From: Greg Kroah-Hartman Date: Wed, 24 Feb 2021 09:04:58 +0000 (+0100) Subject: 4.14-stable patches X-Git-Tag: v5.11.2~15 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0822fec7dd1c1a7e6b9b5866b024c556564ddd2a;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: hid-make-arrays-usage-and-value-to-be-the-same.patch usb-quirks-add-quirk-to-start-video-capture-on-elmo-l-12f-document-camera-reliable.patch --- diff --git a/queue-4.14/hid-make-arrays-usage-and-value-to-be-the-same.patch b/queue-4.14/hid-make-arrays-usage-and-value-to-be-the-same.patch new file mode 100644 index 00000000000..e97ff3d29b8 --- /dev/null +++ b/queue-4.14/hid-make-arrays-usage-and-value-to-be-the-same.patch @@ -0,0 +1,57 @@ +From ed9be64eefe26d7d8b0b5b9fa3ffdf425d87a01f Mon Sep 17 00:00:00 2001 +From: Will McVicker +Date: Sat, 5 Dec 2020 00:48:48 +0000 +Subject: HID: make arrays usage and value to be the same + +From: Will McVicker + +commit ed9be64eefe26d7d8b0b5b9fa3ffdf425d87a01f upstream. + +The HID subsystem allows an "HID report field" to have a different +number of "values" and "usages" when it is allocated. When a field +struct is created, the size of the usage array is guaranteed to be at +least as large as the values array, but it may be larger. This leads to +a potential out-of-bounds write in +__hidinput_change_resolution_multipliers() and an out-of-bounds read in +hidinput_count_leds(). + +To fix this, let's make sure that both the usage and value arrays are +the same size. + +Cc: stable@vger.kernel.org +Signed-off-by: Will McVicker +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -90,7 +90,7 @@ EXPORT_SYMBOL_GPL(hid_register_report); + * Register a new field for this report. + */ + +-static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages, unsigned values) ++static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages) + { + struct hid_field *field; + +@@ -101,7 +101,7 @@ static struct hid_field *hid_register_fi + + field = kzalloc((sizeof(struct hid_field) + + usages * sizeof(struct hid_usage) + +- values * sizeof(unsigned)), GFP_KERNEL); ++ usages * sizeof(unsigned)), GFP_KERNEL); + if (!field) + return NULL; + +@@ -280,7 +280,7 @@ static int hid_add_field(struct hid_pars + usages = max_t(unsigned, parser->local.usage_index, + parser->global.report_count); + +- field = hid_register_field(report, usages, parser->global.report_count); ++ field = hid_register_field(report, usages); + if (!field) + return 0; + diff --git a/queue-4.14/usb-quirks-add-quirk-to-start-video-capture-on-elmo-l-12f-document-camera-reliable.patch b/queue-4.14/usb-quirks-add-quirk-to-start-video-capture-on-elmo-l-12f-document-camera-reliable.patch new file mode 100644 index 00000000000..dcc75941cd3 --- /dev/null +++ b/queue-4.14/usb-quirks-add-quirk-to-start-video-capture-on-elmo-l-12f-document-camera-reliable.patch @@ -0,0 +1,33 @@ +From 1ebe718bb48278105816ba03a0408ecc2d6cf47f Mon Sep 17 00:00:00 2001 +From: Stefan Ursella +Date: Wed, 10 Feb 2021 15:07:11 +0100 +Subject: usb: quirks: add quirk to start video capture on ELMO L-12F document camera reliable + +From: Stefan Ursella + +commit 1ebe718bb48278105816ba03a0408ecc2d6cf47f upstream. + +Without this quirk starting a video capture from the device often fails with + +kernel: uvcvideo: Failed to set UVC probe control : -110 (exp. 34). + +Signed-off-by: Stefan Ursella +Link: https://lore.kernel.org/r/20210210140713.18711-1-stefan.ursella@wolfvision.net +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -230,6 +230,9 @@ static const struct usb_device_id usb_qu + /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */ + { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF }, + ++ /* ELMO L-12F document camera */ ++ { USB_DEVICE(0x09a1, 0x0028), .driver_info = USB_QUIRK_DELAY_CTRL_MSG }, ++ + /* Broadcom BCM92035DGROM BT dongle */ + { USB_DEVICE(0x0a5c, 0x2021), .driver_info = USB_QUIRK_RESET_RESUME }, +