From: Greg Kroah-Hartman Date: Sun, 11 Jun 2023 07:52:02 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v4.14.318~59 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=035703e12bfde7d53167d4a8678bb68af1852775;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: alsa-hda-realtek-add-a-quirk-for-hp-slim-desktop-s01.patch alsa-hda-realtek-add-lenovo-p3-tower-platform.patch alsa-hda-realtek-add-quirks-for-asus-rog-2024-laptops-using-cs35l41.patch batman-adv-broken-sync-while-rescheduling-delayed-work.patch input-psmouse-fix-oob-access-in-elantech-protocol.patch input-xpad-delete-a-razer-deathadder-mouse-vid-pid-entry.patch --- diff --git a/queue-5.10/alsa-hda-realtek-add-a-quirk-for-hp-slim-desktop-s01.patch b/queue-5.10/alsa-hda-realtek-add-a-quirk-for-hp-slim-desktop-s01.patch new file mode 100644 index 00000000000..eb757d92d92 --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-add-a-quirk-for-hp-slim-desktop-s01.patch @@ -0,0 +1,30 @@ +From 527c356b51f3ddee02c9ed5277538f85e30a2cdc Mon Sep 17 00:00:00 2001 +From: Ai Chao +Date: Fri, 26 May 2023 17:47:04 +0800 +Subject: ALSA: hda/realtek: Add a quirk for HP Slim Desktop S01 + +From: Ai Chao + +commit 527c356b51f3ddee02c9ed5277538f85e30a2cdc upstream. + +Add a quirk for HP Slim Desktop S01 to fixup headset MIC no presence. + +Signed-off-by: Ai Chao +Cc: +Link: https://lore.kernel.org/r/20230526094704.14597-1-aichao@kylinos.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -11162,6 +11162,7 @@ static const struct snd_pci_quirk alc662 + SND_PCI_QUIRK(0x103c, 0x8719, "HP", ALC897_FIXUP_HP_HSMIC_VERB), + SND_PCI_QUIRK(0x103c, 0x872b, "HP", ALC897_FIXUP_HP_HSMIC_VERB), + SND_PCI_QUIRK(0x103c, 0x873e, "HP", ALC671_FIXUP_HP_HEADSET_MIC2), ++ SND_PCI_QUIRK(0x103c, 0x8768, "HP Slim Desktop S01", ALC671_FIXUP_HP_HEADSET_MIC2), + SND_PCI_QUIRK(0x103c, 0x877e, "HP 288 Pro G6", ALC671_FIXUP_HP_HEADSET_MIC2), + SND_PCI_QUIRK(0x103c, 0x885f, "HP 288 Pro G8", ALC671_FIXUP_HP_HEADSET_MIC2), + SND_PCI_QUIRK(0x1043, 0x1080, "Asus UX501VW", ALC668_FIXUP_HEADSET_MODE), diff --git a/queue-5.10/alsa-hda-realtek-add-lenovo-p3-tower-platform.patch b/queue-5.10/alsa-hda-realtek-add-lenovo-p3-tower-platform.patch new file mode 100644 index 00000000000..1e6ba9d3dbf --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-add-lenovo-p3-tower-platform.patch @@ -0,0 +1,31 @@ +From 7ca4c8d4d3f41c2cd9b4cf22bb829bf03dac0956 Mon Sep 17 00:00:00 2001 +From: RenHai +Date: Fri, 2 Jun 2023 08:36:04 +0800 +Subject: ALSA: hda/realtek: Add Lenovo P3 Tower platform + +From: RenHai + +commit 7ca4c8d4d3f41c2cd9b4cf22bb829bf03dac0956 upstream. + +Headset microphone on this platform does not work without +ALC897_FIXUP_HEADSET_MIC_PIN fixup. + +Signed-off-by: RenHai +Cc: +Link: https://lore.kernel.org/r/20230602003604.975892-1-kean0048@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -11184,6 +11184,7 @@ static const struct snd_pci_quirk alc662 + SND_PCI_QUIRK(0x14cd, 0x5003, "USI", ALC662_FIXUP_USI_HEADSET_MODE), + SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC662_FIXUP_LENOVO_MULTI_CODECS), + SND_PCI_QUIRK(0x17aa, 0x1057, "Lenovo P360", ALC897_FIXUP_HEADSET_MIC_PIN), ++ SND_PCI_QUIRK(0x17aa, 0x1064, "Lenovo P3 Tower", ALC897_FIXUP_HEADSET_MIC_PIN), + SND_PCI_QUIRK(0x17aa, 0x32ca, "Lenovo ThinkCentre M80", ALC897_FIXUP_HEADSET_MIC_PIN), + SND_PCI_QUIRK(0x17aa, 0x32cb, "Lenovo ThinkCentre M70", ALC897_FIXUP_HEADSET_MIC_PIN), + SND_PCI_QUIRK(0x17aa, 0x32cf, "Lenovo ThinkCentre M950", ALC897_FIXUP_HEADSET_MIC_PIN), diff --git a/queue-5.10/alsa-hda-realtek-add-quirks-for-asus-rog-2024-laptops-using-cs35l41.patch b/queue-5.10/alsa-hda-realtek-add-quirks-for-asus-rog-2024-laptops-using-cs35l41.patch new file mode 100644 index 00000000000..d3c600cefb7 --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-add-quirks-for-asus-rog-2024-laptops-using-cs35l41.patch @@ -0,0 +1,43 @@ +From 811dd426a9b16cf61a86fdb12d5f5b983cbfb130 Mon Sep 17 00:00:00 2001 +From: Stefan Binding +Date: Mon, 5 Jun 2023 16:33:08 +0100 +Subject: ALSA: hda/realtek: Add quirks for Asus ROG 2024 laptops using CS35L41 + +From: Stefan Binding + +commit 811dd426a9b16cf61a86fdb12d5f5b983cbfb130 upstream. + +Add support for Asus ROG 2024 models using CS35L41 SPI with Internal +Boost. + +Signed-off-by: Stefan Binding +Cc: +Link: https://lore.kernel.org/r/20230605153308.448550-1-sbinding@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -9042,6 +9042,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1b11, "ASUS UX431DA", ALC294_FIXUP_ASUS_COEF_1B), + SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC), ++ SND_PCI_QUIRK(0x1043, 0x1b93, "ASUS G614JVR/JIR", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x1043, 0x1c62, "ASUS GU603", ALC289_FIXUP_ASUS_GA401), +@@ -9057,6 +9058,11 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1f92, "ASUS ROG Flow X16", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), ++ SND_PCI_QUIRK(0x1043, 0x3a20, "ASUS G614JZR", ALC245_FIXUP_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x3a30, "ASUS G814JVR/JIR", ALC245_FIXUP_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x3a40, "ASUS G814JZR", ALC245_FIXUP_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x3a50, "ASUS G834JYR/JZR", ALC245_FIXUP_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x3a60, "ASUS G634JYR/JZR", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x834a, "ASUS S101", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC), diff --git a/queue-5.10/batman-adv-broken-sync-while-rescheduling-delayed-work.patch b/queue-5.10/batman-adv-broken-sync-while-rescheduling-delayed-work.patch new file mode 100644 index 00000000000..876377839c0 --- /dev/null +++ b/queue-5.10/batman-adv-broken-sync-while-rescheduling-delayed-work.patch @@ -0,0 +1,58 @@ +From abac3ac97fe8734b620e7322a116450d7f90aa43 Mon Sep 17 00:00:00 2001 +From: Vladislav Efanov +Date: Fri, 26 May 2023 19:16:32 +0300 +Subject: batman-adv: Broken sync while rescheduling delayed work + +From: Vladislav Efanov + +commit abac3ac97fe8734b620e7322a116450d7f90aa43 upstream. + +Syzkaller got a lot of crashes like: +KASAN: use-after-free Write in *_timers* + +All of these crashes point to the same memory area: + +The buggy address belongs to the object at ffff88801f870000 + which belongs to the cache kmalloc-8k of size 8192 +The buggy address is located 5320 bytes inside of + 8192-byte region [ffff88801f870000, ffff88801f872000) + +This area belongs to : + batadv_priv->batadv_priv_dat->delayed_work->timer_list + +The reason for these issues is the lack of synchronization. Delayed +work (batadv_dat_purge) schedules new timer/work while the device +is being deleted. As the result new timer/delayed work is set after +cancel_delayed_work_sync() was called. So after the device is freed +the timer list contains pointer to already freed memory. + +Found by Linux Verification Center (linuxtesting.org) with syzkaller. + +Cc: stable@kernel.org +Fixes: 2f1dfbe18507 ("batman-adv: Distributed ARP Table - implement local storage") +Signed-off-by: Vladislav Efanov +Acked-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/distributed-arp-table.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/batman-adv/distributed-arp-table.c ++++ b/net/batman-adv/distributed-arp-table.c +@@ -102,7 +102,6 @@ static void batadv_dat_purge(struct work + */ + static void batadv_dat_start_timer(struct batadv_priv *bat_priv) + { +- INIT_DELAYED_WORK(&bat_priv->dat.work, batadv_dat_purge); + queue_delayed_work(batadv_event_workqueue, &bat_priv->dat.work, + msecs_to_jiffies(10000)); + } +@@ -822,6 +821,7 @@ int batadv_dat_init(struct batadv_priv * + if (!bat_priv->dat.hash) + return -ENOMEM; + ++ INIT_DELAYED_WORK(&bat_priv->dat.work, batadv_dat_purge); + batadv_dat_start_timer(bat_priv); + + batadv_tvlv_handler_register(bat_priv, batadv_dat_tvlv_ogm_handler_v1, diff --git a/queue-5.10/input-psmouse-fix-oob-access-in-elantech-protocol.patch b/queue-5.10/input-psmouse-fix-oob-access-in-elantech-protocol.patch new file mode 100644 index 00000000000..aabf98d6c2e --- /dev/null +++ b/queue-5.10/input-psmouse-fix-oob-access-in-elantech-protocol.patch @@ -0,0 +1,54 @@ +From 7b63a88bb62ba2ddf5fcd956be85fe46624628b9 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Thu, 11 May 2023 12:08:37 -0700 +Subject: Input: psmouse - fix OOB access in Elantech protocol + +From: Dmitry Torokhov + +commit 7b63a88bb62ba2ddf5fcd956be85fe46624628b9 upstream. + +The kernel only allocate 5 MT slots; check that transmitted slot ID +falls within the acceptable range. + +Link: https://lore.kernel.org/r/ZFnEL91nrT789dbG@google.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/mouse/elantech.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -674,10 +674,11 @@ static void process_packet_head_v4(struc + struct input_dev *dev = psmouse->dev; + struct elantech_data *etd = psmouse->private; + unsigned char *packet = psmouse->packet; +- int id = ((packet[3] & 0xe0) >> 5) - 1; ++ int id; + int pres, traces; + +- if (id < 0) ++ id = ((packet[3] & 0xe0) >> 5) - 1; ++ if (id < 0 || id >= ETP_MAX_FINGERS) + return; + + etd->mt[id].x = ((packet[1] & 0x0f) << 8) | packet[2]; +@@ -707,7 +708,7 @@ static void process_packet_motion_v4(str + int id, sid; + + id = ((packet[0] & 0xe0) >> 5) - 1; +- if (id < 0) ++ if (id < 0 || id >= ETP_MAX_FINGERS) + return; + + sid = ((packet[3] & 0xe0) >> 5) - 1; +@@ -728,7 +729,7 @@ static void process_packet_motion_v4(str + input_report_abs(dev, ABS_MT_POSITION_X, etd->mt[id].x); + input_report_abs(dev, ABS_MT_POSITION_Y, etd->mt[id].y); + +- if (sid >= 0) { ++ if (sid >= 0 && sid < ETP_MAX_FINGERS) { + etd->mt[sid].x += delta_x2 * weight; + etd->mt[sid].y -= delta_y2 * weight; + input_mt_slot(dev, sid); diff --git a/queue-5.10/input-xpad-delete-a-razer-deathadder-mouse-vid-pid-entry.patch b/queue-5.10/input-xpad-delete-a-razer-deathadder-mouse-vid-pid-entry.patch new file mode 100644 index 00000000000..8ce19d47d3b --- /dev/null +++ b/queue-5.10/input-xpad-delete-a-razer-deathadder-mouse-vid-pid-entry.patch @@ -0,0 +1,73 @@ +From feee70f4568650cf44c573488798ffc0a2faeea3 Mon Sep 17 00:00:00 2001 +From: Ismael Ferreras Morezuelas +Date: Tue, 23 May 2023 14:45:10 -0700 +Subject: Input: xpad - delete a Razer DeathAdder mouse VID/PID entry + +From: Ismael Ferreras Morezuelas + +commit feee70f4568650cf44c573488798ffc0a2faeea3 upstream. + +While doing my research to improve the xpad device names I noticed +that the 1532:0037 VID/PID seems to be used by the DeathAdder 2013, +so that Razer Sabertooth instance looked wrong and very suspect to +me. I didn't see any mention in the official drivers, either. + +After doing more research, it turns out that the xpad list +is used by many other projects (like Steam) as-is [1], this +issue was reported [2] and Valve/Sam Lantinga fixed it [3]: + +[1]: https://github.com/libsdl-org/SDL/blob/dcc5eef0e2395854b254ea2873a4899edab347c6/src/joystick/controller_type.h#L251 +[2]: https://steamcommunity.com/app/353380/discussions/0/1743392486228754770/ +[3]: https://hg.libsdl.org/SDL/rev/29809f6f0271 + +(With multiple Internet users reporting similar issues, not linked here) + +After not being able to find the correct VID/PID combination anywhere +on the Internet and not receiving any reply from Razer support I did +some additional detective work, it seems like it presents itself as +"Razer Sabertooth Gaming Controller (XBOX360)", code 1689:FE00. + +Leaving us with this: + * Razer Sabertooth (1689:fe00) + * Razer Sabertooth Elite (24c6:5d04) + * Razer DeathAdder 2013 (1532:0037) [note: not a gamepad] + +So, to sum things up; remove this conflicting/duplicate entry: + +{ 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 }, + +As the real/correct one is already present there, even if +the Internet as a whole insists on presenting it as the +Razer Sabertooth Elite, which (by all accounts) is not: + +{ 0x1689, 0xfe00, "Razer Sabertooth", 0, XTYPE_XBOX360 }, + +Actual change in SDL2 referencing this kernel issue: +https://github.com/libsdl-org/SDL/commit/e5e54169754ca5d3e86339d968b20126d9da0a15 + +For more information of the device, take a look here: +https://github.com/xboxdrv/xboxdrv/pull/59 + +You can see a lsusb dump here: https://github.com/xboxdrv/xboxdrv/files/76581/Qa6dBcrv.txt + +Fixes: f554f619b70 ("Input: xpad - sync device IDs with xboxdrv") +Signed-off-by: Ismael Ferreras Morezuelas +Reviewed-by: Cameron Gutman +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/5c12dbdb-5774-fc68-5c58-ca596383663e@gmail.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -262,7 +262,6 @@ static const struct xpad_device { + { 0x1430, 0xf801, "RedOctane Controller", 0, XTYPE_XBOX360 }, + { 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 }, + { 0x146b, 0x0604, "Bigben Interactive DAIJA Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, +- { 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 }, + { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, + { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE }, + { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 }, diff --git a/queue-5.10/series b/queue-5.10/series index 24c5e7e65d8..bd7ee502e0f 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -32,3 +32,9 @@ lib-cpu_rmap-fix-potential-use-after-free-in-irq_cpu.patch bnxt_en-don-t-issue-ap-reset-during-ethtool-s-reset-.patch bnxt_en-query-default-vlan-before-vnic-setup-on-a-vf.patch bnxt_en-implement-.set_port-.unset_port-udp-tunnel-c.patch +batman-adv-broken-sync-while-rescheduling-delayed-work.patch +input-xpad-delete-a-razer-deathadder-mouse-vid-pid-entry.patch +input-psmouse-fix-oob-access-in-elantech-protocol.patch +alsa-hda-realtek-add-a-quirk-for-hp-slim-desktop-s01.patch +alsa-hda-realtek-add-lenovo-p3-tower-platform.patch +alsa-hda-realtek-add-quirks-for-asus-rog-2024-laptops-using-cs35l41.patch