4.1-stable patches

added patches:
	hp-wmi-limit-hotkey-enable.patch
	zram-fix-possible-use-after-free-in-zcomp_create.patch

diff --git a/queue-4.1/hp-wmi-limit-hotkey-enable.patch b/queue-4.1/hp-wmi-limit-hotkey-enable.patch
new file mode 100644 (file)
index 0000000..cc8175f
--- /dev/null
+++ b/queue-4.1/hp-wmi-limit-hotkey-enable.patch
@@ -0,0 +1,94 @@
+From 8a1513b49321e503fd6c8b6793e3b1f9a8a3285b Mon Sep 17 00:00:00 2001
+From: Kyle Evans <kvans32@gmail.com>
+Date: Fri, 11 Sep 2015 10:40:17 -0500
+Subject: hp-wmi: limit hotkey enable
+
+From: Kyle Evans <kvans32@gmail.com>
+
+commit 8a1513b49321e503fd6c8b6793e3b1f9a8a3285b upstream.
+
+Do not write initialize magic on systems that do not have
+feature query 0xb. Fixes Bug #82451.
+
+Redefine FEATURE_QUERY to align with 0xb and FEATURE2 with 0xd
+for code clearity.
+
+Add a new test function, hp_wmi_bios_2008_later() & simplify
+hp_wmi_bios_2009_later(), which fixes a bug in cases where
+an improper value is returned. Probably also fixes Bug #69131.
+
+Add missing __init tag.
+
+Signed-off-by: Kyle Evans <kvans32@gmail.com>
+Signed-off-by: Darren Hart <dvhart@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/platform/x86/hp-wmi.c |   31 ++++++++++++++++++++-----------
+ 1 file changed, 20 insertions(+), 11 deletions(-)
+
+--- a/drivers/platform/x86/hp-wmi.c
++++ b/drivers/platform/x86/hp-wmi.c
+@@ -54,8 +54,9 @@ MODULE_ALIAS("wmi:5FB7F034-2C63-45e9-BE9
+ #define HPWMI_HARDWARE_QUERY 0x4
+ #define HPWMI_WIRELESS_QUERY 0x5
+ #define HPWMI_BIOS_QUERY 0x9
++#define HPWMI_FEATURE_QUERY 0xb
+ #define HPWMI_HOTKEY_QUERY 0xc
+-#define HPWMI_FEATURE_QUERY 0xd
++#define HPWMI_FEATURE2_QUERY 0xd
+ #define HPWMI_WIRELESS2_QUERY 0x1b
+ #define HPWMI_POSTCODEERROR_QUERY 0x2a
+ 
+@@ -295,25 +296,33 @@ static int hp_wmi_tablet_state(void)
+       return (state & 0x4) ? 1 : 0;
+ }
+ 
+-static int __init hp_wmi_bios_2009_later(void)
++static int __init hp_wmi_bios_2008_later(void)
+ {
+       int state = 0;
+       int ret = hp_wmi_perform_query(HPWMI_FEATURE_QUERY, 0, &state,
+                                      sizeof(state), sizeof(state));
+-      if (ret)
+-              return ret;
++      if (!ret)
++              return 1;
+ 
+-      return (state & 0x10) ? 1 : 0;
++      return (ret == HPWMI_RET_UNKNOWN_CMDTYPE) ? 0 : -ENXIO;
+ }
+ 
+-static int hp_wmi_enable_hotkeys(void)
++static int __init hp_wmi_bios_2009_later(void)
+ {
+-      int ret;
+-      int query = 0x6e;
++      int state = 0;
++      int ret = hp_wmi_perform_query(HPWMI_FEATURE2_QUERY, 0, &state,
++                                     sizeof(state), sizeof(state));
++      if (!ret)
++              return 1;
+ 
+-      ret = hp_wmi_perform_query(HPWMI_BIOS_QUERY, 1, &query, sizeof(query),
+-                                 0);
++      return (ret == HPWMI_RET_UNKNOWN_CMDTYPE) ? 0 : -ENXIO;
++}
+ 
++static int __init hp_wmi_enable_hotkeys(void)
++{
++      int value = 0x6e;
++      int ret = hp_wmi_perform_query(HPWMI_BIOS_QUERY, 1, &value,
++                                     sizeof(value), 0);
+       if (ret)
+               return -EINVAL;
+       return 0;
+@@ -663,7 +672,7 @@ static int __init hp_wmi_input_setup(voi
+                           hp_wmi_tablet_state());
+       input_sync(hp_wmi_input_dev);
+ 
+-      if (hp_wmi_bios_2009_later() == 4)
++      if (!hp_wmi_bios_2009_later() && hp_wmi_bios_2008_later())
+               hp_wmi_enable_hotkeys();
+ 
+       status = wmi_install_notify_handler(HPWMI_EVENT_GUID, hp_wmi_notify, NULL);

diff --git a/queue-4.1/series b/queue-4.1/series
index a6810f9bdd7803fd5486cfd5a49e962234079641..b872eaa15b17701cf7b7c64bbfbdc5ede80c0db1 100644 (file)
--- a/queue-4.1/series
+++ b/queue-4.1/series
@@ -25,3 +25,5 @@ of_mdio-add-new-dt-property-managed-to-specify-the-phy-management-type.patch
 mvneta-use-inband-status-only-when-explicitly-enabled.patch
 netlink-fix-autobind-race-condition-that-leads-to-zero-port-id.patch
 netlink-replace-rhash_portid-with-bound.patch
+zram-fix-possible-use-after-free-in-zcomp_create.patch
+hp-wmi-limit-hotkey-enable.patch

diff --git a/queue-4.1/zram-fix-possible-use-after-free-in-zcomp_create.patch b/queue-4.1/zram-fix-possible-use-after-free-in-zcomp_create.patch
new file mode 100644 (file)
index 0000000..ee93404
--- /dev/null
+++ b/queue-4.1/zram-fix-possible-use-after-free-in-zcomp_create.patch
@@ -0,0 +1,65 @@
+From 3aaf14da807a4e9931a37f21e4251abb8a67021b Mon Sep 17 00:00:00 2001
+From: Luis Henriques <luis.henriques@canonical.com>
+Date: Thu, 17 Sep 2015 16:01:40 -0700
+Subject: zram: fix possible use after free in zcomp_create()
+
+From: Luis Henriques <luis.henriques@canonical.com>
+
+commit 3aaf14da807a4e9931a37f21e4251abb8a67021b upstream.
+
+zcomp_create() verifies the success of zcomp_strm_{multi,single}_create()
+through comp->stream, which can potentially be pointing to memory that
+was freed if these functions returned an error.
+
+While at it, replace a 'ERR_PTR(-ENOMEM)' by a more generic
+'ERR_PTR(error)' as in the future zcomp_strm_{multi,siggle}_create()
+could return other error codes.  Function documentation updated
+accordingly.
+
+Fixes: beca3ec71fe5 ("zram: add multi stream functionality")
+Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
+Acked-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
+Acked-by: Minchan Kim <minchan@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/zram/zcomp.c |   12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/block/zram/zcomp.c
++++ b/drivers/block/zram/zcomp.c
+@@ -325,12 +325,14 @@ void zcomp_destroy(struct zcomp *comp)
+  * allocate new zcomp and initialize it. return compressing
+  * backend pointer or ERR_PTR if things went bad. ERR_PTR(-EINVAL)
+  * if requested algorithm is not supported, ERR_PTR(-ENOMEM) in
+- * case of allocation error.
++ * case of allocation error, or any other error potentially
++ * returned by functions zcomp_strm_{multi,single}_create.
+  */
+ struct zcomp *zcomp_create(const char *compress, int max_strm)
+ {
+       struct zcomp *comp;
+       struct zcomp_backend *backend;
++      int error;
+ 
+       backend = find_backend(compress);
+       if (!backend)
+@@ -342,12 +344,12 @@ struct zcomp *zcomp_create(const char *c
+ 
+       comp->backend = backend;
+       if (max_strm > 1)
+-              zcomp_strm_multi_create(comp, max_strm);
++              error = zcomp_strm_multi_create(comp, max_strm);
+       else
+-              zcomp_strm_single_create(comp);
+-      if (!comp->stream) {
++              error = zcomp_strm_single_create(comp);
++      if (error) {
+               kfree(comp);
+-              return ERR_PTR(-ENOMEM);
++              return ERR_PTR(error);
+       }
+       return comp;
+ }