From: Greg Kroah-Hartman Date: Sun, 11 Jun 2023 07:50:32 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.14.318~62 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5b70b09ef429d5f1eab9cc87830805c759f62f1f;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: alsa-hda-realtek-add-quirks-for-asus-rog-2024-laptops-using-cs35l41.patch batman-adv-broken-sync-while-rescheduling-delayed-work.patch input-psmouse-fix-oob-access-in-elantech-protocol.patch input-xpad-delete-a-razer-deathadder-mouse-vid-pid-entry.patch --- diff --git a/queue-4.14/alsa-hda-realtek-add-quirks-for-asus-rog-2024-laptops-using-cs35l41.patch b/queue-4.14/alsa-hda-realtek-add-quirks-for-asus-rog-2024-laptops-using-cs35l41.patch new file mode 100644 index 00000000000..080a59ce9c2 --- /dev/null +++ b/queue-4.14/alsa-hda-realtek-add-quirks-for-asus-rog-2024-laptops-using-cs35l41.patch @@ -0,0 +1,41 @@ +From 811dd426a9b16cf61a86fdb12d5f5b983cbfb130 Mon Sep 17 00:00:00 2001 +From: Stefan Binding +Date: Mon, 5 Jun 2023 16:33:08 +0100 +Subject: ALSA: hda/realtek: Add quirks for Asus ROG 2024 laptops using CS35L41 + +From: Stefan Binding + +commit 811dd426a9b16cf61a86fdb12d5f5b983cbfb130 upstream. + +Add support for Asus ROG 2024 models using CS35L41 SPI with Internal +Boost. + +Signed-off-by: Stefan Binding +Cc: +Link: https://lore.kernel.org/r/20230605153308.448550-1-sbinding@opensource.cirrus.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6609,11 +6609,17 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW), + SND_PCI_QUIRK(0x1043, 0x1a30, "ASUS X705UD", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x1b13, "Asus U41SV", ALC269_FIXUP_INV_DMIC), ++ SND_PCI_QUIRK(0x1043, 0x1b93, "ASUS G614JVR/JIR", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x1043, 0x125e, "ASUS Q524UQK", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), ++ SND_PCI_QUIRK(0x1043, 0x3a20, "ASUS G614JZR", ALC245_FIXUP_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x3a30, "ASUS G814JVR/JIR", ALC245_FIXUP_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x3a40, "ASUS G814JZR", ALC245_FIXUP_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x3a50, "ASUS G834JYR/JZR", ALC245_FIXUP_CS35L41_SPI_2), ++ SND_PCI_QUIRK(0x1043, 0x3a60, "ASUS G634JYR/JZR", ALC245_FIXUP_CS35L41_SPI_2), + SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x834a, "ASUS S101", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC), diff --git a/queue-4.14/batman-adv-broken-sync-while-rescheduling-delayed-work.patch b/queue-4.14/batman-adv-broken-sync-while-rescheduling-delayed-work.patch new file mode 100644 index 00000000000..7dc4e19c783 --- /dev/null +++ b/queue-4.14/batman-adv-broken-sync-while-rescheduling-delayed-work.patch @@ -0,0 +1,58 @@ +From abac3ac97fe8734b620e7322a116450d7f90aa43 Mon Sep 17 00:00:00 2001 +From: Vladislav Efanov +Date: Fri, 26 May 2023 19:16:32 +0300 +Subject: batman-adv: Broken sync while rescheduling delayed work + +From: Vladislav Efanov + +commit abac3ac97fe8734b620e7322a116450d7f90aa43 upstream. + +Syzkaller got a lot of crashes like: +KASAN: use-after-free Write in *_timers* + +All of these crashes point to the same memory area: + +The buggy address belongs to the object at ffff88801f870000 + which belongs to the cache kmalloc-8k of size 8192 +The buggy address is located 5320 bytes inside of + 8192-byte region [ffff88801f870000, ffff88801f872000) + +This area belongs to : + batadv_priv->batadv_priv_dat->delayed_work->timer_list + +The reason for these issues is the lack of synchronization. Delayed +work (batadv_dat_purge) schedules new timer/work while the device +is being deleted. As the result new timer/delayed work is set after +cancel_delayed_work_sync() was called. So after the device is freed +the timer list contains pointer to already freed memory. + +Found by Linux Verification Center (linuxtesting.org) with syzkaller. + +Cc: stable@kernel.org +Fixes: 2f1dfbe18507 ("batman-adv: Distributed ARP Table - implement local storage") +Signed-off-by: Vladislav Efanov +Acked-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Greg Kroah-Hartman +--- + net/batman-adv/distributed-arp-table.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/batman-adv/distributed-arp-table.c ++++ b/net/batman-adv/distributed-arp-table.c +@@ -60,7 +60,6 @@ static void batadv_dat_purge(struct work + */ + static void batadv_dat_start_timer(struct batadv_priv *bat_priv) + { +- INIT_DELAYED_WORK(&bat_priv->dat.work, batadv_dat_purge); + queue_delayed_work(batadv_event_workqueue, &bat_priv->dat.work, + msecs_to_jiffies(10000)); + } +@@ -774,6 +773,7 @@ int batadv_dat_init(struct batadv_priv * + if (!bat_priv->dat.hash) + return -ENOMEM; + ++ INIT_DELAYED_WORK(&bat_priv->dat.work, batadv_dat_purge); + batadv_dat_start_timer(bat_priv); + + batadv_tvlv_handler_register(bat_priv, batadv_dat_tvlv_ogm_handler_v1, diff --git a/queue-4.14/input-psmouse-fix-oob-access-in-elantech-protocol.patch b/queue-4.14/input-psmouse-fix-oob-access-in-elantech-protocol.patch new file mode 100644 index 00000000000..a13a0475204 --- /dev/null +++ b/queue-4.14/input-psmouse-fix-oob-access-in-elantech-protocol.patch @@ -0,0 +1,54 @@ +From 7b63a88bb62ba2ddf5fcd956be85fe46624628b9 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Thu, 11 May 2023 12:08:37 -0700 +Subject: Input: psmouse - fix OOB access in Elantech protocol + +From: Dmitry Torokhov + +commit 7b63a88bb62ba2ddf5fcd956be85fe46624628b9 upstream. + +The kernel only allocate 5 MT slots; check that transmitted slot ID +falls within the acceptable range. + +Link: https://lore.kernel.org/r/ZFnEL91nrT789dbG@google.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/mouse/elantech.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -595,10 +595,11 @@ static void process_packet_head_v4(struc + struct input_dev *dev = psmouse->dev; + struct elantech_data *etd = psmouse->private; + unsigned char *packet = psmouse->packet; +- int id = ((packet[3] & 0xe0) >> 5) - 1; ++ int id; + int pres, traces; + +- if (id < 0) ++ id = ((packet[3] & 0xe0) >> 5) - 1; ++ if (id < 0 || id >= ETP_MAX_FINGERS) + return; + + etd->mt[id].x = ((packet[1] & 0x0f) << 8) | packet[2]; +@@ -628,7 +629,7 @@ static void process_packet_motion_v4(str + int id, sid; + + id = ((packet[0] & 0xe0) >> 5) - 1; +- if (id < 0) ++ if (id < 0 || id >= ETP_MAX_FINGERS) + return; + + sid = ((packet[3] & 0xe0) >> 5) - 1; +@@ -649,7 +650,7 @@ static void process_packet_motion_v4(str + input_report_abs(dev, ABS_MT_POSITION_X, etd->mt[id].x); + input_report_abs(dev, ABS_MT_POSITION_Y, etd->mt[id].y); + +- if (sid >= 0) { ++ if (sid >= 0 && sid < ETP_MAX_FINGERS) { + etd->mt[sid].x += delta_x2 * weight; + etd->mt[sid].y -= delta_y2 * weight; + input_mt_slot(dev, sid); diff --git a/queue-4.14/input-xpad-delete-a-razer-deathadder-mouse-vid-pid-entry.patch b/queue-4.14/input-xpad-delete-a-razer-deathadder-mouse-vid-pid-entry.patch new file mode 100644 index 00000000000..b639557a941 --- /dev/null +++ b/queue-4.14/input-xpad-delete-a-razer-deathadder-mouse-vid-pid-entry.patch @@ -0,0 +1,73 @@ +From feee70f4568650cf44c573488798ffc0a2faeea3 Mon Sep 17 00:00:00 2001 +From: Ismael Ferreras Morezuelas +Date: Tue, 23 May 2023 14:45:10 -0700 +Subject: Input: xpad - delete a Razer DeathAdder mouse VID/PID entry + +From: Ismael Ferreras Morezuelas + +commit feee70f4568650cf44c573488798ffc0a2faeea3 upstream. + +While doing my research to improve the xpad device names I noticed +that the 1532:0037 VID/PID seems to be used by the DeathAdder 2013, +so that Razer Sabertooth instance looked wrong and very suspect to +me. I didn't see any mention in the official drivers, either. + +After doing more research, it turns out that the xpad list +is used by many other projects (like Steam) as-is [1], this +issue was reported [2] and Valve/Sam Lantinga fixed it [3]: + +[1]: https://github.com/libsdl-org/SDL/blob/dcc5eef0e2395854b254ea2873a4899edab347c6/src/joystick/controller_type.h#L251 +[2]: https://steamcommunity.com/app/353380/discussions/0/1743392486228754770/ +[3]: https://hg.libsdl.org/SDL/rev/29809f6f0271 + +(With multiple Internet users reporting similar issues, not linked here) + +After not being able to find the correct VID/PID combination anywhere +on the Internet and not receiving any reply from Razer support I did +some additional detective work, it seems like it presents itself as +"Razer Sabertooth Gaming Controller (XBOX360)", code 1689:FE00. + +Leaving us with this: + * Razer Sabertooth (1689:fe00) + * Razer Sabertooth Elite (24c6:5d04) + * Razer DeathAdder 2013 (1532:0037) [note: not a gamepad] + +So, to sum things up; remove this conflicting/duplicate entry: + +{ 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 }, + +As the real/correct one is already present there, even if +the Internet as a whole insists on presenting it as the +Razer Sabertooth Elite, which (by all accounts) is not: + +{ 0x1689, 0xfe00, "Razer Sabertooth", 0, XTYPE_XBOX360 }, + +Actual change in SDL2 referencing this kernel issue: +https://github.com/libsdl-org/SDL/commit/e5e54169754ca5d3e86339d968b20126d9da0a15 + +For more information of the device, take a look here: +https://github.com/xboxdrv/xboxdrv/pull/59 + +You can see a lsusb dump here: https://github.com/xboxdrv/xboxdrv/files/76581/Qa6dBcrv.txt + +Fixes: f554f619b70 ("Input: xpad - sync device IDs with xboxdrv") +Signed-off-by: Ismael Ferreras Morezuelas +Reviewed-by: Cameron Gutman +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/5c12dbdb-5774-fc68-5c58-ca596383663e@gmail.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -279,7 +279,6 @@ static const struct xpad_device { + { 0x1430, 0xf801, "RedOctane Controller", 0, XTYPE_XBOX360 }, + { 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 }, + { 0x146b, 0x0604, "Bigben Interactive DAIJA Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, +- { 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 }, + { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, + { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE }, + { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 }, diff --git a/queue-4.14/series b/queue-4.14/series index e2e8716a9e6..93bb6ce74ce 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -8,3 +8,7 @@ rfs-annotate-lockless-accesses-to-rfs-sock-flow-tabl.patch net-sched-move-rtm_tca_policy-declaration-to-include.patch lib-cpu_rmap-fix-potential-use-after-free-in-irq_cpu.patch bnxt_en-query-default-vlan-before-vnic-setup-on-a-vf.patch +batman-adv-broken-sync-while-rescheduling-delayed-work.patch +input-xpad-delete-a-razer-deathadder-mouse-vid-pid-entry.patch +input-psmouse-fix-oob-access-in-elantech-protocol.patch +alsa-hda-realtek-add-quirks-for-asus-rog-2024-laptops-using-cs35l41.patch