From: Greg Kroah-Hartman Date: Sat, 30 Oct 2021 12:34:37 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v4.4.291~29 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e48d811253447476545466e13ce9bb2081e201e1;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: mmc-dw_mmc-exynos-fix-the-finding-clock-sample-value.patch mmc-sdhci-map-more-voltage-level-to-sdhci_power_330.patch mmc-vub300-fix-control-message-timeouts.patch net-lan78xx-fix-division-by-zero-in-send-path.patch --- diff --git a/queue-4.4/mmc-dw_mmc-exynos-fix-the-finding-clock-sample-value.patch b/queue-4.4/mmc-dw_mmc-exynos-fix-the-finding-clock-sample-value.patch new file mode 100644 index 00000000000..391d0278c29 --- /dev/null +++ b/queue-4.4/mmc-dw_mmc-exynos-fix-the-finding-clock-sample-value.patch @@ -0,0 +1,55 @@ +From 697542bceae51f7620af333b065dd09d213629fb Mon Sep 17 00:00:00 2001 +From: Jaehoon Chung +Date: Fri, 22 Oct 2021 17:21:06 +0900 +Subject: mmc: dw_mmc: exynos: fix the finding clock sample value + +From: Jaehoon Chung + +commit 697542bceae51f7620af333b065dd09d213629fb upstream. + +Even though there are candiates value if can't find best value, it's +returned -EIO. It's not proper behavior. +If there is not best value, use a first candiate value to work eMMC. + +Signed-off-by: Jaehoon Chung +Tested-by: Marek Szyprowski +Tested-by: Christian Hewitt +Cc: stable@vger.kernel.org +Fixes: c537a1c5ff63 ("mmc: dw_mmc: exynos: add variable delay tuning sequence") +Link: https://lore.kernel.org/r/20211022082106.1557-1-jh80.chung@samsung.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/dw_mmc-exynos.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/mmc/host/dw_mmc-exynos.c ++++ b/drivers/mmc/host/dw_mmc-exynos.c +@@ -442,6 +442,18 @@ static s8 dw_mci_exynos_get_best_clksmpl + } + } + ++ /* ++ * If there is no cadiates value, then it needs to return -EIO. ++ * If there are candiates values and don't find bset clk sample value, ++ * then use a first candiates clock sample value. ++ */ ++ for (i = 0; i < iter; i++) { ++ __c = ror8(candiates, i); ++ if ((__c & 0x1) == 0x1) { ++ loc = i; ++ goto out; ++ } ++ } + out: + return loc; + } +@@ -472,6 +484,8 @@ static int dw_mci_exynos_execute_tuning( + priv->tuned_sample = found; + } else { + ret = -EIO; ++ dev_warn(&mmc->class_dev, ++ "There is no candiates value about clksmpl!\n"); + } + + return ret; diff --git a/queue-4.4/mmc-sdhci-map-more-voltage-level-to-sdhci_power_330.patch b/queue-4.4/mmc-sdhci-map-more-voltage-level-to-sdhci_power_330.patch new file mode 100644 index 00000000000..7f6a38cf40c --- /dev/null +++ b/queue-4.4/mmc-sdhci-map-more-voltage-level-to-sdhci_power_330.patch @@ -0,0 +1,84 @@ +From 4217d07b9fb328751f877d3bd9550122014860a2 Mon Sep 17 00:00:00 2001 +From: Shawn Guo +Date: Mon, 4 Oct 2021 10:49:35 +0800 +Subject: mmc: sdhci: Map more voltage level to SDHCI_POWER_330 + +From: Shawn Guo + +commit 4217d07b9fb328751f877d3bd9550122014860a2 upstream. + +On Thundercomm TurboX CM2290, the eMMC OCR reports vdd = 23 (3.5 ~ 3.6 V), +which is being treated as an invalid value by sdhci_set_power_noreg(). +And thus eMMC is totally broken on the platform. + +[ 1.436599] ------------[ cut here ]------------ +[ 1.436606] mmc0: Invalid vdd 0x17 +[ 1.436640] WARNING: CPU: 2 PID: 69 at drivers/mmc/host/sdhci.c:2048 sdhci_set_power_noreg+0x168/0x2b4 +[ 1.436655] Modules linked in: +[ 1.436662] CPU: 2 PID: 69 Comm: kworker/u8:1 Tainted: G W 5.15.0-rc1+ #137 +[ 1.436669] Hardware name: Thundercomm TurboX CM2290 (DT) +[ 1.436674] Workqueue: events_unbound async_run_entry_fn +[ 1.436685] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 1.436692] pc : sdhci_set_power_noreg+0x168/0x2b4 +[ 1.436698] lr : sdhci_set_power_noreg+0x168/0x2b4 +[ 1.436703] sp : ffff800010803a60 +[ 1.436705] x29: ffff800010803a60 x28: ffff6a9102465f00 x27: ffff6a9101720a70 +[ 1.436715] x26: ffff6a91014de1c0 x25: ffff6a91014de010 x24: ffff6a91016af280 +[ 1.436724] x23: ffffaf7b1b276640 x22: 0000000000000000 x21: ffff6a9101720000 +[ 1.436733] x20: ffff6a9101720370 x19: ffff6a9101720580 x18: 0000000000000020 +[ 1.436743] x17: 0000000000000000 x16: 0000000000000004 x15: ffffffffffffffff +[ 1.436751] x14: 0000000000000000 x13: 00000000fffffffd x12: ffffaf7b1b84b0bc +[ 1.436760] x11: ffffaf7b1b720d10 x10: 000000000000000a x9 : ffff800010803a60 +[ 1.436769] x8 : 000000000000000a x7 : 000000000000000f x6 : 00000000fffff159 +[ 1.436778] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000ffffffff +[ 1.436787] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff6a9101718d80 +[ 1.436797] Call trace: +[ 1.436800] sdhci_set_power_noreg+0x168/0x2b4 +[ 1.436805] sdhci_set_ios+0xa0/0x7fc +[ 1.436811] mmc_power_up.part.0+0xc4/0x164 +[ 1.436818] mmc_start_host+0xa0/0xb0 +[ 1.436824] mmc_add_host+0x60/0x90 +[ 1.436830] __sdhci_add_host+0x174/0x330 +[ 1.436836] sdhci_msm_probe+0x7c0/0x920 +[ 1.436842] platform_probe+0x68/0xe0 +[ 1.436850] really_probe.part.0+0x9c/0x31c +[ 1.436857] __driver_probe_device+0x98/0x144 +[ 1.436863] driver_probe_device+0xc8/0x15c +[ 1.436869] __device_attach_driver+0xb4/0x120 +[ 1.436875] bus_for_each_drv+0x78/0xd0 +[ 1.436881] __device_attach_async_helper+0xac/0xd0 +[ 1.436888] async_run_entry_fn+0x34/0x110 +[ 1.436895] process_one_work+0x1d0/0x354 +[ 1.436903] worker_thread+0x13c/0x470 +[ 1.436910] kthread+0x150/0x160 +[ 1.436915] ret_from_fork+0x10/0x20 +[ 1.436923] ---[ end trace fcfac44cb045c3a8 ]--- + +Fix the issue by mapping MMC_VDD_35_36 (and MMC_VDD_34_35) to +SDHCI_POWER_330 as well. + +Signed-off-by: Shawn Guo +Acked-by: Adrian Hunter +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20211004024935.15326-1-shawn.guo@linaro.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1319,6 +1319,12 @@ void sdhci_set_power(struct sdhci_host * + break; + case MMC_VDD_32_33: + case MMC_VDD_33_34: ++ /* ++ * 3.4 ~ 3.6V are valid only for those platforms where it's ++ * known that the voltage range is supported by hardware. ++ */ ++ case MMC_VDD_34_35: ++ case MMC_VDD_35_36: + pwr = SDHCI_POWER_330; + break; + default: diff --git a/queue-4.4/mmc-vub300-fix-control-message-timeouts.patch b/queue-4.4/mmc-vub300-fix-control-message-timeouts.patch new file mode 100644 index 00000000000..0acc6860dad --- /dev/null +++ b/queue-4.4/mmc-vub300-fix-control-message-timeouts.patch @@ -0,0 +1,103 @@ +From 8c8171929116cc23f74743d99251eedadf62341a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 25 Oct 2021 13:56:08 +0200 +Subject: mmc: vub300: fix control-message timeouts + +From: Johan Hovold + +commit 8c8171929116cc23f74743d99251eedadf62341a upstream. + +USB control-message timeouts are specified in milliseconds and should +specifically not vary with CONFIG_HZ. + +Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver") +Cc: stable@vger.kernel.org # 3.0 +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20211025115608.5287-1-johan@kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/vub300.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/mmc/host/vub300.c ++++ b/drivers/mmc/host/vub300.c +@@ -579,7 +579,7 @@ static void check_vub300_port_status(str + GET_SYSTEM_PORT_STATUS, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + 0x0000, 0x0000, &vub300->system_port_status, +- sizeof(vub300->system_port_status), HZ); ++ sizeof(vub300->system_port_status), 1000); + if (sizeof(vub300->system_port_status) == retval) + new_system_port_status(vub300); + } +@@ -1245,7 +1245,7 @@ static void __download_offload_pseudocod + SET_INTERRUPT_PSEUDOCODE, + USB_DIR_OUT | USB_TYPE_VENDOR | + USB_RECIP_DEVICE, 0x0000, 0x0000, +- xfer_buffer, xfer_length, HZ); ++ xfer_buffer, xfer_length, 1000); + kfree(xfer_buffer); + if (retval < 0) { + strncpy(vub300->vub_name, +@@ -1292,7 +1292,7 @@ static void __download_offload_pseudocod + SET_TRANSFER_PSEUDOCODE, + USB_DIR_OUT | USB_TYPE_VENDOR | + USB_RECIP_DEVICE, 0x0000, 0x0000, +- xfer_buffer, xfer_length, HZ); ++ xfer_buffer, xfer_length, 1000); + kfree(xfer_buffer); + if (retval < 0) { + strncpy(vub300->vub_name, +@@ -1998,7 +1998,7 @@ static void __set_clock_speed(struct vub + usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), + SET_CLOCK_SPEED, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- 0x00, 0x00, buf, buf_array_size, HZ); ++ 0x00, 0x00, buf, buf_array_size, 1000); + if (retval != 8) { + dev_err(&vub300->udev->dev, "SET_CLOCK_SPEED" + " %dkHz failed with retval=%d\n", kHzClock, retval); +@@ -2020,14 +2020,14 @@ static void vub300_mmc_set_ios(struct mm + usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), + SET_SD_POWER, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- 0x0000, 0x0000, NULL, 0, HZ); ++ 0x0000, 0x0000, NULL, 0, 1000); + /* must wait for the VUB300 u-proc to boot up */ + msleep(600); + } else if ((ios->power_mode == MMC_POWER_UP) && !vub300->card_powered) { + usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), + SET_SD_POWER, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- 0x0001, 0x0000, NULL, 0, HZ); ++ 0x0001, 0x0000, NULL, 0, 1000); + msleep(600); + vub300->card_powered = 1; + } else if (ios->power_mode == MMC_POWER_ON) { +@@ -2290,14 +2290,14 @@ static int vub300_probe(struct usb_inter + GET_HC_INF0, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + 0x0000, 0x0000, &vub300->hc_info, +- sizeof(vub300->hc_info), HZ); ++ sizeof(vub300->hc_info), 1000); + if (retval < 0) + goto error5; + retval = + usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0), + SET_ROM_WAIT_STATES, + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, +- firmware_rom_wait_states, 0x0000, NULL, 0, HZ); ++ firmware_rom_wait_states, 0x0000, NULL, 0, 1000); + if (retval < 0) + goto error5; + dev_info(&vub300->udev->dev, +@@ -2312,7 +2312,7 @@ static int vub300_probe(struct usb_inter + GET_SYSTEM_PORT_STATUS, + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, + 0x0000, 0x0000, &vub300->system_port_status, +- sizeof(vub300->system_port_status), HZ); ++ sizeof(vub300->system_port_status), 1000); + if (retval < 0) { + goto error4; + } else if (sizeof(vub300->system_port_status) == retval) { diff --git a/queue-4.4/net-lan78xx-fix-division-by-zero-in-send-path.patch b/queue-4.4/net-lan78xx-fix-division-by-zero-in-send-path.patch new file mode 100644 index 00000000000..e5752adf87a --- /dev/null +++ b/queue-4.4/net-lan78xx-fix-division-by-zero-in-send-path.patch @@ -0,0 +1,43 @@ +From db6c3c064f5d55fa9969f33eafca3cdbefbb3541 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 26 Oct 2021 12:36:17 +0200 +Subject: net: lan78xx: fix division by zero in send path + +From: Johan Hovold + +commit db6c3c064f5d55fa9969f33eafca3cdbefbb3541 upstream. + +Add the missing endpoint max-packet sanity check to probe() to avoid +division by zero in lan78xx_tx_bh() in case a malicious device has +broken descriptors (or when doing descriptor fuzz testing). + +Note that USB core will reject URBs submitted for endpoints with zero +wMaxPacketSize but that drivers doing packet-size calculations still +need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip +endpoint descriptors with maxpacket=0")). + +Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") +Cc: stable@vger.kernel.org # 4.3 +Cc: Woojung.Huh@microchip.com +Signed-off-by: Johan Hovold +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/lan78xx.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -2956,6 +2956,12 @@ static int lan78xx_probe(struct usb_inte + + dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out, 1); + ++ /* Reject broken descriptors. */ ++ if (dev->maxpacket == 0) { ++ ret = -ENODEV; ++ goto out3; ++ } ++ + /* driver requires remote-wakeup capability during autosuspend. */ + intf->needs_remote_wakeup = 1; + diff --git a/queue-4.4/series b/queue-4.4/series index 40d555eddae..4a7b39ba55d 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -7,3 +7,7 @@ usbnet-fix-error-return-code-in-usbnet_probe.patch ata-sata_mv-fix-the-error-handling-of-mv_chip_id.patch nfc-port100-fix-using-errno-as-command-type-mask.patch revert-net-mdiobus-fix-memory-leak-in-__mdiobus_register.patch +mmc-vub300-fix-control-message-timeouts.patch +mmc-dw_mmc-exynos-fix-the-finding-clock-sample-value.patch +mmc-sdhci-map-more-voltage-level-to-sdhci_power_330.patch +net-lan78xx-fix-division-by-zero-in-send-path.patch