5.15-stable patches

added patches:
	serial-fsl_lpuart-rs485-rts-polariy-is-inverse.patch
	staging-r8188eu-add-firmware-dependency.patch
	staging-rtl8712-fix-use-after-free-bugs.patch

diff --git a/queue-5.15/serial-fsl_lpuart-rs485-rts-polariy-is-inverse.patch b/queue-5.15/serial-fsl_lpuart-rs485-rts-polariy-is-inverse.patch
new file mode 100644 (file)
index 0000000..3216d58
--- /dev/null
+++ b/queue-5.15/serial-fsl_lpuart-rs485-rts-polariy-is-inverse.patch
@@ -0,0 +1,39 @@
+From 846651eca073e2e02e37490a4a52752415d84781 Mon Sep 17 00:00:00 2001
+From: Shenwei Wang <shenwei.wang@nxp.com>
+Date: Fri, 5 Aug 2022 09:45:29 -0500
+Subject: serial: fsl_lpuart: RS485 RTS polariy is inverse
+
+From: Shenwei Wang <shenwei.wang@nxp.com>
+
+commit 846651eca073e2e02e37490a4a52752415d84781 upstream.
+
+The setting of RS485 RTS polarity is inverse in the current driver.
+
+When the property of 'rs485-rts-active-low' is enabled in the dts node,
+the RTS signal should be LOW during sending. Otherwise, if there is no
+such a property, the RTS should be HIGH during sending.
+
+Fixes: 03895cf41d18 ("tty: serial: fsl_lpuart: Add support for RS-485")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Nicolas Diaz <nicolas.diaz@nxp.com>
+Signed-off-by: Shenwei Wang <shenwei.wang@nxp.com>
+Link: https://lore.kernel.org/r/20220805144529.604856-1-shenwei.wang@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/fsl_lpuart.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1381,9 +1381,9 @@ static int lpuart_config_rs485(struct ua
+                * Note: UART is assumed to be active high.
+                */
+               if (rs485->flags & SER_RS485_RTS_ON_SEND)
+-                      modem &= ~UARTMODEM_TXRTSPOL;
+-              else if (rs485->flags & SER_RS485_RTS_AFTER_SEND)
+                       modem |= UARTMODEM_TXRTSPOL;
++              else if (rs485->flags & SER_RS485_RTS_AFTER_SEND)
++                      modem &= ~UARTMODEM_TXRTSPOL;
+       }
+ 
+       /* Store the new configuration */

diff --git a/queue-5.15/series b/queue-5.15/series
index fa44250e87eadf13a008bb36187eef74dcb78a1f..75be00cfb5ea167e874e2a7ea7b993c1bef45803 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -33,3 +33,6 @@ tcp-annotate-data-race-around-challenge_timestamp.patch
 revert-sch_cake-return-__net_xmit_stolen-when-consum.patch
 net-smc-remove-redundant-refcount-increase.patch
 soundwire-qcom-fix-device-status-array-range.patch
+serial-fsl_lpuart-rs485-rts-polariy-is-inverse.patch
+staging-rtl8712-fix-use-after-free-bugs.patch
+staging-r8188eu-add-firmware-dependency.patch

diff --git a/queue-5.15/staging-r8188eu-add-firmware-dependency.patch b/queue-5.15/staging-r8188eu-add-firmware-dependency.patch
new file mode 100644 (file)
index 0000000..a42ac5f
--- /dev/null
+++ b/queue-5.15/staging-r8188eu-add-firmware-dependency.patch
@@ -0,0 +1,48 @@
+From b2fa9e13bbf101c662c4cd974608242a0db98cfc Mon Sep 17 00:00:00 2001
+From: Grzegorz Szymaszek <gszymaszek@short.pl>
+Date: Tue, 2 Aug 2022 19:18:44 +0200
+Subject: staging: r8188eu: add firmware dependency
+
+From: Grzegorz Szymaszek <gszymaszek@short.pl>
+
+commit b2fa9e13bbf101c662c4cd974608242a0db98cfc upstream.
+
+The old rtl8188eu module, removed in commit 55dfa29b43d2 ("staging:
+rtl8188eu: remove rtl8188eu driver from staging dir") (Linux kernel
+v5.15-rc1), required (through a MODULE_FIRMWARE call()) the
+rtlwifi/rtl8188eufw.bin firmware file, which the new r8188eu driver no
+longer requires.
+
+I have tested a few RTL8188EUS-based Wi-Fi cards and, while supported by
+both drivers, they do not work when using the new one and the firmware
+wasn't manually loaded. According to Larry Finger, the module
+maintainer, all such cards need the firmware and the driver should
+depend on it (see the linked mails).
+
+Add a proper MODULE_FIRMWARE() call, like it was done in the old driver.
+
+Thanks to Greg Kroah-Hartman and Larry Finger for quick responses to my
+questions.
+
+Cc: stable <stable@kernel.org>
+Link: https://answers.launchpad.net/ubuntu/+source/linux-meta-hwe-5.15/+question/702611
+Link: https://lore.kernel.org/lkml/YukkBu3TNODO3or9@nx64de-df6d00/
+Signed-off-by: Grzegorz Szymaszek <gszymaszek@short.pl>
+Link: https://lore.kernel.org/r/YulcdKfhA8dPQ78s@nx64de-df6d00
+Acked-by: Phillip Potter <phil@philpotter.co.uk>
+Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/r8188eu/os_dep/os_intfs.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/r8188eu/os_dep/os_intfs.c
++++ b/drivers/staging/r8188eu/os_dep/os_intfs.c
+@@ -17,6 +17,7 @@ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Realtek Wireless Lan Driver");
+ MODULE_AUTHOR("Realtek Semiconductor Corp.");
+ MODULE_VERSION(DRIVERVERSION);
++MODULE_FIRMWARE("rtlwifi/rtl8188eufw.bin");
+ 
+ #define CONFIG_BR_EXT_BRNAME "br0"
+ #define RTW_NOTCH_FILTER 0 /* 0:Disable, 1:Enable, */

diff --git a/queue-5.15/staging-rtl8712-fix-use-after-free-bugs.patch b/queue-5.15/staging-rtl8712-fix-use-after-free-bugs.patch
new file mode 100644 (file)
index 0000000..d4ad9d8
--- /dev/null
+++ b/queue-5.15/staging-rtl8712-fix-use-after-free-bugs.patch
@@ -0,0 +1,75 @@
+From e230a4455ac3e9b112f0367d1b8e255e141afae0 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 30 Aug 2022 17:55:07 +0300
+Subject: staging: rtl8712: fix use after free bugs
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit e230a4455ac3e9b112f0367d1b8e255e141afae0 upstream.
+
+_Read/Write_MACREG callbacks are NULL so the read/write_macreg_hdl()
+functions don't do anything except free the "pcmd" pointer.  It
+results in a use after free.  Delete them.
+
+Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel")
+Cc: stable <stable@kernel.org>
+Reported-by: Zheng Wang <hackerzheng666@gmail.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/Yw4ASqkYcUhUfoY2@kili
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/rtl8712/rtl8712_cmd.c |   36 ----------------------------------
+ 1 file changed, 36 deletions(-)
+
+--- a/drivers/staging/rtl8712/rtl8712_cmd.c
++++ b/drivers/staging/rtl8712/rtl8712_cmd.c
+@@ -117,34 +117,6 @@ static void r871x_internal_cmd_hdl(struc
+       kfree(pdrvcmd->pbuf);
+ }
+ 
+-static u8 read_macreg_hdl(struct _adapter *padapter, u8 *pbuf)
+-{
+-      void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj      *pcmd);
+-      struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;
+-
+-      /*  invoke cmd->callback function */
+-      pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
+-      if (!pcmd_callback)
+-              r8712_free_cmd_obj(pcmd);
+-      else
+-              pcmd_callback(padapter, pcmd);
+-      return H2C_SUCCESS;
+-}
+-
+-static u8 write_macreg_hdl(struct _adapter *padapter, u8 *pbuf)
+-{
+-      void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj      *pcmd);
+-      struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;
+-
+-      /*  invoke cmd->callback function */
+-      pcmd_callback = cmd_callback[pcmd->cmdcode].callback;
+-      if (!pcmd_callback)
+-              r8712_free_cmd_obj(pcmd);
+-      else
+-              pcmd_callback(padapter, pcmd);
+-      return H2C_SUCCESS;
+-}
+-
+ static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf)
+ {
+       struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;
+@@ -213,14 +185,6 @@ static struct cmd_obj *cmd_hdl_filter(st
+       pcmd_r = NULL;
+ 
+       switch (pcmd->cmdcode) {
+-      case GEN_CMD_CODE(_Read_MACREG):
+-              read_macreg_hdl(padapter, (u8 *)pcmd);
+-              pcmd_r = pcmd;
+-              break;
+-      case GEN_CMD_CODE(_Write_MACREG):
+-              write_macreg_hdl(padapter, (u8 *)pcmd);
+-              pcmd_r = pcmd;
+-              break;
+       case GEN_CMD_CODE(_Read_BBREG):
+               read_bbreg_hdl(padapter, (u8 *)pcmd);
+               break;