From: Greg Kroah-Hartman Date: Mon, 9 Aug 2021 08:55:11 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v4.4.280~55 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c2f8eedc972169d6f9f2a14a9097fdc096746ada;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: alsa-hda-realtek-add-mic-quirk-for-acer-sf314-42.patch alsa-hda-realtek-fix-headset-mic-for-acer-swift-sf314-56-alc256.patch alsa-pcm-fix-mmap-capability-check-for-the-snd-dummy-driver.patch alsa-usb-audio-add-registration-quirk-for-jbl-quantum-600.patch alsa-usb-audio-fix-superfluous-autosuspend-recovery.patch usb-cdns3-fixed-incorrect-gadget-state.patch usb-dwc3-gadget-avoid-runtime-resume-if-disabling-pullup.patch usb-gadget-f_hid-added-get_idle-and-set_idle-handlers.patch usb-gadget-f_hid-fixed-null-pointer-dereference.patch usb-gadget-f_hid-idle-uses-the-highest-byte-for-duration.patch usb-gadget-remove-leaked-entry-from-udc-driver-list.patch usb-host-ohci-at91-suspend-resume-ports-after-before-ohci-accesses.patch usb-otg-fsm-fix-hrtimer-list-corruption.patch usb-typec-tcpm-keep-other-events-when-receiving-frs-and-sourcing_vbus-events.patch --- diff --git a/queue-5.10/alsa-hda-realtek-add-mic-quirk-for-acer-sf314-42.patch b/queue-5.10/alsa-hda-realtek-add-mic-quirk-for-acer-sf314-42.patch new file mode 100644 index 00000000000..860551737f6 --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-add-mic-quirk-for-acer-sf314-42.patch @@ -0,0 +1,32 @@ +From 0d4867a185460397af56b9afe3e2243d3e610e37 Mon Sep 17 00:00:00 2001 +From: Alexander Monakov +Date: Wed, 21 Jul 2021 20:01:41 +0300 +Subject: ALSA: hda/realtek: add mic quirk for Acer SF314-42 + +From: Alexander Monakov + +commit 0d4867a185460397af56b9afe3e2243d3e610e37 upstream. + +The Acer Swift SF314-42 laptop is using Realtek ALC255 codec. Add a +quirk so microphone in a headset connected via the right-hand side jack +is usable. + +Signed-off-by: Alexander Monakov +Cc: +Link: https://lore.kernel.org/r/20210721170141.24807-1-amonakov@ispras.ru +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8203,6 +8203,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1025, 0x142b, "Acer Swift SF314-42", ALC255_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1430, "Acer TravelMate B311R-31", ALC256_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1466, "Acer Aspire A515-56", ALC255_FIXUP_ACER_HEADPHONE_AND_MIC), + SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z), diff --git a/queue-5.10/alsa-hda-realtek-fix-headset-mic-for-acer-swift-sf314-56-alc256.patch b/queue-5.10/alsa-hda-realtek-fix-headset-mic-for-acer-swift-sf314-56-alc256.patch new file mode 100644 index 00000000000..91dd9f16aad --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-fix-headset-mic-for-acer-swift-sf314-56-alc256.patch @@ -0,0 +1,32 @@ +From 35171fbfc0d94aa31b009bb475d156ad1941ab50 Mon Sep 17 00:00:00 2001 +From: Nikos Liolios +Date: Tue, 27 Jul 2021 06:05:10 +0300 +Subject: ALSA: hda/realtek: Fix headset mic for Acer SWIFT SF314-56 (ALC256) + +From: Nikos Liolios + +commit 35171fbfc0d94aa31b009bb475d156ad1941ab50 upstream. + +The issue on Acer SWIFT SF314-56 is that headset microphone doesn't work. +The following quirk fixed headset microphone issue. The fixup was found by trial and error. +Note that the fixup of SF314-54/55 (ALC256_FIXUP_ACER_HEADSET_MIC) was not successful on my SF314-56. + +Signed-off-by: Nikos Liolios +Cc: +Link: https://lore.kernel.org/r/20210727030510.36292-1-liolios.nk@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8200,6 +8200,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x129c, "Acer SWIFT SF314-55", ALC256_FIXUP_ACER_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1025, 0x1300, "Acer SWIFT SF314-56", ALC256_FIXUP_ACER_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1308, "Acer Aspire Z24-890", ALC286_FIXUP_ACER_AIO_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x132a, "Acer TravelMate B114-21", ALC233_FIXUP_ACER_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x1330, "Acer TravelMate X514-51T", ALC255_FIXUP_ACER_HEADSET_MIC), diff --git a/queue-5.10/alsa-pcm-fix-mmap-capability-check-for-the-snd-dummy-driver.patch b/queue-5.10/alsa-pcm-fix-mmap-capability-check-for-the-snd-dummy-driver.patch new file mode 100644 index 00000000000..4ba9cfff4d9 --- /dev/null +++ b/queue-5.10/alsa-pcm-fix-mmap-capability-check-for-the-snd-dummy-driver.patch @@ -0,0 +1,33 @@ +From 852a8a97776a153be2e6c803218eced45f37a19c Mon Sep 17 00:00:00 2001 +From: Jaroslav Kysela +Date: Fri, 30 Jul 2021 11:02:54 +0200 +Subject: ALSA: pcm - fix mmap capability check for the snd-dummy driver + +From: Jaroslav Kysela + +commit 852a8a97776a153be2e6c803218eced45f37a19c upstream. + +The snd-dummy driver (fake_buffer configuration) uses the ops->page +callback for the mmap operations. Allow mmap for this case, too. + +Cc: +Fixes: c4824ae7db41 ("ALSA: pcm: Fix mmap capability check") +Signed-off-by: Jaroslav Kysela +Link: https://lore.kernel.org/r/20210730090254.612478-1-perex@perex.cz +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/pcm_native.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -246,7 +246,7 @@ static bool hw_support_mmap(struct snd_p + if (!(substream->runtime->hw.info & SNDRV_PCM_INFO_MMAP)) + return false; + +- if (substream->ops->mmap) ++ if (substream->ops->mmap || substream->ops->page) + return true; + + switch (substream->dma_buffer.dev.type) { diff --git a/queue-5.10/alsa-usb-audio-add-registration-quirk-for-jbl-quantum-600.patch b/queue-5.10/alsa-usb-audio-add-registration-quirk-for-jbl-quantum-600.patch new file mode 100644 index 00000000000..8bcdb8dab85 --- /dev/null +++ b/queue-5.10/alsa-usb-audio-add-registration-quirk-for-jbl-quantum-600.patch @@ -0,0 +1,31 @@ +From 4b0556b96e1fe7723629bd40e3813a30cd632faf Mon Sep 17 00:00:00 2001 +From: Alexander Tsoy +Date: Tue, 27 Jul 2021 12:33:26 +0300 +Subject: ALSA: usb-audio: Add registration quirk for JBL Quantum 600 + +From: Alexander Tsoy + +commit 4b0556b96e1fe7723629bd40e3813a30cd632faf upstream. + +Apparently JBL Quantum 600 has multiple hardware revisions. Apply +registration quirk to another device id as well. + +Signed-off-by: Alexander Tsoy +Cc: +Link: https://lore.kernel.org/r/20210727093326.1153366-1-alexander@tsoy.me +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1897,6 +1897,7 @@ static const struct registration_quirk r + REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */ + REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */ + REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */ ++ REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2), /* JBL Quantum 600 */ + REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */ + { 0 } /* terminator */ + }; diff --git a/queue-5.10/alsa-usb-audio-fix-superfluous-autosuspend-recovery.patch b/queue-5.10/alsa-usb-audio-fix-superfluous-autosuspend-recovery.patch new file mode 100644 index 00000000000..d6bf2276d5e --- /dev/null +++ b/queue-5.10/alsa-usb-audio-fix-superfluous-autosuspend-recovery.patch @@ -0,0 +1,37 @@ +From 66291b6adb66dd3bc96b0f594d88c2ff1300d95f Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 26 Jul 2021 08:26:56 +0200 +Subject: ALSA: usb-audio: Fix superfluous autosuspend recovery + +From: Takashi Iwai + +commit 66291b6adb66dd3bc96b0f594d88c2ff1300d95f upstream. + +The change to restore the autosuspend from the disabled state uses a +wrong check: namely, it should have been the exact comparison of the +quirk_type instead of the bitwise and (&). Otherwise it matches +wrongly with the other quirk types. + +Although re-enabling the autosuspend for the already enabled device +shouldn't matter much, it's better to fix the unbalanced call. + +Fixes: 9799110825db ("ALSA: usb-audio: Disable USB autosuspend properly in setup_disable_autosuspend()") +Cc: +Link: https://lore.kernel.org/r/s5hr1flh9ov.wl-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/card.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -907,7 +907,7 @@ static void usb_audio_disconnect(struct + } + } + +- if (chip->quirk_type & QUIRK_SETUP_DISABLE_AUTOSUSPEND) ++ if (chip->quirk_type == QUIRK_SETUP_DISABLE_AUTOSUSPEND) + usb_enable_autosuspend(interface_to_usbdev(intf)); + + chip->num_interfaces--; diff --git a/queue-5.10/series b/queue-5.10/series index 208601b80a0..9c1e9160b51 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -56,3 +56,17 @@ usb-serial-ftdi_sio-add-device-id-for-auto-m3-op-com-v2.patch firmware_loader-use-etimedout-instead-of-eagain-in-fw_load_sysfs_fallback.patch firmware_loader-fix-use-after-free-in-firmware_fallback_sysfs.patch drm-amdgpu-display-fix-dmub-firmware-version-info.patch +alsa-pcm-fix-mmap-capability-check-for-the-snd-dummy-driver.patch +alsa-hda-realtek-add-mic-quirk-for-acer-sf314-42.patch +alsa-hda-realtek-fix-headset-mic-for-acer-swift-sf314-56-alc256.patch +alsa-usb-audio-fix-superfluous-autosuspend-recovery.patch +alsa-usb-audio-add-registration-quirk-for-jbl-quantum-600.patch +usb-dwc3-gadget-avoid-runtime-resume-if-disabling-pullup.patch +usb-gadget-remove-leaked-entry-from-udc-driver-list.patch +usb-cdns3-fixed-incorrect-gadget-state.patch +usb-gadget-f_hid-added-get_idle-and-set_idle-handlers.patch +usb-gadget-f_hid-fixed-null-pointer-dereference.patch +usb-gadget-f_hid-idle-uses-the-highest-byte-for-duration.patch +usb-host-ohci-at91-suspend-resume-ports-after-before-ohci-accesses.patch +usb-typec-tcpm-keep-other-events-when-receiving-frs-and-sourcing_vbus-events.patch +usb-otg-fsm-fix-hrtimer-list-corruption.patch diff --git a/queue-5.10/usb-cdns3-fixed-incorrect-gadget-state.patch b/queue-5.10/usb-cdns3-fixed-incorrect-gadget-state.patch new file mode 100644 index 00000000000..53f6b89c8f1 --- /dev/null +++ b/queue-5.10/usb-cdns3-fixed-incorrect-gadget-state.patch @@ -0,0 +1,36 @@ +From aa35772f61752d4c636d46be51a4f7ca6c029ee6 Mon Sep 17 00:00:00 2001 +From: Pawel Laszczak +Date: Wed, 23 Jun 2021 09:02:47 +0200 +Subject: usb: cdns3: Fixed incorrect gadget state + +From: Pawel Laszczak + +commit aa35772f61752d4c636d46be51a4f7ca6c029ee6 upstream. + +For delayed status phase, the usb_gadget->state was set +to USB_STATE_ADDRESS and it has never been updated to +USB_STATE_CONFIGURED. +Patch updates the gadget state to correct USB_STATE_CONFIGURED. +As a result of this bug the controller was not able to enter to +Test Mode while using MSC function. + +Cc: +Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") +Signed-off-by: Pawel Laszczak +Link: https://lore.kernel.org/r/20210623070247.46151-1-pawell@gli-login.cadence.com +Signed-off-by: Peter Chen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/cdns3/ep0.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/cdns3/ep0.c ++++ b/drivers/usb/cdns3/ep0.c +@@ -731,6 +731,7 @@ static int cdns3_gadget_ep0_queue(struct + request->actual = 0; + priv_dev->status_completion_no_call = true; + priv_dev->pending_status_request = request; ++ usb_gadget_set_state(&priv_dev->gadget, USB_STATE_CONFIGURED); + spin_unlock_irqrestore(&priv_dev->lock, flags); + + /* diff --git a/queue-5.10/usb-dwc3-gadget-avoid-runtime-resume-if-disabling-pullup.patch b/queue-5.10/usb-dwc3-gadget-avoid-runtime-resume-if-disabling-pullup.patch new file mode 100644 index 00000000000..ebc7d717ddd --- /dev/null +++ b/queue-5.10/usb-dwc3-gadget-avoid-runtime-resume-if-disabling-pullup.patch @@ -0,0 +1,66 @@ +From cb10f68ad8150f243964b19391711aaac5e8ff42 Mon Sep 17 00:00:00 2001 +From: Wesley Cheng +Date: Tue, 3 Aug 2021 23:24:05 -0700 +Subject: usb: dwc3: gadget: Avoid runtime resume if disabling pullup + +From: Wesley Cheng + +commit cb10f68ad8150f243964b19391711aaac5e8ff42 upstream. + +If the device is already in the runtime suspended state, any call to +the pullup routine will issue a runtime resume on the DWC3 core +device. If the USB gadget is disabling the pullup, then avoid having +to issue a runtime resume, as DWC3 gadget has already been +halted/stopped. + +This fixes an issue where the following condition occurs: + +usb_gadget_remove_driver() +-->usb_gadget_disconnect() + -->dwc3_gadget_pullup(0) + -->pm_runtime_get_sync() -> ret = 0 + -->pm_runtime_put() [async] +-->usb_gadget_udc_stop() + -->dwc3_gadget_stop() + -->dwc->gadget_driver = NULL +... + +dwc3_suspend_common() +-->dwc3_gadget_suspend() + -->DWC3 halt/stop routine skipped, driver_data == NULL + +This leads to a situation where the DWC3 gadget is not properly +stopped, as the runtime resume would have re-enabled EP0 and event +interrupts, and since we avoided the DWC3 gadget suspend, these +resources were never disabled. + +Fixes: 77adb8bdf422 ("usb: dwc3: gadget: Allow runtime suspend if UDC unbinded") +Cc: stable +Acked-by: Felipe Balbi +Signed-off-by: Wesley Cheng +Link: https://lore.kernel.org/r/1628058245-30692-1-git-send-email-wcheng@codeaurora.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2132,6 +2132,17 @@ static int dwc3_gadget_pullup(struct usb + } + + /* ++ * Avoid issuing a runtime resume if the device is already in the ++ * suspended state during gadget disconnect. DWC3 gadget was already ++ * halted/stopped during runtime suspend. ++ */ ++ if (!is_on) { ++ pm_runtime_barrier(dwc->dev); ++ if (pm_runtime_suspended(dwc->dev)) ++ return 0; ++ } ++ ++ /* + * Check the return value for successful resume, or error. For a + * successful resume, the DWC3 runtime PM resume routine will handle + * the run stop sequence, so avoid duplicate operations here. diff --git a/queue-5.10/usb-gadget-f_hid-added-get_idle-and-set_idle-handlers.patch b/queue-5.10/usb-gadget-f_hid-added-get_idle-and-set_idle-handlers.patch new file mode 100644 index 00000000000..bb0ac6a8260 --- /dev/null +++ b/queue-5.10/usb-gadget-f_hid-added-get_idle-and-set_idle-handlers.patch @@ -0,0 +1,74 @@ +From afcff6dc690e24d636a41fd4bee6057e7c70eebd Mon Sep 17 00:00:00 2001 +From: Maxim Devaev +Date: Wed, 21 Jul 2021 21:03:51 +0300 +Subject: usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers + +From: Maxim Devaev + +commit afcff6dc690e24d636a41fd4bee6057e7c70eebd upstream. + +The USB HID standard declares mandatory support for GET_IDLE and SET_IDLE +requests for Boot Keyboard. Most hosts can handle their absence, but others +like some old/strange UEFIs and BIOSes consider this a critical error +and refuse to work with f_hid. + +This primitive implementation of saving and returning idle is sufficient +to meet the requirements of the standard and these devices. + +Acked-by: Felipe Balbi +Cc: stable +Signed-off-by: Maxim Devaev +Link: https://lore.kernel.org/r/20210721180351.129450-1-mdevaev@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/f_hid.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +--- a/drivers/usb/gadget/function/f_hid.c ++++ b/drivers/usb/gadget/function/f_hid.c +@@ -41,6 +41,7 @@ struct f_hidg { + unsigned char bInterfaceSubClass; + unsigned char bInterfaceProtocol; + unsigned char protocol; ++ unsigned char idle; + unsigned short report_desc_length; + char *report_desc; + unsigned short report_length; +@@ -523,6 +524,14 @@ static int hidg_setup(struct usb_functio + goto respond; + break; + ++ case ((USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8 ++ | HID_REQ_GET_IDLE): ++ VDBG(cdev, "get_idle\n"); ++ length = min_t(unsigned int, length, 1); ++ ((u8 *) req->buf)[0] = hidg->idle; ++ goto respond; ++ break; ++ + case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8 + | HID_REQ_SET_REPORT): + VDBG(cdev, "set_report | wLength=%d\n", ctrl->wLength); +@@ -546,6 +555,14 @@ static int hidg_setup(struct usb_functio + goto stall; + break; + ++ case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8 ++ | HID_REQ_SET_IDLE): ++ VDBG(cdev, "set_idle\n"); ++ length = 0; ++ hidg->idle = value; ++ goto respond; ++ break; ++ + case ((USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_INTERFACE) << 8 + | USB_REQ_GET_DESCRIPTOR): + switch (value >> 8) { +@@ -773,6 +790,7 @@ static int hidg_bind(struct usb_configur + hidg_interface_desc.bInterfaceSubClass = hidg->bInterfaceSubClass; + hidg_interface_desc.bInterfaceProtocol = hidg->bInterfaceProtocol; + hidg->protocol = HID_REPORT_PROTOCOL; ++ hidg->idle = 1; + hidg_ss_in_ep_desc.wMaxPacketSize = cpu_to_le16(hidg->report_length); + hidg_ss_in_comp_desc.wBytesPerInterval = + cpu_to_le16(hidg->report_length); diff --git a/queue-5.10/usb-gadget-f_hid-fixed-null-pointer-dereference.patch b/queue-5.10/usb-gadget-f_hid-fixed-null-pointer-dereference.patch new file mode 100644 index 00000000000..86aa202c239 --- /dev/null +++ b/queue-5.10/usb-gadget-f_hid-fixed-null-pointer-dereference.patch @@ -0,0 +1,79 @@ +From 2867652e4766360adf14dfda3832455e04964f2a Mon Sep 17 00:00:00 2001 +From: Phil Elwell +Date: Fri, 23 Jul 2021 18:59:30 +0300 +Subject: usb: gadget: f_hid: fixed NULL pointer dereference + +From: Phil Elwell + +commit 2867652e4766360adf14dfda3832455e04964f2a upstream. + +Disconnecting and reconnecting the USB cable can lead to crashes +and a variety of kernel log spam. + +The problem was found and reproduced on the Raspberry Pi [1] +and the original fix was created in Raspberry's own fork [2]. + +Link: https://github.com/raspberrypi/linux/issues/3870 [1] +Link: https://github.com/raspberrypi/linux/commit/a6e47d5f4efbd2ea6a0b6565cd2f9b7bb217ded5 [2] +Signed-off-by: Maxim Devaev +Signed-off-by: Phil Elwell +Cc: stable +Link: https://lore.kernel.org/r/20210723155928.210019-1-mdevaev@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/f_hid.c | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +--- a/drivers/usb/gadget/function/f_hid.c ++++ b/drivers/usb/gadget/function/f_hid.c +@@ -339,6 +339,11 @@ static ssize_t f_hidg_write(struct file + + spin_lock_irqsave(&hidg->write_spinlock, flags); + ++ if (!hidg->req) { ++ spin_unlock_irqrestore(&hidg->write_spinlock, flags); ++ return -ESHUTDOWN; ++ } ++ + #define WRITE_COND (!hidg->write_pending) + try_again: + /* write queue */ +@@ -359,8 +364,14 @@ try_again: + count = min_t(unsigned, count, hidg->report_length); + + spin_unlock_irqrestore(&hidg->write_spinlock, flags); +- status = copy_from_user(req->buf, buffer, count); + ++ if (!req) { ++ ERROR(hidg->func.config->cdev, "hidg->req is NULL\n"); ++ status = -ESHUTDOWN; ++ goto release_write_pending; ++ } ++ ++ status = copy_from_user(req->buf, buffer, count); + if (status != 0) { + ERROR(hidg->func.config->cdev, + "copy_from_user error\n"); +@@ -388,14 +399,17 @@ try_again: + + spin_unlock_irqrestore(&hidg->write_spinlock, flags); + ++ if (!hidg->in_ep->enabled) { ++ ERROR(hidg->func.config->cdev, "in_ep is disabled\n"); ++ status = -ESHUTDOWN; ++ goto release_write_pending; ++ } ++ + status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC); +- if (status < 0) { +- ERROR(hidg->func.config->cdev, +- "usb_ep_queue error on int endpoint %zd\n", status); ++ if (status < 0) + goto release_write_pending; +- } else { ++ else + status = count; +- } + + return status; + release_write_pending: diff --git a/queue-5.10/usb-gadget-f_hid-idle-uses-the-highest-byte-for-duration.patch b/queue-5.10/usb-gadget-f_hid-idle-uses-the-highest-byte-for-duration.patch new file mode 100644 index 00000000000..25644e56999 --- /dev/null +++ b/queue-5.10/usb-gadget-f_hid-idle-uses-the-highest-byte-for-duration.patch @@ -0,0 +1,32 @@ +From fa20bada3f934e3b3e4af4c77e5b518cd5a282e5 Mon Sep 17 00:00:00 2001 +From: Maxim Devaev +Date: Tue, 27 Jul 2021 21:58:00 +0300 +Subject: usb: gadget: f_hid: idle uses the highest byte for duration + +From: Maxim Devaev + +commit fa20bada3f934e3b3e4af4c77e5b518cd5a282e5 upstream. + +SET_IDLE value must be shifted 8 bits to the right to get duration. +This confirmed by USBCV test. + +Fixes: afcff6dc690e ("usb: gadget: f_hid: added GET_IDLE and SET_IDLE handlers") +Cc: stable +Signed-off-by: Maxim Devaev +Link: https://lore.kernel.org/r/20210727185800.43796-1-mdevaev@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/f_hid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/f_hid.c ++++ b/drivers/usb/gadget/function/f_hid.c +@@ -573,7 +573,7 @@ static int hidg_setup(struct usb_functio + | HID_REQ_SET_IDLE): + VDBG(cdev, "set_idle\n"); + length = 0; +- hidg->idle = value; ++ hidg->idle = value >> 8; + goto respond; + break; + diff --git a/queue-5.10/usb-gadget-remove-leaked-entry-from-udc-driver-list.patch b/queue-5.10/usb-gadget-remove-leaked-entry-from-udc-driver-list.patch new file mode 100644 index 00000000000..cf86efa3d5d --- /dev/null +++ b/queue-5.10/usb-gadget-remove-leaked-entry-from-udc-driver-list.patch @@ -0,0 +1,61 @@ +From fa4a8dcfd51b911f101ebc461dfe22230b74dd64 Mon Sep 17 00:00:00 2001 +From: Zhang Qilong +Date: Tue, 27 Jul 2021 15:31:42 +0800 +Subject: usb: gadget: remove leaked entry from udc driver list + +From: Zhang Qilong + +commit fa4a8dcfd51b911f101ebc461dfe22230b74dd64 upstream. + +The usb_add_gadget_udc will add a new gadget to the udc class +driver list. Not calling usb_del_gadget_udc in error branch +will result in residual gadget entry in the udc driver list. +We fix it by calling usb_del_gadget_udc to clean it when error +return. + +Fixes: 48ba02b2e2b1 ("usb: gadget: add udc driver for max3420") +Acked-by: Felipe Balbi +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20210727073142.84666-1-zhangqilong3@huawei.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/max3420_udc.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/usb/gadget/udc/max3420_udc.c ++++ b/drivers/usb/gadget/udc/max3420_udc.c +@@ -1260,12 +1260,14 @@ static int max3420_probe(struct spi_devi + err = devm_request_irq(&spi->dev, irq, max3420_irq_handler, 0, + "max3420", udc); + if (err < 0) +- return err; ++ goto del_gadget; + + udc->thread_task = kthread_create(max3420_thread, udc, + "max3420-thread"); +- if (IS_ERR(udc->thread_task)) +- return PTR_ERR(udc->thread_task); ++ if (IS_ERR(udc->thread_task)) { ++ err = PTR_ERR(udc->thread_task); ++ goto del_gadget; ++ } + + irq = of_irq_get_byname(spi->dev.of_node, "vbus"); + if (irq <= 0) { /* no vbus irq implies self-powered design */ +@@ -1285,10 +1287,14 @@ static int max3420_probe(struct spi_devi + err = devm_request_irq(&spi->dev, irq, + max3420_vbus_handler, 0, "vbus", udc); + if (err < 0) +- return err; ++ goto del_gadget; + } + + return 0; ++ ++del_gadget: ++ usb_del_gadget_udc(&udc->gadget); ++ return err; + } + + static int max3420_remove(struct spi_device *spi) diff --git a/queue-5.10/usb-host-ohci-at91-suspend-resume-ports-after-before-ohci-accesses.patch b/queue-5.10/usb-host-ohci-at91-suspend-resume-ports-after-before-ohci-accesses.patch new file mode 100644 index 00000000000..313ab7856a0 --- /dev/null +++ b/queue-5.10/usb-host-ohci-at91-suspend-resume-ports-after-before-ohci-accesses.patch @@ -0,0 +1,65 @@ +From 00de6a572f30ee93cad7e0704ec4232e5e72bda8 Mon Sep 17 00:00:00 2001 +From: Claudiu Beznea +Date: Wed, 21 Jul 2021 16:29:05 +0300 +Subject: usb: host: ohci-at91: suspend/resume ports after/before OHCI accesses + +From: Claudiu Beznea + +commit 00de6a572f30ee93cad7e0704ec4232e5e72bda8 upstream. + +On SAMA7G5 suspending ports will cut the access to OHCI registers and +any subsequent access to them will lead to CPU being blocked trying to +access that memory. Same thing happens on resume: if OHCI memory is +accessed before resuming ports the CPU will block on that access. The +OCHI memory is accessed on suspend/resume though +ohci_suspend()/ohci_resume(). + +Acked-by: Alan Stern +Signed-off-by: Claudiu Beznea +Cc: stable +Link: https://lore.kernel.org/r/20210721132905.1970713-1-claudiu.beznea@microchip.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/ohci-at91.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/usb/host/ohci-at91.c ++++ b/drivers/usb/host/ohci-at91.c +@@ -606,8 +606,6 @@ ohci_hcd_at91_drv_suspend(struct device + if (ohci_at91->wakeup) + enable_irq_wake(hcd->irq); + +- ohci_at91_port_suspend(ohci_at91->sfr_regmap, 1); +- + ret = ohci_suspend(hcd, ohci_at91->wakeup); + if (ret) { + if (ohci_at91->wakeup) +@@ -627,7 +625,10 @@ ohci_hcd_at91_drv_suspend(struct device + /* flush the writes */ + (void) ohci_readl (ohci, &ohci->regs->control); + msleep(1); ++ ohci_at91_port_suspend(ohci_at91->sfr_regmap, 1); + at91_stop_clock(ohci_at91); ++ } else { ++ ohci_at91_port_suspend(ohci_at91->sfr_regmap, 1); + } + + return ret; +@@ -639,6 +640,8 @@ ohci_hcd_at91_drv_resume(struct device * + struct usb_hcd *hcd = dev_get_drvdata(dev); + struct ohci_at91_priv *ohci_at91 = hcd_to_ohci_at91_priv(hcd); + ++ ohci_at91_port_suspend(ohci_at91->sfr_regmap, 0); ++ + if (ohci_at91->wakeup) + disable_irq_wake(hcd->irq); + else +@@ -646,8 +649,6 @@ ohci_hcd_at91_drv_resume(struct device * + + ohci_resume(hcd, false); + +- ohci_at91_port_suspend(ohci_at91->sfr_regmap, 0); +- + return 0; + } + diff --git a/queue-5.10/usb-otg-fsm-fix-hrtimer-list-corruption.patch b/queue-5.10/usb-otg-fsm-fix-hrtimer-list-corruption.patch new file mode 100644 index 00000000000..41ddaf4009a --- /dev/null +++ b/queue-5.10/usb-otg-fsm-fix-hrtimer-list-corruption.patch @@ -0,0 +1,64 @@ +From bf88fef0b6f1488abeca594d377991171c00e52a Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Sat, 17 Jul 2021 21:21:27 +0300 +Subject: usb: otg-fsm: Fix hrtimer list corruption + +From: Dmitry Osipenko + +commit bf88fef0b6f1488abeca594d377991171c00e52a upstream. + +The HNP work can be re-scheduled while it's still in-fly. This results in +re-initialization of the busy work, resetting the hrtimer's list node of +the work and crashing kernel with null dereference within kernel/timer +once work's timer is expired. It's very easy to trigger this problem by +re-plugging USB cable quickly. Initialize HNP work only once to fix this +trouble. + + Unable to handle kernel NULL pointer dereference at virtual address 00000126) + ... + PC is at __run_timers.part.0+0x150/0x228 + LR is at __next_timer_interrupt+0x51/0x9c + ... + (__run_timers.part.0) from [] (run_timer_softirq+0x2f/0x50) + (run_timer_softirq) from [] (__do_softirq+0xd5/0x2f0) + (__do_softirq) from [] (irq_exit+0xab/0xb8) + (irq_exit) from [] (handle_domain_irq+0x45/0x60) + (handle_domain_irq) from [] (gic_handle_irq+0x6b/0x7c) + (gic_handle_irq) from [] (__irq_svc+0x65/0xac) + +Cc: stable@vger.kernel.org +Acked-by: Peter Chen +Signed-off-by: Dmitry Osipenko +Link: https://lore.kernel.org/r/20210717182134.30262-6-digetx@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/common/usb-otg-fsm.c | 6 +++++- + include/linux/usb/otg-fsm.h | 1 + + 2 files changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/usb/common/usb-otg-fsm.c ++++ b/drivers/usb/common/usb-otg-fsm.c +@@ -193,7 +193,11 @@ static void otg_start_hnp_polling(struct + if (!fsm->host_req_flag) + return; + +- INIT_DELAYED_WORK(&fsm->hnp_polling_work, otg_hnp_polling_work); ++ if (!fsm->hnp_work_inited) { ++ INIT_DELAYED_WORK(&fsm->hnp_polling_work, otg_hnp_polling_work); ++ fsm->hnp_work_inited = true; ++ } ++ + schedule_delayed_work(&fsm->hnp_polling_work, + msecs_to_jiffies(T_HOST_REQ_POLL)); + } +--- a/include/linux/usb/otg-fsm.h ++++ b/include/linux/usb/otg-fsm.h +@@ -196,6 +196,7 @@ struct otg_fsm { + struct mutex lock; + u8 *host_req_flag; + struct delayed_work hnp_polling_work; ++ bool hnp_work_inited; + bool state_changed; + }; + diff --git a/queue-5.10/usb-typec-tcpm-keep-other-events-when-receiving-frs-and-sourcing_vbus-events.patch b/queue-5.10/usb-typec-tcpm-keep-other-events-when-receiving-frs-and-sourcing_vbus-events.patch new file mode 100644 index 00000000000..ea478ceb01d --- /dev/null +++ b/queue-5.10/usb-typec-tcpm-keep-other-events-when-receiving-frs-and-sourcing_vbus-events.patch @@ -0,0 +1,45 @@ +From 43ad944cd73f2360ec8ff31d29ea44830b3119af Mon Sep 17 00:00:00 2001 +From: Kyle Tso +Date: Tue, 3 Aug 2021 17:13:14 +0800 +Subject: usb: typec: tcpm: Keep other events when receiving FRS and Sourcing_vbus events + +From: Kyle Tso + +commit 43ad944cd73f2360ec8ff31d29ea44830b3119af upstream. + +When receiving FRS and Sourcing_Vbus events from low-level drivers, keep +other events which come a bit earlier so that they will not be ignored +in the event handler. + +Fixes: 8dc4bd073663 ("usb: typec: tcpm: Add support for Sink Fast Role SWAP(FRS)") +Cc: stable +Cc: Badhri Jagan Sridharan +Reviewed-by: Guenter Roeck +Reviewed-by: Badhri Jagan Sridharan +Signed-off-by: Kyle Tso +Link: https://lore.kernel.org/r/20210803091314.3051302-1-kyletso@google.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm/tcpm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -4314,7 +4314,7 @@ EXPORT_SYMBOL_GPL(tcpm_pd_hard_reset); + void tcpm_sink_frs(struct tcpm_port *port) + { + spin_lock(&port->pd_event_lock); +- port->pd_events = TCPM_FRS_EVENT; ++ port->pd_events |= TCPM_FRS_EVENT; + spin_unlock(&port->pd_event_lock); + kthread_queue_work(port->wq, &port->event_work); + } +@@ -4323,7 +4323,7 @@ EXPORT_SYMBOL_GPL(tcpm_sink_frs); + void tcpm_sourcing_vbus(struct tcpm_port *port) + { + spin_lock(&port->pd_event_lock); +- port->pd_events = TCPM_SOURCING_VBUS; ++ port->pd_events |= TCPM_SOURCING_VBUS; + spin_unlock(&port->pd_event_lock); + kthread_queue_work(port->wq, &port->event_work); + }