From: Greg Kroah-Hartman Date: Tue, 17 Sep 2019 13:13:05 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.14.145~18 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1fea6a217f0b82e318fb94ae38c700c73fa04861;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: drm-mediatek-mtk_drm_drv.c-add-of_node_put-before-goto.patch drm-panel-orientation-quirks-add-extra-quirk-table-entry-for-gpd-micropc.patch iio-adc-stm32-dfsdm-fix-data-type.patch modules-fix-bug-when-load-module-with-rodata-n.patch modules-fix-compile-error-if-don-t-have-strict-module-rwx.patch revert-bluetooth-btusb-driver-to-enable-the-usb-wakeup-feature.patch --- diff --git a/queue-4.19/drm-mediatek-mtk_drm_drv.c-add-of_node_put-before-goto.patch b/queue-4.19/drm-mediatek-mtk_drm_drv.c-add-of_node_put-before-goto.patch new file mode 100644 index 00000000000..9f7d32aee82 --- /dev/null +++ b/queue-4.19/drm-mediatek-mtk_drm_drv.c-add-of_node_put-before-goto.patch @@ -0,0 +1,44 @@ +From 165d42c012be69900f0e2f8545626cb9e7d4a832 Mon Sep 17 00:00:00 2001 +From: Nishka Dasgupta +Date: Sat, 6 Jul 2019 19:00:21 +0530 +Subject: drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto + +From: Nishka Dasgupta + +commit 165d42c012be69900f0e2f8545626cb9e7d4a832 upstream. + +Each iteration of for_each_child_of_node puts the previous +node, but in the case of a goto from the middle of the loop, there is +no put, thus causing a memory leak. Hence add an of_node_put before the +goto in two places. +Issue found with Coccinelle. + +Fixes: 119f5173628a (drm/mediatek: Add DRM Driver for Mediatek SoC MT8173) + +Signed-off-by: Nishka Dasgupta +Signed-off-by: CK Hu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -566,12 +566,15 @@ static int mtk_drm_probe(struct platform + comp = devm_kzalloc(dev, sizeof(*comp), GFP_KERNEL); + if (!comp) { + ret = -ENOMEM; ++ of_node_put(node); + goto err_node; + } + + ret = mtk_ddp_comp_init(dev, node, comp, comp_id, NULL); +- if (ret) ++ if (ret) { ++ of_node_put(node); + goto err_node; ++ } + + private->ddp_comp[comp_id] = comp; + } diff --git a/queue-4.19/drm-panel-orientation-quirks-add-extra-quirk-table-entry-for-gpd-micropc.patch b/queue-4.19/drm-panel-orientation-quirks-add-extra-quirk-table-entry-for-gpd-micropc.patch new file mode 100644 index 00000000000..ebedec06f24 --- /dev/null +++ b/queue-4.19/drm-panel-orientation-quirks-add-extra-quirk-table-entry-for-gpd-micropc.patch @@ -0,0 +1,51 @@ +From dae1ccee012ea7514af8e4a88429844157aca7dc Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Mon, 24 Jun 2019 17:40:14 +0200 +Subject: drm: panel-orientation-quirks: Add extra quirk table entry for GPD MicroPC + +From: Hans de Goede + +commit dae1ccee012ea7514af8e4a88429844157aca7dc upstream. + +Newer GPD MicroPC BIOS versions have proper DMI strings, add an extra quirk +table entry for these new strings. This is good news, as this means that we +no longer have to update the BIOS dates list with every BIOS update. + +Fixes: 652b8b086538("drm: panel-orientation-quirks: Add quirk for GPD MicroPC") +Acked-by: Maxime Ripard +Signed-off-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/20190624154014.8557-2-hdegoede@redhat.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -82,6 +82,12 @@ static const struct drm_dmi_panel_orient + .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, + }; + ++static const struct drm_dmi_panel_orientation_data lcd720x1280_rightside_up = { ++ .width = 720, ++ .height = 1280, ++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, ++}; ++ + static const struct drm_dmi_panel_orientation_data lcd800x1280_rightside_up = { + .width = 800, + .height = 1280, +@@ -109,6 +115,12 @@ static const struct dmi_system_id orient + DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"), + }, + .driver_data = (void *)&gpd_micropc, ++ }, { /* GPD MicroPC (later BIOS versions with proper DMI strings) */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "MicroPC"), ++ }, ++ .driver_data = (void *)&lcd720x1280_rightside_up, + }, { /* + * GPD Pocket, note that the the DMI data is less generic then + * it seems, devices with a board-vendor of "AMI Corporation" diff --git a/queue-4.19/iio-adc-stm32-dfsdm-fix-data-type.patch b/queue-4.19/iio-adc-stm32-dfsdm-fix-data-type.patch new file mode 100644 index 00000000000..88f3fd084b8 --- /dev/null +++ b/queue-4.19/iio-adc-stm32-dfsdm-fix-data-type.patch @@ -0,0 +1,42 @@ +From c6013bf50e2a2a94ab3d012e191096432aa50c6f Mon Sep 17 00:00:00 2001 +From: Olivier Moysan +Date: Wed, 19 Jun 2019 15:03:48 +0200 +Subject: iio: adc: stm32-dfsdm: fix data type + +From: Olivier Moysan + +commit c6013bf50e2a2a94ab3d012e191096432aa50c6f upstream. + +Fix the data type as DFSDM raw output is complements 2, +24bits left aligned in a 32-bit register. +This change does not affect AUDIO path +- Set data as signed for IIO (as for AUDIO) +- Set 8 bit right shift for IIO. +The 8 LSBs bits of data contains channel info and are masked. + +Signed-off-by: Olivier Moysan +Fixes: e2e6771c6462 ("IIO: ADC: add STM32 DFSDM sigma delta ADC support") +Acked-by: Fabrice Gasnier +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/stm32-dfsdm-adc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/iio/adc/stm32-dfsdm-adc.c ++++ b/drivers/iio/adc/stm32-dfsdm-adc.c +@@ -981,11 +981,11 @@ static int stm32_dfsdm_adc_chan_init_one + ch->info_mask_shared_by_all = BIT(IIO_CHAN_INFO_OVERSAMPLING_RATIO); + + if (adc->dev_data->type == DFSDM_AUDIO) { +- ch->scan_type.sign = 's'; + ch->ext_info = dfsdm_adc_audio_ext_info; + } else { +- ch->scan_type.sign = 'u'; ++ ch->scan_type.shift = 8; + } ++ ch->scan_type.sign = 's'; + ch->scan_type.realbits = 24; + ch->scan_type.storagebits = 32; + diff --git a/queue-4.19/modules-fix-bug-when-load-module-with-rodata-n.patch b/queue-4.19/modules-fix-bug-when-load-module-with-rodata-n.patch new file mode 100644 index 00000000000..a66e777fa37 --- /dev/null +++ b/queue-4.19/modules-fix-bug-when-load-module-with-rodata-n.patch @@ -0,0 +1,97 @@ +From 2eef1399a866c57687962e15142b141a4f8e7862 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Thu, 20 Jun 2019 10:18:14 +0800 +Subject: modules: fix BUG when load module with rodata=n + +From: Yang Yingliang + +commit 2eef1399a866c57687962e15142b141a4f8e7862 upstream. + +When loading a module with rodata=n, it causes an executing +NX-protected page BUG. + +[ 32.379191] kernel tried to execute NX-protected page - exploit attempt? (uid: 0) +[ 32.382917] BUG: unable to handle page fault for address: ffffffffc0005000 +[ 32.385947] #PF: supervisor instruction fetch in kernel mode +[ 32.387662] #PF: error_code(0x0011) - permissions violation +[ 32.389352] PGD 240c067 P4D 240c067 PUD 240e067 PMD 421a52067 PTE 8000000421a53063 +[ 32.391396] Oops: 0011 [#1] SMP PTI +[ 32.392478] CPU: 7 PID: 2697 Comm: insmod Tainted: G O 5.2.0-rc5+ #202 +[ 32.394588] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 +[ 32.398157] RIP: 0010:ko_test_init+0x0/0x1000 [ko_test] +[ 32.399662] Code: Bad RIP value. +[ 32.400621] RSP: 0018:ffffc900029f3ca8 EFLAGS: 00010246 +[ 32.402171] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 +[ 32.404332] RDX: 00000000000004c7 RSI: 0000000000000cc0 RDI: ffffffffc0005000 +[ 32.406347] RBP: ffffffffc0005000 R08: ffff88842fbebc40 R09: ffffffff810ede4a +[ 32.408392] R10: ffffea00108e3480 R11: 0000000000000000 R12: ffff88842bee21a0 +[ 32.410472] R13: 0000000000000001 R14: 0000000000000001 R15: ffffc900029f3e78 +[ 32.412609] FS: 00007fb4f0c0a700(0000) GS:ffff88842fbc0000(0000) knlGS:0000000000000000 +[ 32.414722] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 32.416290] CR2: ffffffffc0004fd6 CR3: 0000000421a90004 CR4: 0000000000020ee0 +[ 32.418471] Call Trace: +[ 32.419136] do_one_initcall+0x41/0x1df +[ 32.420199] ? _cond_resched+0x10/0x40 +[ 32.421433] ? kmem_cache_alloc_trace+0x36/0x160 +[ 32.422827] do_init_module+0x56/0x1f7 +[ 32.423946] load_module+0x1e67/0x2580 +[ 32.424947] ? __alloc_pages_nodemask+0x150/0x2c0 +[ 32.426413] ? map_vm_area+0x2d/0x40 +[ 32.427530] ? __vmalloc_node_range+0x1ef/0x260 +[ 32.428850] ? __do_sys_init_module+0x135/0x170 +[ 32.430060] ? _cond_resched+0x10/0x40 +[ 32.431249] __do_sys_init_module+0x135/0x170 +[ 32.432547] do_syscall_64+0x43/0x120 +[ 32.433853] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Because if rodata=n, set_memory_x() can't be called, fix this by +calling set_memory_x in complete_formation(); + +Fixes: f2c65fb3221a ("x86/modules: Avoid breaking W^X while loading modules") +Suggested-by: Jian Cheng +Reviewed-by: Nadav Amit +Signed-off-by: Yang Yingliang +Signed-off-by: Jessica Yu +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/module.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -1956,13 +1956,9 @@ void module_enable_ro(const struct modul + return; + + frob_text(&mod->core_layout, set_memory_ro); +- frob_text(&mod->core_layout, set_memory_x); + + frob_rodata(&mod->core_layout, set_memory_ro); +- + frob_text(&mod->init_layout, set_memory_ro); +- frob_text(&mod->init_layout, set_memory_x); +- + frob_rodata(&mod->init_layout, set_memory_ro); + + if (after_init) +@@ -2049,6 +2045,12 @@ static void module_enable_nx(const struc + static void module_disable_nx(const struct module *mod) { } + #endif + ++static void module_enable_x(const struct module *mod) ++{ ++ frob_text(&mod->core_layout, set_memory_x); ++ frob_text(&mod->init_layout, set_memory_x); ++} ++ + #ifdef CONFIG_LIVEPATCH + /* + * Persist Elf information about a module. Copy the Elf header, +@@ -3604,6 +3606,7 @@ static int complete_formation(struct mod + + module_enable_ro(mod, false); + module_enable_nx(mod); ++ module_enable_x(mod); + + /* Mark state as coming so strong_try_module_get() ignores us, + * but kallsyms etc. can see us. */ diff --git a/queue-4.19/modules-fix-compile-error-if-don-t-have-strict-module-rwx.patch b/queue-4.19/modules-fix-compile-error-if-don-t-have-strict-module-rwx.patch new file mode 100644 index 00000000000..1b04ae94cd8 --- /dev/null +++ b/queue-4.19/modules-fix-compile-error-if-don-t-have-strict-module-rwx.patch @@ -0,0 +1,71 @@ +From 93651f80dcb616b8c9115cdafc8e57a781af22d0 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Tue, 25 Jun 2019 17:40:28 +0800 +Subject: modules: fix compile error if don't have strict module rwx + +From: Yang Yingliang + +commit 93651f80dcb616b8c9115cdafc8e57a781af22d0 upstream. + +If CONFIG_ARCH_HAS_STRICT_MODULE_RWX is not defined, +we need stub for module_enable_nx() and module_enable_x(). + +If CONFIG_ARCH_HAS_STRICT_MODULE_RWX is defined, but +CONFIG_STRICT_MODULE_RWX is disabled, we need stub for +module_enable_nx. + +Move frob_text() outside of the CONFIG_STRICT_MODULE_RWX, +because it is needed anyway. + +Fixes: 2eef1399a866 ("modules: fix BUG when load module with rodata=n") +Signed-off-by: Yang Yingliang +Signed-off-by: Jessica Yu +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/module.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -1884,7 +1884,7 @@ static void mod_sysfs_teardown(struct mo + mod_sysfs_fini(mod); + } + +-#ifdef CONFIG_STRICT_MODULE_RWX ++#ifdef CONFIG_ARCH_HAS_STRICT_MODULE_RWX + /* + * LKM RO/NX protection: protect module's text/ro-data + * from modification and any data from execution. +@@ -1907,6 +1907,7 @@ static void frob_text(const struct modul + layout->text_size >> PAGE_SHIFT); + } + ++#ifdef CONFIG_STRICT_MODULE_RWX + static void frob_rodata(const struct module_layout *layout, + int (*set_memory)(unsigned long start, int num_pages)) + { +@@ -2039,17 +2040,21 @@ static void disable_ro_nx(const struct m + frob_writable_data(layout, set_memory_x); + } + +-#else ++#else /* !CONFIG_STRICT_MODULE_RWX */ + static void disable_ro_nx(const struct module_layout *layout) { } + static void module_enable_nx(const struct module *mod) { } + static void module_disable_nx(const struct module *mod) { } +-#endif ++#endif /* CONFIG_STRICT_MODULE_RWX */ + + static void module_enable_x(const struct module *mod) + { + frob_text(&mod->core_layout, set_memory_x); + frob_text(&mod->init_layout, set_memory_x); + } ++#else /* !CONFIG_ARCH_HAS_STRICT_MODULE_RWX */ ++static void module_enable_nx(const struct module *mod) { } ++static void module_enable_x(const struct module *mod) { } ++#endif /* CONFIG_ARCH_HAS_STRICT_MODULE_RWX */ + + #ifdef CONFIG_LIVEPATCH + /* diff --git a/queue-4.19/revert-bluetooth-btusb-driver-to-enable-the-usb-wakeup-feature.patch b/queue-4.19/revert-bluetooth-btusb-driver-to-enable-the-usb-wakeup-feature.patch new file mode 100644 index 00000000000..6fa913c1a39 --- /dev/null +++ b/queue-4.19/revert-bluetooth-btusb-driver-to-enable-the-usb-wakeup-feature.patch @@ -0,0 +1,57 @@ +From 1ffdb51f28e8ec6be0a2b812c1765b5cf5c44a8f Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Mon, 19 Aug 2019 12:04:08 -0500 +Subject: Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature" + +From: Mario Limonciello + +commit 1ffdb51f28e8ec6be0a2b812c1765b5cf5c44a8f upstream. + +This reverts commit a0085f2510e8976614ad8f766b209448b385492f. + +This commit has caused regressions in notebooks that support suspend +to idle such as the XPS 9360, XPS 9370 and XPS 9380. + +These notebooks will wakeup from suspend to idle from an unsolicited +advertising packet from an unpaired BLE device. + +In a bug report it was sugggested that this is caused by a generic +lack of LE privacy support. Revert this commit until that behavior +can be avoided by the kernel. + +Fixes: a0085f2510e8 ("Bluetooth: btusb: driver to enable the usb-wakeup feature") +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=200039 +Link: https://marc.info/?l=linux-bluetooth&m=156441081612627&w=2 +Link: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/750073/ +CC: Bastien Nocera +CC: Christian Kellner +CC: Sukumar Ghorai +Signed-off-by: Mario Limonciello +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/btusb.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -1139,10 +1139,6 @@ static int btusb_open(struct hci_dev *hd + } + + data->intf->needs_remote_wakeup = 1; +- /* device specific wakeup source enabled and required for USB +- * remote wakeup while host is suspended +- */ +- device_wakeup_enable(&data->udev->dev); + + if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags)) + goto done; +@@ -1206,7 +1202,6 @@ static int btusb_close(struct hci_dev *h + goto failed; + + data->intf->needs_remote_wakeup = 0; +- device_wakeup_disable(&data->udev->dev); + usb_autopm_put_interface(data->intf); + + failed: diff --git a/queue-4.19/series b/queue-4.19/series index 3cee3be4f19..4467685fedf 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -38,3 +38,9 @@ crypto-talitos-fix-ecb-algs-ivsize.patch crypto-talitos-do-not-modify-req-cryptlen-on-decryption.patch crypto-talitos-hmac-snoop-no-afeu-mode-requires-sw-icv-checking.patch firmware-ti_sci-always-request-response-from-firmware.patch +drm-panel-orientation-quirks-add-extra-quirk-table-entry-for-gpd-micropc.patch +drm-mediatek-mtk_drm_drv.c-add-of_node_put-before-goto.patch +revert-bluetooth-btusb-driver-to-enable-the-usb-wakeup-feature.patch +iio-adc-stm32-dfsdm-fix-data-type.patch +modules-fix-bug-when-load-module-with-rodata-n.patch +modules-fix-compile-error-if-don-t-have-strict-module-rwx.patch