--- /dev/null
+From 165d42c012be69900f0e2f8545626cb9e7d4a832 Mon Sep 17 00:00:00 2001
+From: Nishka Dasgupta <nishkadg.linux@gmail.com>
+Date: Sat, 6 Jul 2019 19:00:21 +0530
+Subject: drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto
+
+From: Nishka Dasgupta <nishkadg.linux@gmail.com>
+
+commit 165d42c012be69900f0e2f8545626cb9e7d4a832 upstream.
+
+Each iteration of for_each_child_of_node puts the previous
+node, but in the case of a goto from the middle of the loop, there is
+no put, thus causing a memory leak. Hence add an of_node_put before the
+goto in two places.
+Issue found with Coccinelle.
+
+Fixes: 119f5173628a (drm/mediatek: Add DRM Driver for Mediatek SoC MT8173)
+
+Signed-off-by: Nishka Dasgupta <nishkadg.linux@gmail.com>
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/mediatek/mtk_drm_drv.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+@@ -566,12 +566,15 @@ static int mtk_drm_probe(struct platform
+ comp = devm_kzalloc(dev, sizeof(*comp), GFP_KERNEL);
+ if (!comp) {
+ ret = -ENOMEM;
++ of_node_put(node);
+ goto err_node;
+ }
+
+ ret = mtk_ddp_comp_init(dev, node, comp, comp_id, NULL);
+- if (ret)
++ if (ret) {
++ of_node_put(node);
+ goto err_node;
++ }
+
+ private->ddp_comp[comp_id] = comp;
+ }
--- /dev/null
+From dae1ccee012ea7514af8e4a88429844157aca7dc Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 24 Jun 2019 17:40:14 +0200
+Subject: drm: panel-orientation-quirks: Add extra quirk table entry for GPD MicroPC
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit dae1ccee012ea7514af8e4a88429844157aca7dc upstream.
+
+Newer GPD MicroPC BIOS versions have proper DMI strings, add an extra quirk
+table entry for these new strings. This is good news, as this means that we
+no longer have to update the BIOS dates list with every BIOS update.
+
+Fixes: 652b8b086538("drm: panel-orientation-quirks: Add quirk for GPD MicroPC")
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190624154014.8557-2-hdegoede@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_panel_orientation_quirks.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -82,6 +82,12 @@ static const struct drm_dmi_panel_orient
+ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
+ };
+
++static const struct drm_dmi_panel_orientation_data lcd720x1280_rightside_up = {
++ .width = 720,
++ .height = 1280,
++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
++};
++
+ static const struct drm_dmi_panel_orientation_data lcd800x1280_rightside_up = {
+ .width = 800,
+ .height = 1280,
+@@ -109,6 +115,12 @@ static const struct dmi_system_id orient
+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"),
+ },
+ .driver_data = (void *)&gpd_micropc,
++ }, { /* GPD MicroPC (later BIOS versions with proper DMI strings) */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "MicroPC"),
++ },
++ .driver_data = (void *)&lcd720x1280_rightside_up,
+ }, { /*
+ * GPD Pocket, note that the the DMI data is less generic then
+ * it seems, devices with a board-vendor of "AMI Corporation"
--- /dev/null
+From c6013bf50e2a2a94ab3d012e191096432aa50c6f Mon Sep 17 00:00:00 2001
+From: Olivier Moysan <olivier.moysan@st.com>
+Date: Wed, 19 Jun 2019 15:03:48 +0200
+Subject: iio: adc: stm32-dfsdm: fix data type
+
+From: Olivier Moysan <olivier.moysan@st.com>
+
+commit c6013bf50e2a2a94ab3d012e191096432aa50c6f upstream.
+
+Fix the data type as DFSDM raw output is complements 2,
+24bits left aligned in a 32-bit register.
+This change does not affect AUDIO path
+- Set data as signed for IIO (as for AUDIO)
+- Set 8 bit right shift for IIO.
+The 8 LSBs bits of data contains channel info and are masked.
+
+Signed-off-by: Olivier Moysan <olivier.moysan@st.com>
+Fixes: e2e6771c6462 ("IIO: ADC: add STM32 DFSDM sigma delta ADC support")
+Acked-by: Fabrice Gasnier <fabrice.gasnier@st.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/stm32-dfsdm-adc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/adc/stm32-dfsdm-adc.c
++++ b/drivers/iio/adc/stm32-dfsdm-adc.c
+@@ -981,11 +981,11 @@ static int stm32_dfsdm_adc_chan_init_one
+ ch->info_mask_shared_by_all = BIT(IIO_CHAN_INFO_OVERSAMPLING_RATIO);
+
+ if (adc->dev_data->type == DFSDM_AUDIO) {
+- ch->scan_type.sign = 's';
+ ch->ext_info = dfsdm_adc_audio_ext_info;
+ } else {
+- ch->scan_type.sign = 'u';
++ ch->scan_type.shift = 8;
+ }
++ ch->scan_type.sign = 's';
+ ch->scan_type.realbits = 24;
+ ch->scan_type.storagebits = 32;
+
--- /dev/null
+From 2eef1399a866c57687962e15142b141a4f8e7862 Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Thu, 20 Jun 2019 10:18:14 +0800
+Subject: modules: fix BUG when load module with rodata=n
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+commit 2eef1399a866c57687962e15142b141a4f8e7862 upstream.
+
+When loading a module with rodata=n, it causes an executing
+NX-protected page BUG.
+
+[ 32.379191] kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
+[ 32.382917] BUG: unable to handle page fault for address: ffffffffc0005000
+[ 32.385947] #PF: supervisor instruction fetch in kernel mode
+[ 32.387662] #PF: error_code(0x0011) - permissions violation
+[ 32.389352] PGD 240c067 P4D 240c067 PUD 240e067 PMD 421a52067 PTE 8000000421a53063
+[ 32.391396] Oops: 0011 [#1] SMP PTI
+[ 32.392478] CPU: 7 PID: 2697 Comm: insmod Tainted: G O 5.2.0-rc5+ #202
+[ 32.394588] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
+[ 32.398157] RIP: 0010:ko_test_init+0x0/0x1000 [ko_test]
+[ 32.399662] Code: Bad RIP value.
+[ 32.400621] RSP: 0018:ffffc900029f3ca8 EFLAGS: 00010246
+[ 32.402171] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
+[ 32.404332] RDX: 00000000000004c7 RSI: 0000000000000cc0 RDI: ffffffffc0005000
+[ 32.406347] RBP: ffffffffc0005000 R08: ffff88842fbebc40 R09: ffffffff810ede4a
+[ 32.408392] R10: ffffea00108e3480 R11: 0000000000000000 R12: ffff88842bee21a0
+[ 32.410472] R13: 0000000000000001 R14: 0000000000000001 R15: ffffc900029f3e78
+[ 32.412609] FS: 00007fb4f0c0a700(0000) GS:ffff88842fbc0000(0000) knlGS:0000000000000000
+[ 32.414722] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 32.416290] CR2: ffffffffc0004fd6 CR3: 0000000421a90004 CR4: 0000000000020ee0
+[ 32.418471] Call Trace:
+[ 32.419136] do_one_initcall+0x41/0x1df
+[ 32.420199] ? _cond_resched+0x10/0x40
+[ 32.421433] ? kmem_cache_alloc_trace+0x36/0x160
+[ 32.422827] do_init_module+0x56/0x1f7
+[ 32.423946] load_module+0x1e67/0x2580
+[ 32.424947] ? __alloc_pages_nodemask+0x150/0x2c0
+[ 32.426413] ? map_vm_area+0x2d/0x40
+[ 32.427530] ? __vmalloc_node_range+0x1ef/0x260
+[ 32.428850] ? __do_sys_init_module+0x135/0x170
+[ 32.430060] ? _cond_resched+0x10/0x40
+[ 32.431249] __do_sys_init_module+0x135/0x170
+[ 32.432547] do_syscall_64+0x43/0x120
+[ 32.433853] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Because if rodata=n, set_memory_x() can't be called, fix this by
+calling set_memory_x in complete_formation();
+
+Fixes: f2c65fb3221a ("x86/modules: Avoid breaking W^X while loading modules")
+Suggested-by: Jian Cheng <cj.chengjian@huawei.com>
+Reviewed-by: Nadav Amit <namit@vmware.com>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/module.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1956,13 +1956,9 @@ void module_enable_ro(const struct modul
+ return;
+
+ frob_text(&mod->core_layout, set_memory_ro);
+- frob_text(&mod->core_layout, set_memory_x);
+
+ frob_rodata(&mod->core_layout, set_memory_ro);
+-
+ frob_text(&mod->init_layout, set_memory_ro);
+- frob_text(&mod->init_layout, set_memory_x);
+-
+ frob_rodata(&mod->init_layout, set_memory_ro);
+
+ if (after_init)
+@@ -2049,6 +2045,12 @@ static void module_enable_nx(const struc
+ static void module_disable_nx(const struct module *mod) { }
+ #endif
+
++static void module_enable_x(const struct module *mod)
++{
++ frob_text(&mod->core_layout, set_memory_x);
++ frob_text(&mod->init_layout, set_memory_x);
++}
++
+ #ifdef CONFIG_LIVEPATCH
+ /*
+ * Persist Elf information about a module. Copy the Elf header,
+@@ -3604,6 +3606,7 @@ static int complete_formation(struct mod
+
+ module_enable_ro(mod, false);
+ module_enable_nx(mod);
++ module_enable_x(mod);
+
+ /* Mark state as coming so strong_try_module_get() ignores us,
+ * but kallsyms etc. can see us. */
--- /dev/null
+From 93651f80dcb616b8c9115cdafc8e57a781af22d0 Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Tue, 25 Jun 2019 17:40:28 +0800
+Subject: modules: fix compile error if don't have strict module rwx
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+commit 93651f80dcb616b8c9115cdafc8e57a781af22d0 upstream.
+
+If CONFIG_ARCH_HAS_STRICT_MODULE_RWX is not defined,
+we need stub for module_enable_nx() and module_enable_x().
+
+If CONFIG_ARCH_HAS_STRICT_MODULE_RWX is defined, but
+CONFIG_STRICT_MODULE_RWX is disabled, we need stub for
+module_enable_nx.
+
+Move frob_text() outside of the CONFIG_STRICT_MODULE_RWX,
+because it is needed anyway.
+
+Fixes: 2eef1399a866 ("modules: fix BUG when load module with rodata=n")
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/module.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1884,7 +1884,7 @@ static void mod_sysfs_teardown(struct mo
+ mod_sysfs_fini(mod);
+ }
+
+-#ifdef CONFIG_STRICT_MODULE_RWX
++#ifdef CONFIG_ARCH_HAS_STRICT_MODULE_RWX
+ /*
+ * LKM RO/NX protection: protect module's text/ro-data
+ * from modification and any data from execution.
+@@ -1907,6 +1907,7 @@ static void frob_text(const struct modul
+ layout->text_size >> PAGE_SHIFT);
+ }
+
++#ifdef CONFIG_STRICT_MODULE_RWX
+ static void frob_rodata(const struct module_layout *layout,
+ int (*set_memory)(unsigned long start, int num_pages))
+ {
+@@ -2039,17 +2040,21 @@ static void disable_ro_nx(const struct m
+ frob_writable_data(layout, set_memory_x);
+ }
+
+-#else
++#else /* !CONFIG_STRICT_MODULE_RWX */
+ static void disable_ro_nx(const struct module_layout *layout) { }
+ static void module_enable_nx(const struct module *mod) { }
+ static void module_disable_nx(const struct module *mod) { }
+-#endif
++#endif /* CONFIG_STRICT_MODULE_RWX */
+
+ static void module_enable_x(const struct module *mod)
+ {
+ frob_text(&mod->core_layout, set_memory_x);
+ frob_text(&mod->init_layout, set_memory_x);
+ }
++#else /* !CONFIG_ARCH_HAS_STRICT_MODULE_RWX */
++static void module_enable_nx(const struct module *mod) { }
++static void module_enable_x(const struct module *mod) { }
++#endif /* CONFIG_ARCH_HAS_STRICT_MODULE_RWX */
+
+ #ifdef CONFIG_LIVEPATCH
+ /*
--- /dev/null
+From 1ffdb51f28e8ec6be0a2b812c1765b5cf5c44a8f Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@dell.com>
+Date: Mon, 19 Aug 2019 12:04:08 -0500
+Subject: Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature"
+
+From: Mario Limonciello <mario.limonciello@dell.com>
+
+commit 1ffdb51f28e8ec6be0a2b812c1765b5cf5c44a8f upstream.
+
+This reverts commit a0085f2510e8976614ad8f766b209448b385492f.
+
+This commit has caused regressions in notebooks that support suspend
+to idle such as the XPS 9360, XPS 9370 and XPS 9380.
+
+These notebooks will wakeup from suspend to idle from an unsolicited
+advertising packet from an unpaired BLE device.
+
+In a bug report it was sugggested that this is caused by a generic
+lack of LE privacy support. Revert this commit until that behavior
+can be avoided by the kernel.
+
+Fixes: a0085f2510e8 ("Bluetooth: btusb: driver to enable the usb-wakeup feature")
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=200039
+Link: https://marc.info/?l=linux-bluetooth&m=156441081612627&w=2
+Link: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/750073/
+CC: Bastien Nocera <hadess@hadess.net>
+CC: Christian Kellner <ckellner@redhat.com>
+CC: Sukumar Ghorai <sukumar.ghorai@intel.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@dell.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bluetooth/btusb.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -1139,10 +1139,6 @@ static int btusb_open(struct hci_dev *hd
+ }
+
+ data->intf->needs_remote_wakeup = 1;
+- /* device specific wakeup source enabled and required for USB
+- * remote wakeup while host is suspended
+- */
+- device_wakeup_enable(&data->udev->dev);
+
+ if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
+ goto done;
+@@ -1206,7 +1202,6 @@ static int btusb_close(struct hci_dev *h
+ goto failed;
+
+ data->intf->needs_remote_wakeup = 0;
+- device_wakeup_disable(&data->udev->dev);
+ usb_autopm_put_interface(data->intf);
+
+ failed:
crypto-talitos-do-not-modify-req-cryptlen-on-decryption.patch
crypto-talitos-hmac-snoop-no-afeu-mode-requires-sw-icv-checking.patch
firmware-ti_sci-always-request-response-from-firmware.patch
+drm-panel-orientation-quirks-add-extra-quirk-table-entry-for-gpd-micropc.patch
+drm-mediatek-mtk_drm_drv.c-add-of_node_put-before-goto.patch
+revert-bluetooth-btusb-driver-to-enable-the-usb-wakeup-feature.patch
+iio-adc-stm32-dfsdm-fix-data-type.patch
+modules-fix-bug-when-load-module-with-rodata-n.patch
+modules-fix-compile-error-if-don-t-have-strict-module-rwx.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
