From d549a5b62345f26ac414e5b0be12435eba374b9e Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 19 Dec 2022 16:23:22 +0100 Subject: [PATCH] 6.0-stable patches added patches: igb-initialize-mailbox-message-for-vf-reset.patch keys-encrypted-fix-key-instantiation-with-user-provided-data.patch usb-dwc3-pci-update-pcie-device-id-for-usb3-controller-on-cpu-sub-system-for-raptor-lake.patch usb-typec-ucsi-resume-in-separate-work.patch usb-ulpi-defer-ulpi_register-on-ulpi_read_id-timeout.patch xhci-apply-xhci_reset_to_default-quirk-to-adl-n.patch --- ...tialize-mailbox-message-for-vf-reset.patch | 38 ++++++++ ...nstantiation-with-user-provided-data.patch | 82 ++++++++++++++++ queue-6.0/series | 6 ++ ...er-on-cpu-sub-system-for-raptor-lake.patch | 33 +++++++ ...b-typec-ucsi-resume-in-separate-work.patch | 96 +++++++++++++++++++ ...lpi_register-on-ulpi_read_id-timeout.patch | 43 +++++++++ ...xhci_reset_to_default-quirk-to-adl-n.patch | 48 ++++++++++ 7 files changed, 346 insertions(+) create mode 100644 queue-6.0/igb-initialize-mailbox-message-for-vf-reset.patch create mode 100644 queue-6.0/keys-encrypted-fix-key-instantiation-with-user-provided-data.patch create mode 100644 queue-6.0/usb-dwc3-pci-update-pcie-device-id-for-usb3-controller-on-cpu-sub-system-for-raptor-lake.patch create mode 100644 queue-6.0/usb-typec-ucsi-resume-in-separate-work.patch create mode 100644 queue-6.0/usb-ulpi-defer-ulpi_register-on-ulpi_read_id-timeout.patch create mode 100644 queue-6.0/xhci-apply-xhci_reset_to_default-quirk-to-adl-n.patch diff --git a/queue-6.0/igb-initialize-mailbox-message-for-vf-reset.patch b/queue-6.0/igb-initialize-mailbox-message-for-vf-reset.patch new file mode 100644 index 00000000000..6482bcfc13f --- /dev/null +++ b/queue-6.0/igb-initialize-mailbox-message-for-vf-reset.patch @@ -0,0 +1,38 @@ +From de5dc44370fbd6b46bd7f1a1e00369be54a041c8 Mon Sep 17 00:00:00 2001 +From: Tony Nguyen +Date: Mon, 12 Dec 2022 11:00:31 -0800 +Subject: igb: Initialize mailbox message for VF reset + +From: Tony Nguyen + +commit de5dc44370fbd6b46bd7f1a1e00369be54a041c8 upstream. + +When a MAC address is not assigned to the VF, that portion of the message +sent to the VF is not set. The memory, however, is allocated from the +stack meaning that information may be leaked to the VM. Initialize the +message buffer to 0 so that no information is passed to the VM in this +case. + +Fixes: 6ddbc4cf1f4d ("igb: Indicate failure on vf reset for empty mac address") +Reported-by: Akihiko Odaki +Signed-off-by: Tony Nguyen +Reviewed-by: Akihiko Odaki +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20221212190031.3983342-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/igb/igb_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -7522,7 +7522,7 @@ static void igb_vf_reset_msg(struct igb_ + { + struct e1000_hw *hw = &adapter->hw; + unsigned char *vf_mac = adapter->vf_data[vf].vf_mac_addresses; +- u32 reg, msgbuf[3]; ++ u32 reg, msgbuf[3] = {}; + u8 *addr = (u8 *)(&msgbuf[1]); + + /* process all the same items cleared in a function level reset */ diff --git a/queue-6.0/keys-encrypted-fix-key-instantiation-with-user-provided-data.patch b/queue-6.0/keys-encrypted-fix-key-instantiation-with-user-provided-data.patch new file mode 100644 index 00000000000..0397d429117 --- /dev/null +++ b/queue-6.0/keys-encrypted-fix-key-instantiation-with-user-provided-data.patch @@ -0,0 +1,82 @@ +From 5adedd42245af0860ebda8fe0949f24f5204c1b1 Mon Sep 17 00:00:00 2001 +From: Nikolaus Voss +Date: Wed, 19 Oct 2022 18:38:20 +0200 +Subject: KEYS: encrypted: fix key instantiation with user-provided data + +From: Nikolaus Voss + +commit 5adedd42245af0860ebda8fe0949f24f5204c1b1 upstream. + +Commit cd3bc044af48 ("KEYS: encrypted: Instantiate key with +user-provided decrypted data") added key instantiation with user +provided decrypted data. The user data is hex-ascii-encoded but was +just memcpy'ed to the binary buffer. Fix this to use hex2bin instead. + +Old keys created from user provided decrypted data saved with "keyctl +pipe" are still valid, however if the key is recreated from decrypted +data the old key must be converted to the correct format. This can be +done with a small shell script, e.g.: + +BROKENKEY=abcdefABCDEF1234567890aaaaaaaaaa +NEWKEY=$(echo -ne $BROKENKEY | xxd -p -c32) +keyctl add user masterkey "$(cat masterkey.bin)" @u +keyctl add encrypted testkey "new user:masterkey 32 $NEWKEY" @u + +However, NEWKEY is still broken: If for BROKENKEY 32 bytes were +specified, a brute force attacker knowing the key properties would only +need to try at most 2^(16*8) keys, as if the key was only 16 bytes long. + +The security issue is a result of the combination of limiting the input +range to hex-ascii and using memcpy() instead of hex2bin(). It could +have been fixed either by allowing binary input or using hex2bin() (and +doubling the ascii input key length). This patch implements the latter. + +The corresponding test for the Linux Test Project ltp has also been +fixed (see link below). + +Fixes: cd3bc044af48 ("KEYS: encrypted: Instantiate key with user-provided decrypted data") +Cc: stable@kernel.org +Link: https://lore.kernel.org/ltp/20221006081709.92303897@mail.steuer-voss.de/ +Reviewed-by: Mimi Zohar +Signed-off-by: Nikolaus Voss +Signed-off-by: Mimi Zohar +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/security/keys/trusted-encrypted.rst | 3 ++- + security/keys/encrypted-keys/encrypted.c | 6 +++--- + 2 files changed, 5 insertions(+), 4 deletions(-) + +--- a/Documentation/security/keys/trusted-encrypted.rst ++++ b/Documentation/security/keys/trusted-encrypted.rst +@@ -350,7 +350,8 @@ Load an encrypted key "evm" from saved b + + Instantiate an encrypted key "evm" using user-provided decrypted data:: + +- $ keyctl add encrypted evm "new default user:kmk 32 `cat evm_decrypted_data.blob`" @u ++ $ evmkey=$(dd if=/dev/urandom bs=1 count=32 | xxd -c32 -p) ++ $ keyctl add encrypted evm "new default user:kmk 32 $evmkey" @u + 794890253 + + $ keyctl print 794890253 +--- a/security/keys/encrypted-keys/encrypted.c ++++ b/security/keys/encrypted-keys/encrypted.c +@@ -627,7 +627,7 @@ static struct encrypted_key_payload *enc + pr_err("encrypted key: instantiation of keys using provided decrypted data is disabled since CONFIG_USER_DECRYPTED_DATA is set to false\n"); + return ERR_PTR(-EINVAL); + } +- if (strlen(decrypted_data) != decrypted_datalen) { ++ if (strlen(decrypted_data) != decrypted_datalen * 2) { + pr_err("encrypted key: decrypted data provided does not match decrypted data length provided\n"); + return ERR_PTR(-EINVAL); + } +@@ -791,8 +791,8 @@ static int encrypted_init(struct encrypt + ret = encrypted_key_decrypt(epayload, format, hex_encoded_iv); + } else if (decrypted_data) { + get_random_bytes(epayload->iv, ivsize); +- memcpy(epayload->decrypted_data, decrypted_data, +- epayload->decrypted_datalen); ++ ret = hex2bin(epayload->decrypted_data, decrypted_data, ++ epayload->decrypted_datalen); + } else { + get_random_bytes(epayload->iv, ivsize); + get_random_bytes(epayload->decrypted_data, epayload->decrypted_datalen); diff --git a/queue-6.0/series b/queue-6.0/series index a48a0a4a9f1..fc83c2e05b8 100644 --- a/queue-6.0/series +++ b/queue-6.0/series @@ -17,3 +17,9 @@ usb-serial-cp210x-add-kamstrup-rf-sniffer-pids.patch usb-serial-f81232-fix-division-by-zero-on-line-speed-change.patch usb-serial-f81534-fix-division-by-zero-on-line-speed-change.patch alsa-hda-realtek-fix-mute-micmute-leds-for-a-hp-probook.patch +xhci-apply-xhci_reset_to_default-quirk-to-adl-n.patch +igb-initialize-mailbox-message-for-vf-reset.patch +usb-typec-ucsi-resume-in-separate-work.patch +usb-dwc3-pci-update-pcie-device-id-for-usb3-controller-on-cpu-sub-system-for-raptor-lake.patch +keys-encrypted-fix-key-instantiation-with-user-provided-data.patch +usb-ulpi-defer-ulpi_register-on-ulpi_read_id-timeout.patch diff --git a/queue-6.0/usb-dwc3-pci-update-pcie-device-id-for-usb3-controller-on-cpu-sub-system-for-raptor-lake.patch b/queue-6.0/usb-dwc3-pci-update-pcie-device-id-for-usb3-controller-on-cpu-sub-system-for-raptor-lake.patch new file mode 100644 index 00000000000..27d420a5f71 --- /dev/null +++ b/queue-6.0/usb-dwc3-pci-update-pcie-device-id-for-usb3-controller-on-cpu-sub-system-for-raptor-lake.patch @@ -0,0 +1,33 @@ +From f05f80f217bf52443a2582bca19fd78188333f25 Mon Sep 17 00:00:00 2001 +From: Shruthi Sanil +Date: Fri, 25 Nov 2022 16:23:27 +0530 +Subject: usb: dwc3: pci: Update PCIe device ID for USB3 controller on CPU sub-system for Raptor Lake + +From: Shruthi Sanil + +commit f05f80f217bf52443a2582bca19fd78188333f25 upstream. + +The device ID 0xa70e is defined for the USB3 device controller in the CPU +sub-system of Raptor Lake platform. Hence updating the ID accordingly. + +Fixes: bad0d1d726ac ("usb: dwc3: pci: Add support for Intel Raptor Lake") +Cc: stable +Reviewed-by: Heikki Krogerus +Signed-off-by: Shruthi Sanil +Link: https://lore.kernel.org/r/20221125105327.27945-1-shruthi.sanil@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -44,7 +44,7 @@ + #define PCI_DEVICE_ID_INTEL_ADLP 0x51ee + #define PCI_DEVICE_ID_INTEL_ADLM 0x54ee + #define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1 +-#define PCI_DEVICE_ID_INTEL_RPL 0x460e ++#define PCI_DEVICE_ID_INTEL_RPL 0xa70e + #define PCI_DEVICE_ID_INTEL_RPLS 0x7a61 + #define PCI_DEVICE_ID_INTEL_MTLP 0x7ec1 + #define PCI_DEVICE_ID_INTEL_MTL 0x7e7e diff --git a/queue-6.0/usb-typec-ucsi-resume-in-separate-work.patch b/queue-6.0/usb-typec-ucsi-resume-in-separate-work.patch new file mode 100644 index 00000000000..81e35e65f02 --- /dev/null +++ b/queue-6.0/usb-typec-ucsi-resume-in-separate-work.patch @@ -0,0 +1,96 @@ +From e0dced9c7d4763fd97c86a13902d135f03cc42eb Mon Sep 17 00:00:00 2001 +From: Heikki Krogerus +Date: Wed, 23 Nov 2022 11:30:21 +0200 +Subject: usb: typec: ucsi: Resume in separate work + +From: Heikki Krogerus + +commit e0dced9c7d4763fd97c86a13902d135f03cc42eb upstream. + +It can take more than one second to check each connector +when the system is resumed. So if you have, say, eight +connectors, it may take eight seconds for ucsi_resume() to +finish. That's a bit too much. + +This will modify ucsi_resume() so that it schedules a work +where the interface is actually resumed instead of checking +the connectors directly. The connections will also be +checked in separate tasks which are queued for each connector +separately. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216706 +Fixes: 99f6d4361113 ("usb: typec: ucsi: Check the connection on resume") +Cc: +Reported-by: Todd Brandt +Signed-off-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20221123093021.25981-1-heikki.krogerus@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi.c | 17 +++++++++++++---- + drivers/usb/typec/ucsi/ucsi.h | 1 + + 2 files changed, 14 insertions(+), 4 deletions(-) + +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -1270,8 +1270,9 @@ err: + return ret; + } + +-int ucsi_resume(struct ucsi *ucsi) ++static void ucsi_resume_work(struct work_struct *work) + { ++ struct ucsi *ucsi = container_of(work, struct ucsi, resume_work); + struct ucsi_connector *con; + u64 command; + int ret; +@@ -1279,15 +1280,21 @@ int ucsi_resume(struct ucsi *ucsi) + /* Restore UCSI notification enable mask after system resume */ + command = UCSI_SET_NOTIFICATION_ENABLE | ucsi->ntfy; + ret = ucsi_send_command(ucsi, command, NULL, 0); +- if (ret < 0) +- return ret; ++ if (ret < 0) { ++ dev_err(ucsi->dev, "failed to re-enable notifications (%d)\n", ret); ++ return; ++ } + + for (con = ucsi->connector; con->port; con++) { + mutex_lock(&con->lock); +- ucsi_check_connection(con); ++ ucsi_partner_task(con, ucsi_check_connection, 1, 0); + mutex_unlock(&con->lock); + } ++} + ++int ucsi_resume(struct ucsi *ucsi) ++{ ++ queue_work(system_long_wq, &ucsi->resume_work); + return 0; + } + EXPORT_SYMBOL_GPL(ucsi_resume); +@@ -1347,6 +1354,7 @@ struct ucsi *ucsi_create(struct device * + if (!ucsi) + return ERR_PTR(-ENOMEM); + ++ INIT_WORK(&ucsi->resume_work, ucsi_resume_work); + INIT_DELAYED_WORK(&ucsi->work, ucsi_init_work); + mutex_init(&ucsi->ppm_lock); + ucsi->dev = dev; +@@ -1401,6 +1409,7 @@ void ucsi_unregister(struct ucsi *ucsi) + + /* Make sure that we are not in the middle of driver initialization */ + cancel_delayed_work_sync(&ucsi->work); ++ cancel_work_sync(&ucsi->resume_work); + + /* Disable notifications */ + ucsi->ops->async_write(ucsi, UCSI_CONTROL, &cmd, sizeof(cmd)); +--- a/drivers/usb/typec/ucsi/ucsi.h ++++ b/drivers/usb/typec/ucsi/ucsi.h +@@ -287,6 +287,7 @@ struct ucsi { + struct ucsi_capability cap; + struct ucsi_connector *connector; + ++ struct work_struct resume_work; + struct delayed_work work; + int work_count; + #define UCSI_ROLE_SWITCH_RETRY_PER_HZ 10 diff --git a/queue-6.0/usb-ulpi-defer-ulpi_register-on-ulpi_read_id-timeout.patch b/queue-6.0/usb-ulpi-defer-ulpi_register-on-ulpi_read_id-timeout.patch new file mode 100644 index 00000000000..8e85b8e3f06 --- /dev/null +++ b/queue-6.0/usb-ulpi-defer-ulpi_register-on-ulpi_read_id-timeout.patch @@ -0,0 +1,43 @@ +From 8a7b31d545d3a15f0e6f5984ae16f0ca4fd76aac Mon Sep 17 00:00:00 2001 +From: Ferry Toth +Date: Mon, 5 Dec 2022 21:15:26 +0100 +Subject: usb: ulpi: defer ulpi_register on ulpi_read_id timeout + +From: Ferry Toth + +commit 8a7b31d545d3a15f0e6f5984ae16f0ca4fd76aac upstream. + +Since commit 0f0101719138 ("usb: dwc3: Don't switch OTG -> peripheral +if extcon is present") Dual Role support on Intel Merrifield platform +broke due to rearranging the call to dwc3_get_extcon(). + +It appears to be caused by ulpi_read_id() on the first test write failing +with -ETIMEDOUT. Currently ulpi_read_id() expects to discover the phy via +DT when the test write fails and returns 0 in that case, even if DT does not +provide the phy. As a result usb probe completes without phy. + +Make ulpi_read_id() return -ETIMEDOUT to its user if the first test write +fails. The user should then handle it appropriately. A follow up patch +will make dwc3_core_init() set -EPROBE_DEFER in this case and bail out. + +Fixes: ef6a7bcfb01c ("usb: ulpi: Support device discovery via DT") +Cc: stable@vger.kernel.org +Acked-by: Heikki Krogerus +Signed-off-by: Ferry Toth +Link: https://lore.kernel.org/r/20221205201527.13525-2-ftoth@exalondelft.nl +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/common/ulpi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/common/ulpi.c ++++ b/drivers/usb/common/ulpi.c +@@ -207,7 +207,7 @@ static int ulpi_read_id(struct ulpi *ulp + /* Test the interface */ + ret = ulpi_write(ulpi, ULPI_SCRATCH, 0xaa); + if (ret < 0) +- goto err; ++ return ret; + + ret = ulpi_read(ulpi, ULPI_SCRATCH); + if (ret < 0) diff --git a/queue-6.0/xhci-apply-xhci_reset_to_default-quirk-to-adl-n.patch b/queue-6.0/xhci-apply-xhci_reset_to_default-quirk-to-adl-n.patch new file mode 100644 index 00000000000..9b0180c3c22 --- /dev/null +++ b/queue-6.0/xhci-apply-xhci_reset_to_default-quirk-to-adl-n.patch @@ -0,0 +1,48 @@ +From fed70b61ef2c0aed54456db3d485b215f6cc3209 Mon Sep 17 00:00:00 2001 +From: Reka Norman +Date: Wed, 30 Nov 2022 11:19:40 +0200 +Subject: xhci: Apply XHCI_RESET_TO_DEFAULT quirk to ADL-N + +From: Reka Norman + +commit fed70b61ef2c0aed54456db3d485b215f6cc3209 upstream. + +ADL-N systems have the same issue as ADL-P, where a large boot firmware +delay is seen if USB ports are left in U3 at shutdown. So apply the +XHCI_RESET_TO_DEFAULT quirk to ADL-N as well. + +This patch depends on commit 34cd2db408d5 ("xhci: Add quirk to reset +host back to default state at shutdown"). + +The issue it fixes is a ~20s boot time delay when booting from S5. It +affects ADL-N devices, and ADL-N support was added starting from v5.16. + +Cc: stable@vger.kernel.org +Signed-off-by: Reka Norman +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20221130091944.2171610-3-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-pci.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -59,6 +59,7 @@ + #define PCI_DEVICE_ID_INTEL_TIGER_LAKE_XHCI 0x9a13 + #define PCI_DEVICE_ID_INTEL_MAPLE_RIDGE_XHCI 0x1138 + #define PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI 0x51ed ++#define PCI_DEVICE_ID_INTEL_ALDER_LAKE_N_PCH_XHCI 0x54ed + + #define PCI_DEVICE_ID_AMD_RENOIR_XHCI 0x1639 + #define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9 +@@ -246,7 +247,8 @@ static void xhci_pci_quirks(struct devic + xhci->quirks |= XHCI_MISSING_CAS; + + if (pdev->vendor == PCI_VENDOR_ID_INTEL && +- pdev->device == PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI) ++ (pdev->device == PCI_DEVICE_ID_INTEL_ALDER_LAKE_PCH_XHCI || ++ pdev->device == PCI_DEVICE_ID_INTEL_ALDER_LAKE_N_PCH_XHCI)) + xhci->quirks |= XHCI_RESET_TO_DEFAULT; + + if (pdev->vendor == PCI_VENDOR_ID_INTEL && -- 2.47.3