--- /dev/null
+From 6507ef10660efdfee93f0f3b9fac24b5e4d83e56 Mon Sep 17 00:00:00 2001
+From: Julian Sax <jsbc@gmx.de>
+Date: Tue, 5 May 2020 17:10:42 +0200
+Subject: HID: i2c-hid: add Schneider SCL142ALM to descriptor override
+
+From: Julian Sax <jsbc@gmx.de>
+
+commit 6507ef10660efdfee93f0f3b9fac24b5e4d83e56 upstream.
+
+This device uses the SIPODEV SP1064 touchpad, which does not
+supply descriptors, so it has to be added to the override list.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Julian Sax <jsbc@gmx.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+@@ -381,6 +381,14 @@ static const struct dmi_system_id i2c_hi
+ },
+ .driver_data = (void *)&sipodev_desc
+ },
++ {
++ .ident = "Schneider SCL142ALM",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SCHNEIDER"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "SCL142ALM"),
++ },
++ .driver_data = (void *)&sipodev_desc
++ },
+ { } /* Terminate list */
+ };
+
--- /dev/null
+From e72455b898ac678667c5674668186b4670d87d11 Mon Sep 17 00:00:00 2001
+From: Scott Shumate <scott.shumate@gmail.com>
+Date: Wed, 13 May 2020 13:39:26 -0500
+Subject: HID: sony: Fix for broken buttons on DS3 USB dongles
+
+From: Scott Shumate <scott.shumate@gmail.com>
+
+commit e72455b898ac678667c5674668186b4670d87d11 upstream.
+
+Fix for non-working buttons on knock-off USB dongles for Sony
+controllers. These USB dongles are used to connect older Sony DA/DS1/DS2
+controllers via USB and are common on Amazon, AliExpress, etc. Without
+the patch, the square, X, and circle buttons do not function. These
+dongles used to work prior to kernel 4.10 but removing the global DS3
+report fixup in commit e19a267b9987 ("HID: sony: DS3 comply to Linux gamepad
+spec") exposed the problem.
+
+Many people reported the problem on the Ubuntu forums and are working
+around the problem by falling back to the 4.9 hid-sony driver.
+
+The problem stems from these dongles incorrectly reporting their button
+count as 13 instead of 16. This patch fixes up the report descriptor by
+changing the button report count to 16 and removing 3 padding bits.
+
+Cc: stable@vger.kernel.org
+Fixes: e19a267b9987 ("HID: sony: DS3 comply to Linux gamepad spec")
+Signed-off-by: Scott Shumate <scott.shumate@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-sony.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/drivers/hid/hid-sony.c
++++ b/drivers/hid/hid-sony.c
+@@ -837,6 +837,23 @@ static u8 *sony_report_fixup(struct hid_
+ if (sc->quirks & PS3REMOTE)
+ return ps3remote_fixup(hdev, rdesc, rsize);
+
++ /*
++ * Some knock-off USB dongles incorrectly report their button count
++ * as 13 instead of 16 causing three non-functional buttons.
++ */
++ if ((sc->quirks & SIXAXIS_CONTROLLER_USB) && *rsize >= 45 &&
++ /* Report Count (13) */
++ rdesc[23] == 0x95 && rdesc[24] == 0x0D &&
++ /* Usage Maximum (13) */
++ rdesc[37] == 0x29 && rdesc[38] == 0x0D &&
++ /* Report Count (3) */
++ rdesc[43] == 0x95 && rdesc[44] == 0x03) {
++ hid_info(hdev, "Fixing up USB dongle report descriptor\n");
++ rdesc[24] = 0x10;
++ rdesc[38] = 0x10;
++ rdesc[44] = 0x00;
++ }
++
+ return rdesc;
+ }
+
--- /dev/null
+From 54e200ab40fc14c863bcc80a51e20b7906608fce Mon Sep 17 00:00:00 2001
+From: Daniel Axtens <dja@axtens.net>
+Date: Thu, 4 Jun 2020 16:51:27 -0700
+Subject: kernel/relay.c: handle alloc_percpu returning NULL in relay_open
+
+From: Daniel Axtens <dja@axtens.net>
+
+commit 54e200ab40fc14c863bcc80a51e20b7906608fce upstream.
+
+alloc_percpu() may return NULL, which means chan->buf may be set to NULL.
+In that case, when we do *per_cpu_ptr(chan->buf, ...), we dereference an
+invalid pointer:
+
+ BUG: Unable to handle kernel data access at 0x7dae0000
+ Faulting instruction address: 0xc0000000003f3fec
+ ...
+ NIP relay_open+0x29c/0x600
+ LR relay_open+0x270/0x600
+ Call Trace:
+ relay_open+0x264/0x600 (unreliable)
+ __blk_trace_setup+0x254/0x600
+ blk_trace_setup+0x68/0xa0
+ sg_ioctl+0x7bc/0x2e80
+ do_vfs_ioctl+0x13c/0x1300
+ ksys_ioctl+0x94/0x130
+ sys_ioctl+0x48/0xb0
+ system_call+0x5c/0x68
+
+Check if alloc_percpu returns NULL.
+
+This was found by syzkaller both on x86 and powerpc, and the reproducer
+it found on powerpc is capable of hitting the issue as an unprivileged
+user.
+
+Fixes: 017c59c042d0 ("relay: Use per CPU constructs for the relay channel buffer pointers")
+Reported-by: syzbot+1e925b4b836afe85a1c6@syzkaller-ppc64.appspotmail.com
+Reported-by: syzbot+587b2421926808309d21@syzkaller-ppc64.appspotmail.com
+Reported-by: syzbot+58320b7171734bf79d26@syzkaller.appspotmail.com
+Reported-by: syzbot+d6074fb08bdb2e010520@syzkaller.appspotmail.com
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Michael Ellerman <mpe@ellerman.id.au>
+Reviewed-by: Andrew Donnellan <ajd@linux.ibm.com>
+Acked-by: David Rientjes <rientjes@google.com>
+Cc: Akash Goel <akash.goel@intel.com>
+Cc: Andrew Donnellan <ajd@linux.ibm.com>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Cc: Salvatore Bonaccorso <carnil@debian.org>
+Cc: <stable@vger.kernel.org> [4.10+]
+Link: http://lkml.kernel.org/r/20191219121256.26480-1-dja@axtens.net
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/relay.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/kernel/relay.c
++++ b/kernel/relay.c
+@@ -580,6 +580,11 @@ struct rchan *relay_open(const char *bas
+ return NULL;
+
+ chan->buf = alloc_percpu(struct rchan_buf *);
++ if (!chan->buf) {
++ kfree(chan);
++ return NULL;
++ }
++
+ chan->version = RELAYFS_CHANNEL_VERSION;
+ chan->n_subbufs = n_subbufs;
+ chan->subbuf_size = subbuf_size;
--- /dev/null
+From 5bfea2d9b17f1034a68147a8b03b9789af5700f9 Mon Sep 17 00:00:00 2001
+From: Fan Yang <Fan_Yang@sjtu.edu.cn>
+Date: Thu, 4 Jun 2020 18:22:07 +0800
+Subject: mm: Fix mremap not considering huge pmd devmap
+
+From: Fan Yang <Fan_Yang@sjtu.edu.cn>
+
+commit 5bfea2d9b17f1034a68147a8b03b9789af5700f9 upstream.
+
+The original code in mm/mremap.c checks huge pmd by:
+
+ if (is_swap_pmd(*old_pmd) || pmd_trans_huge(*old_pmd)) {
+
+However, a DAX mapped nvdimm is mapped as huge page (by default) but it
+is not transparent huge page (_PAGE_PSE | PAGE_DEVMAP). This commit
+changes the condition to include the case.
+
+This addresses CVE-2020-10757.
+
+Fixes: 5c7fb56e5e3f ("mm, dax: dax-pmd vs thp-pmd vs hugetlbfs-pmd")
+Cc: <stable@vger.kernel.org>
+Reported-by: Fan Yang <Fan_Yang@sjtu.edu.cn>
+Signed-off-by: Fan Yang <Fan_Yang@sjtu.edu.cn>
+Tested-by: Fan Yang <Fan_Yang@sjtu.edu.cn>
+Tested-by: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/pgtable.h | 1 +
+ mm/mremap.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/include/asm/pgtable.h
++++ b/arch/x86/include/asm/pgtable.h
+@@ -234,6 +234,7 @@ static inline int pmd_large(pmd_t pte)
+ }
+
+ #ifdef CONFIG_TRANSPARENT_HUGEPAGE
++/* NOTE: when predicate huge page, consider also pmd_devmap, or use pmd_large */
+ static inline int pmd_trans_huge(pmd_t pmd)
+ {
+ return (pmd_val(pmd) & (_PAGE_PSE|_PAGE_DEVMAP)) == _PAGE_PSE;
+--- a/mm/mremap.c
++++ b/mm/mremap.c
+@@ -223,7 +223,7 @@ unsigned long move_page_tables(struct vm
+ new_pmd = alloc_new_pmd(vma->vm_mm, vma, new_addr);
+ if (!new_pmd)
+ break;
+- if (is_swap_pmd(*old_pmd) || pmd_trans_huge(*old_pmd)) {
++ if (is_swap_pmd(*old_pmd) || pmd_trans_huge(*old_pmd) || pmd_devmap(*old_pmd)) {
+ if (extent == HPAGE_PMD_SIZE) {
+ bool moved;
+ /* See comment in move_ptes() */
--- /dev/null
+From 83fc5dd57f86c3ec7d6d22565a6ff6c948853b64 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Pouiller?= <jerome.pouiller@silabs.com>
+Date: Mon, 11 May 2020 18:19:02 +0200
+Subject: mmc: fix compilation of user API
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jérôme Pouiller <jerome.pouiller@silabs.com>
+
+commit 83fc5dd57f86c3ec7d6d22565a6ff6c948853b64 upstream.
+
+The definitions of MMC_IOC_CMD and of MMC_IOC_MULTI_CMD rely on
+MMC_BLOCK_MAJOR:
+
+ #define MMC_IOC_CMD _IOWR(MMC_BLOCK_MAJOR, 0, struct mmc_ioc_cmd)
+ #define MMC_IOC_MULTI_CMD _IOWR(MMC_BLOCK_MAJOR, 1, struct mmc_ioc_multi_cmd)
+
+However, MMC_BLOCK_MAJOR is defined in linux/major.h and
+linux/mmc/ioctl.h did not include it.
+
+Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200511161902.191405-1-Jerome.Pouiller@silabs.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/uapi/linux/mmc/ioctl.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/uapi/linux/mmc/ioctl.h
++++ b/include/uapi/linux/mmc/ioctl.h
+@@ -3,6 +3,7 @@
+ #define LINUX_MMC_IOCTL_H
+
+ #include <linux/types.h>
++#include <linux/major.h>
+
+ struct mmc_ioc_cmd {
+ /* Implies direction of data. true = write, false = read */
--- /dev/null
+From 63e49a9fdac1b4e97ac26cb3fe953f210d83bc53 Mon Sep 17 00:00:00 2001
+From: Giuseppe Marco Randazzo <gmrandazzo@gmail.com>
+Date: Mon, 6 Apr 2020 00:06:59 +0200
+Subject: p54usb: add AirVasT USB stick device-id
+
+From: Giuseppe Marco Randazzo <gmrandazzo@gmail.com>
+
+commit 63e49a9fdac1b4e97ac26cb3fe953f210d83bc53 upstream.
+
+This patch adds the AirVasT USB wireless devices 124a:4026
+to the list of supported devices. It's using the ISL3886
+usb firmware. Without this modification, the wiki adapter
+is not recognized.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Giuseppe Marco Randazzo <gmrandazzo@gmail.com>
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com> [formatted, reworded]
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200405220659.45621-1-chunkeey@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intersil/p54/p54usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/intersil/p54/p54usb.c
++++ b/drivers/net/wireless/intersil/p54/p54usb.c
+@@ -64,6 +64,7 @@ static const struct usb_device_id p54u_t
+ {USB_DEVICE(0x0db0, 0x6826)}, /* MSI UB54G (MS-6826) */
+ {USB_DEVICE(0x107b, 0x55f2)}, /* Gateway WGU-210 (Gemtek) */
+ {USB_DEVICE(0x124a, 0x4023)}, /* Shuttle PN15, Airvast WM168g, IOGear GWU513 */
++ {USB_DEVICE(0x124a, 0x4026)}, /* AirVasT USB wireless device */
+ {USB_DEVICE(0x1435, 0x0210)}, /* Inventel UR054G */
+ {USB_DEVICE(0x15a9, 0x0002)}, /* Gemtek WUBI-100GW 802.11g */
+ {USB_DEVICE(0x1630, 0x0005)}, /* 2Wire 802.11g USB (v1) / Z-Com */
net-ethernet-freescale-rework-quiesce-activate-for-u.patch
net-ethernet-stmmac-enable-interface-clocks-on-probe.patch
net-smsc911x-fix-runtime-pm-imbalance-on-error.patch
+mm-fix-mremap-not-considering-huge-pmd-devmap.patch
+hid-sony-fix-for-broken-buttons-on-ds3-usb-dongles.patch
+hid-i2c-hid-add-schneider-scl142alm-to-descriptor-override.patch
+p54usb-add-airvast-usb-stick-device-id.patch
+kernel-relay.c-handle-alloc_percpu-returning-null-in-relay_open.patch
+mmc-fix-compilation-of-user-api.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
