From 3bd42d280c5b18ad90df8bf0b22ef4d87ea8f7b3 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 5 Sep 2022 17:46:22 +0200 Subject: [PATCH] 5.15-stable patches added patches: serial-fsl_lpuart-rs485-rts-polariy-is-inverse.patch staging-r8188eu-add-firmware-dependency.patch staging-rtl8712-fix-use-after-free-bugs.patch --- ..._lpuart-rs485-rts-polariy-is-inverse.patch | 39 ++++++++++ queue-5.15/series | 3 + ...ging-r8188eu-add-firmware-dependency.patch | 48 ++++++++++++ ...ging-rtl8712-fix-use-after-free-bugs.patch | 75 +++++++++++++++++++ 4 files changed, 165 insertions(+) create mode 100644 queue-5.15/serial-fsl_lpuart-rs485-rts-polariy-is-inverse.patch create mode 100644 queue-5.15/staging-r8188eu-add-firmware-dependency.patch create mode 100644 queue-5.15/staging-rtl8712-fix-use-after-free-bugs.patch diff --git a/queue-5.15/serial-fsl_lpuart-rs485-rts-polariy-is-inverse.patch b/queue-5.15/serial-fsl_lpuart-rs485-rts-polariy-is-inverse.patch new file mode 100644 index 00000000000..3216d58c864 --- /dev/null +++ b/queue-5.15/serial-fsl_lpuart-rs485-rts-polariy-is-inverse.patch @@ -0,0 +1,39 @@ +From 846651eca073e2e02e37490a4a52752415d84781 Mon Sep 17 00:00:00 2001 +From: Shenwei Wang +Date: Fri, 5 Aug 2022 09:45:29 -0500 +Subject: serial: fsl_lpuart: RS485 RTS polariy is inverse + +From: Shenwei Wang + +commit 846651eca073e2e02e37490a4a52752415d84781 upstream. + +The setting of RS485 RTS polarity is inverse in the current driver. + +When the property of 'rs485-rts-active-low' is enabled in the dts node, +the RTS signal should be LOW during sending. Otherwise, if there is no +such a property, the RTS should be HIGH during sending. + +Fixes: 03895cf41d18 ("tty: serial: fsl_lpuart: Add support for RS-485") +Cc: stable +Signed-off-by: Nicolas Diaz +Signed-off-by: Shenwei Wang +Link: https://lore.kernel.org/r/20220805144529.604856-1-shenwei.wang@nxp.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/fsl_lpuart.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1381,9 +1381,9 @@ static int lpuart_config_rs485(struct ua + * Note: UART is assumed to be active high. + */ + if (rs485->flags & SER_RS485_RTS_ON_SEND) +- modem &= ~UARTMODEM_TXRTSPOL; +- else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) + modem |= UARTMODEM_TXRTSPOL; ++ else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) ++ modem &= ~UARTMODEM_TXRTSPOL; + } + + /* Store the new configuration */ diff --git a/queue-5.15/series b/queue-5.15/series index fa44250e87e..75be00cfb5e 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -33,3 +33,6 @@ tcp-annotate-data-race-around-challenge_timestamp.patch revert-sch_cake-return-__net_xmit_stolen-when-consum.patch net-smc-remove-redundant-refcount-increase.patch soundwire-qcom-fix-device-status-array-range.patch +serial-fsl_lpuart-rs485-rts-polariy-is-inverse.patch +staging-rtl8712-fix-use-after-free-bugs.patch +staging-r8188eu-add-firmware-dependency.patch diff --git a/queue-5.15/staging-r8188eu-add-firmware-dependency.patch b/queue-5.15/staging-r8188eu-add-firmware-dependency.patch new file mode 100644 index 00000000000..a42ac5fe20b --- /dev/null +++ b/queue-5.15/staging-r8188eu-add-firmware-dependency.patch @@ -0,0 +1,48 @@ +From b2fa9e13bbf101c662c4cd974608242a0db98cfc Mon Sep 17 00:00:00 2001 +From: Grzegorz Szymaszek +Date: Tue, 2 Aug 2022 19:18:44 +0200 +Subject: staging: r8188eu: add firmware dependency + +From: Grzegorz Szymaszek + +commit b2fa9e13bbf101c662c4cd974608242a0db98cfc upstream. + +The old rtl8188eu module, removed in commit 55dfa29b43d2 ("staging: +rtl8188eu: remove rtl8188eu driver from staging dir") (Linux kernel +v5.15-rc1), required (through a MODULE_FIRMWARE call()) the +rtlwifi/rtl8188eufw.bin firmware file, which the new r8188eu driver no +longer requires. + +I have tested a few RTL8188EUS-based Wi-Fi cards and, while supported by +both drivers, they do not work when using the new one and the firmware +wasn't manually loaded. According to Larry Finger, the module +maintainer, all such cards need the firmware and the driver should +depend on it (see the linked mails). + +Add a proper MODULE_FIRMWARE() call, like it was done in the old driver. + +Thanks to Greg Kroah-Hartman and Larry Finger for quick responses to my +questions. + +Cc: stable +Link: https://answers.launchpad.net/ubuntu/+source/linux-meta-hwe-5.15/+question/702611 +Link: https://lore.kernel.org/lkml/YukkBu3TNODO3or9@nx64de-df6d00/ +Signed-off-by: Grzegorz Szymaszek +Link: https://lore.kernel.org/r/YulcdKfhA8dPQ78s@nx64de-df6d00 +Acked-by: Phillip Potter +Acked-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/r8188eu/os_dep/os_intfs.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/r8188eu/os_dep/os_intfs.c ++++ b/drivers/staging/r8188eu/os_dep/os_intfs.c +@@ -17,6 +17,7 @@ MODULE_LICENSE("GPL"); + MODULE_DESCRIPTION("Realtek Wireless Lan Driver"); + MODULE_AUTHOR("Realtek Semiconductor Corp."); + MODULE_VERSION(DRIVERVERSION); ++MODULE_FIRMWARE("rtlwifi/rtl8188eufw.bin"); + + #define CONFIG_BR_EXT_BRNAME "br0" + #define RTW_NOTCH_FILTER 0 /* 0:Disable, 1:Enable, */ diff --git a/queue-5.15/staging-rtl8712-fix-use-after-free-bugs.patch b/queue-5.15/staging-rtl8712-fix-use-after-free-bugs.patch new file mode 100644 index 00000000000..d4ad9d84f41 --- /dev/null +++ b/queue-5.15/staging-rtl8712-fix-use-after-free-bugs.patch @@ -0,0 +1,75 @@ +From e230a4455ac3e9b112f0367d1b8e255e141afae0 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 30 Aug 2022 17:55:07 +0300 +Subject: staging: rtl8712: fix use after free bugs + +From: Dan Carpenter + +commit e230a4455ac3e9b112f0367d1b8e255e141afae0 upstream. + +_Read/Write_MACREG callbacks are NULL so the read/write_macreg_hdl() +functions don't do anything except free the "pcmd" pointer. It +results in a use after free. Delete them. + +Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel") +Cc: stable +Reported-by: Zheng Wang +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/Yw4ASqkYcUhUfoY2@kili +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/rtl8712/rtl8712_cmd.c | 36 ---------------------------------- + 1 file changed, 36 deletions(-) + +--- a/drivers/staging/rtl8712/rtl8712_cmd.c ++++ b/drivers/staging/rtl8712/rtl8712_cmd.c +@@ -117,34 +117,6 @@ static void r871x_internal_cmd_hdl(struc + kfree(pdrvcmd->pbuf); + } + +-static u8 read_macreg_hdl(struct _adapter *padapter, u8 *pbuf) +-{ +- void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd); +- struct cmd_obj *pcmd = (struct cmd_obj *)pbuf; +- +- /* invoke cmd->callback function */ +- pcmd_callback = cmd_callback[pcmd->cmdcode].callback; +- if (!pcmd_callback) +- r8712_free_cmd_obj(pcmd); +- else +- pcmd_callback(padapter, pcmd); +- return H2C_SUCCESS; +-} +- +-static u8 write_macreg_hdl(struct _adapter *padapter, u8 *pbuf) +-{ +- void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd); +- struct cmd_obj *pcmd = (struct cmd_obj *)pbuf; +- +- /* invoke cmd->callback function */ +- pcmd_callback = cmd_callback[pcmd->cmdcode].callback; +- if (!pcmd_callback) +- r8712_free_cmd_obj(pcmd); +- else +- pcmd_callback(padapter, pcmd); +- return H2C_SUCCESS; +-} +- + static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf) + { + struct cmd_obj *pcmd = (struct cmd_obj *)pbuf; +@@ -213,14 +185,6 @@ static struct cmd_obj *cmd_hdl_filter(st + pcmd_r = NULL; + + switch (pcmd->cmdcode) { +- case GEN_CMD_CODE(_Read_MACREG): +- read_macreg_hdl(padapter, (u8 *)pcmd); +- pcmd_r = pcmd; +- break; +- case GEN_CMD_CODE(_Write_MACREG): +- write_macreg_hdl(padapter, (u8 *)pcmd); +- pcmd_r = pcmd; +- break; + case GEN_CMD_CODE(_Read_BBREG): + read_bbreg_hdl(padapter, (u8 *)pcmd); + break; -- 2.47.3