From: Greg Kroah-Hartman Date: Thu, 1 Oct 2015 09:30:03 +0000 (+0200) Subject: 4.1-stable patches X-Git-Tag: v3.14.54~2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=078347a6468e962e084ef648ad4686e3613a3622;p=thirdparty%2Fkernel%2Fstable-queue.git 4.1-stable patches added patches: hp-wmi-limit-hotkey-enable.patch zram-fix-possible-use-after-free-in-zcomp_create.patch --- diff --git a/queue-4.1/hp-wmi-limit-hotkey-enable.patch b/queue-4.1/hp-wmi-limit-hotkey-enable.patch new file mode 100644 index 00000000000..cc8175f87a3 --- /dev/null +++ b/queue-4.1/hp-wmi-limit-hotkey-enable.patch @@ -0,0 +1,94 @@ +From 8a1513b49321e503fd6c8b6793e3b1f9a8a3285b Mon Sep 17 00:00:00 2001 +From: Kyle Evans +Date: Fri, 11 Sep 2015 10:40:17 -0500 +Subject: hp-wmi: limit hotkey enable + +From: Kyle Evans + +commit 8a1513b49321e503fd6c8b6793e3b1f9a8a3285b upstream. + +Do not write initialize magic on systems that do not have +feature query 0xb. Fixes Bug #82451. + +Redefine FEATURE_QUERY to align with 0xb and FEATURE2 with 0xd +for code clearity. + +Add a new test function, hp_wmi_bios_2008_later() & simplify +hp_wmi_bios_2009_later(), which fixes a bug in cases where +an improper value is returned. Probably also fixes Bug #69131. + +Add missing __init tag. + +Signed-off-by: Kyle Evans +Signed-off-by: Darren Hart +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/hp-wmi.c | 31 ++++++++++++++++++++----------- + 1 file changed, 20 insertions(+), 11 deletions(-) + +--- a/drivers/platform/x86/hp-wmi.c ++++ b/drivers/platform/x86/hp-wmi.c +@@ -54,8 +54,9 @@ MODULE_ALIAS("wmi:5FB7F034-2C63-45e9-BE9 + #define HPWMI_HARDWARE_QUERY 0x4 + #define HPWMI_WIRELESS_QUERY 0x5 + #define HPWMI_BIOS_QUERY 0x9 ++#define HPWMI_FEATURE_QUERY 0xb + #define HPWMI_HOTKEY_QUERY 0xc +-#define HPWMI_FEATURE_QUERY 0xd ++#define HPWMI_FEATURE2_QUERY 0xd + #define HPWMI_WIRELESS2_QUERY 0x1b + #define HPWMI_POSTCODEERROR_QUERY 0x2a + +@@ -295,25 +296,33 @@ static int hp_wmi_tablet_state(void) + return (state & 0x4) ? 1 : 0; + } + +-static int __init hp_wmi_bios_2009_later(void) ++static int __init hp_wmi_bios_2008_later(void) + { + int state = 0; + int ret = hp_wmi_perform_query(HPWMI_FEATURE_QUERY, 0, &state, + sizeof(state), sizeof(state)); +- if (ret) +- return ret; ++ if (!ret) ++ return 1; + +- return (state & 0x10) ? 1 : 0; ++ return (ret == HPWMI_RET_UNKNOWN_CMDTYPE) ? 0 : -ENXIO; + } + +-static int hp_wmi_enable_hotkeys(void) ++static int __init hp_wmi_bios_2009_later(void) + { +- int ret; +- int query = 0x6e; ++ int state = 0; ++ int ret = hp_wmi_perform_query(HPWMI_FEATURE2_QUERY, 0, &state, ++ sizeof(state), sizeof(state)); ++ if (!ret) ++ return 1; + +- ret = hp_wmi_perform_query(HPWMI_BIOS_QUERY, 1, &query, sizeof(query), +- 0); ++ return (ret == HPWMI_RET_UNKNOWN_CMDTYPE) ? 0 : -ENXIO; ++} + ++static int __init hp_wmi_enable_hotkeys(void) ++{ ++ int value = 0x6e; ++ int ret = hp_wmi_perform_query(HPWMI_BIOS_QUERY, 1, &value, ++ sizeof(value), 0); + if (ret) + return -EINVAL; + return 0; +@@ -663,7 +672,7 @@ static int __init hp_wmi_input_setup(voi + hp_wmi_tablet_state()); + input_sync(hp_wmi_input_dev); + +- if (hp_wmi_bios_2009_later() == 4) ++ if (!hp_wmi_bios_2009_later() && hp_wmi_bios_2008_later()) + hp_wmi_enable_hotkeys(); + + status = wmi_install_notify_handler(HPWMI_EVENT_GUID, hp_wmi_notify, NULL); diff --git a/queue-4.1/series b/queue-4.1/series index a6810f9bdd7..b872eaa15b1 100644 --- a/queue-4.1/series +++ b/queue-4.1/series @@ -25,3 +25,5 @@ of_mdio-add-new-dt-property-managed-to-specify-the-phy-management-type.patch mvneta-use-inband-status-only-when-explicitly-enabled.patch netlink-fix-autobind-race-condition-that-leads-to-zero-port-id.patch netlink-replace-rhash_portid-with-bound.patch +zram-fix-possible-use-after-free-in-zcomp_create.patch +hp-wmi-limit-hotkey-enable.patch diff --git a/queue-4.1/zram-fix-possible-use-after-free-in-zcomp_create.patch b/queue-4.1/zram-fix-possible-use-after-free-in-zcomp_create.patch new file mode 100644 index 00000000000..ee934048ac6 --- /dev/null +++ b/queue-4.1/zram-fix-possible-use-after-free-in-zcomp_create.patch @@ -0,0 +1,65 @@ +From 3aaf14da807a4e9931a37f21e4251abb8a67021b Mon Sep 17 00:00:00 2001 +From: Luis Henriques +Date: Thu, 17 Sep 2015 16:01:40 -0700 +Subject: zram: fix possible use after free in zcomp_create() + +From: Luis Henriques + +commit 3aaf14da807a4e9931a37f21e4251abb8a67021b upstream. + +zcomp_create() verifies the success of zcomp_strm_{multi,single}_create() +through comp->stream, which can potentially be pointing to memory that +was freed if these functions returned an error. + +While at it, replace a 'ERR_PTR(-ENOMEM)' by a more generic +'ERR_PTR(error)' as in the future zcomp_strm_{multi,siggle}_create() +could return other error codes. Function documentation updated +accordingly. + +Fixes: beca3ec71fe5 ("zram: add multi stream functionality") +Signed-off-by: Luis Henriques +Acked-by: Sergey Senozhatsky +Acked-by: Minchan Kim +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/zram/zcomp.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/block/zram/zcomp.c ++++ b/drivers/block/zram/zcomp.c +@@ -325,12 +325,14 @@ void zcomp_destroy(struct zcomp *comp) + * allocate new zcomp and initialize it. return compressing + * backend pointer or ERR_PTR if things went bad. ERR_PTR(-EINVAL) + * if requested algorithm is not supported, ERR_PTR(-ENOMEM) in +- * case of allocation error. ++ * case of allocation error, or any other error potentially ++ * returned by functions zcomp_strm_{multi,single}_create. + */ + struct zcomp *zcomp_create(const char *compress, int max_strm) + { + struct zcomp *comp; + struct zcomp_backend *backend; ++ int error; + + backend = find_backend(compress); + if (!backend) +@@ -342,12 +344,12 @@ struct zcomp *zcomp_create(const char *c + + comp->backend = backend; + if (max_strm > 1) +- zcomp_strm_multi_create(comp, max_strm); ++ error = zcomp_strm_multi_create(comp, max_strm); + else +- zcomp_strm_single_create(comp); +- if (!comp->stream) { ++ error = zcomp_strm_single_create(comp); ++ if (error) { + kfree(comp); +- return ERR_PTR(-ENOMEM); ++ return ERR_PTR(error); + } + return comp; + }