diff --git a/device/testing/linux-postmarketos-qcom-msm8939/0001-USB-gadget-detect-too-big-endpoint-0-requests.patch b/device/testing/linux-postmarketos-qcom-msm8939/0001-USB-gadget-detect-too-big-endpoint-0-requests.patch new file mode 100644 index 000000000..bbc0e9e0b --- /dev/null +++ b/device/testing/linux-postmarketos-qcom-msm8939/0001-USB-gadget-detect-too-big-endpoint-0-requests.patch @@ -0,0 +1,111 @@ +From 1aecf197f858d8d09f9527676f62d8fb858cfac0 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Thu, 9 Dec 2021 18:59:27 +0100 +Subject: [PATCH] USB: gadget: detect too-big endpoint 0 requests + +commit 153a2d7e3350cc89d406ba2d35be8793a64c2038 upstream. + +Sometimes USB hosts can ask for buffers that are too large from endpoint +0, which should not be allowed. If this happens for OUT requests, stall +the endpoint, but for IN requests, trim the request size to the endpoint +buffer size. + +Co-developed-by: Szymon Heidrich +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/composite.c | 12 ++++++++++++ + drivers/usb/gadget/legacy/dbgp.c | 13 +++++++++++++ + drivers/usb/gadget/legacy/inode.c | 16 +++++++++++++++- + 3 files changed, 40 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c +index 504c1cbc2..1ef7922b5 100644 +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -1679,6 +1679,18 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) + struct usb_function *f = NULL; + u8 endp; + ++ if (w_length > USB_COMP_EP0_BUFSIZ) { ++ if (ctrl->bRequestType == USB_DIR_OUT) { ++ goto done; ++ } else { ++ /* Cast away the const, we are going to overwrite on purpose. */ ++ __le16 *temp = (__le16 *)&ctrl->wLength; ++ ++ *temp = cpu_to_le16(USB_COMP_EP0_BUFSIZ); ++ w_length = USB_COMP_EP0_BUFSIZ; ++ } ++ } ++ + /* partial re-init of the response message; the function or the + * gadget might need to intercept e.g. a control-OUT completion + * when we delegate to it. +diff --git a/drivers/usb/gadget/legacy/dbgp.c b/drivers/usb/gadget/legacy/dbgp.c +index e1d566c99..e567afcb2 100644 +--- a/drivers/usb/gadget/legacy/dbgp.c ++++ b/drivers/usb/gadget/legacy/dbgp.c +@@ -345,6 +345,19 @@ static int dbgp_setup(struct usb_gadget *gadget, + void *data = NULL; + u16 len = 0; + ++ if (length > DBGP_REQ_LEN) { ++ if (ctrl->bRequestType == USB_DIR_OUT) { ++ return err; ++ } else { ++ /* Cast away the const, we are going to overwrite on purpose. */ ++ __le16 *temp = (__le16 *)&ctrl->wLength; ++ ++ *temp = cpu_to_le16(DBGP_REQ_LEN); ++ length = DBGP_REQ_LEN; ++ } ++ } ++ ++ + if (request == USB_REQ_GET_DESCRIPTOR) { + switch (value>>8) { + case USB_DT_DEVICE: +diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c +index 539220d7f..0a4041552 100644 +--- a/drivers/usb/gadget/legacy/inode.c ++++ b/drivers/usb/gadget/legacy/inode.c +@@ -110,6 +110,8 @@ enum ep0_state { + /* enough for the whole queue: most events invalidate others */ + #define N_EVENT 5 + ++#define RBUF_SIZE 256 ++ + struct dev_data { + spinlock_t lock; + refcount_t count; +@@ -144,7 +146,7 @@ struct dev_data { + struct dentry *dentry; + + /* except this scratch i/o buffer for ep0 */ +- u8 rbuf [256]; ++ u8 rbuf[RBUF_SIZE]; + }; + + static inline void get_dev (struct dev_data *data) +@@ -1334,6 +1336,18 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) + u16 w_value = le16_to_cpu(ctrl->wValue); + u16 w_length = le16_to_cpu(ctrl->wLength); + ++ if (w_length > RBUF_SIZE) { ++ if (ctrl->bRequestType == USB_DIR_OUT) { ++ return value; ++ } else { ++ /* Cast away the const, we are going to overwrite on purpose. */ ++ __le16 *temp = (__le16 *)&ctrl->wLength; ++ ++ *temp = cpu_to_le16(RBUF_SIZE); ++ w_length = RBUF_SIZE; ++ } ++ } ++ + spin_lock (&dev->lock); + dev->setup_abort = 0; + if (dev->state == STATE_DEV_UNCONNECTED) { +-- +2.54.0 + diff --git a/device/testing/linux-postmarketos-qcom-msm8939/0002-USB-gadget-zero-allocate-endpoint-0-buffers.patch b/device/testing/linux-postmarketos-qcom-msm8939/0002-USB-gadget-zero-allocate-endpoint-0-buffers.patch new file mode 100644 index 000000000..d48e24470 --- /dev/null +++ b/device/testing/linux-postmarketos-qcom-msm8939/0002-USB-gadget-zero-allocate-endpoint-0-buffers.patch @@ -0,0 +1,48 @@ +From 9aaf4d8e2c87a5c4620085926428b5b62cf7fec8 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Thu, 9 Dec 2021 19:02:15 +0100 +Subject: [PATCH] USB: gadget: zero allocate endpoint 0 buffers + +commit 86ebbc11bb3f60908a51f3e41a17e3f477c2eaa3 upstream. + +Under some conditions, USB gadget devices can show allocated buffer +contents to a host. Fix this up by zero-allocating them so that any +extra data will all just be zeros. + +Reported-by: Szymon Heidrich +Tested-by: Szymon Heidrich +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/composite.c | 2 +- + drivers/usb/gadget/legacy/dbgp.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c +index 1ef7922b5..284eea9f6 100644 +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -2221,7 +2221,7 @@ int composite_dev_prepare(struct usb_composite_driver *composite, + if (!cdev->req) + return -ENOMEM; + +- cdev->req->buf = kmalloc(USB_COMP_EP0_BUFSIZ, GFP_KERNEL); ++ cdev->req->buf = kzalloc(USB_COMP_EP0_BUFSIZ, GFP_KERNEL); + if (!cdev->req->buf) + goto fail; + +diff --git a/drivers/usb/gadget/legacy/dbgp.c b/drivers/usb/gadget/legacy/dbgp.c +index e567afcb2..355bc7dab 100644 +--- a/drivers/usb/gadget/legacy/dbgp.c ++++ b/drivers/usb/gadget/legacy/dbgp.c +@@ -137,7 +137,7 @@ static int dbgp_enable_ep_req(struct usb_ep *ep) + goto fail_1; + } + +- req->buf = kmalloc(DBGP_REQ_LEN, GFP_KERNEL); ++ req->buf = kzalloc(DBGP_REQ_LEN, GFP_KERNEL); + if (!req->buf) { + err = -ENOMEM; + stp = 2; +-- +2.54.0 + diff --git a/device/testing/linux-postmarketos-qcom-msm8939/APKBUILD b/device/testing/linux-postmarketos-qcom-msm8939/APKBUILD index 8515ea1d7..9643948cb 100644 --- a/device/testing/linux-postmarketos-qcom-msm8939/APKBUILD +++ b/device/testing/linux-postmarketos-qcom-msm8939/APKBUILD @@ -4,7 +4,7 @@ maintainer="Newbyte " _flavor="postmarketos-qcom-msm8939" pkgname=linux-$_flavor pkgver=5.15_git20220114 -pkgrel=2 +pkgrel=3 pkgdesc="Mainline kernel fork for Qualcomm MSM8939 devices" arch="aarch64" _carch="arm64" @@ -33,8 +33,8 @@ _tag="5.15-v1" _config="config-$_flavor.$arch" source=" $pkgname-$_tag.tar.gz::$url/-/archive/$_tag/linux-$_tag.tar.gz - 36dfdf11af49d3c009c711fb16f5c6e7a274505d.patch::https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/patch/?id=36dfdf11af49d3c009c711fb16f5c6e7a274505d - 6eea4ace62fa6414432692ee44f0c0a3d541d97a.patch::https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/patch/?id=6eea4ace62fa6414432692ee44f0c0a3d541d97a + 0001-USB-gadget-detect-too-big-endpoint-0-requests.patch + 0002-USB-gadget-zero-allocate-endpoint-0-buffers.patch $_config " builddir="$srcdir/$_repository-$_tag" @@ -55,9 +55,10 @@ package() { make zinstall modules_install dtbs_install \ ARCH="$_carch" \ INSTALL_PATH="$pkgdir"/boot \ - INSTALL_MOD_PATH="$pkgdir" \ + INSTALL_MOD_PATH="$pkgdir"/usr \ INSTALL_MOD_STRIP=1 \ - INSTALL_DTBS_PATH="$pkgdir"/boot/dtbs + INSTALL_DTBS_PATH="$pkgdir"/boot/dtbs \ + V=1 rm -f "$pkgdir"/lib/modules/*/build "$pkgdir"/lib/modules/*/source install -D "$builddir"/include/config/kernel.release \ @@ -65,7 +66,7 @@ package() { } sha512sums=" 9bd3481d6c9ecc213e9fa37b88366130b8b74b2eaa8625294031ee883232e5e20b3b47053dad8642eeb8fb1bad79cb70232ba6be46476fb2b81ee1576890b5a8 linux-postmarketos-qcom-msm8939-5.15-v1.tar.gz -c2f8cd37d3b25eafde1fbb1ceecec6bcf49b76e8e1a3dce05686acf05f632cec6d7a49ae4ccb56df75cd65b2f741a44d52d5e8890fd977def1df8c06fa42ca27 36dfdf11af49d3c009c711fb16f5c6e7a274505d.patch -e542ad376c7c6cffbae640c04eae57240b2f60616c3ae19f0e4e9f38d8eabbe297c7caa5fc1b5f3f55291f71f727974f7f0c09c476a4869ccf6f483eb17871b2 6eea4ace62fa6414432692ee44f0c0a3d541d97a.patch +07819b7fbbff495aeb43816afe4121491a15cadda9d107ceabf089d17c71dc25b2ad049d85904859a798288192587747d43a7d0273282f6d7387ceb7a1265418 0001-USB-gadget-detect-too-big-endpoint-0-requests.patch +4fa5e6b6c6f8cb54438fe5cd90b686e8ee4dfb632a4578d0166818bd370c76524dbeaf206e2be1edf3cb084ca896e09770775791c350d12aec57bd4838f1e814 0002-USB-gadget-zero-allocate-endpoint-0-buffers.patch 9ee8133743394f48a91d2871c67816d5f2968dc4b8b3a4d238a5d56e86afa74151b23b02fdf88845eb33da913c97db4da1d547f30d835ae5556e54af14d58cf3 config-postmarketos-qcom-msm8939.aarch64 "