hid, report->id, buf, len, +- report->type, reqtype); ++ ret = hid_hw_raw_request(hid, report->id, buf, len, report->type, reqtype); + if (ret < 0) { + dbg_hid("unable to complete request: %d\n", ret); + goto out; diff --git a/queue-5.10/hid-core-ensure-__hid_request-reserves-the-report-id-as-the-first-byte.patch b/queue-5.10/hid-core-ensure-__hid_request-reserves-the-report-id-as-the-first-byte.patch new file mode 100644 index 0000000000..5c7cbd3d7f --- /dev/null +++ b/queue-5.10/hid-core-ensure-__hid_request-reserves-the-report-id-as-the-first-byte.patch @@ -0,0 +1,82 @@ +From 0d0777ccaa2d46609d05b66ba0096802a2746193 Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Thu, 10 Jul 2025 16:01:34 +0200 +Subject: HID: core: ensure __hid_request reserves the report ID as the first byte + +From: Benjamin Tissoires + +commit 0d0777ccaa2d46609d05b66ba0096802a2746193 upstream. + +The low level transport driver expects the first byte to be the report +ID, even when the report ID is not use (in which case they just shift +the buffer). + +However, __hid_request() whas not offsetting the buffer it used by one +in this case, meaning that the raw_request() callback emitted by the +transport driver would be stripped of the first byte. + +Note: this changes the API for uhid devices when a request is made +through hid_hw_request. However, several considerations makes me think +this is fine: +- every request to a HID device made through hid_hw_request() would see + that change, but every request made through hid_hw_raw_request() + already has the new behaviour. So that means that the users are + already facing situations where they might have or not the first byte + being the null report ID when it is 0. We are making things more + straightforward in the end. +- uhid is mainly used for BLE devices +- uhid is also used for testing, but I don't see that change a big issue +- for BLE devices, we can check which kernel module is calling + hid_hw_request() +- and in those modules, we can check which are using a Bluetooth device +- and then we can check if the command is used with a report ID or not. +- surprise: none of the kernel module are using a report ID 0 +- and finally, bluez, in its function set_report()[0], does the same + shift if the report ID is 0 and the given buffer has a size > 0. + +[0] https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/profiles/input/hog-lib.c#n879 + +Reported-by: Alan Stern +Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@rowland.harvard.edu/ +Reported-by: syzbot+8258d5439c49d4c35f43@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=8258d5439c49d4c35f43 +Tested-by: syzbot+8258d5439c49d4c35f43@syzkaller.appspotmail.com +Fixes: 4fa5a7f76cc7 ("HID: core: implement generic .request()") +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20250710-report-size-null-v2-2-ccf922b7c4e5@kernel.org +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-core.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1730,7 +1730,7 @@ static struct hid_report *hid_get_report + int __hid_request(struct hid_device *hid, struct hid_report *report, + int reqtype) + { +- char *buf; ++ char *buf, *data_buf; + int ret; + u32 len; + +@@ -1738,10 +1738,17 @@ int __hid_request(struct hid_device *hid + if (!buf) + return -ENOMEM; + ++ data_buf = buf; + len = hid_report_len(report); + ++ if (report->id == 0) { ++ /* reserve the first byte for the report ID */ ++ data_buf++; ++ len++; ++ } ++ + if (reqtype == HID_REQ_SET_REPORT) +- hid_output_report(report, buf); ++ hid_output_report(report, data_buf); + + ret = hid->ll_driver->raw_request(hid, report->id, buf, len, + report->type, reqtype); diff --git a/queue-5.10/hid-core-ensure-the-allocated-report-buffer-can-contain-the-reserved-report-id.patch b/queue-5.10/hid-core-ensure-the-allocated-report-buffer-can-contain-the-reserved-report-id.patch new file mode 100644 index 0000000000..518746745a --- /dev/null +++ b/queue-5.10/hid-core-ensure-the-allocated-report-buffer-can-contain-the-reserved-report-id.patch @@ -0,0 +1,41 @@ +From 4f15ee98304b96e164ff2340e1dfd6181c3f42aa Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Thu, 10 Jul 2025 16:01:33 +0200 +Subject: HID: core: ensure the allocated report buffer can contain the reserved report ID + +From: Benjamin Tissoires + +commit 4f15ee98304b96e164ff2340e1dfd6181c3f42aa upstream. + +When the report ID is not used, the low level transport drivers expect +the first byte to be 0. However, currently the allocated buffer not +account for that extra byte, meaning that instead of having 8 guaranteed +bytes for implement to be working, we only have 7. + +Reported-by: Alan Stern +Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@rowland.harvard.edu/ +Cc: stable@vger.kernel.org +Suggested-by: Alan Stern +Link: https://patch.msgid.link/20250710-report-size-null-v2-1-ccf922b7c4e5@kernel.org +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1662,9 +1662,12 @@ u8 *hid_alloc_report_buf(struct hid_repo + /* + * 7 extra bytes are necessary to achieve proper functionality + * of implement() working on 8 byte chunks ++ * 1 extra byte for the report ID if it is null (not used) so ++ * we can reserve that extra byte in the first position of the buffer ++ * when sending it to .raw_request() + */ + +- u32 len = hid_report_len(report) + 7; ++ u32 len = hid_report_len(report) + 7 + (report->id == 0); + + return kzalloc(len, flags); + } diff --git a/queue-5.10/i2c-stm32-fix-the-device-used-for-the-dma-map.patch b/queue-5.10/i2c-stm32-fix-the-device-used-for-the-dma-map.patch new file mode 100644 index 0000000000..3978db3296 --- /dev/null +++ b/queue-5.10/i2c-stm32-fix-the-device-used-for-the-dma-map.patch @@ -0,0 +1,77 @@ +From c870cbbd71fccda71d575f0acd4a8d2b7cd88861 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Cl=C3=A9ment=20Le=20Goffic?= +Date: Fri, 4 Jul 2025 10:39:14 +0200 +Subject: i2c: stm32: fix the device used for the DMA map +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Le Goffic + +commit c870cbbd71fccda71d575f0acd4a8d2b7cd88861 upstream. + +If the DMA mapping failed, it produced an error log with the wrong +device name: +"stm32-dma3 40400000.dma-controller: rejecting DMA map of vmalloc memory" +Fix this issue by replacing the dev with the I2C dev. + +Fixes: bb8822cbbc53 ("i2c: i2c-stm32: Add generic DMA API") +Signed-off-by: Clément Le Goffic +Cc: # v4.18+ +Acked-by: Alain Volmat +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/20250704-i2c-upstream-v4-1-84a095a2c728@foss.st.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-stm32.c | 8 +++----- + drivers/i2c/busses/i2c-stm32f7.c | 4 ++-- + 2 files changed, 5 insertions(+), 7 deletions(-) + +--- a/drivers/i2c/busses/i2c-stm32.c ++++ b/drivers/i2c/busses/i2c-stm32.c +@@ -102,7 +102,6 @@ int stm32_i2c_prep_dma_xfer(struct devic + void *dma_async_param) + { + struct dma_async_tx_descriptor *txdesc; +- struct device *chan_dev; + int ret; + + if (rd_wr) { +@@ -116,11 +115,10 @@ int stm32_i2c_prep_dma_xfer(struct devic + } + + dma->dma_len = len; +- chan_dev = dma->chan_using->device->dev; + +- dma->dma_buf = dma_map_single(chan_dev, buf, dma->dma_len, ++ dma->dma_buf = dma_map_single(dev, buf, dma->dma_len, + dma->dma_data_dir); +- if (dma_mapping_error(chan_dev, dma->dma_buf)) { ++ if (dma_mapping_error(dev, dma->dma_buf)) { + dev_err(dev, "DMA mapping failed\n"); + return -EINVAL; + } +@@ -150,7 +148,7 @@ int stm32_i2c_prep_dma_xfer(struct devic + return 0; + + err: +- dma_unmap_single(chan_dev, dma->dma_buf, dma->dma_len, ++ dma_unmap_single(dev, dma->dma_buf, dma->dma_len, + dma->dma_data_dir); + return ret; + } +--- a/drivers/i2c/busses/i2c-stm32f7.c ++++ b/drivers/i2c/busses/i2c-stm32f7.c +@@ -700,10 +700,10 @@ static void stm32f7_i2c_dma_callback(voi + { + struct stm32f7_i2c_dev *i2c_dev = (struct stm32f7_i2c_dev *)arg; + struct stm32_i2c_dma *dma = i2c_dev->dma; +- struct device *dev = dma->chan_using->device->dev; + + stm32f7_i2c_disable_dma_req(i2c_dev); +- dma_unmap_single(dev, dma->dma_buf, dma->dma_len, dma->dma_data_dir); ++ dma_unmap_single(i2c_dev->dev, dma->dma_buf, dma->dma_len, ++ dma->dma_data_dir); + complete(&dma->dma_complete); + } + diff --git a/queue-5.10/input-xpad-set-correct-controller-type-for-acer-ngr200.patch b/queue-5.10/input-xpad-set-correct-controller-type-for-acer-ngr200.patch new file mode 100644 index 0000000000..4965d131de --- /dev/null +++ b/queue-5.10/input-xpad-set-correct-controller-type-for-acer-ngr200.patch @@ -0,0 +1,39 @@ +From bcce05041b21888f10b80ea903dcfe51a25c586e Mon Sep 17 00:00:00 2001 +From: Nilton Perim Neto +Date: Sat, 19 Jul 2025 22:07:36 -0700 +Subject: Input: xpad - set correct controller type for Acer NGR200 + +From: Nilton Perim Neto + +commit bcce05041b21888f10b80ea903dcfe51a25c586e upstream. + +The controller should have been set as XTYPE_XBOX360 and not XTYPE_XBOX. +Also the entry is in the wrong place. Fix it. + +Reported-by: Vicki Pfau +Signed-off-by: Nilton Perim Neto +Link: https://lore.kernel.org/r/20250708033126.26216-2-niltonperimneto@gmail.com +Fixes: 22c69d786ef8 ("Input: xpad - support Acer NGR 200 Controller") +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -142,12 +142,12 @@ static const struct xpad_device { + { 0x046d, 0xca88, "Logitech Compact Controller for Xbox", 0, XTYPE_XBOX }, + { 0x046d, 0xca8a, "Logitech Precision Vibration Feedback Wheel", 0, XTYPE_XBOX }, + { 0x046d, 0xcaa3, "Logitech DriveFx Racing Wheel", 0, XTYPE_XBOX360 }, ++ { 0x0502, 0x1305, "Acer NGR200", 0, XTYPE_XBOX360 }, + { 0x056e, 0x2004, "Elecom JC-U3613M", 0, XTYPE_XBOX360 }, + { 0x05fd, 0x1007, "Mad Catz Controller (unverified)", 0, XTYPE_XBOX }, + { 0x05fd, 0x107a, "InterAct 'PowerPad Pro' X-Box pad (Germany)", 0, XTYPE_XBOX }, + { 0x05fe, 0x3030, "Chic Controller", 0, XTYPE_XBOX }, + { 0x05fe, 0x3031, "Chic Controller", 0, XTYPE_XBOX }, +- { 0x0502, 0x1305, "Acer NGR200", 0, XTYPE_XBOX }, + { 0x062a, 0x0020, "Logic3 Xbox GamePad", 0, XTYPE_XBOX }, + { 0x062a, 0x0033, "Competition Pro Steering Wheel", 0, XTYPE_XBOX }, + { 0x06a3, 0x0200, "Saitek Racing Wheel", 0, XTYPE_XBOX }, diff --git a/queue-5.10/pch_uart-fix-dma_sync_sg_for_device-nents-value.patch b/queue-5.10/pch_uart-fix-dma_sync_sg_for_device-nents-value.patch new file mode 100644 index 0000000000..c5606bc035 --- /dev/null +++ b/queue-5.10/pch_uart-fix-dma_sync_sg_for_device-nents-value.patch @@ -0,0 +1,36 @@ +From 6c0e9f05c9d7875995b0e92ace71be947f280bbd Mon Sep 17 00:00:00 2001 +From: Thomas Fourier +Date: Tue, 1 Jul 2025 13:34:52 +0200 +Subject: pch_uart: Fix dma_sync_sg_for_device() nents value + +From: Thomas Fourier + +commit 6c0e9f05c9d7875995b0e92ace71be947f280bbd upstream. + +The dma_sync_sg_for_device() functions should be called with the same +nents as the dma_map_sg(), not the value the map function returned +according to the documentation in Documentation/core-api/dma-api.rst:450: + With the sync_sg API, all the parameters must be the same + as those passed into the sg mapping API. + +Fixes: da3564ee027e ("pch_uart: add multi-scatter processing") +Cc: stable +Signed-off-by: Thomas Fourier +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20250701113452.18590-2-fourier.thomas@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/pch_uart.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/pch_uart.c ++++ b/drivers/tty/serial/pch_uart.c +@@ -1018,7 +1018,7 @@ static unsigned int dma_handle_tx(struct + __func__); + return 0; + } +- dma_sync_sg_for_device(port->dev, priv->sg_tx_p, nent, DMA_TO_DEVICE); ++ dma_sync_sg_for_device(port->dev, priv->sg_tx_p, num, DMA_TO_DEVICE); + priv->desc_tx = desc; + desc->callback = pch_dma_tx_complete; + desc->callback_param = priv; diff --git a/queue-5.10/phy-tegra-xusb-fix-unbalanced-regulator-disable-in-utmi-phy-mode.patch b/queue-5.10/phy-tegra-xusb-fix-unbalanced-regulator-disable-in-utmi-phy-mode.patch new file mode 100644 index 0000000000..e55e59813c --- /dev/null +++ b/queue-5.10/phy-tegra-xusb-fix-unbalanced-regulator-disable-in-utmi-phy-mode.patch @@ -0,0 +1,137 @@ +From cefc1caee9dd06c69e2d807edc5949b329f52b22 Mon Sep 17 00:00:00 2001 +From: Wayne Chang +Date: Fri, 2 May 2025 17:26:06 +0800 +Subject: phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode + +From: Wayne Chang + +commit cefc1caee9dd06c69e2d807edc5949b329f52b22 upstream. + +When transitioning from USB_ROLE_DEVICE to USB_ROLE_NONE, the code +assumed that the regulator should be disabled. However, if the regulator +is marked as always-on, regulator_is_enabled() continues to return true, +leading to an incorrect attempt to disable a regulator which is not +enabled. + +This can result in warnings such as: + +[ 250.155624] WARNING: CPU: 1 PID: 7326 at drivers/regulator/core.c:3004 +_regulator_disable+0xe4/0x1a0 +[ 250.155652] unbalanced disables for VIN_SYS_5V0 + +To fix this, we move the regulator control logic into +tegra186_xusb_padctl_id_override() function since it's directly related +to the ID override state. The regulator is now only disabled when the role +transitions from USB_ROLE_HOST to USB_ROLE_NONE, by checking the VBUS_ID +register. This ensures that regulator enable/disable operations are +properly balanced and only occur when actually transitioning to/from host +mode. + +Fixes: 49d46e3c7e59 ("phy: tegra: xusb: Add set_mode support for UTMI phy on Tegra186") +Cc: stable@vger.kernel.org +Signed-off-by: Wayne Chang +Reviewed-by: Jon Hunter +Tested-by: Jon Hunter +Link: https://lore.kernel.org/r/20250502092606.2275682-1-waynec@nvidia.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/tegra/xusb-tegra186.c | 59 +++++++++++++++++++++++--------------- + 1 file changed, 37 insertions(+), 22 deletions(-) + +--- a/drivers/phy/tegra/xusb-tegra186.c ++++ b/drivers/phy/tegra/xusb-tegra186.c +@@ -328,13 +328,15 @@ static int tegra186_xusb_padctl_vbus_ove + } + + static int tegra186_xusb_padctl_id_override(struct tegra_xusb_padctl *padctl, +- bool status) ++ struct tegra_xusb_usb2_port *port, bool status) + { +- u32 value; ++ u32 value, id_override; ++ int err = 0; + + dev_dbg(padctl->dev, "%s id override\n", status ? "set" : "clear"); + + value = padctl_readl(padctl, USB2_VBUS_ID); ++ id_override = value & ID_OVERRIDE(~0); + + if (status) { + if (value & VBUS_OVERRIDE) { +@@ -345,14 +347,34 @@ static int tegra186_xusb_padctl_id_overr + value = padctl_readl(padctl, USB2_VBUS_ID); + } + +- value &= ~ID_OVERRIDE(~0); +- value |= ID_OVERRIDE_GROUNDED; ++ if (id_override != ID_OVERRIDE_GROUNDED) { ++ value &= ~ID_OVERRIDE(~0); ++ value |= ID_OVERRIDE_GROUNDED; ++ padctl_writel(padctl, value, USB2_VBUS_ID); ++ ++ err = regulator_enable(port->supply); ++ if (err) { ++ dev_err(padctl->dev, "Failed to enable regulator: %d\n", err); ++ return err; ++ } ++ } + } else { +- value &= ~ID_OVERRIDE(~0); +- value |= ID_OVERRIDE_FLOATING; +- } ++ if (id_override == ID_OVERRIDE_GROUNDED) { ++ /* ++ * The regulator is disabled only when the role transitions ++ * from USB_ROLE_HOST to USB_ROLE_NONE. ++ */ ++ err = regulator_disable(port->supply); ++ if (err) { ++ dev_err(padctl->dev, "Failed to disable regulator: %d\n", err); ++ return err; ++ } + +- padctl_writel(padctl, value, USB2_VBUS_ID); ++ value &= ~ID_OVERRIDE(~0); ++ value |= ID_OVERRIDE_FLOATING; ++ padctl_writel(padctl, value, USB2_VBUS_ID); ++ } ++ } + + return 0; + } +@@ -372,27 +394,20 @@ static int tegra186_utmi_phy_set_mode(st + + if (mode == PHY_MODE_USB_OTG) { + if (submode == USB_ROLE_HOST) { +- tegra186_xusb_padctl_id_override(padctl, true); +- +- err = regulator_enable(port->supply); ++ err = tegra186_xusb_padctl_id_override(padctl, port, true); ++ if (err) ++ goto out; + } else if (submode == USB_ROLE_DEVICE) { + tegra186_xusb_padctl_vbus_override(padctl, true); + } else if (submode == USB_ROLE_NONE) { +- /* +- * When port is peripheral only or role transitions to +- * USB_ROLE_NONE from USB_ROLE_DEVICE, regulator is not +- * enabled. +- */ +- if (regulator_is_enabled(port->supply)) +- regulator_disable(port->supply); +- +- tegra186_xusb_padctl_id_override(padctl, false); ++ err = tegra186_xusb_padctl_id_override(padctl, port, false); ++ if (err) ++ goto out; + tegra186_xusb_padctl_vbus_override(padctl, false); + } + } +- ++out: + mutex_unlock(&padctl->lock); +- + return err; + } + diff --git a/queue-5.10/series b/queue-5.10/series new file mode 100644 index 0000000000..920b603f30 --- /dev/null +++ b/queue-5.10/series @@ -0,0 +1,12 @@ +phy-tegra-xusb-fix-unbalanced-regulator-disable-in-utmi-phy-mode.patch +usb-serial-option-add-telit-cinterion-fe910c04-ecm-composition.patch +usb-serial-option-add-foxconn-t99w640.patch +usb-serial-ftdi_sio-add-support-for-ndi-emguide-gemini.patch +usb-gadget-configfs-fix-oob-read-on-empty-string-write.patch +i2c-stm32-fix-the-device-used-for-the-dma-map.patch +thunderbolt-fix-bit-masking-in-tb_dp_port_set_hops.patch +input-xpad-set-correct-controller-type-for-acer-ngr200.patch +pch_uart-fix-dma_sync_sg_for_device-nents-value.patch +hid-core-ensure-the-allocated-report-buffer-can-contain-the-reserved-report-id.patch +hid-core-ensure-__hid_request-reserves-the-report-id-as-the-first-byte.patch +hid-core-do-not-bypass-hid_hw_raw_request.patch diff --git a/queue-5.10/thunderbolt-fix-bit-masking-in-tb_dp_port_set_hops.patch b/queue-5.10/thunderbolt-fix-bit-masking-in-tb_dp_port_set_hops.patch new file mode 100644 index 0000000000..37d7486bd4 --- /dev/null +++ b/queue-5.10/thunderbolt-fix-bit-masking-in-tb_dp_port_set_hops.patch @@ -0,0 +1,35 @@ +From 2cdde91c14ec358087f43287513946d493aef940 Mon Sep 17 00:00:00 2001 +From: Alok Tiwari +Date: Sun, 22 Jun 2025 10:17:02 -0700 +Subject: thunderbolt: Fix bit masking in tb_dp_port_set_hops() + +From: Alok Tiwari + +commit 2cdde91c14ec358087f43287513946d493aef940 upstream. + +The tb_dp_port_set_hops() function was incorrectly clearing +ADP_DP_CS_1_AUX_RX_HOPID_MASK twice. According to the function's +purpose, it should clear both TX and RX AUX HopID fields. Replace the +first instance with ADP_DP_CS_1_AUX_TX_HOPID_MASK to ensure proper +configuration of both AUX directions. + +Fixes: 98176380cbe5 ("thunderbolt: Convert DP adapter register names to follow the USB4 spec") +Cc: stable@vger.kernel.org +Signed-off-by: Alok Tiwari +Signed-off-by: Mika Westerberg +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thunderbolt/switch.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/thunderbolt/switch.c ++++ b/drivers/thunderbolt/switch.c +@@ -1179,7 +1179,7 @@ int tb_dp_port_set_hops(struct tb_port * + return ret; + + data[0] &= ~ADP_DP_CS_0_VIDEO_HOPID_MASK; +- data[1] &= ~ADP_DP_CS_1_AUX_RX_HOPID_MASK; ++ data[1] &= ~ADP_DP_CS_1_AUX_TX_HOPID_MASK; + data[1] &= ~ADP_DP_CS_1_AUX_RX_HOPID_MASK; + + data[0] |= (video << ADP_DP_CS_0_VIDEO_HOPID_SHIFT) & diff --git a/queue-5.10/usb-gadget-configfs-fix-oob-read-on-empty-string-write.patch b/queue-5.10/usb-gadget-configfs-fix-oob-read-on-empty-string-write.patch new file mode 100644 index 0000000000..bc6d58d6d1 --- /dev/null +++ b/queue-5.10/usb-gadget-configfs-fix-oob-read-on-empty-string-write.patch @@ -0,0 +1,36 @@ +From 3014168731b7930300aab656085af784edc861f6 Mon Sep 17 00:00:00 2001 +From: Xinyu Liu <1171169449@qq.com> +Date: Wed, 9 Jul 2025 11:55:33 +0800 +Subject: usb: gadget: configfs: Fix OOB read on empty string write + +From: Xinyu Liu <1171169449@qq.com> + +commit 3014168731b7930300aab656085af784edc861f6 upstream. + +When writing an empty string to either 'qw_sign' or 'landingPage' +sysfs attributes, the store functions attempt to access page[l - 1] +before validating that the length 'l' is greater than zero. + +This patch fixes the vulnerability by adding a check at the beginning +of os_desc_qw_sign_store() and webusb_landingPage_store() to handle +the zero-length input case gracefully by returning immediately. + +Signed-off-by: Xinyu Liu +Cc: stable +Link: https://lore.kernel.org/r/tencent_B1C9481688D0E95E7362AB2E999DE8048207@qq.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/configfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -855,6 +855,8 @@ static ssize_t os_desc_qw_sign_store(str + struct gadget_info *gi = os_desc_item_to_gadget_info(item); + int res, l; + ++ if (!len) ++ return len; + l = min((int)len, OS_STRING_QW_SIGN_LEN >> 1); + if (page[l - 1] == '\n') + --l; diff --git a/queue-5.10/usb-serial-ftdi_sio-add-support-for-ndi-emguide-gemini.patch b/queue-5.10/usb-serial-ftdi_sio-add-support-for-ndi-emguide-gemini.patch new file mode 100644 index 0000000000..eb4307a4f0 --- /dev/null +++ b/queue-5.10/usb-serial-ftdi_sio-add-support-for-ndi-emguide-gemini.patch @@ -0,0 +1,46 @@ +From c980666b6958d9a841597331b38115a29a32250e Mon Sep 17 00:00:00 2001 +From: "Ryan Mann (NDI)" +Date: Thu, 10 Jul 2025 13:08:00 +0000 +Subject: USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI + +From: Ryan Mann (NDI) + +commit c980666b6958d9a841597331b38115a29a32250e upstream. + +NDI (Northern Digital Inc.) is introducing a new product called the +EMGUIDE GEMINI that will use an FTDI chip for USB serial communications. +Add the NDI EMGUIDE GEMINI product ID that uses the NDI Vendor ID +rather than the FTDI Vendor ID, unlike older products. + +Signed-off-by: Ryan Mann +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/ftdi_sio.c | 2 ++ + drivers/usb/serial/ftdi_sio_ids.h | 3 +++ + 2 files changed, 5 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -781,6 +781,8 @@ static const struct usb_device_id id_tab + .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, + { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID), + .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, ++ { USB_DEVICE(FTDI_NDI_VID, FTDI_NDI_EMGUIDE_GEMINI_PID), ++ .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, + { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) }, + { USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) }, + { USB_DEVICE(FTDI_VID, RTSYSTEMS_USB_VX8_PID) }, +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -197,6 +197,9 @@ + #define FTDI_NDI_FUTURE_3_PID 0xDA73 /* NDI future device #3 */ + #define FTDI_NDI_AURORA_SCU_PID 0xDA74 /* NDI Aurora SCU */ + ++#define FTDI_NDI_VID 0x23F2 ++#define FTDI_NDI_EMGUIDE_GEMINI_PID 0x0003 /* NDI Emguide Gemini */ ++ + /* + * ChamSys Limited (www.chamsys.co.uk) USB wing/interface product IDs + */ diff --git a/queue-5.10/usb-serial-option-add-foxconn-t99w640.patch b/queue-5.10/usb-serial-option-add-foxconn-t99w640.patch new file mode 100644 index 0000000000..f046cdfe2e --- /dev/null +++ b/queue-5.10/usb-serial-option-add-foxconn-t99w640.patch @@ -0,0 +1,60 @@ +From 08f49cdb71f3759368fded4dbc9dde35a404ec2b Mon Sep 17 00:00:00 2001 +From: Slark Xiao +Date: Fri, 20 Jun 2025 11:57:21 +0800 +Subject: USB: serial: option: add Foxconn T99W640 + +From: Slark Xiao + +commit 08f49cdb71f3759368fded4dbc9dde35a404ec2b upstream. + +T99W640 is designed based on Qualconn SDX72 chip. There are 3 +serial ports to be enumerated: Diag, NMEA and AT. + +Test evidence as below: +T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 +D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 +P: Vendor=0489 ProdID=e167 Rev=05.15 +S: Manufacturer=QCOM +S: Product=SDXPINNL USB WWAN Adapter +S: SerialNumber=cc1f1d92 +C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim +E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim +E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) +E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms +E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms + +0&1: MBIM, 2:Modem, 3:GNSS(non-serial port), 4: NMEA, 5:Diag + +Signed-off-by: Slark Xiao +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -2346,6 +2346,8 @@ static const struct usb_device_id option + .driver_info = RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe145, 0xff), /* Foxconn T99W651 RNDIS */ + .driver_info = RSVD(5) | RSVD(6) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe167, 0xff), /* Foxconn T99W640 MBIM */ ++ .driver_info = RSVD(3) }, + { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ + .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, + { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */ diff --git a/queue-5.10/usb-serial-option-add-telit-cinterion-fe910c04-ecm-composition.patch b/queue-5.10/usb-serial-option-add-telit-cinterion-fe910c04-ecm-composition.patch new file mode 100644 index 0000000000..f281a8ef27 --- /dev/null +++ b/queue-5.10/usb-serial-option-add-telit-cinterion-fe910c04-ecm-composition.patch @@ -0,0 +1,57 @@ +From 252f4ac08cd2f16ecd20e4c5e41ac2a17dd86942 Mon Sep 17 00:00:00 2001 +From: Fabio Porcedda +Date: Thu, 10 Jul 2025 14:16:38 +0200 +Subject: USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition + +From: Fabio Porcedda + +commit 252f4ac08cd2f16ecd20e4c5e41ac2a17dd86942 upstream. + +Add Telit Cinterion FE910C04 (ECM) composition: +0x10c7: ECM + tty (AT) + tty (AT) + tty (diag) + +usb-devices output: +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=1bc7 ProdID=10c7 Rev=05.15 +S: Manufacturer=Telit Cinterion +S: Product=FE910 +S: SerialNumber=f71b8b32 +C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether +E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Cc: stable@vger.kernel.org +Signed-off-by: Fabio Porcedda +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1415,6 +1415,9 @@ static const struct usb_device_id option + .driver_info = NCTRL(5) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x60) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x30), /* Telit FE910C04 (ECM) */ ++ .driver_info = NCTRL(4) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x30), /* Telit FN990B (MBIM) */ + .driver_info = NCTRL(6) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x40) },