--- /dev/null
+From 53f1647da3e8fb3e89066798f0fdc045064d353d Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Wed, 3 Apr 2019 14:48:33 +0200
+Subject: hwmon: (pwm-fan) Disable PWM if fetching cooling data fails
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+commit 53f1647da3e8fb3e89066798f0fdc045064d353d upstream.
+
+In case pwm_fan_of_get_cooling_data() fails we should disable the PWM
+just like in the other error cases.
+
+Fixes: 2e5219c77183 ("hwmon: (pwm-fan) Read PWM FAN configuration from device tree")
+Cc: <stable@vger.kernel.org> # 4.14+
+Reported-by: Guenter Rock <linux@roeck-us.net>
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/pwm-fan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/pwm-fan.c
++++ b/drivers/hwmon/pwm-fan.c
+@@ -250,7 +250,7 @@ static int pwm_fan_probe(struct platform
+
+ ret = pwm_fan_of_get_cooling_data(&pdev->dev, ctx);
+ if (ret)
+- return ret;
++ goto err_pwm_disable;
+
+ ctx->pwm_fan_state = ctx->pwm_fan_max_state;
+ if (IS_ENABLED(CONFIG_THERMAL)) {
--- /dev/null
+From 998267900cee901c5d1dfa029a6304d00acbc29f Mon Sep 17 00:00:00 2001
+From: Andrea Parri <andrea.parri@amarulasolutions.com>
+Date: Tue, 16 Apr 2019 14:17:11 +0200
+Subject: kernfs: fix barrier usage in __kernfs_new_node()
+
+From: Andrea Parri <andrea.parri@amarulasolutions.com>
+
+commit 998267900cee901c5d1dfa029a6304d00acbc29f upstream.
+
+smp_mb__before_atomic() can not be applied to atomic_set(). Remove the
+barrier and rely on RELEASE synchronization.
+
+Fixes: ba16b2846a8c6 ("kernfs: add an API to get kernfs node from inode number")
+Cc: stable@vger.kernel.org
+Signed-off-by: Andrea Parri <andrea.parri@amarulasolutions.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/kernfs/dir.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/fs/kernfs/dir.c
++++ b/fs/kernfs/dir.c
+@@ -650,11 +650,10 @@ static struct kernfs_node *__kernfs_new_
+ kn->id.generation = gen;
+
+ /*
+- * set ino first. This barrier is paired with atomic_inc_not_zero in
++ * set ino first. This RELEASE is paired with atomic_inc_not_zero in
+ * kernfs_find_and_get_node_by_ino
+ */
+- smp_mb__before_atomic();
+- atomic_set(&kn->count, 1);
++ atomic_set_release(&kn->count, 1);
+ atomic_set(&kn->active, KN_DEACTIVATED_BIAS);
+ RB_CLEAR_NODE(&kn->rb);
+
--- /dev/null
+From 6cc13c28da5beee0f706db6450e190709700b34a Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@dell.com>
+Date: Wed, 27 Mar 2019 09:25:34 -0500
+Subject: platform/x86: dell-laptop: fix rfkill functionality
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mario Limonciello <mario.limonciello@dell.com>
+
+commit 6cc13c28da5beee0f706db6450e190709700b34a upstream.
+
+When converting the driver two arguments were transposed leading
+to rfkill not working.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201427
+Reported-by: Pepijn de Vos <pepijndevos@gmail.com>
+Fixes: 549b49 ("platform/x86: dell-smbios: Introduce dispatcher for SMM calls")
+Signed-off-by: Mario Limonciello <mario.limonciello@dell.com>
+Acked-by: Pali Rohár <pali.rohar@gmail.com>
+Cc: <stable@vger.kernel.org> # 4.14.x
+Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/platform/x86/dell-laptop.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/platform/x86/dell-laptop.c
++++ b/drivers/platform/x86/dell-laptop.c
+@@ -532,7 +532,7 @@ static void dell_rfkill_query(struct rfk
+ return;
+ }
+
+- dell_fill_request(&buffer, 0, 0x2, 0, 0);
++ dell_fill_request(&buffer, 0x2, 0, 0, 0);
+ ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL);
+ hwswitch = buffer.output[1];
+
+@@ -563,7 +563,7 @@ static int dell_debugfs_show(struct seq_
+ return ret;
+ status = buffer.output[1];
+
+- dell_fill_request(&buffer, 0, 0x2, 0, 0);
++ dell_fill_request(&buffer, 0x2, 0, 0, 0);
+ hwswitch_ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL);
+ if (hwswitch_ret)
+ return hwswitch_ret;
+@@ -648,7 +648,7 @@ static void dell_update_rfkill(struct wo
+ if (ret != 0)
+ return;
+
+- dell_fill_request(&buffer, 0, 0x2, 0, 0);
++ dell_fill_request(&buffer, 0x2, 0, 0, 0);
+ ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL);
+
+ if (ret == 0 && (status & BIT(0)))
--- /dev/null
+From 1cbd7a64959d33e7a2a1fa2bf36a62b350a9fcbd Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Wed, 24 Apr 2019 13:09:34 -0500
+Subject: platform/x86: sony-laptop: Fix unintentional fall-through
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+commit 1cbd7a64959d33e7a2a1fa2bf36a62b350a9fcbd upstream.
+
+It seems that the default case should return AE_CTRL_TERMINATE, instead
+of falling through to case ACPI_RESOURCE_TYPE_END_TAG and returning AE_OK;
+otherwise the line of code at the end of the function is unreachable and
+makes no sense:
+
+return AE_CTRL_TERMINATE;
+
+This fix is based on the following thread of discussion:
+
+https://lore.kernel.org/patchwork/patch/959782/
+
+Fixes: 33a04454527e ("sony-laptop: Add SNY6001 device handling (sonypi reimplementation)")
+Cc: stable@vger.kernel.org
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/platform/x86/sony-laptop.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/platform/x86/sony-laptop.c
++++ b/drivers/platform/x86/sony-laptop.c
+@@ -4424,14 +4424,16 @@ sony_pic_read_possible_resource(struct a
+ }
+ return AE_OK;
+ }
++
++ case ACPI_RESOURCE_TYPE_END_TAG:
++ return AE_OK;
++
+ default:
+ dprintk("Resource %d isn't an IRQ nor an IO port\n",
+ resource->type);
++ return AE_CTRL_TERMINATE;
+
+- case ACPI_RESOURCE_TYPE_END_TAG:
+- return AE_OK;
+ }
+- return AE_CTRL_TERMINATE;
+ }
+
+ static int sony_pic_possible_resources(struct acpi_device *device)
--- /dev/null
+From f7db839fccf087664e5587966220821289b6a9cb Mon Sep 17 00:00:00 2001
+From: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Date: Thu, 7 Mar 2019 17:37:16 +0800
+Subject: platform/x86: thinkpad_acpi: Disable Bluetooth for some machines
+
+From: Jiaxun Yang <jiaxun.yang@flygoat.com>
+
+commit f7db839fccf087664e5587966220821289b6a9cb upstream.
+
+Some AMD based ThinkPads have a firmware bug that calling
+"GBDC" will cause Bluetooth on Intel wireless cards blocked.
+
+Probe these models by DMI match and disable Bluetooth subdriver
+if specified Intel wireless card exist.
+
+Cc: stable <stable@vger.kernel.org> # 4.14+
+Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/platform/x86/thinkpad_acpi.c | 72 ++++++++++++++++++++++++++++++++++-
+ 1 file changed, 70 insertions(+), 2 deletions(-)
+
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -79,7 +79,7 @@
+ #include <linux/jiffies.h>
+ #include <linux/workqueue.h>
+ #include <linux/acpi.h>
+-#include <linux/pci_ids.h>
++#include <linux/pci.h>
+ #include <linux/power_supply.h>
+ #include <linux/thinkpad_acpi.h>
+ #include <sound/core.h>
+@@ -4496,6 +4496,74 @@ static void bluetooth_exit(void)
+ bluetooth_shutdown();
+ }
+
++static const struct dmi_system_id bt_fwbug_list[] __initconst = {
++ {
++ .ident = "ThinkPad E485",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_BOARD_NAME, "20KU"),
++ },
++ },
++ {
++ .ident = "ThinkPad E585",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_BOARD_NAME, "20KV"),
++ },
++ },
++ {
++ .ident = "ThinkPad A285 - 20MW",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_BOARD_NAME, "20MW"),
++ },
++ },
++ {
++ .ident = "ThinkPad A285 - 20MX",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_BOARD_NAME, "20MX"),
++ },
++ },
++ {
++ .ident = "ThinkPad A485 - 20MU",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_BOARD_NAME, "20MU"),
++ },
++ },
++ {
++ .ident = "ThinkPad A485 - 20MV",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_BOARD_NAME, "20MV"),
++ },
++ },
++ {}
++};
++
++static const struct pci_device_id fwbug_cards_ids[] __initconst = {
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x24F3) },
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x24FD) },
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2526) },
++ {}
++};
++
++
++static int __init have_bt_fwbug(void)
++{
++ /*
++ * Some AMD based ThinkPads have a firmware bug that calling
++ * "GBDC" will cause bluetooth on Intel wireless cards blocked
++ */
++ if (dmi_check_system(bt_fwbug_list) && pci_dev_present(fwbug_cards_ids)) {
++ vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_RFKILL,
++ FW_BUG "disable bluetooth subdriver for Intel cards\n");
++ return 1;
++ } else
++ return 0;
++}
++
+ static int __init bluetooth_init(struct ibm_init_struct *iibm)
+ {
+ int res;
+@@ -4508,7 +4576,7 @@ static int __init bluetooth_init(struct
+
+ /* bluetooth not supported on 570, 600e/x, 770e, 770x, A21e, A2xm/p,
+ G4x, R30, R31, R40e, R50e, T20-22, X20-21 */
+- tp_features.bluetooth = hkey_handle &&
++ tp_features.bluetooth = !have_bt_fwbug() && hkey_handle &&
+ acpi_evalf(hkey_handle, &status, "GBDC", "qd");
+
+ vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_RFKILL,
bfq-update-internal-depth-state-when-queue-depth-cha.patch
+platform-x86-sony-laptop-fix-unintentional-fall-through.patch
+platform-x86-thinkpad_acpi-disable-bluetooth-for-some-machines.patch
+platform-x86-dell-laptop-fix-rfkill-functionality.patch
+hwmon-pwm-fan-disable-pwm-if-fetching-cooling-data-fails.patch
+kernfs-fix-barrier-usage-in-__kernfs_new_node.patch
+virt-vbox-sanity-check-parameter-types-for-hgcm-calls-coming-from-userspace.patch
--- /dev/null
+From cf4f2ad6b87dda2dbe0573b1ebeb0273f8d4aac6 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 4 Apr 2019 14:39:09 +0200
+Subject: virt: vbox: Sanity-check parameter types for hgcm-calls coming from userspace
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit cf4f2ad6b87dda2dbe0573b1ebeb0273f8d4aac6 upstream.
+
+Userspace can make host function calls, called hgcm-calls through the
+/dev/vboxguest device.
+
+In this case we should not accept all hgcm-function-parameter-types, some
+are only valid for in kernel calls.
+
+This commit adds proper hgcm-function-parameter-type validation to the
+ioctl for doing a hgcm-call from userspace.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/virt/vboxguest/vboxguest_core.c | 31 +++++++++++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+--- a/drivers/virt/vboxguest/vboxguest_core.c
++++ b/drivers/virt/vboxguest/vboxguest_core.c
+@@ -1263,6 +1263,20 @@ static int vbg_ioctl_hgcm_disconnect(str
+ return ret;
+ }
+
++static bool vbg_param_valid(enum vmmdev_hgcm_function_parameter_type type)
++{
++ switch (type) {
++ case VMMDEV_HGCM_PARM_TYPE_32BIT:
++ case VMMDEV_HGCM_PARM_TYPE_64BIT:
++ case VMMDEV_HGCM_PARM_TYPE_LINADDR:
++ case VMMDEV_HGCM_PARM_TYPE_LINADDR_IN:
++ case VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT:
++ return true;
++ default:
++ return false;
++ }
++}
++
+ static int vbg_ioctl_hgcm_call(struct vbg_dev *gdev,
+ struct vbg_session *session, bool f32bit,
+ struct vbg_ioctl_hgcm_call *call)
+@@ -1298,6 +1312,23 @@ static int vbg_ioctl_hgcm_call(struct vb
+ }
+ call->hdr.size_out = actual_size;
+
++ /* Validate parameter types */
++ if (f32bit) {
++ struct vmmdev_hgcm_function_parameter32 *parm =
++ VBG_IOCTL_HGCM_CALL_PARMS32(call);
++
++ for (i = 0; i < call->parm_count; i++)
++ if (!vbg_param_valid(parm[i].type))
++ return -EINVAL;
++ } else {
++ struct vmmdev_hgcm_function_parameter *parm =
++ VBG_IOCTL_HGCM_CALL_PARMS(call);
++
++ for (i = 0; i < call->parm_count; i++)
++ if (!vbg_param_valid(parm[i].type))
++ return -EINVAL;
++ }
++
+ /*
+ * Validate the client id.
+ */
projects / thirdparty / kernel / stable-queue.git / commitdiff
