From: Greg Kroah-Hartman Date: Wed, 23 Dec 2020 11:36:27 +0000 (+0100) Subject: 4.4-stable patches X-Git-Tag: v5.10.3~22 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cccec415b5ed172de70d3d5320b0718c0de88157;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: soc-tegra-fuse-fix-index-bug-in-get_process_id.patch usb-chipidea-ci_hdrc_imx-pass-disable_device_streaming-flag-to-imx6ul.patch usb-gadget-f_rndis-fix-bitrate-for-superspeed-and-above.patch usb-serial-option-add-interface-number-sanity-check-to-flag-handling.patch --- diff --git a/queue-4.4/series b/queue-4.4/series index dbd5c99ed95..a94569c8c35 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -23,3 +23,7 @@ scsi-bnx2i-requires-mmu.patch can-softing-softing_netdev_open-fix-error-handling.patch rdma-cm-fix-an-attempt-to-use-non-valid-pointer-when.patch dm-table-remove-bug_on-in_interrupt.patch +soc-tegra-fuse-fix-index-bug-in-get_process_id.patch +usb-serial-option-add-interface-number-sanity-check-to-flag-handling.patch +usb-gadget-f_rndis-fix-bitrate-for-superspeed-and-above.patch +usb-chipidea-ci_hdrc_imx-pass-disable_device_streaming-flag-to-imx6ul.patch diff --git a/queue-4.4/soc-tegra-fuse-fix-index-bug-in-get_process_id.patch b/queue-4.4/soc-tegra-fuse-fix-index-bug-in-get_process_id.patch new file mode 100644 index 00000000000..613c5bca883 --- /dev/null +++ b/queue-4.4/soc-tegra-fuse-fix-index-bug-in-get_process_id.patch @@ -0,0 +1,33 @@ +From b9ce9b0f83b536a4ac7de7567a265d28d13e5bea Mon Sep 17 00:00:00 2001 +From: Nicolin Chen +Date: Wed, 18 Nov 2020 20:44:57 -0800 +Subject: soc/tegra: fuse: Fix index bug in get_process_id + +From: Nicolin Chen + +commit b9ce9b0f83b536a4ac7de7567a265d28d13e5bea upstream. + +This patch simply fixes a bug of referencing speedos[num] in every +for-loop iteration in get_process_id function. + +Fixes: 0dc5a0d83675 ("soc/tegra: fuse: Add Tegra210 support") +Cc: +Signed-off-by: Nicolin Chen +Signed-off-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/soc/tegra/fuse/speedo-tegra210.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/soc/tegra/fuse/speedo-tegra210.c ++++ b/drivers/soc/tegra/fuse/speedo-tegra210.c +@@ -105,7 +105,7 @@ static int get_process_id(int value, con + unsigned int i; + + for (i = 0; i < num; i++) +- if (value < speedos[num]) ++ if (value < speedos[i]) + return i; + + return -EINVAL; diff --git a/queue-4.4/usb-chipidea-ci_hdrc_imx-pass-disable_device_streaming-flag-to-imx6ul.patch b/queue-4.4/usb-chipidea-ci_hdrc_imx-pass-disable_device_streaming-flag-to-imx6ul.patch new file mode 100644 index 00000000000..d3d6b7870ff --- /dev/null +++ b/queue-4.4/usb-chipidea-ci_hdrc_imx-pass-disable_device_streaming-flag-to-imx6ul.patch @@ -0,0 +1,38 @@ +From c7721e15f434920145c376e8fe77e1c079fc3726 Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Mon, 7 Dec 2020 10:09:09 +0800 +Subject: usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul + +From: Fabio Estevam + +commit c7721e15f434920145c376e8fe77e1c079fc3726 upstream. + +According to the i.MX6UL Errata document: +https://www.nxp.com/docs/en/errata/IMX6ULCE.pdf + +ERR007881 also affects i.MX6UL, so pass the +CI_HDRC_DISABLE_DEVICE_STREAMING flag to workaround the issue. + +Fixes: 52fe568e5d71 ("usb: chipidea: imx: add imx6ul usb support") +Cc: +Signed-off-by: Fabio Estevam +Signed-off-by: Peter Chen +Link: https://lore.kernel.org/r/20201207020909.22483-2-peter.chen@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/chipidea/ci_hdrc_imx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/chipidea/ci_hdrc_imx.c ++++ b/drivers/usb/chipidea/ci_hdrc_imx.c +@@ -58,7 +58,8 @@ static const struct ci_hdrc_imx_platform + + static const struct ci_hdrc_imx_platform_flag imx6ul_usb_data = { + .flags = CI_HDRC_SUPPORTS_RUNTIME_PM | +- CI_HDRC_TURN_VBUS_EARLY_ON, ++ CI_HDRC_TURN_VBUS_EARLY_ON | ++ CI_HDRC_DISABLE_DEVICE_STREAMING, + }; + + static const struct ci_hdrc_imx_platform_flag imx7d_usb_data = { diff --git a/queue-4.4/usb-gadget-f_rndis-fix-bitrate-for-superspeed-and-above.patch b/queue-4.4/usb-gadget-f_rndis-fix-bitrate-for-superspeed-and-above.patch new file mode 100644 index 00000000000..552acfe3928 --- /dev/null +++ b/queue-4.4/usb-gadget-f_rndis-fix-bitrate-for-superspeed-and-above.patch @@ -0,0 +1,40 @@ +From b00f444f9add39b64d1943fa75538a1ebd54a290 Mon Sep 17 00:00:00 2001 +From: Will McVicker +Date: Fri, 27 Nov 2020 15:05:55 +0100 +Subject: USB: gadget: f_rndis: fix bitrate for SuperSpeed and above + +From: Will McVicker + +commit b00f444f9add39b64d1943fa75538a1ebd54a290 upstream. + +Align the SuperSpeed Plus bitrate for f_rndis to match f_ncm's ncm_bitrate +defined by commit 1650113888fe ("usb: gadget: f_ncm: add SuperSpeed descriptors +for CDC NCM"). + +Cc: Felipe Balbi +Cc: EJ Hsu +Cc: Peter Chen +Cc: stable +Signed-off-by: Will McVicker +Reviewed-by: Peter Chen +Link: https://lore.kernel.org/r/20201127140559.381351-2-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_rndis.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/f_rndis.c ++++ b/drivers/usb/gadget/function/f_rndis.c +@@ -91,8 +91,10 @@ static inline struct f_rndis *func_to_rn + /* peak (theoretical) bulk transfer rate in bits-per-second */ + static unsigned int bitrate(struct usb_gadget *g) + { ++ if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS) ++ return 4250000000U; + if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER) +- return 13 * 1024 * 8 * 1000 * 8; ++ return 3750000000U; + else if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH) + return 13 * 512 * 8 * 1000 * 8; + else diff --git a/queue-4.4/usb-serial-option-add-interface-number-sanity-check-to-flag-handling.patch b/queue-4.4/usb-serial-option-add-interface-number-sanity-check-to-flag-handling.patch new file mode 100644 index 00000000000..c7f8d367e78 --- /dev/null +++ b/queue-4.4/usb-serial-option-add-interface-number-sanity-check-to-flag-handling.patch @@ -0,0 +1,85 @@ +From a251963f76fa0226d0fdf0c4f989496f18d9ae7f Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 9 Dec 2020 11:42:21 +0100 +Subject: USB: serial: option: add interface-number sanity check to flag handling + +From: Johan Hovold + +commit a251963f76fa0226d0fdf0c4f989496f18d9ae7f upstream. + +Add an interface-number sanity check before testing the device flags to +avoid relying on undefined behaviour when left shifting in case a device +uses an interface number greater than or equal to BITS_PER_LONG (i.e. 64 +or 32). + +Reported-by: syzbot+8881b478dad0a7971f79@syzkaller.appspotmail.com +Fixes: c3a65808f04a ("USB: serial: option: reimplement interface masking") +Cc: stable@vger.kernel.org +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -563,6 +563,9 @@ static void option_instat_callback(struc + + /* Device flags */ + ++/* Highest interface number which can be used with NCTRL() and RSVD() */ ++#define FLAG_IFNUM_MAX 7 ++ + /* Interface does not support modem-control requests */ + #define NCTRL(ifnum) ((BIT(ifnum) & 0xff) << 8) + +@@ -2086,6 +2089,14 @@ static struct usb_serial_driver * const + + module_usb_serial_driver(serial_drivers, option_ids); + ++static bool iface_is_reserved(unsigned long device_flags, u8 ifnum) ++{ ++ if (ifnum > FLAG_IFNUM_MAX) ++ return false; ++ ++ return device_flags & RSVD(ifnum); ++} ++ + static int option_probe(struct usb_serial *serial, + const struct usb_device_id *id) + { +@@ -2103,7 +2114,7 @@ static int option_probe(struct usb_seria + * the same class/subclass/protocol as the serial interfaces. Look at + * the Windows driver .INF files for reserved interface numbers. + */ +- if (device_flags & RSVD(iface_desc->bInterfaceNumber)) ++ if (iface_is_reserved(device_flags, iface_desc->bInterfaceNumber)) + return -ENODEV; + /* + * Don't bind network interface on Samsung GT-B3730, it is handled by +@@ -2120,6 +2131,14 @@ static int option_probe(struct usb_seria + return 0; + } + ++static bool iface_no_modem_control(unsigned long device_flags, u8 ifnum) ++{ ++ if (ifnum > FLAG_IFNUM_MAX) ++ return false; ++ ++ return device_flags & NCTRL(ifnum); ++} ++ + static int option_attach(struct usb_serial *serial) + { + struct usb_interface_descriptor *iface_desc; +@@ -2135,7 +2154,7 @@ static int option_attach(struct usb_seri + + iface_desc = &serial->interface->cur_altsetting->desc; + +- if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber))) ++ if (!iface_no_modem_control(device_flags, iface_desc->bInterfaceNumber)) + data->use_send_setup = 1; + + if (device_flags & ZLP)