--- /dev/null
+From 5f38b06db8af3ed6c2fc1b427504ca56fae2eacc Mon Sep 17 00:00:00 2001
+From: Tom Rix <trix@redhat.com>
+Date: Sun, 13 Sep 2020 12:02:03 -0700
+Subject: platform/x86: thinkpad_acpi: initialize tp_nvram_state variable
+
+From: Tom Rix <trix@redhat.com>
+
+commit 5f38b06db8af3ed6c2fc1b427504ca56fae2eacc upstream.
+
+clang static analysis flags this represenative problem
+thinkpad_acpi.c:2523:7: warning: Branch condition evaluates
+ to a garbage value
+ if (!oldn->mute ||
+ ^~~~~~~~~~~
+
+In hotkey_kthread() mute is conditionally set by hotkey_read_nvram()
+but unconditionally checked by hotkey_compare_and_issue_event().
+So the tp_nvram_state variable s[2] needs to be initialized.
+
+Fixes: 01e88f25985d ("ACPI: thinkpad-acpi: add CMOS NVRAM polling for hot keys (v9)")
+Signed-off-by: Tom Rix <trix@redhat.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: mark gross <mgross@linux.intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/platform/x86/thinkpad_acpi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -2477,7 +2477,7 @@ static void hotkey_compare_and_issue_eve
+ */
+ static int hotkey_kthread(void *data)
+ {
+- struct tp_nvram_state s[2];
++ struct tp_nvram_state s[2] = { 0 };
+ u32 poll_mask, event_mask;
+ unsigned int si, so;
+ unsigned long t;
--- /dev/null
+From 720ef73d1a239e33c3ad8fac356b9b1348e68aaf Mon Sep 17 00:00:00 2001
+From: Aaron Ma <aaron.ma@canonical.com>
+Date: Sat, 3 Oct 2020 01:09:16 +0800
+Subject: platform/x86: thinkpad_acpi: re-initialize ACPI buffer size when reuse
+
+From: Aaron Ma <aaron.ma@canonical.com>
+
+commit 720ef73d1a239e33c3ad8fac356b9b1348e68aaf upstream.
+
+Evaluating ACPI _BCL could fail, then ACPI buffer size will be set to 0.
+When reuse this ACPI buffer, AE_BUFFER_OVERFLOW will be triggered.
+
+Re-initialize buffer size will make ACPI evaluate successfully.
+
+Fixes: 46445b6b896fd ("thinkpad-acpi: fix handle locate for video and query of _BCL")
+Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/platform/x86/thinkpad_acpi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -6749,8 +6749,10 @@ static int __init tpacpi_query_bcl_level
+ list_for_each_entry(child, &device->children, node) {
+ acpi_status status = acpi_evaluate_object(child->handle, "_BCL",
+ NULL, &buffer);
+- if (ACPI_FAILURE(status))
++ if (ACPI_FAILURE(status)) {
++ buffer.length = ACPI_ALLOCATE_BUFFER;
+ continue;
++ }
+
+ obj = (union acpi_object *)buffer.pointer;
+ if (!obj || (obj->type != ACPI_TYPE_PACKAGE)) {
fbcon-fix-global-out-of-bounds-read-in-fbcon_get_font.patch
net-wireless-nl80211-fix-out-of-bounds-access-in-nl80211_del_key.patch
usermodehelper-reset-umask-to-default-before-executing-user-process.patch
+platform-x86-thinkpad_acpi-initialize-tp_nvram_state-variable.patch
+platform-x86-thinkpad_acpi-re-initialize-acpi-buffer-size-when-reuse.patch