From: Greg Kroah-Hartman Date: Mon, 13 May 2019 07:53:05 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v5.1.2~37 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3ba00a7b9bcadb27f45c2cda9e0b1394d4ab5396;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: hwmon-pwm-fan-disable-pwm-if-fetching-cooling-data-fails.patch kernfs-fix-barrier-usage-in-__kernfs_new_node.patch platform-x86-dell-laptop-fix-rfkill-functionality.patch platform-x86-sony-laptop-fix-unintentional-fall-through.patch platform-x86-thinkpad_acpi-disable-bluetooth-for-some-machines.patch virt-vbox-sanity-check-parameter-types-for-hgcm-calls-coming-from-userspace.patch --- diff --git a/queue-4.19/hwmon-pwm-fan-disable-pwm-if-fetching-cooling-data-fails.patch b/queue-4.19/hwmon-pwm-fan-disable-pwm-if-fetching-cooling-data-fails.patch new file mode 100644 index 00000000000..5671c6c84a2 --- /dev/null +++ b/queue-4.19/hwmon-pwm-fan-disable-pwm-if-fetching-cooling-data-fails.patch @@ -0,0 +1,34 @@ +From 53f1647da3e8fb3e89066798f0fdc045064d353d Mon Sep 17 00:00:00 2001 +From: Stefan Wahren +Date: Wed, 3 Apr 2019 14:48:33 +0200 +Subject: hwmon: (pwm-fan) Disable PWM if fetching cooling data fails + +From: Stefan Wahren + +commit 53f1647da3e8fb3e89066798f0fdc045064d353d upstream. + +In case pwm_fan_of_get_cooling_data() fails we should disable the PWM +just like in the other error cases. + +Fixes: 2e5219c77183 ("hwmon: (pwm-fan) Read PWM FAN configuration from device tree") +Cc: # 4.14+ +Reported-by: Guenter Rock +Signed-off-by: Stefan Wahren +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/pwm-fan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwmon/pwm-fan.c ++++ b/drivers/hwmon/pwm-fan.c +@@ -250,7 +250,7 @@ static int pwm_fan_probe(struct platform + + ret = pwm_fan_of_get_cooling_data(&pdev->dev, ctx); + if (ret) +- return ret; ++ goto err_pwm_disable; + + ctx->pwm_fan_state = ctx->pwm_fan_max_state; + if (IS_ENABLED(CONFIG_THERMAL)) { diff --git a/queue-4.19/kernfs-fix-barrier-usage-in-__kernfs_new_node.patch b/queue-4.19/kernfs-fix-barrier-usage-in-__kernfs_new_node.patch new file mode 100644 index 00000000000..48e95eae268 --- /dev/null +++ b/queue-4.19/kernfs-fix-barrier-usage-in-__kernfs_new_node.patch @@ -0,0 +1,38 @@ +From 998267900cee901c5d1dfa029a6304d00acbc29f Mon Sep 17 00:00:00 2001 +From: Andrea Parri +Date: Tue, 16 Apr 2019 14:17:11 +0200 +Subject: kernfs: fix barrier usage in __kernfs_new_node() + +From: Andrea Parri + +commit 998267900cee901c5d1dfa029a6304d00acbc29f upstream. + +smp_mb__before_atomic() can not be applied to atomic_set(). Remove the +barrier and rely on RELEASE synchronization. + +Fixes: ba16b2846a8c6 ("kernfs: add an API to get kernfs node from inode number") +Cc: stable@vger.kernel.org +Signed-off-by: Andrea Parri +Acked-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + fs/kernfs/dir.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/fs/kernfs/dir.c ++++ b/fs/kernfs/dir.c +@@ -650,11 +650,10 @@ static struct kernfs_node *__kernfs_new_ + kn->id.generation = gen; + + /* +- * set ino first. This barrier is paired with atomic_inc_not_zero in ++ * set ino first. This RELEASE is paired with atomic_inc_not_zero in + * kernfs_find_and_get_node_by_ino + */ +- smp_mb__before_atomic(); +- atomic_set(&kn->count, 1); ++ atomic_set_release(&kn->count, 1); + atomic_set(&kn->active, KN_DEACTIVATED_BIAS); + RB_CLEAR_NODE(&kn->rb); + diff --git a/queue-4.19/platform-x86-dell-laptop-fix-rfkill-functionality.patch b/queue-4.19/platform-x86-dell-laptop-fix-rfkill-functionality.patch new file mode 100644 index 00000000000..b5aca16881c --- /dev/null +++ b/queue-4.19/platform-x86-dell-laptop-fix-rfkill-functionality.patch @@ -0,0 +1,57 @@ +From 6cc13c28da5beee0f706db6450e190709700b34a Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Wed, 27 Mar 2019 09:25:34 -0500 +Subject: platform/x86: dell-laptop: fix rfkill functionality +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mario Limonciello + +commit 6cc13c28da5beee0f706db6450e190709700b34a upstream. + +When converting the driver two arguments were transposed leading +to rfkill not working. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201427 +Reported-by: Pepijn de Vos +Fixes: 549b49 ("platform/x86: dell-smbios: Introduce dispatcher for SMM calls") +Signed-off-by: Mario Limonciello +Acked-by: Pali Rohár +Cc: # 4.14.x +Signed-off-by: Darren Hart (VMware) +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/dell-laptop.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/platform/x86/dell-laptop.c ++++ b/drivers/platform/x86/dell-laptop.c +@@ -532,7 +532,7 @@ static void dell_rfkill_query(struct rfk + return; + } + +- dell_fill_request(&buffer, 0, 0x2, 0, 0); ++ dell_fill_request(&buffer, 0x2, 0, 0, 0); + ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL); + hwswitch = buffer.output[1]; + +@@ -563,7 +563,7 @@ static int dell_debugfs_show(struct seq_ + return ret; + status = buffer.output[1]; + +- dell_fill_request(&buffer, 0, 0x2, 0, 0); ++ dell_fill_request(&buffer, 0x2, 0, 0, 0); + hwswitch_ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL); + if (hwswitch_ret) + return hwswitch_ret; +@@ -648,7 +648,7 @@ static void dell_update_rfkill(struct wo + if (ret != 0) + return; + +- dell_fill_request(&buffer, 0, 0x2, 0, 0); ++ dell_fill_request(&buffer, 0x2, 0, 0, 0); + ret = dell_send_request(&buffer, CLASS_INFO, SELECT_RFKILL); + + if (ret == 0 && (status & BIT(0))) diff --git a/queue-4.19/platform-x86-sony-laptop-fix-unintentional-fall-through.patch b/queue-4.19/platform-x86-sony-laptop-fix-unintentional-fall-through.patch new file mode 100644 index 00000000000..318025af46a --- /dev/null +++ b/queue-4.19/platform-x86-sony-laptop-fix-unintentional-fall-through.patch @@ -0,0 +1,53 @@ +From 1cbd7a64959d33e7a2a1fa2bf36a62b350a9fcbd Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Wed, 24 Apr 2019 13:09:34 -0500 +Subject: platform/x86: sony-laptop: Fix unintentional fall-through + +From: Gustavo A. R. Silva + +commit 1cbd7a64959d33e7a2a1fa2bf36a62b350a9fcbd upstream. + +It seems that the default case should return AE_CTRL_TERMINATE, instead +of falling through to case ACPI_RESOURCE_TYPE_END_TAG and returning AE_OK; +otherwise the line of code at the end of the function is unreachable and +makes no sense: + +return AE_CTRL_TERMINATE; + +This fix is based on the following thread of discussion: + +https://lore.kernel.org/patchwork/patch/959782/ + +Fixes: 33a04454527e ("sony-laptop: Add SNY6001 device handling (sonypi reimplementation)") +Cc: stable@vger.kernel.org +Signed-off-by: Gustavo A. R. Silva +Reviewed-by: Kees Cook +Signed-off-by: Andy Shevchenko +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/sony-laptop.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/platform/x86/sony-laptop.c ++++ b/drivers/platform/x86/sony-laptop.c +@@ -4424,14 +4424,16 @@ sony_pic_read_possible_resource(struct a + } + return AE_OK; + } ++ ++ case ACPI_RESOURCE_TYPE_END_TAG: ++ return AE_OK; ++ + default: + dprintk("Resource %d isn't an IRQ nor an IO port\n", + resource->type); ++ return AE_CTRL_TERMINATE; + +- case ACPI_RESOURCE_TYPE_END_TAG: +- return AE_OK; + } +- return AE_CTRL_TERMINATE; + } + + static int sony_pic_possible_resources(struct acpi_device *device) diff --git a/queue-4.19/platform-x86-thinkpad_acpi-disable-bluetooth-for-some-machines.patch b/queue-4.19/platform-x86-thinkpad_acpi-disable-bluetooth-for-some-machines.patch new file mode 100644 index 00000000000..efb1a507fb4 --- /dev/null +++ b/queue-4.19/platform-x86-thinkpad_acpi-disable-bluetooth-for-some-machines.patch @@ -0,0 +1,119 @@ +From f7db839fccf087664e5587966220821289b6a9cb Mon Sep 17 00:00:00 2001 +From: Jiaxun Yang +Date: Thu, 7 Mar 2019 17:37:16 +0800 +Subject: platform/x86: thinkpad_acpi: Disable Bluetooth for some machines + +From: Jiaxun Yang + +commit f7db839fccf087664e5587966220821289b6a9cb upstream. + +Some AMD based ThinkPads have a firmware bug that calling +"GBDC" will cause Bluetooth on Intel wireless cards blocked. + +Probe these models by DMI match and disable Bluetooth subdriver +if specified Intel wireless card exist. + +Cc: stable # 4.14+ +Signed-off-by: Jiaxun Yang +Signed-off-by: Andy Shevchenko +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/thinkpad_acpi.c | 72 ++++++++++++++++++++++++++++++++++- + 1 file changed, 70 insertions(+), 2 deletions(-) + +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -79,7 +79,7 @@ + #include + #include + #include +-#include ++#include + #include + #include + #include +@@ -4496,6 +4496,74 @@ static void bluetooth_exit(void) + bluetooth_shutdown(); + } + ++static const struct dmi_system_id bt_fwbug_list[] __initconst = { ++ { ++ .ident = "ThinkPad E485", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_BOARD_NAME, "20KU"), ++ }, ++ }, ++ { ++ .ident = "ThinkPad E585", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_BOARD_NAME, "20KV"), ++ }, ++ }, ++ { ++ .ident = "ThinkPad A285 - 20MW", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_BOARD_NAME, "20MW"), ++ }, ++ }, ++ { ++ .ident = "ThinkPad A285 - 20MX", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_BOARD_NAME, "20MX"), ++ }, ++ }, ++ { ++ .ident = "ThinkPad A485 - 20MU", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_BOARD_NAME, "20MU"), ++ }, ++ }, ++ { ++ .ident = "ThinkPad A485 - 20MV", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_BOARD_NAME, "20MV"), ++ }, ++ }, ++ {} ++}; ++ ++static const struct pci_device_id fwbug_cards_ids[] __initconst = { ++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x24F3) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x24FD) }, ++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2526) }, ++ {} ++}; ++ ++ ++static int __init have_bt_fwbug(void) ++{ ++ /* ++ * Some AMD based ThinkPads have a firmware bug that calling ++ * "GBDC" will cause bluetooth on Intel wireless cards blocked ++ */ ++ if (dmi_check_system(bt_fwbug_list) && pci_dev_present(fwbug_cards_ids)) { ++ vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_RFKILL, ++ FW_BUG "disable bluetooth subdriver for Intel cards\n"); ++ return 1; ++ } else ++ return 0; ++} ++ + static int __init bluetooth_init(struct ibm_init_struct *iibm) + { + int res; +@@ -4508,7 +4576,7 @@ static int __init bluetooth_init(struct + + /* bluetooth not supported on 570, 600e/x, 770e, 770x, A21e, A2xm/p, + G4x, R30, R31, R40e, R50e, T20-22, X20-21 */ +- tp_features.bluetooth = hkey_handle && ++ tp_features.bluetooth = !have_bt_fwbug() && hkey_handle && + acpi_evalf(hkey_handle, &status, "GBDC", "qd"); + + vdbg_printk(TPACPI_DBG_INIT | TPACPI_DBG_RFKILL, diff --git a/queue-4.19/series b/queue-4.19/series index 29682e0390d..3760195d709 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -1 +1,7 @@ bfq-update-internal-depth-state-when-queue-depth-cha.patch +platform-x86-sony-laptop-fix-unintentional-fall-through.patch +platform-x86-thinkpad_acpi-disable-bluetooth-for-some-machines.patch +platform-x86-dell-laptop-fix-rfkill-functionality.patch +hwmon-pwm-fan-disable-pwm-if-fetching-cooling-data-fails.patch +kernfs-fix-barrier-usage-in-__kernfs_new_node.patch +virt-vbox-sanity-check-parameter-types-for-hgcm-calls-coming-from-userspace.patch diff --git a/queue-4.19/virt-vbox-sanity-check-parameter-types-for-hgcm-calls-coming-from-userspace.patch b/queue-4.19/virt-vbox-sanity-check-parameter-types-for-hgcm-calls-coming-from-userspace.patch new file mode 100644 index 00000000000..3a9ad9e69f9 --- /dev/null +++ b/queue-4.19/virt-vbox-sanity-check-parameter-types-for-hgcm-calls-coming-from-userspace.patch @@ -0,0 +1,73 @@ +From cf4f2ad6b87dda2dbe0573b1ebeb0273f8d4aac6 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 4 Apr 2019 14:39:09 +0200 +Subject: virt: vbox: Sanity-check parameter types for hgcm-calls coming from userspace + +From: Hans de Goede + +commit cf4f2ad6b87dda2dbe0573b1ebeb0273f8d4aac6 upstream. + +Userspace can make host function calls, called hgcm-calls through the +/dev/vboxguest device. + +In this case we should not accept all hgcm-function-parameter-types, some +are only valid for in kernel calls. + +This commit adds proper hgcm-function-parameter-type validation to the +ioctl for doing a hgcm-call from userspace. + +Cc: stable@vger.kernel.org +Signed-off-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/virt/vboxguest/vboxguest_core.c | 31 +++++++++++++++++++++++++++++++ + 1 file changed, 31 insertions(+) + +--- a/drivers/virt/vboxguest/vboxguest_core.c ++++ b/drivers/virt/vboxguest/vboxguest_core.c +@@ -1263,6 +1263,20 @@ static int vbg_ioctl_hgcm_disconnect(str + return ret; + } + ++static bool vbg_param_valid(enum vmmdev_hgcm_function_parameter_type type) ++{ ++ switch (type) { ++ case VMMDEV_HGCM_PARM_TYPE_32BIT: ++ case VMMDEV_HGCM_PARM_TYPE_64BIT: ++ case VMMDEV_HGCM_PARM_TYPE_LINADDR: ++ case VMMDEV_HGCM_PARM_TYPE_LINADDR_IN: ++ case VMMDEV_HGCM_PARM_TYPE_LINADDR_OUT: ++ return true; ++ default: ++ return false; ++ } ++} ++ + static int vbg_ioctl_hgcm_call(struct vbg_dev *gdev, + struct vbg_session *session, bool f32bit, + struct vbg_ioctl_hgcm_call *call) +@@ -1298,6 +1312,23 @@ static int vbg_ioctl_hgcm_call(struct vb + } + call->hdr.size_out = actual_size; + ++ /* Validate parameter types */ ++ if (f32bit) { ++ struct vmmdev_hgcm_function_parameter32 *parm = ++ VBG_IOCTL_HGCM_CALL_PARMS32(call); ++ ++ for (i = 0; i < call->parm_count; i++) ++ if (!vbg_param_valid(parm[i].type)) ++ return -EINVAL; ++ } else { ++ struct vmmdev_hgcm_function_parameter *parm = ++ VBG_IOCTL_HGCM_CALL_PARMS(call); ++ ++ for (i = 0; i < call->parm_count; i++) ++ if (!vbg_param_valid(parm[i].type)) ++ return -EINVAL; ++ } ++ + /* + * Validate the client id. + */