From: Greg Kroah-Hartman Date: Thu, 6 Jun 2019 19:55:23 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v5.1.8~8 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=178a796d8d607ce92d9d29a11b87d9d020d1bcaa;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: net-cdc_ncm-getntbformat-endian-fix.patch usb-gadget-fix-request-length-error-for-isoc-transfer.patch --- diff --git a/queue-4.4/net-cdc_ncm-getntbformat-endian-fix.patch b/queue-4.4/net-cdc_ncm-getntbformat-endian-fix.patch new file mode 100644 index 00000000000..05fdc975b9a --- /dev/null +++ b/queue-4.4/net-cdc_ncm-getntbformat-endian-fix.patch @@ -0,0 +1,54 @@ +From 6314dab4b8fb8493d810e175cb340376052c69b6 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= +Date: Wed, 15 Nov 2017 09:35:02 +0100 +Subject: net: cdc_ncm: GetNtbFormat endian fix +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bjørn Mork + +commit 6314dab4b8fb8493d810e175cb340376052c69b6 upstream. + +The GetNtbFormat and SetNtbFormat requests operate on 16 bit little +endian values. We get away with ignoring this most of the time, because +we only care about USB_CDC_NCM_NTB16_FORMAT which is 0x0000. This +fails for USB_CDC_NCM_NTB32_FORMAT. + +Fix comparison between LE value from device and constant by converting +the constant to LE. + +Reported-by: Ben Hutchings +Fixes: 2b02c20ce0c2 ("cdc_ncm: Set NTB format again after altsetting switch for Huawei devices") +Cc: Enrico Mioso +Cc: Christian Panton +Signed-off-by: Bjørn Mork +Acked-By: Enrico Mioso +Signed-off-by: David S. Miller +Signed-off-by: Nobuhiro Iwamatsu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/usb/cdc_ncm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -727,7 +727,7 @@ int cdc_ncm_bind_common(struct usbnet *d + int err; + u8 iface_no; + struct usb_cdc_parsed_header hdr; +- u16 curr_ntb_format; ++ __le16 curr_ntb_format; + + ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); + if (!ctx) +@@ -841,7 +841,7 @@ int cdc_ncm_bind_common(struct usbnet *d + goto error2; + } + +- if (curr_ntb_format == USB_CDC_NCM_NTB32_FORMAT) { ++ if (curr_ntb_format == cpu_to_le16(USB_CDC_NCM_NTB32_FORMAT)) { + dev_info(&intf->dev, "resetting NTB format to 16-bit"); + err = usbnet_write_cmd(dev, USB_CDC_SET_NTB_FORMAT, + USB_TYPE_CLASS | USB_DIR_OUT diff --git a/queue-4.4/series b/queue-4.4/series index eccedbc46ea..df2d06a5a72 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -224,3 +224,5 @@ brcmfmac-add-length-checks-in-scheduled-scan-result-handler.patch brcmfmac-add-subtype-check-for-event-handling-in-data-path.patch userfaultfd-don-t-pin-the-user-memory-in-userfaultfd_file_create.patch revert-x86-build-move-_etext-to-actual-end-of-.text.patch +net-cdc_ncm-getntbformat-endian-fix.patch +usb-gadget-fix-request-length-error-for-isoc-transfer.patch diff --git a/queue-4.4/usb-gadget-fix-request-length-error-for-isoc-transfer.patch b/queue-4.4/usb-gadget-fix-request-length-error-for-isoc-transfer.patch new file mode 100644 index 00000000000..fec9c9036ef --- /dev/null +++ b/queue-4.4/usb-gadget-fix-request-length-error-for-isoc-transfer.patch @@ -0,0 +1,41 @@ +From 982555fc26f9d8bcdbd5f9db0378fe0682eb4188 Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Tue, 8 Nov 2016 10:08:24 +0800 +Subject: usb: gadget: fix request length error for isoc transfer + +From: Peter Chen + +commit 982555fc26f9d8bcdbd5f9db0378fe0682eb4188 upstream. + +For isoc endpoint descriptor, the wMaxPacketSize is not real max packet +size (see Table 9-13. Standard Endpoint Descriptor, USB 2.0 specifcation), +it may contain the number of packet, so the real max packet should be +ep->desc->wMaxPacketSize && 0x7ff. + +Cc: Felipe F. Tonello +Cc: Felipe Balbi +Fixes: 16b114a6d797 ("usb: gadget: fix usb_ep_align_maybe + endianness and new usb_ep_aligna") + +Signed-off-by: Peter Chen +Signed-off-by: Felipe Balbi +Signed-off-by: Nobuhiro Iwamatsu +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/usb/gadget.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/include/linux/usb/gadget.h ++++ b/include/linux/usb/gadget.h +@@ -671,7 +671,9 @@ static inline struct usb_gadget *dev_to_ + */ + static inline size_t usb_ep_align(struct usb_ep *ep, size_t len) + { +- return round_up(len, (size_t)le16_to_cpu(ep->desc->wMaxPacketSize)); ++ int max_packet_size = (size_t)usb_endpoint_maxp(ep->desc) & 0x7ff; ++ ++ return round_up(len, max_packet_size); + } + + /**