Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichal Kubecek <mkubecek@suse.cz>2019-10-02 07:25:52 +0200
committerMichal Kubecek <mkubecek@suse.cz>2019-10-02 07:25:52 +0200
commitbc1a2defa2a40a15cbacfe8c18a5e6358b839526 (patch)
treee8e55d1bfe16d9cc4558661a9437d2ff5984de75
parente17daff334c3b2ebde0820713292b34f8aa4f330 (diff)
parent50acd22c9011516248d69ee8efea925de5e674d9 (diff)
Merge branch 'users/oneukum/SLE15-SP2/for-next' into SLE15-SP2
Pull USB and IPMI fixes from Oliver Neukum.
-rw-r--r--patches.suse/0001-b2c2-flexcop-usb-add-sanity-checking.patch33
-rw-r--r--patches.suse/0001-ipmi-move-message-error-checking-to-avoid-deadlock.patch194
-rw-r--r--patches.suse/0001-usb-dwc3-meson-g12a-fix-suspend-resume-regulator-unb.patch77
-rw-r--r--patches.suse/0001-usb-typec-tps6598x-Fix-build-error-without-CONFIG_RE.patch42
-rw-r--r--series.conf6
5 files changed, 352 insertions, 0 deletions
diff --git a/patches.suse/0001-b2c2-flexcop-usb-add-sanity-checking.patch b/patches.suse/0001-b2c2-flexcop-usb-add-sanity-checking.patch
new file mode 100644
index 0000000000..39680b0f14
--- /dev/null
+++ b/patches.suse/0001-b2c2-flexcop-usb-add-sanity-checking.patch
@@ -0,0 +1,33 @@
+From 182cbde95325d129b20a8b07f46af07affd19bb1 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Mon, 29 Jul 2019 16:21:11 +0200
+Subject: [PATCH] b2c2-flexcop-usb: add sanity checking
+References: bsc#1146540 CVE-2019-15291
+Patch-mainline: submitted https://www.mail-archive.com/linux-media@vger.kernel.org/msg148850.html
+
+The driver needs an isochronous endpoint to be present. It will
+oops in its absence. Add checking for it.
+
+Reported-by: syzbot+d93dff37e6a89431c158@syzkaller.appspotmail.com
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/media/usb/b2c2/flexcop-usb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/media/usb/b2c2/flexcop-usb.c b/drivers/media/usb/b2c2/flexcop-usb.c
+index 1826ff825c2e..1a801dc286f8 100644
+--- a/drivers/media/usb/b2c2/flexcop-usb.c
++++ b/drivers/media/usb/b2c2/flexcop-usb.c
+@@ -538,6 +538,9 @@ static int flexcop_usb_probe(struct usb_interface *intf,
+ struct flexcop_device *fc = NULL;
+ int ret;
+
++ if (intf->cur_altsetting->desc.bNumEndpoints < 1)
++ return -ENODEV;
++
+ if ((fc = flexcop_device_kmalloc(sizeof(struct flexcop_usb))) == NULL) {
+ err("out of memory\n");
+ return -ENOMEM;
+--
+2.16.4
+
diff --git a/patches.suse/0001-ipmi-move-message-error-checking-to-avoid-deadlock.patch b/patches.suse/0001-ipmi-move-message-error-checking-to-avoid-deadlock.patch
new file mode 100644
index 0000000000..f7bb204d5e
--- /dev/null
+++ b/patches.suse/0001-ipmi-move-message-error-checking-to-avoid-deadlock.patch
@@ -0,0 +1,194 @@
+From 383035211c79d4d98481a09ad429b31c7dbf22bd Mon Sep 17 00:00:00 2001
+From: Tony Camuso <tcamuso@redhat.com>
+Date: Thu, 22 Aug 2019 08:24:53 -0400
+Subject: [PATCH] ipmi: move message error checking to avoid deadlock
+Git-commit: 383035211c79d4d98481a09ad429b31c7dbf22bd
+Patch-mainline: v5.4-rc1
+References: bsc#1152489
+
+V1->V2: in handle_one_rcv_msg, if data_size > 2, set requeue to zero and
+ goto out instead of calling ipmi_free_msg.
+ Kosuke Tatsukawa <tatsu@ab.jp.nec.com>
+
+In the source stack trace below, function set_need_watch tries to
+take out the same si_lock that was taken earlier by ipmi_thread.
+
+ipmi_thread() [drivers/char/ipmi/ipmi_si_intf.c:995]
+ smi_event_handler() [drivers/char/ipmi/ipmi_si_intf.c:765]
+ handle_transaction_done() [drivers/char/ipmi/ipmi_si_intf.c:555]
+ deliver_recv_msg() [drivers/char/ipmi/ipmi_si_intf.c:283]
+ ipmi_smi_msg_received() [drivers/char/ipmi/ipmi_msghandler.c:4503]
+ intf_err_seq() [drivers/char/ipmi/ipmi_msghandler.c:1149]
+ smi_remove_watch() [drivers/char/ipmi/ipmi_msghandler.c:999]
+ set_need_watch() [drivers/char/ipmi/ipmi_si_intf.c:1066]
+
+Upstream commit e1891cffd4c4896a899337a243273f0e23c028df adds code to
+ipmi_smi_msg_received() to call smi_remove_watch() via intf_err_seq()
+and this seems to be causing the deadlock.
+
+commit e1891cffd4c4896a899337a243273f0e23c028df
+Author: Corey Minyard <cminyard@mvista.com>
+Date: Wed Oct 24 15:17:04 2018 -0500
+ ipmi: Make the smi watcher be disabled immediately when not needed
+
+The fix is to put all messages in the queue and move the message
+checking code out of ipmi_smi_msg_received and into handle_one_recv_msg,
+which processes the message checking after ipmi_thread releases its
+locks.
+
+Additionally,Kosuke Tatsukawa <tatsu@ab.jp.nec.com> reported that
+handle_new_recv_msgs calls ipmi_free_msg when handle_one_rcv_msg returns
+zero, so that the call to ipmi_free_msg in handle_one_rcv_msg introduced
+another panic when "ipmitool sensor list" was run in a loop. He
+submitted this part of the patch.
+
++free_msg:
++ requeue = 0;
++ goto out;
+
+Reported by: Osamu Samukawa <osa-samukawa@tg.jp.nec.com>
+Characterized by: Kosuke Tatsukawa <tatsu@ab.jp.nec.com>
+Signed-off-by: Tony Camuso <tcamuso@redhat.com>
+Fixes: e1891cffd4c4 ("ipmi: Make the smi watcher be disabled immediately when not needed")
+Cc: stable@vger.kernel.org # 5.1
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/char/ipmi/ipmi_msghandler.c | 114 ++++++++++++++++++------------------
+ 1 file changed, 57 insertions(+), 57 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
+index 3548aceed4a9..2aab80e19ae0 100644
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -4218,7 +4218,53 @@ static int handle_one_recv_msg(struct ipmi_smi *intf,
+ int chan;
+
+ ipmi_debug_msg("Recv:", msg->rsp, msg->rsp_size);
+- if (msg->rsp_size < 2) {
++
++ if ((msg->data_size >= 2)
++ && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
++ && (msg->data[1] == IPMI_SEND_MSG_CMD)
++ && (msg->user_data == NULL)) {
++
++ if (intf->in_shutdown)
++ goto free_msg;
++
++ /*
++ * This is the local response to a command send, start
++ * the timer for these. The user_data will not be
++ * NULL if this is a response send, and we will let
++ * response sends just go through.
++ */
++
++ /*
++ * Check for errors, if we get certain errors (ones
++ * that mean basically we can try again later), we
++ * ignore them and start the timer. Otherwise we
++ * report the error immediately.
++ */
++ if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
++ && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
++ && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)
++ && (msg->rsp[2] != IPMI_BUS_ERR)
++ && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) {
++ int ch = msg->rsp[3] & 0xf;
++ struct ipmi_channel *chans;
++
++ /* Got an error sending the message, handle it. */
++
++ chans = READ_ONCE(intf->channel_list)->c;
++ if ((chans[ch].medium == IPMI_CHANNEL_MEDIUM_8023LAN)
++ || (chans[ch].medium == IPMI_CHANNEL_MEDIUM_ASYNC))
++ ipmi_inc_stat(intf, sent_lan_command_errs);
++ else
++ ipmi_inc_stat(intf, sent_ipmb_command_errs);
++ intf_err_seq(intf, msg->msgid, msg->rsp[2]);
++ } else
++ /* The message was sent, start the timer. */
++ intf_start_seq_timer(intf, msg->msgid);
++free_msg:
++ requeue = 0;
++ goto out;
++
++ } else if (msg->rsp_size < 2) {
+ /* Message is too small to be correct. */
+ dev_warn(intf->si_dev,
+ "BMC returned too small a message for netfn %x cmd %x, got %d bytes\n",
+@@ -4475,62 +4521,16 @@ void ipmi_smi_msg_received(struct ipmi_smi *intf,
+ unsigned long flags = 0; /* keep us warning-free. */
+ int run_to_completion = intf->run_to_completion;
+
+- if ((msg->data_size >= 2)
+- && (msg->data[0] == (IPMI_NETFN_APP_REQUEST << 2))
+- && (msg->data[1] == IPMI_SEND_MSG_CMD)
+- && (msg->user_data == NULL)) {
+-
+- if (intf->in_shutdown)
+- goto free_msg;
+-
+- /*
+- * This is the local response to a command send, start
+- * the timer for these. The user_data will not be
+- * NULL if this is a response send, and we will let
+- * response sends just go through.
+- */
+-
+- /*
+- * Check for errors, if we get certain errors (ones
+- * that mean basically we can try again later), we
+- * ignore them and start the timer. Otherwise we
+- * report the error immediately.
+- */
+- if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
+- && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
+- && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)
+- && (msg->rsp[2] != IPMI_BUS_ERR)
+- && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR)) {
+- int ch = msg->rsp[3] & 0xf;
+- struct ipmi_channel *chans;
+-
+- /* Got an error sending the message, handle it. */
+-
+- chans = READ_ONCE(intf->channel_list)->c;
+- if ((chans[ch].medium == IPMI_CHANNEL_MEDIUM_8023LAN)
+- || (chans[ch].medium == IPMI_CHANNEL_MEDIUM_ASYNC))
+- ipmi_inc_stat(intf, sent_lan_command_errs);
+- else
+- ipmi_inc_stat(intf, sent_ipmb_command_errs);
+- intf_err_seq(intf, msg->msgid, msg->rsp[2]);
+- } else
+- /* The message was sent, start the timer. */
+- intf_start_seq_timer(intf, msg->msgid);
+-
+-free_msg:
+- ipmi_free_smi_msg(msg);
+- } else {
+- /*
+- * To preserve message order, we keep a queue and deliver from
+- * a tasklet.
+- */
+- if (!run_to_completion)
+- spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
+- list_add_tail(&msg->link, &intf->waiting_rcv_msgs);
+- if (!run_to_completion)
+- spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
+- flags);
+- }
++ /*
++ * To preserve message order, we keep a queue and deliver from
++ * a tasklet.
++ */
++ if (!run_to_completion)
++ spin_lock_irqsave(&intf->waiting_rcv_msgs_lock, flags);
++ list_add_tail(&msg->link, &intf->waiting_rcv_msgs);
++ if (!run_to_completion)
++ spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
++ flags);
+
+ if (!run_to_completion)
+ spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
+--
+2.16.4
+
diff --git a/patches.suse/0001-usb-dwc3-meson-g12a-fix-suspend-resume-regulator-unb.patch b/patches.suse/0001-usb-dwc3-meson-g12a-fix-suspend-resume-regulator-unb.patch
new file mode 100644
index 0000000000..f8b1d620ac
--- /dev/null
+++ b/patches.suse/0001-usb-dwc3-meson-g12a-fix-suspend-resume-regulator-unb.patch
@@ -0,0 +1,77 @@
+From 1cf084d161f40baf4aa6976bb2dcef114adbebd6 Mon Sep 17 00:00:00 2001
+From: Neil Armstrong <narmstrong@baylibre.com>
+Date: Wed, 21 Aug 2019 15:35:18 +0200
+Subject: [PATCH] usb: dwc3: meson-g12a: fix suspend resume regulator
+ unbalanced disables
+Git-commit: 1cf084d161f40baf4aa6976bb2dcef114adbebd6
+Patch-mainline: v5.4-rc1
+References: bsc#1152489
+
+When going in suspend, in Device mode, then resuming back leads
+to the following:
+
+unbalanced disables for USB_PWR_EN
+WARNING: CPU: 0 PID: 163 at ../drivers/regulator/core.c:2590 _regulator_disable+0x104/0x180
+Hardware name: Amlogic Meson G12A U200 Development Board (DT)
+[...]
+pc : _regulator_disable+0x104/0x180
+lr : _regulator_disable+0x104/0x180
+[...]
+Call trace:
+ _regulator_disable+0x104/0x180
+ regulator_disable+0x40/0x78
+ dwc3_meson_g12a_otg_mode_set+0x84/0xb0
+ dwc3_meson_g12a_irq_thread+0x58/0xb8
+ irq_thread_fn+0x28/0x80
+ irq_thread+0x118/0x1b8
+ kthread+0xf4/0x120
+ ret_from_fork+0x10/0x18
+
+This disables the regulator if enabled on suspend, and the reverse on
+resume.
+
+Fixes: c99993376f72 ("usb: dwc3: Add Amlogic G12A DWC3 glue")
+Tested-by: Kevin Hilman <khilman@baylibre.com>
+Reported-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/usb/dwc3/dwc3-meson-g12a.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-meson-g12a.c b/drivers/usb/dwc3/dwc3-meson-g12a.c
+index d73ccd9e1366..8a3ec1a951fe 100644
+--- a/drivers/usb/dwc3/dwc3-meson-g12a.c
++++ b/drivers/usb/dwc3/dwc3-meson-g12a.c
+@@ -562,7 +562,13 @@ static int __maybe_unused dwc3_meson_g12a_runtime_resume(struct device *dev)
+ static int __maybe_unused dwc3_meson_g12a_suspend(struct device *dev)
+ {
+ struct dwc3_meson_g12a *priv = dev_get_drvdata(dev);
+- int i;
++ int i, ret;
++
++ if (priv->vbus && priv->otg_phy_mode == PHY_MODE_USB_HOST) {
++ ret = regulator_disable(priv->vbus);
++ if (ret)
++ return ret;
++ }
+
+ for (i = 0 ; i < PHY_COUNT ; ++i) {
+ phy_power_off(priv->phys[i]);
+@@ -597,6 +603,12 @@ static int __maybe_unused dwc3_meson_g12a_resume(struct device *dev)
+ return ret;
+ }
+
++ if (priv->vbus && priv->otg_phy_mode == PHY_MODE_USB_HOST) {
++ ret = regulator_enable(priv->vbus);
++ if (ret)
++ return ret;
++ }
++
+ return 0;
+ }
+
+--
+2.16.4
+
diff --git a/patches.suse/0001-usb-typec-tps6598x-Fix-build-error-without-CONFIG_RE.patch b/patches.suse/0001-usb-typec-tps6598x-Fix-build-error-without-CONFIG_RE.patch
new file mode 100644
index 0000000000..93ec81b86c
--- /dev/null
+++ b/patches.suse/0001-usb-typec-tps6598x-Fix-build-error-without-CONFIG_RE.patch
@@ -0,0 +1,42 @@
+From 35af2445dc306403254a181507b390ec9eb725d5 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Tue, 3 Sep 2019 20:10:26 +0800
+Subject: [PATCH] usb: typec: tps6598x: Fix build error without
+ CONFIG_REGMAP_I2C
+Git-commit: 35af2445dc306403254a181507b390ec9eb725d5
+Patch-mainline: v5.4-rc1
+References: bsc#1152489
+
+If CONFIG_REGMAP_I2C is not set, building fails:
+
+drivers/usb/typec/tps6598x.o: In function `tps6598x_probe':
+tps6598x.c:(.text+0x5f0): undefined reference to `__devm_regmap_init_i2c'
+
+Select REGMAP_I2C to fix this.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20190903121026.22148-1-yuehaibing@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/usb/typec/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/typec/Kconfig b/drivers/usb/typec/Kconfig
+index 89d9193bd1cf..895e2418de53 100644
+--- a/drivers/usb/typec/Kconfig
++++ b/drivers/usb/typec/Kconfig
+@@ -53,6 +53,7 @@ source "drivers/usb/typec/ucsi/Kconfig"
+ config TYPEC_TPS6598X
+ tristate "TI TPS6598x USB Power Delivery controller driver"
+ depends on I2C
++ select REGMAP_I2C
+ help
+ Say Y or M here if your system has TI TPS65982 or TPS65983 USB Power
+ Delivery controller.
+--
+2.16.4
+
diff --git a/series.conf b/series.conf
index 64709125f3..5d977c650f 100644
--- a/series.conf
+++ b/series.conf
@@ -77,6 +77,8 @@
patches.suse/powerpc-xive-Implement-get_irqchip_state-method-for-.patch
patches.suse/KVM-PPC-Book3S-HV-Check-for-MMU-ready-on-piggybacked.patch
patches.suse/KVM-PPC-Book3S-HV-Don-t-lose-pending-doorbell-reques.patch
+ patches.suse/0001-usb-dwc3-meson-g12a-fix-suspend-resume-regulator-unb.patch
+ patches.suse/0001-usb-typec-tps6598x-Fix-build-error-without-CONFIG_RE.patch
patches.suse/USB-usbcore-Fix-slab-out-of-bounds-bug-during-device.patch
patches.suse/tty-serial-atmel-reschedule-TX-after-RX-was-started.patch
patches.suse/serial-sprd-correct-the-wrong-sequence-of-arguments.patch
@@ -92,6 +94,7 @@
patches.suse/net-stmmac-Hold-rtnl-lock-in-suspend-resume-callback.patch
patches.suse/xen-netfront-do-not-assume-sk_buff_head-list-is-empt.patch
patches.suse/ovl-fix-regression-caused-by-overlapping-layers-dete.patch
+ patches.suse/0001-ipmi-move-message-error-checking-to-avoid-deadlock.patch
patches.suse/0001-drm-lima-Mark-64-bit-number-as-ULL.patch
patches.suse/0002-drm-lima-Reduce-the-amount-of-logs-on-deferred-probe.patch
patches.suse/0004-drm-panel-make-drm_panel.h-self-contained.patch
@@ -204,6 +207,9 @@
patches.suse/0001-video-backlight-Drop-default-m-for-LCD-BACKLIGHT_CLA.patch
patches.suse/0004-drm-amdgpu-Fix-KFD-related-kernel-oops-on-Hawaii.patch
+ # out-of-tree patches
+ patches.suse/0001-b2c2-flexcop-usb-add-sanity-checking.patch
+
########################################################
# end of sorted patches
########################################################