From: Greg Kroah-Hartman Date: Sat, 9 Oct 2021 13:42:43 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v5.14.12~42 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b156b7deaa7576cccfe2a91ab10aa4b7a389e528;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: partially-revert-usb-kconfig-using-select-for-usb_common-dependency.patch usb-cdc-acm-fix-break-reporting.patch usb-cdc-acm-fix-racy-tty-buffer-accesses.patch usb-typec-tcpm-handle-src_startup-state-if-cc-changes.patch xen-privcmd-fix-error-handling-in-mmap-resource-processing.patch --- diff --git a/queue-5.4/partially-revert-usb-kconfig-using-select-for-usb_common-dependency.patch b/queue-5.4/partially-revert-usb-kconfig-using-select-for-usb_common-dependency.patch new file mode 100644 index 00000000000..966aca23aff --- /dev/null +++ b/queue-5.4/partially-revert-usb-kconfig-using-select-for-usb_common-dependency.patch @@ -0,0 +1,36 @@ +From 4d1aa9112c8e6995ef2c8a76972c9671332ccfea Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Tue, 21 Sep 2021 16:34:42 +0200 +Subject: Partially revert "usb: Kconfig: using select for USB_COMMON dependency" + +From: Ben Hutchings + +commit 4d1aa9112c8e6995ef2c8a76972c9671332ccfea upstream. + +This reverts commit cb9c1cfc86926d0e86d19c8e34f6c23458cd3478 for +USB_LED_TRIG. This config symbol has bool type and enables extra code +in usb_common itself, not a separate driver. Enabling it should not +force usb_common to be built-in! + +Fixes: cb9c1cfc8692 ("usb: Kconfig: using select for USB_COMMON dependency") +Cc: stable +Signed-off-by: Ben Hutchings +Signed-off-by: Salvatore Bonaccorso +Link: https://lore.kernel.org/r/20210921143442.340087-1-carnil@debian.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/common/Kconfig | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/usb/common/Kconfig ++++ b/drivers/usb/common/Kconfig +@@ -6,8 +6,7 @@ config USB_COMMON + + config USB_LED_TRIG + bool "USB LED Triggers" +- depends on LEDS_CLASS && LEDS_TRIGGERS +- select USB_COMMON ++ depends on LEDS_CLASS && USB_COMMON && LEDS_TRIGGERS + help + This option adds LED triggers for USB host and/or gadget activity. + diff --git a/queue-5.4/series b/queue-5.4/series index 1a426a5c648..ed78b4515b6 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -1 +1,5 @@ partially-revert-usb-kconfig-using-select-for-usb_common-dependency.patch +usb-cdc-acm-fix-racy-tty-buffer-accesses.patch +usb-cdc-acm-fix-break-reporting.patch +usb-typec-tcpm-handle-src_startup-state-if-cc-changes.patch +xen-privcmd-fix-error-handling-in-mmap-resource-processing.patch diff --git a/queue-5.4/usb-cdc-acm-fix-break-reporting.patch b/queue-5.4/usb-cdc-acm-fix-break-reporting.patch new file mode 100644 index 00000000000..6b5bd2ca06c --- /dev/null +++ b/queue-5.4/usb-cdc-acm-fix-break-reporting.patch @@ -0,0 +1,36 @@ +From 58fc1daa4d2e9789b9ffc880907c961ea7c062cc Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 29 Sep 2021 11:09:37 +0200 +Subject: USB: cdc-acm: fix break reporting + +From: Johan Hovold + +commit 58fc1daa4d2e9789b9ffc880907c961ea7c062cc upstream. + +A recent change that started reporting break events forgot to push the +event to the line discipline, which meant that a detected break would +not be reported until further characters had been receive (the port +could even have been closed and reopened in between). + +Fixes: 08dff274edda ("cdc-acm: fix BREAK rx code path adding necessary calls") +Cc: stable@vger.kernel.org +Acked-by: Oliver Neukum +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210929090937.7410-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/cdc-acm.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -339,6 +339,9 @@ static void acm_process_notification(str + acm->iocount.overrun++; + spin_unlock_irqrestore(&acm->read_lock, flags); + ++ if (newctrl & ACM_CTRL_BRK) ++ tty_flip_buffer_push(&acm->port); ++ + if (difference) + wake_up_all(&acm->wioctl); + diff --git a/queue-5.4/usb-cdc-acm-fix-racy-tty-buffer-accesses.patch b/queue-5.4/usb-cdc-acm-fix-racy-tty-buffer-accesses.patch new file mode 100644 index 00000000000..f76c4a44862 --- /dev/null +++ b/queue-5.4/usb-cdc-acm-fix-racy-tty-buffer-accesses.patch @@ -0,0 +1,53 @@ +From 65a205e6113506e69a503b61d97efec43fc10fd7 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 29 Sep 2021 11:09:36 +0200 +Subject: USB: cdc-acm: fix racy tty buffer accesses + +From: Johan Hovold + +commit 65a205e6113506e69a503b61d97efec43fc10fd7 upstream. + +A recent change that started reporting break events to the line +discipline caused the tty-buffer insertions to no longer be serialised +by inserting events also from the completion handler for the interrupt +endpoint. + +Completion calls for distinct endpoints are not guaranteed to be +serialised. For example, in case a host-controller driver uses +bottom-half completion, the interrupt and bulk-in completion handlers +can end up running in parallel on two CPUs (high-and low-prio tasklets, +respectively) thereby breaking the tty layer's single producer +assumption. + +Fix this by holding the read lock also when inserting characters from +the bulk endpoint. + +Fixes: 08dff274edda ("cdc-acm: fix BREAK rx code path adding necessary calls") +Cc: stable@vger.kernel.org +Acked-by: Oliver Neukum +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210929090937.7410-2-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/cdc-acm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -474,11 +474,16 @@ static int acm_submit_read_urbs(struct a + + static void acm_process_read_urb(struct acm *acm, struct urb *urb) + { ++ unsigned long flags; ++ + if (!urb->actual_length) + return; + ++ spin_lock_irqsave(&acm->read_lock, flags); + tty_insert_flip_string(&acm->port, urb->transfer_buffer, + urb->actual_length); ++ spin_unlock_irqrestore(&acm->read_lock, flags); ++ + tty_flip_buffer_push(&acm->port); + } + diff --git a/queue-5.4/usb-typec-tcpm-handle-src_startup-state-if-cc-changes.patch b/queue-5.4/usb-typec-tcpm-handle-src_startup-state-if-cc-changes.patch new file mode 100644 index 00000000000..f5c3e9c6e01 --- /dev/null +++ b/queue-5.4/usb-typec-tcpm-handle-src_startup-state-if-cc-changes.patch @@ -0,0 +1,38 @@ +From 6d91017a295e9790eec02c4e43f020cdb55f5d98 Mon Sep 17 00:00:00 2001 +From: Xu Yang +Date: Tue, 28 Sep 2021 19:16:39 +0800 +Subject: usb: typec: tcpm: handle SRC_STARTUP state if cc changes + +From: Xu Yang + +commit 6d91017a295e9790eec02c4e43f020cdb55f5d98 upstream. + +TCPM for DRP should do the same action as SRC_ATTACHED when cc changes in +SRC_STARTUP state. Otherwise, TCPM will transition to SRC_UNATTACHED state +which is not satisfied with the Type-C spec. + +Per Type-C spec: +DRP port should move to Unattached.SNK instead of Unattached.SRC if sink +removed. + +Fixes: 4b4e02c83167 ("typec: tcpm: Move out of staging") +cc: +Reviewed-by: Guenter Roeck +Acked-by: Heikki Krogerus +Signed-off-by: Xu Yang +Link: https://lore.kernel.org/r/20210928111639.3854174-1-xu.yang_2@nxp.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -3679,6 +3679,7 @@ static void _tcpm_cc_change(struct tcpm_ + tcpm_set_state(port, SRC_ATTACH_WAIT, 0); + break; + case SRC_ATTACHED: ++ case SRC_STARTUP: + case SRC_SEND_CAPABILITIES: + case SRC_READY: + if (tcpm_port_is_disconnected(port) || diff --git a/queue-5.4/xen-privcmd-fix-error-handling-in-mmap-resource-processing.patch b/queue-5.4/xen-privcmd-fix-error-handling-in-mmap-resource-processing.patch new file mode 100644 index 00000000000..e479fb9ae5a --- /dev/null +++ b/queue-5.4/xen-privcmd-fix-error-handling-in-mmap-resource-processing.patch @@ -0,0 +1,52 @@ +From e11423d6721dd63b23fb41ade5e8d0b448b17780 Mon Sep 17 00:00:00 2001 +From: Jan Beulich +Date: Wed, 22 Sep 2021 12:17:48 +0200 +Subject: xen/privcmd: fix error handling in mmap-resource processing + +From: Jan Beulich + +commit e11423d6721dd63b23fb41ade5e8d0b448b17780 upstream. + +xen_pfn_t is the same size as int only on 32-bit builds (and not even +on Arm32). Hence pfns[] can't be used directly to read individual error +values returned from xen_remap_domain_mfn_array(); every other error +indicator would be skipped/ignored on 64-bit. + +Fixes: 3ad0876554ca ("xen/privcmd: add IOCTL_PRIVCMD_MMAP_RESOURCE") +Cc: stable@vger.kernel.org +Signed-off-by: Jan Beulich +Reviewed-by: Boris Ostrovsky +Signed-off-by: Greg Kroah-Hartman + +Link: https://lore.kernel.org/r/aa6d6a67-6889-338a-a910-51e889f792d5@suse.com +Signed-off-by: Juergen Gross +--- + drivers/xen/privcmd.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/xen/privcmd.c ++++ b/drivers/xen/privcmd.c +@@ -810,11 +810,12 @@ static long privcmd_ioctl_mmap_resource( + unsigned int domid = + (xdata.flags & XENMEM_rsrc_acq_caller_owned) ? + DOMID_SELF : kdata.dom; +- int num; ++ int num, *errs = (int *)pfns; + ++ BUILD_BUG_ON(sizeof(*errs) > sizeof(*pfns)); + num = xen_remap_domain_mfn_array(vma, + kdata.addr & PAGE_MASK, +- pfns, kdata.num, (int *)pfns, ++ pfns, kdata.num, errs, + vma->vm_page_prot, + domid, + vma->vm_private_data); +@@ -824,7 +825,7 @@ static long privcmd_ioctl_mmap_resource( + unsigned int i; + + for (i = 0; i < num; i++) { +- rc = pfns[i]; ++ rc = errs[i]; + if (rc < 0) + break; + }