]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.9-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 14 May 2019 08:22:56 +0000 (10:22 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 14 May 2019 08:22:56 +0000 (10:22 +0200)
added patches:
alsa-pcm-remove-sndrv_pcm_ioctl1_info-internal-command.patch
cw1200-fix-missing-unlock-on-error-in-cw1200_hw_scan.patch
x86-vdso-pass-eh-frame-hdr-to-the-linker.patch

queue-4.9/alsa-pcm-remove-sndrv_pcm_ioctl1_info-internal-command.patch [new file with mode: 0644]
queue-4.9/cw1200-fix-missing-unlock-on-error-in-cw1200_hw_scan.patch [new file with mode: 0644]
queue-4.9/input-synaptics-rmi4-fix-possible-double-free.patch
queue-4.9/series
queue-4.9/x86-vdso-pass-eh-frame-hdr-to-the-linker.patch [new file with mode: 0644]

diff --git a/queue-4.9/alsa-pcm-remove-sndrv_pcm_ioctl1_info-internal-command.patch b/queue-4.9/alsa-pcm-remove-sndrv_pcm_ioctl1_info-internal-command.patch
new file mode 100644 (file)
index 0000000..ab4ab7d
--- /dev/null
@@ -0,0 +1,72 @@
+From e11f0f90a626f93899687b1cc909ee37dd6c5809 Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Wed, 14 Jun 2017 19:30:03 +0900
+Subject: ALSA: pcm: remove SNDRV_PCM_IOCTL1_INFO internal command
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+commit e11f0f90a626f93899687b1cc909ee37dd6c5809 upstream.
+
+Drivers can implement 'struct snd_pcm_ops.ioctl' to handle some requests
+from ALSA PCM core. These requests are internal purpose in kernel land.
+Usually common set of operations are used for it.
+
+SNDRV_PCM_IOCTL1_INFO is one of the requests. According to code comment,
+it has been obsoleted in the old days.
+
+We can see old releases in ftp.alsa-project.org. The command was firstly
+introduced in v0.5.0 release as SND_PCM_IOCTL1_INFO, to allow drivers to
+fill data of 'struct snd_pcm_channel_info' type. In v0.9.0 release,
+this was obsoleted by the other commands for ioctl(2) such as
+SNDRV_PCM_IOCTL_CHANNEL_INFO.
+
+This commit removes the long-abandoned command, bye.
+
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/sound/pcm.h     |    2 +-
+ sound/core/pcm_lib.c    |    2 --
+ sound/core/pcm_native.c |    6 +-----
+ 3 files changed, 2 insertions(+), 8 deletions(-)
+
+--- a/include/sound/pcm.h
++++ b/include/sound/pcm.h
+@@ -100,7 +100,7 @@ struct snd_pcm_ops {
+ #endif
+ #define SNDRV_PCM_IOCTL1_RESET                0
+-#define SNDRV_PCM_IOCTL1_INFO         1
++/* 1 is absent slot. */
+ #define SNDRV_PCM_IOCTL1_CHANNEL_INFO 2
+ #define SNDRV_PCM_IOCTL1_GSTATE               3
+ #define SNDRV_PCM_IOCTL1_FIFO_SIZE    4
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -1849,8 +1849,6 @@ int snd_pcm_lib_ioctl(struct snd_pcm_sub
+                     unsigned int cmd, void *arg)
+ {
+       switch (cmd) {
+-      case SNDRV_PCM_IOCTL1_INFO:
+-              return 0;
+       case SNDRV_PCM_IOCTL1_RESET:
+               return snd_pcm_lib_ioctl_reset(substream, arg);
+       case SNDRV_PCM_IOCTL1_CHANNEL_INFO:
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -214,11 +214,7 @@ int snd_pcm_info(struct snd_pcm_substrea
+       info->subdevices_avail = pstr->substream_count - pstr->substream_opened;
+       strlcpy(info->subname, substream->name, sizeof(info->subname));
+       runtime = substream->runtime;
+-      /* AB: FIXME!!! This is definitely nonsense */
+-      if (runtime) {
+-              info->sync = runtime->sync;
+-              substream->ops->ioctl(substream, SNDRV_PCM_IOCTL1_INFO, info);
+-      }
++
+       return 0;
+ }
diff --git a/queue-4.9/cw1200-fix-missing-unlock-on-error-in-cw1200_hw_scan.patch b/queue-4.9/cw1200-fix-missing-unlock-on-error-in-cw1200_hw_scan.patch
new file mode 100644 (file)
index 0000000..3f6ad7b
--- /dev/null
@@ -0,0 +1,37 @@
+From 51c8d24101c79ffce3e79137e2cee5dfeb956dd7 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Sat, 22 Dec 2018 10:34:54 +0000
+Subject: cw1200: fix missing unlock on error in cw1200_hw_scan()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+commit 51c8d24101c79ffce3e79137e2cee5dfeb956dd7 upstream.
+
+Add the missing unlock before return from function cw1200_hw_scan()
+in the error handling case.
+
+Fixes: 4f68ef64cd7f ("cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Acked-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/st/cw1200/scan.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/st/cw1200/scan.c
++++ b/drivers/net/wireless/st/cw1200/scan.c
+@@ -84,8 +84,11 @@ int cw1200_hw_scan(struct ieee80211_hw *
+       frame.skb = ieee80211_probereq_get(hw, priv->vif->addr, NULL, 0,
+               req->ie_len);
+-      if (!frame.skb)
++      if (!frame.skb) {
++              mutex_unlock(&priv->conf_mutex);
++              up(&priv->scan.lock);
+               return -ENOMEM;
++      }
+       if (req->ie_len)
+               memcpy(skb_put(frame.skb, req->ie_len), req->ie, req->ie_len);
index 2262ebf6d3aaa97e97d8ec2c10b30471efc04d4c..76a7fc4f71915b5455455c07311895fdcf7a5682 100644 (file)
@@ -13,14 +13,12 @@ Signed-off-by: Pan Bian <bianpan2016@163.com>
 Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 ---
- drivers/input/rmi4/rmi_driver.c | 6 +-----
+ drivers/input/rmi4/rmi_driver.c |    6 +-----
  1 file changed, 1 insertion(+), 5 deletions(-)
 
-diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
-index 4a88312fbd254..65038dcc7613e 100644
 --- a/drivers/input/rmi4/rmi_driver.c
 +++ b/drivers/input/rmi4/rmi_driver.c
-@@ -772,7 +772,7 @@ static int rmi_create_function(struct rmi_device *rmi_dev,
+@@ -772,7 +772,7 @@ static int rmi_create_function(struct rm
  
        error = rmi_register_function(fn);
        if (error)
@@ -29,7 +27,7 @@ index 4a88312fbd254..65038dcc7613e 100644
  
        if (pdt->function_number == 0x01)
                data->f01_container = fn;
-@@ -780,10 +780,6 @@ static int rmi_create_function(struct rmi_device *rmi_dev,
+@@ -780,10 +780,6 @@ static int rmi_create_function(struct rm
        list_add_tail(&fn->node, &data->function_list);
  
        return RMI_SCAN_CONTINUE;
@@ -40,6 +38,3 @@ index 4a88312fbd254..65038dcc7613e 100644
  }
  
  int rmi_driver_suspend(struct rmi_device *rmi_dev)
--- 
-2.20.1
-
index ef4502131f03e6c917006d1081a5ac87c286f513..4eca0c1957ee1bf42dfb38ba0f5d3ebc949d32aa 100644 (file)
@@ -27,3 +27,6 @@ gpu-ipu-v3-dp-fix-csc-handling.patch
 spi-micrel-eth-switch-declare-missing-of-table.patch
 spi-st-st95hf-nfc-declare-missing-of-table.patch
 input-synaptics-rmi4-fix-possible-double-free.patch
+cw1200-fix-missing-unlock-on-error-in-cw1200_hw_scan.patch
+alsa-pcm-remove-sndrv_pcm_ioctl1_info-internal-command.patch
+x86-vdso-pass-eh-frame-hdr-to-the-linker.patch
diff --git a/queue-4.9/x86-vdso-pass-eh-frame-hdr-to-the-linker.patch b/queue-4.9/x86-vdso-pass-eh-frame-hdr-to-the-linker.patch
new file mode 100644 (file)
index 0000000..803d402
--- /dev/null
@@ -0,0 +1,67 @@
+From cd01544a268ad8ee5b1dfe42c4393f1095f86879 Mon Sep 17 00:00:00 2001
+From: Alistair Strachan <astrachan@google.com>
+Date: Fri, 14 Dec 2018 14:36:37 -0800
+Subject: x86/vdso: Pass --eh-frame-hdr to the linker
+
+From: Alistair Strachan <astrachan@google.com>
+
+commit cd01544a268ad8ee5b1dfe42c4393f1095f86879 upstream.
+
+Commit
+
+  379d98ddf413 ("x86: vdso: Use $LD instead of $CC to link")
+
+accidentally broke unwinding from userspace, because ld would strip the
+.eh_frame sections when linking.
+
+Originally, the compiler would implicitly add --eh-frame-hdr when
+invoking the linker, but when this Makefile was converted from invoking
+ld via the compiler, to invoking it directly (like vmlinux does),
+the flag was missed. (The EH_FRAME section is important for the VDSO
+shared libraries, but not for vmlinux.)
+
+Fix the problem by explicitly specifying --eh-frame-hdr, which restores
+parity with the old method.
+
+See relevant bug reports for additional info:
+
+  https://bugzilla.kernel.org/show_bug.cgi?id=201741
+  https://bugzilla.redhat.com/show_bug.cgi?id=1659295
+
+Fixes: 379d98ddf413 ("x86: vdso: Use $LD instead of $CC to link")
+Reported-by: Florian Weimer <fweimer@redhat.com>
+Reported-by: Carlos O'Donell <carlos@redhat.com>
+Reported-by: "H. J. Lu" <hjl.tools@gmail.com>
+Signed-off-by: Alistair Strachan <astrachan@google.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Tested-by: Laura Abbott <labbott@redhat.com>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Carlos O'Donell <carlos@redhat.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Joel Fernandes <joel@joelfernandes.org>
+Cc: kernel-team@android.com
+Cc: Laura Abbott <labbott@redhat.com>
+Cc: stable <stable@vger.kernel.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: X86 ML <x86@kernel.org>
+Link: https://lkml.kernel.org/r/20181214223637.35954-1-astrachan@google.com
+Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/entry/vdso/Makefile |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/entry/vdso/Makefile
++++ b/arch/x86/entry/vdso/Makefile
+@@ -167,7 +167,8 @@ quiet_cmd_vdso = VDSO    $@
+                sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
+ VDSO_LDFLAGS = -shared $(call ld-option, --hash-style=both) \
+-      $(call ld-option, --build-id) -Bsymbolic
++      $(call ld-option, --build-id) $(call ld-option, --eh-frame-hdr) \
++      -Bsymbolic
+ GCOV_PROFILE := n
+ #