From: Greg Kroah-Hartman Date: Wed, 17 Jun 2026 03:27:29 +0000 (+0530) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3106a9001ee188a3db2ca5dd02c10271fe7bffdc;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: media-rc-igorplugusb-fix-control-request-setup-packet.patch media-rc-ttusbir-fix-inverted-error-logic.patch --- diff --git a/queue-5.10/media-rc-igorplugusb-fix-control-request-setup-packet.patch b/queue-5.10/media-rc-igorplugusb-fix-control-request-setup-packet.patch new file mode 100644 index 0000000000..20c67af4ca --- /dev/null +++ b/queue-5.10/media-rc-igorplugusb-fix-control-request-setup-packet.patch @@ -0,0 +1,50 @@ +From 171022c7d594c133a45f92357a2a91475edabe20 Mon Sep 17 00:00:00 2001 +From: Henri A +Date: Wed, 20 May 2026 10:25:44 -0400 +Subject: media: rc: igorplugusb: fix control request setup packet + +From: Henri A + +commit 171022c7d594c133a45f92357a2a91475edabe20 upstream. + +Commit eac69475b01f ("media: rc: igorplugusb: heed coherency +rules") changed the control request storage from an embedded struct to +an allocated pointer so it can obey DMA coherency rules. + +However, the driver still passes &ir->request to usb_fill_control_urb(). +That points the URB setup packet at the pointer field itself rather than +at the allocated struct usb_ctrlrequest. + +USB core then interprets pointer bytes as the setup packet. This can +produce an invalid bRequestType and trigger the control direction warning +reported by syzbot: + + usb 2-1: BOGUS control dir, pipe 80003580 doesn't match bRequestType 0 + +Pass ir->request itself as the setup packet. + +Fixes: eac69475b01f ("media: rc: igorplugusb: heed coherency rules") +Reported-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=11f0e4f957c7c3bf3d51 +Tested-by: syzbot+11f0e4f957c7c3bf3d51@syzkaller.appspotmail.com +Cc: stable@vger.kernel.org +Assisted-by: Codex:GPT-5.5 +Signed-off-by: Henri A +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/rc/igorplugusb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/rc/igorplugusb.c ++++ b/drivers/media/rc/igorplugusb.c +@@ -183,7 +183,7 @@ static int igorplugusb_probe(struct usb_ + goto fail; + + usb_fill_control_urb(ir->urb, udev, +- usb_rcvctrlpipe(udev, 0), (uint8_t *)&ir->request, ++ usb_rcvctrlpipe(udev, 0), (uint8_t *)ir->request, + ir->buf_in, sizeof(ir->buf_in), igorplugusb_callback, ir); + + usb_make_path(udev, ir->phys, sizeof(ir->phys)); diff --git a/queue-5.10/media-rc-ttusbir-fix-inverted-error-logic.patch b/queue-5.10/media-rc-ttusbir-fix-inverted-error-logic.patch new file mode 100644 index 0000000000..50ee584bc6 --- /dev/null +++ b/queue-5.10/media-rc-ttusbir-fix-inverted-error-logic.patch @@ -0,0 +1,33 @@ +From 646ebdd3105809d84ed04aa9e92e47e89cc44502 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Fri, 10 Apr 2026 23:03:09 +0200 +Subject: media: rc: ttusbir: fix inverted error logic + +From: Oliver Neukum + +commit 646ebdd3105809d84ed04aa9e92e47e89cc44502 upstream. + +We have to report ENOMEM if no buffer is allocated. +Typo dropped a "!". Restore it. + +Fixes: 50acaad3d202 ("media: rc: ttusbir: respect DMA coherency rules") +Cc: stable@vger.kernel.org +Signed-off-by: Oliver Neukum +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/rc/ttusbir.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/rc/ttusbir.c ++++ b/drivers/media/rc/ttusbir.c +@@ -193,7 +193,7 @@ static int ttusbir_probe(struct usb_inte + tt = kzalloc(sizeof(*tt), GFP_KERNEL); + buffer = kzalloc(5, GFP_KERNEL); + rc = rc_allocate_device(RC_DRIVER_IR_RAW); +- if (!tt || !rc || buffer) { ++ if (!tt || !rc || !buffer) { + ret = -ENOMEM; + goto out; + } diff --git a/queue-5.10/series b/queue-5.10/series index 2667b03248..f4272a6b4c 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -340,3 +340,5 @@ arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt-100-cpu.patch fbdev-vt8500lcdfb-fix-dma_free_coherent-cpu_addr-parameter.patch apparmor-validate-default-dfa-states-are-in-bounds.patch x86-cpu-amd-move-the-zen3-btc_no-detection-to-the-zen3-init-function.patch +media-rc-ttusbir-fix-inverted-error-logic.patch +media-rc-igorplugusb-fix-control-request-setup-packet.patch