drop another patch

diff --git a/queue-4.14/media-rtl28xxu-fix-zero-length-control-request.patch b/queue-4.14/media-rtl28xxu-fix-zero-length-control-request.patch
deleted file mode 100644 (file)
index e3ea772..0000000
--- a/queue-4.14/media-rtl28xxu-fix-zero-length-control-request.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 25d5ce3a606a1eb23a9265d615a92a876ff9cb5f Mon Sep 17 00:00:00 2001
-From: Johan Hovold <johan@kernel.org>
-Date: Mon, 24 May 2021 13:09:20 +0200
-Subject: media: rtl28xxu: fix zero-length control request
-
-From: Johan Hovold <johan@kernel.org>
-
-commit 25d5ce3a606a1eb23a9265d615a92a876ff9cb5f upstream.
-
-The direction of the pipe argument must match the request-type direction
-bit or control requests may fail depending on the host-controller-driver
-implementation.
-
-Control transfers without a data stage are treated as OUT requests by
-the USB stack and should be using usb_sndctrlpipe(). Failing to do so
-will now trigger a warning.
-
-Fix the zero-length i2c-read request used for type detection by
-attempting to read a single byte instead.
-
-Reported-by: syzbot+faf11bbadc5a372564da@syzkaller.appspotmail.com
-Fixes: d0f232e823af ("[media] rtl28xxu: add heuristic to detect chip type")
-Cc: stable@vger.kernel.org      # 4.0
-Cc: Antti Palosaari <crope@iki.fi>
-Signed-off-by: Johan Hovold <johan@kernel.org>
-Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/media/usb/dvb-usb-v2/rtl28xxu.c |    3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
-+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
-@@ -603,8 +603,9 @@ static int rtl28xxu_read_config(struct d
- static int rtl28xxu_identify_state(struct dvb_usb_device *d, const char **name)
- {
-       struct rtl28xxu_dev *dev = d_to_priv(d);
-+      u8 buf[1];
-       int ret;
--      struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 0, NULL};
-+      struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 1, buf};
- 
-       dev_dbg(&d->intf->dev, "\n");
- 

diff --git a/queue-4.14/series b/queue-4.14/series
index c319e7929fe6adde6ec73a95cbd0ff1475d68f07..3e96dae60d54fbda0e5e913faa286beef2a6386f 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -224,7 +224,6 @@ media-dtv5100-fix-control-request-directions.patch
 media-zr364xx-fix-memory-leak-in-zr364xx_start_readpipe.patch
 media-gspca-sq905-fix-control-request-direction.patch
 media-gspca-sunplus-fix-zero-length-control-requests.patch
-media-rtl28xxu-fix-zero-length-control-request.patch
 media-uvcvideo-fix-pixel-format-change-for-elgato-cam-link-4k.patch
 jfs-fix-gpf-in-difree.patch
 smackfs-restrict-bytes-count-in-smk_set_cipso.patch

diff --git a/queue-4.19/media-rtl28xxu-fix-zero-length-control-request.patch b/queue-4.19/media-rtl28xxu-fix-zero-length-control-request.patch
deleted file mode 100644 (file)
index e3ea772..0000000
--- a/queue-4.19/media-rtl28xxu-fix-zero-length-control-request.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 25d5ce3a606a1eb23a9265d615a92a876ff9cb5f Mon Sep 17 00:00:00 2001
-From: Johan Hovold <johan@kernel.org>
-Date: Mon, 24 May 2021 13:09:20 +0200
-Subject: media: rtl28xxu: fix zero-length control request
-
-From: Johan Hovold <johan@kernel.org>
-
-commit 25d5ce3a606a1eb23a9265d615a92a876ff9cb5f upstream.
-
-The direction of the pipe argument must match the request-type direction
-bit or control requests may fail depending on the host-controller-driver
-implementation.
-
-Control transfers without a data stage are treated as OUT requests by
-the USB stack and should be using usb_sndctrlpipe(). Failing to do so
-will now trigger a warning.
-
-Fix the zero-length i2c-read request used for type detection by
-attempting to read a single byte instead.
-
-Reported-by: syzbot+faf11bbadc5a372564da@syzkaller.appspotmail.com
-Fixes: d0f232e823af ("[media] rtl28xxu: add heuristic to detect chip type")
-Cc: stable@vger.kernel.org      # 4.0
-Cc: Antti Palosaari <crope@iki.fi>
-Signed-off-by: Johan Hovold <johan@kernel.org>
-Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/media/usb/dvb-usb-v2/rtl28xxu.c |    3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
-+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
-@@ -603,8 +603,9 @@ static int rtl28xxu_read_config(struct d
- static int rtl28xxu_identify_state(struct dvb_usb_device *d, const char **name)
- {
-       struct rtl28xxu_dev *dev = d_to_priv(d);
-+      u8 buf[1];
-       int ret;
--      struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 0, NULL};
-+      struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 1, buf};
- 
-       dev_dbg(&d->intf->dev, "\n");
- 

diff --git a/queue-4.19/series b/queue-4.19/series
index 4ffe17b69661e3cec40993533b8cc774b665f492..e9c08ea30700ec3201da9ca349d4a7b9d9a26d6a 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -310,7 +310,6 @@ media-dtv5100-fix-control-request-directions.patch
 media-zr364xx-fix-memory-leak-in-zr364xx_start_readpipe.patch
 media-gspca-sq905-fix-control-request-direction.patch
 media-gspca-sunplus-fix-zero-length-control-requests.patch
-media-rtl28xxu-fix-zero-length-control-request.patch
 media-uvcvideo-fix-pixel-format-change-for-elgato-cam-link-4k.patch
 pinctrl-mcp23s08-fix-missing-unlock-on-error-in-mcp23s08_irq.patch
 jfs-fix-gpf-in-difree.patch

diff --git a/queue-4.4/media-rtl28xxu-fix-zero-length-control-request.patch b/queue-4.4/media-rtl28xxu-fix-zero-length-control-request.patch
deleted file mode 100644 (file)
index 1ac226d..0000000
--- a/queue-4.4/media-rtl28xxu-fix-zero-length-control-request.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 25d5ce3a606a1eb23a9265d615a92a876ff9cb5f Mon Sep 17 00:00:00 2001
-From: Johan Hovold <johan@kernel.org>
-Date: Mon, 24 May 2021 13:09:20 +0200
-Subject: media: rtl28xxu: fix zero-length control request
-
-From: Johan Hovold <johan@kernel.org>
-
-commit 25d5ce3a606a1eb23a9265d615a92a876ff9cb5f upstream.
-
-The direction of the pipe argument must match the request-type direction
-bit or control requests may fail depending on the host-controller-driver
-implementation.
-
-Control transfers without a data stage are treated as OUT requests by
-the USB stack and should be using usb_sndctrlpipe(). Failing to do so
-will now trigger a warning.
-
-Fix the zero-length i2c-read request used for type detection by
-attempting to read a single byte instead.
-
-Reported-by: syzbot+faf11bbadc5a372564da@syzkaller.appspotmail.com
-Fixes: d0f232e823af ("[media] rtl28xxu: add heuristic to detect chip type")
-Cc: stable@vger.kernel.org      # 4.0
-Cc: Antti Palosaari <crope@iki.fi>
-Signed-off-by: Johan Hovold <johan@kernel.org>
-Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/media/usb/dvb-usb-v2/rtl28xxu.c |    3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
-+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
-@@ -593,8 +593,9 @@ static int rtl28xxu_read_config(struct d
- static int rtl28xxu_identify_state(struct dvb_usb_device *d, const char **name)
- {
-       struct rtl28xxu_dev *dev = d_to_priv(d);
-+      u8 buf[1];
-       int ret;
--      struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 0, NULL};
-+      struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 1, buf};
- 
-       dev_dbg(&d->intf->dev, "\n");
- 

diff --git a/queue-4.4/series b/queue-4.4/series
index 782e9997fa2e657af83442ef3ca8c7dd2e5cf329..42d9aa235053feedcac18d2c31401156f570a035 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -136,6 +136,5 @@ dm-btree-remove-assign-new_root-only-when-removal-succeeds.patch
 media-zr364xx-fix-memory-leak-in-zr364xx_start_readpipe.patch
 media-gspca-sq905-fix-control-request-direction.patch
 media-gspca-sunplus-fix-zero-length-control-requests.patch
-media-rtl28xxu-fix-zero-length-control-request.patch
 media-uvcvideo-fix-pixel-format-change-for-elgato-cam-link-4k.patch
 jfs-fix-gpf-in-difree.patch

diff --git a/queue-4.9/media-rtl28xxu-fix-zero-length-control-request.patch b/queue-4.9/media-rtl28xxu-fix-zero-length-control-request.patch
deleted file mode 100644 (file)
index e3ea772..0000000
--- a/queue-4.9/media-rtl28xxu-fix-zero-length-control-request.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 25d5ce3a606a1eb23a9265d615a92a876ff9cb5f Mon Sep 17 00:00:00 2001
-From: Johan Hovold <johan@kernel.org>
-Date: Mon, 24 May 2021 13:09:20 +0200
-Subject: media: rtl28xxu: fix zero-length control request
-
-From: Johan Hovold <johan@kernel.org>
-
-commit 25d5ce3a606a1eb23a9265d615a92a876ff9cb5f upstream.
-
-The direction of the pipe argument must match the request-type direction
-bit or control requests may fail depending on the host-controller-driver
-implementation.
-
-Control transfers without a data stage are treated as OUT requests by
-the USB stack and should be using usb_sndctrlpipe(). Failing to do so
-will now trigger a warning.
-
-Fix the zero-length i2c-read request used for type detection by
-attempting to read a single byte instead.
-
-Reported-by: syzbot+faf11bbadc5a372564da@syzkaller.appspotmail.com
-Fixes: d0f232e823af ("[media] rtl28xxu: add heuristic to detect chip type")
-Cc: stable@vger.kernel.org      # 4.0
-Cc: Antti Palosaari <crope@iki.fi>
-Signed-off-by: Johan Hovold <johan@kernel.org>
-Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/media/usb/dvb-usb-v2/rtl28xxu.c |    3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
-+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
-@@ -603,8 +603,9 @@ static int rtl28xxu_read_config(struct d
- static int rtl28xxu_identify_state(struct dvb_usb_device *d, const char **name)
- {
-       struct rtl28xxu_dev *dev = d_to_priv(d);
-+      u8 buf[1];
-       int ret;
--      struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 0, NULL};
-+      struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 1, buf};
- 
-       dev_dbg(&d->intf->dev, "\n");
- 

diff --git a/queue-4.9/series b/queue-4.9/series
index 6e308c463fb78eedfd2b71eeb82b104497a44deb..451aafde41c8588d806cb7831c1949d121654fc7 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -174,7 +174,6 @@ media-dtv5100-fix-control-request-directions.patch
 media-zr364xx-fix-memory-leak-in-zr364xx_start_readpipe.patch
 media-gspca-sq905-fix-control-request-direction.patch
 media-gspca-sunplus-fix-zero-length-control-requests.patch
-media-rtl28xxu-fix-zero-length-control-request.patch
 media-uvcvideo-fix-pixel-format-change-for-elgato-cam-link-4k.patch
 jfs-fix-gpf-in-difree.patch
 smackfs-restrict-bytes-count-in-smk_set_cipso.patch

diff --git a/queue-5.10/media-rtl28xxu-fix-zero-length-control-request.patch b/queue-5.10/media-rtl28xxu-fix-zero-length-control-request.patch
deleted file mode 100644 (file)
index d8678fb..0000000
--- a/queue-5.10/media-rtl28xxu-fix-zero-length-control-request.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 25d5ce3a606a1eb23a9265d615a92a876ff9cb5f Mon Sep 17 00:00:00 2001
-From: Johan Hovold <johan@kernel.org>
-Date: Mon, 24 May 2021 13:09:20 +0200
-Subject: media: rtl28xxu: fix zero-length control request
-
-From: Johan Hovold <johan@kernel.org>
-
-commit 25d5ce3a606a1eb23a9265d615a92a876ff9cb5f upstream.
-
-The direction of the pipe argument must match the request-type direction
-bit or control requests may fail depending on the host-controller-driver
-implementation.
-
-Control transfers without a data stage are treated as OUT requests by
-the USB stack and should be using usb_sndctrlpipe(). Failing to do so
-will now trigger a warning.
-
-Fix the zero-length i2c-read request used for type detection by
-attempting to read a single byte instead.
-
-Reported-by: syzbot+faf11bbadc5a372564da@syzkaller.appspotmail.com
-Fixes: d0f232e823af ("[media] rtl28xxu: add heuristic to detect chip type")
-Cc: stable@vger.kernel.org      # 4.0
-Cc: Antti Palosaari <crope@iki.fi>
-Signed-off-by: Johan Hovold <johan@kernel.org>
-Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/media/usb/dvb-usb-v2/rtl28xxu.c |    3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
-+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
-@@ -612,8 +612,9 @@ static int rtl28xxu_read_config(struct d
- static int rtl28xxu_identify_state(struct dvb_usb_device *d, const char **name)
- {
-       struct rtl28xxu_dev *dev = d_to_priv(d);
-+      u8 buf[1];
-       int ret;
--      struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 0, NULL};
-+      struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 1, buf};
- 
-       dev_dbg(&d->intf->dev, "\n");
- 

diff --git a/queue-5.10/series b/queue-5.10/series
index 6a15c26083c94ffba2d0f939d9d00b5764cce8a3..44168b63a361e7a110884bb4dd8f49ee0c91004a 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -202,7 +202,6 @@ media-dtv5100-fix-control-request-directions.patch
 media-zr364xx-fix-memory-leak-in-zr364xx_start_readpipe.patch
 media-gspca-sq905-fix-control-request-direction.patch
 media-gspca-sunplus-fix-zero-length-control-requests.patch
-media-rtl28xxu-fix-zero-length-control-request.patch
 media-uvcvideo-fix-pixel-format-change-for-elgato-cam-link-4k.patch
 io_uring-fix-clear-ioring_setup_r_disabled-in-wrong-function.patch
 dm-writecache-write-at-least-4k-when-committing.patch

diff --git a/queue-5.12/media-rtl28xxu-fix-zero-length-control-request.patch b/queue-5.12/media-rtl28xxu-fix-zero-length-control-request.patch
deleted file mode 100644 (file)
index d8678fb..0000000
--- a/queue-5.12/media-rtl28xxu-fix-zero-length-control-request.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 25d5ce3a606a1eb23a9265d615a92a876ff9cb5f Mon Sep 17 00:00:00 2001
-From: Johan Hovold <johan@kernel.org>
-Date: Mon, 24 May 2021 13:09:20 +0200
-Subject: media: rtl28xxu: fix zero-length control request
-
-From: Johan Hovold <johan@kernel.org>
-
-commit 25d5ce3a606a1eb23a9265d615a92a876ff9cb5f upstream.
-
-The direction of the pipe argument must match the request-type direction
-bit or control requests may fail depending on the host-controller-driver
-implementation.
-
-Control transfers without a data stage are treated as OUT requests by
-the USB stack and should be using usb_sndctrlpipe(). Failing to do so
-will now trigger a warning.
-
-Fix the zero-length i2c-read request used for type detection by
-attempting to read a single byte instead.
-
-Reported-by: syzbot+faf11bbadc5a372564da@syzkaller.appspotmail.com
-Fixes: d0f232e823af ("[media] rtl28xxu: add heuristic to detect chip type")
-Cc: stable@vger.kernel.org      # 4.0
-Cc: Antti Palosaari <crope@iki.fi>
-Signed-off-by: Johan Hovold <johan@kernel.org>
-Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/media/usb/dvb-usb-v2/rtl28xxu.c |    3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
-+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
-@@ -612,8 +612,9 @@ static int rtl28xxu_read_config(struct d
- static int rtl28xxu_identify_state(struct dvb_usb_device *d, const char **name)
- {
-       struct rtl28xxu_dev *dev = d_to_priv(d);
-+      u8 buf[1];
-       int ret;
--      struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 0, NULL};
-+      struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 1, buf};
- 
-       dev_dbg(&d->intf->dev, "\n");
- 

diff --git a/queue-5.12/series b/queue-5.12/series
index f9cbaee39b7b4b2214d4a261325e58d06d10b95c..a3cba279549fd6b974edef951537ceb650c37382 100644 (file)
--- a/queue-5.12/series
+++ b/queue-5.12/series
@@ -224,7 +224,6 @@ media-zr364xx-fix-memory-leak-in-zr364xx_start_readpipe.patch
 media-ccs-fix-the-op_pll_multiplier-address.patch
 media-gspca-sq905-fix-control-request-direction.patch
 media-gspca-sunplus-fix-zero-length-control-requests.patch
-media-rtl28xxu-fix-zero-length-control-request.patch
 media-uvcvideo-fix-pixel-format-change-for-elgato-cam-link-4k.patch
 s390-vdso-always-enable-vdso.patch
 s390-vdso64-add-sigreturn-rt_sigreturn-and-restart_syscall.patch

diff --git a/queue-5.13/media-rtl28xxu-fix-zero-length-control-request.patch b/queue-5.13/media-rtl28xxu-fix-zero-length-control-request.patch
deleted file mode 100644 (file)
index d8678fb..0000000
--- a/queue-5.13/media-rtl28xxu-fix-zero-length-control-request.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 25d5ce3a606a1eb23a9265d615a92a876ff9cb5f Mon Sep 17 00:00:00 2001
-From: Johan Hovold <johan@kernel.org>
-Date: Mon, 24 May 2021 13:09:20 +0200
-Subject: media: rtl28xxu: fix zero-length control request
-
-From: Johan Hovold <johan@kernel.org>
-
-commit 25d5ce3a606a1eb23a9265d615a92a876ff9cb5f upstream.
-
-The direction of the pipe argument must match the request-type direction
-bit or control requests may fail depending on the host-controller-driver
-implementation.
-
-Control transfers without a data stage are treated as OUT requests by
-the USB stack and should be using usb_sndctrlpipe(). Failing to do so
-will now trigger a warning.
-
-Fix the zero-length i2c-read request used for type detection by
-attempting to read a single byte instead.
-
-Reported-by: syzbot+faf11bbadc5a372564da@syzkaller.appspotmail.com
-Fixes: d0f232e823af ("[media] rtl28xxu: add heuristic to detect chip type")
-Cc: stable@vger.kernel.org      # 4.0
-Cc: Antti Palosaari <crope@iki.fi>
-Signed-off-by: Johan Hovold <johan@kernel.org>
-Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/media/usb/dvb-usb-v2/rtl28xxu.c |    3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
-+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
-@@ -612,8 +612,9 @@ static int rtl28xxu_read_config(struct d
- static int rtl28xxu_identify_state(struct dvb_usb_device *d, const char **name)
- {
-       struct rtl28xxu_dev *dev = d_to_priv(d);
-+      u8 buf[1];
-       int ret;
--      struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 0, NULL};
-+      struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 1, buf};
- 
-       dev_dbg(&d->intf->dev, "\n");
- 

diff --git a/queue-5.13/series b/queue-5.13/series
index e664548844c2daa7b574953712dd28df9e90e507..7c0dc91462e8988fe8be38a30668015aca55b5c0 100644 (file)
--- a/queue-5.13/series
+++ b/queue-5.13/series
@@ -248,7 +248,6 @@ media-zr364xx-fix-memory-leak-in-zr364xx_start_readpipe.patch
 media-ccs-fix-the-op_pll_multiplier-address.patch
 media-gspca-sq905-fix-control-request-direction.patch
 media-gspca-sunplus-fix-zero-length-control-requests.patch
-media-rtl28xxu-fix-zero-length-control-request.patch
 media-uvcvideo-fix-pixel-format-change-for-elgato-cam-link-4k.patch
 s390-vdso-always-enable-vdso.patch
 s390-vdso64-add-sigreturn-rt_sigreturn-and-restart_syscall.patch

diff --git a/queue-5.4/media-rtl28xxu-fix-zero-length-control-request.patch b/queue-5.4/media-rtl28xxu-fix-zero-length-control-request.patch
deleted file mode 100644 (file)
index d9918db..0000000
--- a/queue-5.4/media-rtl28xxu-fix-zero-length-control-request.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 25d5ce3a606a1eb23a9265d615a92a876ff9cb5f Mon Sep 17 00:00:00 2001
-From: Johan Hovold <johan@kernel.org>
-Date: Mon, 24 May 2021 13:09:20 +0200
-Subject: media: rtl28xxu: fix zero-length control request
-
-From: Johan Hovold <johan@kernel.org>
-
-commit 25d5ce3a606a1eb23a9265d615a92a876ff9cb5f upstream.
-
-The direction of the pipe argument must match the request-type direction
-bit or control requests may fail depending on the host-controller-driver
-implementation.
-
-Control transfers without a data stage are treated as OUT requests by
-the USB stack and should be using usb_sndctrlpipe(). Failing to do so
-will now trigger a warning.
-
-Fix the zero-length i2c-read request used for type detection by
-attempting to read a single byte instead.
-
-Reported-by: syzbot+faf11bbadc5a372564da@syzkaller.appspotmail.com
-Fixes: d0f232e823af ("[media] rtl28xxu: add heuristic to detect chip type")
-Cc: stable@vger.kernel.org      # 4.0
-Cc: Antti Palosaari <crope@iki.fi>
-Signed-off-by: Johan Hovold <johan@kernel.org>
-Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/media/usb/dvb-usb-v2/rtl28xxu.c |    3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
-+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
-@@ -609,8 +609,9 @@ static int rtl28xxu_read_config(struct d
- static int rtl28xxu_identify_state(struct dvb_usb_device *d, const char **name)
- {
-       struct rtl28xxu_dev *dev = d_to_priv(d);
-+      u8 buf[1];
-       int ret;
--      struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 0, NULL};
-+      struct rtl28xxu_req req_demod_i2c = {0x0020, CMD_I2C_DA_RD, 1, buf};
- 
-       dev_dbg(&d->intf->dev, "\n");
- 

diff --git a/queue-5.4/series b/queue-5.4/series
index 99afd3023a39892fe63c00f15dca893867f6a320..d769772eb8240f2a1a017128fd1f6b266c8db75b 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -113,7 +113,6 @@ media-dtv5100-fix-control-request-directions.patch
 media-zr364xx-fix-memory-leak-in-zr364xx_start_readpipe.patch
 media-gspca-sq905-fix-control-request-direction.patch
 media-gspca-sunplus-fix-zero-length-control-requests.patch
-media-rtl28xxu-fix-zero-length-control-request.patch
 media-uvcvideo-fix-pixel-format-change-for-elgato-cam-link-4k.patch
 pinctrl-mcp23s08-fix-missing-unlock-on-error-in-mcp23s08_irq.patch
 jfs-fix-gpf-in-difree.patch