diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-05-12 12:41:06 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-05-12 12:41:06 +0200 |
| commit | e53f8367b3f5b00edbcc234b7f67103aed1b11b3 (patch) | |
| tree | 87073a33e71106b5e7f58e9a9df3bd31a8a49fa3 | |
| parent | 2e563631f104181a9658937400cb4d491ed69a94 (diff) | |
| download | stable-queue-e53f8367b3f5b00edbcc234b7f67103aed1b11b3.tar.gz | |
6.14-stable patches
added patches:
usb-misc-onboard_usb_dev-fix-support-for-cypress-hx3-hubs.patch
usb-typec-tcpm-delay-snk_try_wait_debounce-to-src_trywait-transition.patch
usb-typec-ucsi-displayport-fix-deadlock.patch
usb-typec-ucsi-displayport-fix-null-pointer-access.patch
usb-usbtmc-fix-erroneous-generic_read-ioctl-return.patch
usb-usbtmc-fix-erroneous-get_stb-ioctl-error-returns.patch
usb-usbtmc-fix-erroneous-wait_srq-ioctl-return.patch
usb-usbtmc-use-interruptible-sleep-in-usbtmc_read.patch
9 files changed, 554 insertions, 0 deletions
diff --git a/queue-6.14/series b/queue-6.14/series index 6b284e6a16c..b8cd6a14bc0 100644 --- a/queue-6.14/series +++ b/queue-6.14/series @@ -138,3 +138,11 @@ usb-gadget-f_ecm-add-get_status-callback.patch usb-gadget-tegra-xudc-ack-st_rc-after-clearing-ctrl_run.patch usb-gadget-use-get_status-callback-to-set-remote-wakeup-capability.patch usb-host-tegra-prevent-host-controller-crash-when-otg-port-is-used.patch +usb-misc-onboard_usb_dev-fix-support-for-cypress-hx3-hubs.patch +usb-typec-tcpm-delay-snk_try_wait_debounce-to-src_trywait-transition.patch +usb-typec-ucsi-displayport-fix-deadlock.patch +usb-typec-ucsi-displayport-fix-null-pointer-access.patch +usb-usbtmc-use-interruptible-sleep-in-usbtmc_read.patch +usb-usbtmc-fix-erroneous-get_stb-ioctl-error-returns.patch +usb-usbtmc-fix-erroneous-wait_srq-ioctl-return.patch +usb-usbtmc-fix-erroneous-generic_read-ioctl-return.patch diff --git a/queue-6.14/usb-misc-onboard_usb_dev-fix-support-for-cypress-hx3-hubs.patch b/queue-6.14/usb-misc-onboard_usb_dev-fix-support-for-cypress-hx3-hubs.patch new file mode 100644 index 00000000000..30887c5788b --- /dev/null +++ b/queue-6.14/usb-misc-onboard_usb_dev-fix-support-for-cypress-hx3-hubs.patch @@ -0,0 +1,55 @@ +From 9f657a92805cfc98e11cf5da9e8f4e02ecff2260 Mon Sep 17 00:00:00 2001 +From: Lukasz Czechowski <lukasz.czechowski@thaumatec.com> +Date: Fri, 25 Apr 2025 17:18:06 +0200 +Subject: usb: misc: onboard_usb_dev: fix support for Cypress HX3 hubs + +From: Lukasz Czechowski <lukasz.czechowski@thaumatec.com> + +commit 9f657a92805cfc98e11cf5da9e8f4e02ecff2260 upstream. + +The Cypress HX3 USB3.0 hubs use different PID values depending +on the product variant. The comment in compatibles table is +misleading, as the currently used PIDs (0x6504 and 0x6506 for +USB 3.0 and USB 2.0, respectively) are defaults for the CYUSB331x, +while CYUSB330x and CYUSB332x variants use different values. +Based on the datasheet [1], update the compatible usb devices table +to handle different types of the hub. +The change also includes vendor mode PIDs, which are used by the +hub in I2C Master boot mode, if connected EEPROM contains invalid +signature or is blank. This allows to correctly boot the hub even +if the EEPROM will have broken content. +Number of vcc supplies and timing requirements are the same for all +HX variants, so the platform driver's match table does not have to +be extended. + +[1] https://www.infineon.com/dgdl/Infineon-HX3_USB_3_0_Hub_Consumer_Industrial-DataSheet-v22_00-EN.pdf?fileId=8ac78c8c7d0d8da4017d0ecb53f644b8 + Table 9. PID Values + +Fixes: b43cd82a1a40 ("usb: misc: onboard-hub: add support for Cypress HX3 USB 3.0 family") +Cc: stable <stable@kernel.org> +Signed-off-by: Lukasz Czechowski <lukasz.czechowski@thaumatec.com> +Link: https://lore.kernel.org/r/20250425-onboard_usb_dev-v2-1-4a76a474a010@thaumatec.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/usb/misc/onboard_usb_dev.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/usb/misc/onboard_usb_dev.c ++++ b/drivers/usb/misc/onboard_usb_dev.c +@@ -569,8 +569,14 @@ static void onboard_dev_usbdev_disconnec + } + + static const struct usb_device_id onboard_dev_id_table[] = { +- { USB_DEVICE(VENDOR_ID_CYPRESS, 0x6504) }, /* CYUSB33{0,1,2}x/CYUSB230x 3.0 HUB */ +- { USB_DEVICE(VENDOR_ID_CYPRESS, 0x6506) }, /* CYUSB33{0,1,2}x/CYUSB230x 2.0 HUB */ ++ { USB_DEVICE(VENDOR_ID_CYPRESS, 0x6500) }, /* CYUSB330x 3.0 HUB */ ++ { USB_DEVICE(VENDOR_ID_CYPRESS, 0x6502) }, /* CYUSB330x 2.0 HUB */ ++ { USB_DEVICE(VENDOR_ID_CYPRESS, 0x6503) }, /* CYUSB33{0,1}x 2.0 HUB, Vendor Mode */ ++ { USB_DEVICE(VENDOR_ID_CYPRESS, 0x6504) }, /* CYUSB331x 3.0 HUB */ ++ { USB_DEVICE(VENDOR_ID_CYPRESS, 0x6506) }, /* CYUSB331x 2.0 HUB */ ++ { USB_DEVICE(VENDOR_ID_CYPRESS, 0x6507) }, /* CYUSB332x 2.0 HUB, Vendor Mode */ ++ { USB_DEVICE(VENDOR_ID_CYPRESS, 0x6508) }, /* CYUSB332x 3.0 HUB */ ++ { USB_DEVICE(VENDOR_ID_CYPRESS, 0x650a) }, /* CYUSB332x 2.0 HUB */ + { USB_DEVICE(VENDOR_ID_CYPRESS, 0x6570) }, /* CY7C6563x 2.0 HUB */ + { USB_DEVICE(VENDOR_ID_GENESYS, 0x0608) }, /* Genesys Logic GL850G USB 2.0 HUB */ + { USB_DEVICE(VENDOR_ID_GENESYS, 0x0610) }, /* Genesys Logic GL852G USB 2.0 HUB */ diff --git a/queue-6.14/usb-typec-tcpm-delay-snk_try_wait_debounce-to-src_trywait-transition.patch b/queue-6.14/usb-typec-tcpm-delay-snk_try_wait_debounce-to-src_trywait-transition.patch new file mode 100644 index 00000000000..449f72010be --- /dev/null +++ b/queue-6.14/usb-typec-tcpm-delay-snk_try_wait_debounce-to-src_trywait-transition.patch @@ -0,0 +1,44 @@ +From e918d3959b5ae0e793b8f815ce62240e10ba03a4 Mon Sep 17 00:00:00 2001 +From: RD Babiera <rdbabiera@google.com> +Date: Tue, 29 Apr 2025 23:47:01 +0000 +Subject: usb: typec: tcpm: delay SNK_TRY_WAIT_DEBOUNCE to SRC_TRYWAIT transition + +From: RD Babiera <rdbabiera@google.com> + +commit e918d3959b5ae0e793b8f815ce62240e10ba03a4 upstream. + +This patch fixes Type-C Compliance Test TD 4.7.6 - Try.SNK DRP Connect +SNKAS. + +The compliance tester moves into SNK_UNATTACHED during toggling and +expects the PUT to apply Rp after tPDDebounce of detection. If the port +is in SNK_TRY_WAIT_DEBOUNCE, it will move into SRC_TRYWAIT immediately +and apply Rp. This violates TD 4.7.5.V.3, where the tester confirms that +the PUT attaches Rp after the transitions to Unattached.SNK for +tPDDebounce. + +Change the tcpm_set_state delay between SNK_TRY_WAIT_DEBOUNCE and +SRC_TRYWAIT to tPDDebounce. + +Fixes: a0a3e04e6b2c ("staging: typec: tcpm: Check for Rp for tPDDebounce") +Cc: stable <stable@kernel.org> +Signed-off-by: RD Babiera <rdbabiera@google.com> +Reviewed-by: Badhri Jagan Sridharan <badhri@google.com> +Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> +Link: https://lore.kernel.org/r/20250429234703.3748506-2-rdbabiera@google.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/usb/typec/tcpm/tcpm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/usb/typec/tcpm/tcpm.c ++++ b/drivers/usb/typec/tcpm/tcpm.c +@@ -5965,7 +5965,7 @@ static void _tcpm_cc_change(struct tcpm_ + case SNK_TRY_WAIT_DEBOUNCE: + if (!tcpm_port_is_sink(port)) { + port->max_wait = 0; +- tcpm_set_state(port, SRC_TRYWAIT, 0); ++ tcpm_set_state(port, SRC_TRYWAIT, PD_T_PD_DEBOUNCE); + } + break; + case SRC_TRY_WAIT: diff --git a/queue-6.14/usb-typec-ucsi-displayport-fix-deadlock.patch b/queue-6.14/usb-typec-ucsi-displayport-fix-deadlock.patch new file mode 100644 index 00000000000..d39e0478289 --- /dev/null +++ b/queue-6.14/usb-typec-ucsi-displayport-fix-deadlock.patch @@ -0,0 +1,156 @@ +From 364618c89d4c57c85e5fc51a2446cd939bf57802 Mon Sep 17 00:00:00 2001 +From: Andrei Kuchynski <akuchynski@chromium.org> +Date: Thu, 24 Apr 2025 08:44:28 +0000 +Subject: usb: typec: ucsi: displayport: Fix deadlock + +From: Andrei Kuchynski <akuchynski@chromium.org> + +commit 364618c89d4c57c85e5fc51a2446cd939bf57802 upstream. + +This patch introduces the ucsi_con_mutex_lock / ucsi_con_mutex_unlock +functions to the UCSI driver. ucsi_con_mutex_lock ensures the connector +mutex is only locked if a connection is established and the partner pointer +is valid. This resolves a deadlock scenario where +ucsi_displayport_remove_partner holds con->mutex waiting for +dp_altmode_work to complete while dp_altmode_work attempts to acquire it. + +Cc: stable <stable@kernel.org> +Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode") +Signed-off-by: Andrei Kuchynski <akuchynski@chromium.org> +Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> +Link: https://lore.kernel.org/r/20250424084429.3220757-2-akuchynski@chromium.org +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/usb/typec/ucsi/displayport.c | 19 +++++++++++-------- + drivers/usb/typec/ucsi/ucsi.c | 34 ++++++++++++++++++++++++++++++++++ + drivers/usb/typec/ucsi/ucsi.h | 2 ++ + 3 files changed, 47 insertions(+), 8 deletions(-) + +--- a/drivers/usb/typec/ucsi/displayport.c ++++ b/drivers/usb/typec/ucsi/displayport.c +@@ -54,7 +54,8 @@ static int ucsi_displayport_enter(struct + u8 cur = 0; + int ret; + +- mutex_lock(&dp->con->lock); ++ if (!ucsi_con_mutex_lock(dp->con)) ++ return -ENOTCONN; + + if (!dp->override && dp->initialized) { + const struct typec_altmode *p = typec_altmode_get_partner(alt); +@@ -100,7 +101,7 @@ static int ucsi_displayport_enter(struct + schedule_work(&dp->work); + ret = 0; + err_unlock: +- mutex_unlock(&dp->con->lock); ++ ucsi_con_mutex_unlock(dp->con); + + return ret; + } +@@ -112,7 +113,8 @@ static int ucsi_displayport_exit(struct + u64 command; + int ret = 0; + +- mutex_lock(&dp->con->lock); ++ if (!ucsi_con_mutex_lock(dp->con)) ++ return -ENOTCONN; + + if (!dp->override) { + const struct typec_altmode *p = typec_altmode_get_partner(alt); +@@ -144,7 +146,7 @@ static int ucsi_displayport_exit(struct + schedule_work(&dp->work); + + out_unlock: +- mutex_unlock(&dp->con->lock); ++ ucsi_con_mutex_unlock(dp->con); + + return ret; + } +@@ -202,20 +204,21 @@ static int ucsi_displayport_vdm(struct t + int cmd = PD_VDO_CMD(header); + int svdm_version; + +- mutex_lock(&dp->con->lock); ++ if (!ucsi_con_mutex_lock(dp->con)) ++ return -ENOTCONN; + + if (!dp->override && dp->initialized) { + const struct typec_altmode *p = typec_altmode_get_partner(alt); + + dev_warn(&p->dev, + "firmware doesn't support alternate mode overriding\n"); +- mutex_unlock(&dp->con->lock); ++ ucsi_con_mutex_unlock(dp->con); + return -EOPNOTSUPP; + } + + svdm_version = typec_altmode_get_svdm_version(alt); + if (svdm_version < 0) { +- mutex_unlock(&dp->con->lock); ++ ucsi_con_mutex_unlock(dp->con); + return svdm_version; + } + +@@ -259,7 +262,7 @@ static int ucsi_displayport_vdm(struct t + break; + } + +- mutex_unlock(&dp->con->lock); ++ ucsi_con_mutex_unlock(dp->con); + + return 0; + } +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -1923,6 +1923,40 @@ void ucsi_set_drvdata(struct ucsi *ucsi, + EXPORT_SYMBOL_GPL(ucsi_set_drvdata); + + /** ++ * ucsi_con_mutex_lock - Acquire the connector mutex ++ * @con: The connector interface to lock ++ * ++ * Returns true on success, false if the connector is disconnected ++ */ ++bool ucsi_con_mutex_lock(struct ucsi_connector *con) ++{ ++ bool mutex_locked = false; ++ bool connected = true; ++ ++ while (connected && !mutex_locked) { ++ mutex_locked = mutex_trylock(&con->lock) != 0; ++ connected = UCSI_CONSTAT(con, CONNECTED); ++ if (connected && !mutex_locked) ++ msleep(20); ++ } ++ ++ connected = connected && con->partner; ++ if (!connected && mutex_locked) ++ mutex_unlock(&con->lock); ++ ++ return connected; ++} ++ ++/** ++ * ucsi_con_mutex_unlock - Release the connector mutex ++ * @con: The connector interface to unlock ++ */ ++void ucsi_con_mutex_unlock(struct ucsi_connector *con) ++{ ++ mutex_unlock(&con->lock); ++} ++ ++/** + * ucsi_create - Allocate UCSI instance + * @dev: Device interface to the PPM (Platform Policy Manager) + * @ops: I/O routines +--- a/drivers/usb/typec/ucsi/ucsi.h ++++ b/drivers/usb/typec/ucsi/ucsi.h +@@ -94,6 +94,8 @@ int ucsi_register(struct ucsi *ucsi); + void ucsi_unregister(struct ucsi *ucsi); + void *ucsi_get_drvdata(struct ucsi *ucsi); + void ucsi_set_drvdata(struct ucsi *ucsi, void *data); ++bool ucsi_con_mutex_lock(struct ucsi_connector *con); ++void ucsi_con_mutex_unlock(struct ucsi_connector *con); + + void ucsi_connector_change(struct ucsi *ucsi, u8 num); + diff --git a/queue-6.14/usb-typec-ucsi-displayport-fix-null-pointer-access.patch b/queue-6.14/usb-typec-ucsi-displayport-fix-null-pointer-access.patch new file mode 100644 index 00000000000..ac7dce571c8 --- /dev/null +++ b/queue-6.14/usb-typec-ucsi-displayport-fix-null-pointer-access.patch @@ -0,0 +1,35 @@ +From 312d79669e71283d05c05cc49a1a31e59e3d9e0e Mon Sep 17 00:00:00 2001 +From: Andrei Kuchynski <akuchynski@chromium.org> +Date: Thu, 24 Apr 2025 08:44:29 +0000 +Subject: usb: typec: ucsi: displayport: Fix NULL pointer access + +From: Andrei Kuchynski <akuchynski@chromium.org> + +commit 312d79669e71283d05c05cc49a1a31e59e3d9e0e upstream. + +This patch ensures that the UCSI driver waits for all pending tasks in the +ucsi_displayport_work workqueue to finish executing before proceeding with +the partner removal. + +Cc: stable <stable@kernel.org> +Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode") +Signed-off-by: Andrei Kuchynski <akuchynski@chromium.org> +Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> +Reviewed-by: Benson Leung <bleung@chromium.org> +Link: https://lore.kernel.org/r/20250424084429.3220757-3-akuchynski@chromium.org +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/usb/typec/ucsi/displayport.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/typec/ucsi/displayport.c ++++ b/drivers/usb/typec/ucsi/displayport.c +@@ -299,6 +299,8 @@ void ucsi_displayport_remove_partner(str + if (!dp) + return; + ++ cancel_work_sync(&dp->work); ++ + dp->data.conf = 0; + dp->data.status = 0; + dp->initialized = false; diff --git a/queue-6.14/usb-usbtmc-fix-erroneous-generic_read-ioctl-return.patch b/queue-6.14/usb-usbtmc-fix-erroneous-generic_read-ioctl-return.patch new file mode 100644 index 00000000000..5a3bcd1b24c --- /dev/null +++ b/queue-6.14/usb-usbtmc-fix-erroneous-generic_read-ioctl-return.patch @@ -0,0 +1,66 @@ +From 4e77d3ec7c7c0d9535ccf1138827cb9bb5480b9b Mon Sep 17 00:00:00 2001 +From: Dave Penkler <dpenkler@gmail.com> +Date: Fri, 2 May 2025 09:09:41 +0200 +Subject: usb: usbtmc: Fix erroneous generic_read ioctl return + +From: Dave Penkler <dpenkler@gmail.com> + +commit 4e77d3ec7c7c0d9535ccf1138827cb9bb5480b9b upstream. + +wait_event_interruptible_timeout returns a long +The return value was being assigned to an int causing an integer overflow +when the remaining jiffies > INT_MAX which resulted in random error +returns. + +Use a long return value, converting to the int ioctl return only on error. + +Fixes: bb99794a4792 ("usb: usbtmc: Add ioctl for vendor specific read") +Cc: stable@vger.kernel.org +Signed-off-by: Dave Penkler <dpenkler@gmail.com> +Link: https://lore.kernel.org/r/20250502070941.31819-4-dpenkler@gmail.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/usb/class/usbtmc.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -833,6 +833,7 @@ static ssize_t usbtmc_generic_read(struc + unsigned long expire; + int bufcount = 1; + int again = 0; ++ long wait_rv; + + /* mutex already locked */ + +@@ -945,19 +946,24 @@ static ssize_t usbtmc_generic_read(struc + if (!(flags & USBTMC_FLAG_ASYNC)) { + dev_dbg(dev, "%s: before wait time %lu\n", + __func__, expire); +- retval = wait_event_interruptible_timeout( ++ wait_rv = wait_event_interruptible_timeout( + file_data->wait_bulk_in, + usbtmc_do_transfer(file_data), + expire); + +- dev_dbg(dev, "%s: wait returned %d\n", +- __func__, retval); ++ dev_dbg(dev, "%s: wait returned %ld\n", ++ __func__, wait_rv); + +- if (retval <= 0) { +- if (retval == 0) +- retval = -ETIMEDOUT; ++ if (wait_rv < 0) { ++ retval = wait_rv; + goto error; + } ++ ++ if (wait_rv == 0) { ++ retval = -ETIMEDOUT; ++ goto error; ++ } ++ + } + + urb = usb_get_from_anchor(&file_data->in_anchor); diff --git a/queue-6.14/usb-usbtmc-fix-erroneous-get_stb-ioctl-error-returns.patch b/queue-6.14/usb-usbtmc-fix-erroneous-get_stb-ioctl-error-returns.patch new file mode 100644 index 00000000000..1309c86da82 --- /dev/null +++ b/queue-6.14/usb-usbtmc-fix-erroneous-get_stb-ioctl-error-returns.patch @@ -0,0 +1,70 @@ +From cac01bd178d6a2a23727f138d647ce1a0e8a73a1 Mon Sep 17 00:00:00 2001 +From: Dave Penkler <dpenkler@gmail.com> +Date: Fri, 2 May 2025 09:09:39 +0200 +Subject: usb: usbtmc: Fix erroneous get_stb ioctl error returns + +From: Dave Penkler <dpenkler@gmail.com> + +commit cac01bd178d6a2a23727f138d647ce1a0e8a73a1 upstream. + +wait_event_interruptible_timeout returns a long +The return was being assigned to an int causing an integer overflow when +the remaining jiffies > INT_MAX resulting in random error returns. + +Use a long return value and convert to int ioctl return only on error. + +When the return value of wait_event_interruptible_timeout was <= INT_MAX +the number of remaining jiffies was returned which has no meaning for the +user. Return 0 on success. + +Reported-by: Michael Katzmann <vk2bea@gmail.com> +Fixes: dbf3e7f654c0 ("Implement an ioctl to support the USMTMC-USB488 READ_STATUS_BYTE operation.") +Cc: stable@vger.kernel.org +Signed-off-by: Dave Penkler <dpenkler@gmail.com> +Link: https://lore.kernel.org/r/20250502070941.31819-2-dpenkler@gmail.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/usb/class/usbtmc.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -482,6 +482,7 @@ static int usbtmc_get_stb(struct usbtmc_ + u8 *buffer; + u8 tag; + int rv; ++ long wait_rv; + + dev_dbg(dev, "Enter ioctl_read_stb iin_ep_present: %d\n", + data->iin_ep_present); +@@ -511,16 +512,17 @@ static int usbtmc_get_stb(struct usbtmc_ + } + + if (data->iin_ep_present) { +- rv = wait_event_interruptible_timeout( ++ wait_rv = wait_event_interruptible_timeout( + data->waitq, + atomic_read(&data->iin_data_valid) != 0, + file_data->timeout); +- if (rv < 0) { +- dev_dbg(dev, "wait interrupted %d\n", rv); ++ if (wait_rv < 0) { ++ dev_dbg(dev, "wait interrupted %ld\n", wait_rv); ++ rv = wait_rv; + goto exit; + } + +- if (rv == 0) { ++ if (wait_rv == 0) { + dev_dbg(dev, "wait timed out\n"); + rv = -ETIMEDOUT; + goto exit; +@@ -539,6 +541,8 @@ static int usbtmc_get_stb(struct usbtmc_ + + dev_dbg(dev, "stb:0x%02x received %d\n", (unsigned int)*stb, rv); + ++ rv = 0; ++ + exit: + /* bump interrupt bTag */ + data->iin_bTag += 1; diff --git a/queue-6.14/usb-usbtmc-fix-erroneous-wait_srq-ioctl-return.patch b/queue-6.14/usb-usbtmc-fix-erroneous-wait_srq-ioctl-return.patch new file mode 100644 index 00000000000..383c8cf2653 --- /dev/null +++ b/queue-6.14/usb-usbtmc-fix-erroneous-wait_srq-ioctl-return.patch @@ -0,0 +1,74 @@ +From a9747c9b8b59ab4207effd20eb91a890acb44e16 Mon Sep 17 00:00:00 2001 +From: Dave Penkler <dpenkler@gmail.com> +Date: Fri, 2 May 2025 09:09:40 +0200 +Subject: usb: usbtmc: Fix erroneous wait_srq ioctl return + +From: Dave Penkler <dpenkler@gmail.com> + +commit a9747c9b8b59ab4207effd20eb91a890acb44e16 upstream. + +wait_event_interruptible_timeout returns a long +The return was being assigned to an int causing an integer overflow when +the remaining jiffies > INT_MAX resulting in random error returns. + +Use a long return value, converting to the int ioctl return only on +error. + +Fixes: 739240a9f6ac ("usb: usbtmc: Add ioctl USBTMC488_IOCTL_WAIT_SRQ") +Cc: stable@vger.kernel.org +Signed-off-by: Dave Penkler <dpenkler@gmail.com> +Link: https://lore.kernel.org/r/20250502070941.31819-3-dpenkler@gmail.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/usb/class/usbtmc.c | 23 +++++++++++------------ + 1 file changed, 11 insertions(+), 12 deletions(-) + +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -606,9 +606,9 @@ static int usbtmc488_ioctl_wait_srq(stru + { + struct usbtmc_device_data *data = file_data->data; + struct device *dev = &data->intf->dev; +- int rv; + u32 timeout; + unsigned long expire; ++ long wait_rv; + + if (!data->iin_ep_present) { + dev_dbg(dev, "no interrupt endpoint present\n"); +@@ -622,25 +622,24 @@ static int usbtmc488_ioctl_wait_srq(stru + + mutex_unlock(&data->io_mutex); + +- rv = wait_event_interruptible_timeout( +- data->waitq, +- atomic_read(&file_data->srq_asserted) != 0 || +- atomic_read(&file_data->closing), +- expire); ++ wait_rv = wait_event_interruptible_timeout( ++ data->waitq, ++ atomic_read(&file_data->srq_asserted) != 0 || ++ atomic_read(&file_data->closing), ++ expire); + + mutex_lock(&data->io_mutex); + + /* Note! disconnect or close could be called in the meantime */ + if (atomic_read(&file_data->closing) || data->zombie) +- rv = -ENODEV; ++ return -ENODEV; + +- if (rv < 0) { +- /* dev can be invalid now! */ +- pr_debug("%s - wait interrupted %d\n", __func__, rv); +- return rv; ++ if (wait_rv < 0) { ++ dev_dbg(dev, "%s - wait interrupted %ld\n", __func__, wait_rv); ++ return wait_rv; + } + +- if (rv == 0) { ++ if (wait_rv == 0) { + dev_dbg(dev, "%s - wait timed out\n", __func__); + return -ETIMEDOUT; + } diff --git a/queue-6.14/usb-usbtmc-use-interruptible-sleep-in-usbtmc_read.patch b/queue-6.14/usb-usbtmc-use-interruptible-sleep-in-usbtmc_read.patch new file mode 100644 index 00000000000..affa150dc98 --- /dev/null +++ b/queue-6.14/usb-usbtmc-use-interruptible-sleep-in-usbtmc_read.patch @@ -0,0 +1,46 @@ +From 054c5145540e5ad5b80adf23a5e3e2fc281fb8aa Mon Sep 17 00:00:00 2001 +From: Oliver Neukum <oneukum@suse.com> +Date: Wed, 30 Apr 2025 15:48:10 +0200 +Subject: USB: usbtmc: use interruptible sleep in usbtmc_read + +From: Oliver Neukum <oneukum@suse.com> + +commit 054c5145540e5ad5b80adf23a5e3e2fc281fb8aa upstream. + +usbtmc_read() calls usbtmc_generic_read() +which uses interruptible sleep, but usbtmc_read() +itself uses uninterruptble sleep for mutual exclusion +between threads. That makes no sense. +Both should use interruptible sleep. + +Fixes: 5b775f672cc99 ("USB: add USB test and measurement class driver") +Cc: stable <stable@kernel.org> +Signed-off-by: Oliver Neukum <oneukum@suse.com> +Link: https://lore.kernel.org/r/20250430134810.226015-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +--- + drivers/usb/class/usbtmc.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -1380,7 +1380,10 @@ static ssize_t usbtmc_read(struct file * + if (!buffer) + return -ENOMEM; + +- mutex_lock(&data->io_mutex); ++ retval = mutex_lock_interruptible(&data->io_mutex); ++ if (retval < 0) ++ goto exit_nolock; ++ + if (data->zombie) { + retval = -ENODEV; + goto exit; +@@ -1503,6 +1506,7 @@ static ssize_t usbtmc_read(struct file * + + exit: + mutex_unlock(&data->io_mutex); ++exit_nolock: + kfree(buffer); + return retval; + } |