From: Greg Kroah-Hartman Date: Mon, 18 Feb 2019 10:57:05 +0000 (+0100) Subject: 3.18-stable patches X-Git-Tag: v3.18.135~21 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e62834a055bb1290d6cb7a29b168660a3a7b27bd;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: alsa-usb-audio-fix-implicit-fb-endpoint-setup-by-quirk.patch input-bma150-register-input-device-after-setting-private-data.patch input-elantech-enable-3rd-button-support-on-fujitsu-celsius-h780.patch perf-core-fix-impossible-ring-buffer-sizes-warning.patch --- diff --git a/queue-3.18/alsa-usb-audio-fix-implicit-fb-endpoint-setup-by-quirk.patch b/queue-3.18/alsa-usb-audio-fix-implicit-fb-endpoint-setup-by-quirk.patch new file mode 100644 index 00000000000..1097812b2cc --- /dev/null +++ b/queue-3.18/alsa-usb-audio-fix-implicit-fb-endpoint-setup-by-quirk.patch @@ -0,0 +1,58 @@ +From 2bc16b9f3223d049b57202ee702fcb5b9b507019 Mon Sep 17 00:00:00 2001 +From: Manuel Reinhardt +Date: Thu, 31 Jan 2019 15:32:35 +0100 +Subject: ALSA: usb-audio: Fix implicit fb endpoint setup by quirk + +From: Manuel Reinhardt + +commit 2bc16b9f3223d049b57202ee702fcb5b9b507019 upstream. + +The commit a60945fd08e4 ("ALSA: usb-audio: move implicit fb quirks to +separate function") introduced an error in the handling of quirks for +implicit feedback endpoints. This commit fixes this. + +If a quirk successfully sets up an implicit feedback endpoint, usb-audio +no longer tries to find the implicit fb endpoint itself. + +Fixes: a60945fd08e4 ("ALSA: usb-audio: move implicit fb quirks to separate function") +Signed-off-by: Manuel Reinhardt +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/pcm.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -311,6 +311,9 @@ static int search_roland_implicit_fb(str + return 0; + } + ++/* Setup an implicit feedback endpoint from a quirk. Returns 0 if no quirk ++ * applies. Returns 1 if a quirk was found. ++ */ + static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs, + struct usb_device *dev, + struct usb_interface_descriptor *altsd, +@@ -370,7 +373,7 @@ add_sync_ep: + + subs->data_endpoint->sync_master = subs->sync_endpoint; + +- return 0; ++ return 1; + } + + static int set_sync_endpoint(struct snd_usb_substream *subs, +@@ -395,6 +398,10 @@ static int set_sync_endpoint(struct snd_ + if (err < 0) + return err; + ++ /* endpoint set by quirk */ ++ if (err > 0) ++ return 0; ++ + if (altsd->bNumEndpoints < 2) + return 0; + diff --git a/queue-3.18/cifs-limit-memory-used-by-lock-request-calls-to-a-pa.patch b/queue-3.18/cifs-limit-memory-used-by-lock-request-calls-to-a-pa.patch index 16aa4e05c13..0bf87c66d59 100644 --- a/queue-3.18/cifs-limit-memory-used-by-lock-request-calls-to-a-pa.patch +++ b/queue-3.18/cifs-limit-memory-used-by-lock-request-calls-to-a-pa.patch @@ -16,15 +16,13 @@ Signed-off-by: Ross Lagerwall Signed-off-by: Steve French Signed-off-by: Sasha Levin --- - fs/cifs/file.c | 8 ++++++++ - fs/cifs/smb2file.c | 4 ++++ + fs/cifs/file.c | 8 ++++++++ + fs/cifs/smb2file.c | 4 ++++ 2 files changed, 12 insertions(+) -diff --git a/fs/cifs/file.c b/fs/cifs/file.c -index 338c92620d07..5dd8165a5429 100644 --- a/fs/cifs/file.c +++ b/fs/cifs/file.c -@@ -1075,6 +1075,10 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile) +@@ -1075,6 +1075,10 @@ cifs_push_mandatory_locks(struct cifsFil return -EINVAL; } @@ -35,7 +33,7 @@ index 338c92620d07..5dd8165a5429 100644 max_num = (max_buf - sizeof(struct smb_hdr)) / sizeof(LOCKING_ANDX_RANGE); buf = kzalloc(max_num * sizeof(LOCKING_ANDX_RANGE), GFP_KERNEL); -@@ -1410,6 +1414,10 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, +@@ -1410,6 +1414,10 @@ cifs_unlock_range(struct cifsFileInfo *c if (max_buf < (sizeof(struct smb_hdr) + sizeof(LOCKING_ANDX_RANGE))) return -EINVAL; @@ -46,11 +44,9 @@ index 338c92620d07..5dd8165a5429 100644 max_num = (max_buf - sizeof(struct smb_hdr)) / sizeof(LOCKING_ANDX_RANGE); buf = kzalloc(max_num * sizeof(LOCKING_ANDX_RANGE), GFP_KERNEL); -diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c -index fabeaa0ff1bf..df7f4515c63d 100644 --- a/fs/cifs/smb2file.c +++ b/fs/cifs/smb2file.c -@@ -110,6 +110,8 @@ smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, +@@ -110,6 +110,8 @@ smb2_unlock_range(struct cifsFileInfo *c if (max_buf < sizeof(struct smb2_lock_element)) return -EINVAL; @@ -59,7 +55,7 @@ index fabeaa0ff1bf..df7f4515c63d 100644 max_num = max_buf / sizeof(struct smb2_lock_element); buf = kzalloc(max_num * sizeof(struct smb2_lock_element), GFP_KERNEL); if (!buf) -@@ -246,6 +248,8 @@ smb2_push_mandatory_locks(struct cifsFileInfo *cfile) +@@ -246,6 +248,8 @@ smb2_push_mandatory_locks(struct cifsFil return -EINVAL; } @@ -68,6 +64,3 @@ index fabeaa0ff1bf..df7f4515c63d 100644 max_num = max_buf / sizeof(struct smb2_lock_element); buf = kzalloc(max_num * sizeof(struct smb2_lock_element), GFP_KERNEL); if (!buf) { --- -2.19.1 - diff --git a/queue-3.18/input-bma150-register-input-device-after-setting-private-data.patch b/queue-3.18/input-bma150-register-input-device-after-setting-private-data.patch new file mode 100644 index 00000000000..899e3d725e2 --- /dev/null +++ b/queue-3.18/input-bma150-register-input-device-after-setting-private-data.patch @@ -0,0 +1,106 @@ +From 90cc55f067f6ca0e64e5e52883ece47d8af7b67b Mon Sep 17 00:00:00 2001 +From: Jonathan Bakker +Date: Wed, 6 Feb 2019 10:45:37 -0800 +Subject: Input: bma150 - register input device after setting private data +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Bakker + +commit 90cc55f067f6ca0e64e5e52883ece47d8af7b67b upstream. + +Otherwise we introduce a race condition where userspace can request input +before we're ready leading to null pointer dereference such as + +input: bma150 as /devices/platform/i2c-gpio-2/i2c-5/5-0038/input/input3 +Unable to handle kernel NULL pointer dereference at virtual address 00000018 +pgd = (ptrval) +[00000018] *pgd=55dac831, *pte=00000000, *ppte=00000000 +Internal error: Oops: 17 [#1] PREEMPT ARM +Modules linked in: bma150 input_polldev [last unloaded: bma150] +CPU: 0 PID: 2870 Comm: accelerometer Not tainted 5.0.0-rc3-dirty #46 +Hardware name: Samsung S5PC110/S5PV210-based board +PC is at input_event+0x8/0x60 +LR is at bma150_report_xyz+0x9c/0xe0 [bma150] +pc : [<80450f70>] lr : [<7f0a614c>] psr: 800d0013 +sp : a4c1fd78 ip : 00000081 fp : 00020000 +r10: 00000000 r9 : a5e2944c r8 : a7455000 +r7 : 00000016 r6 : 00000101 r5 : a7617940 r4 : 80909048 +r3 : fffffff2 r2 : 00000000 r1 : 00000003 r0 : 00000000 +Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none +Control: 10c5387d Table: 54e34019 DAC: 00000051 +Process accelerometer (pid: 2870, stack limit = 0x(ptrval)) +Stackck: (0xa4c1fd78 to 0xa4c20000) +fd60: fffffff3 fc813f6c +fd80: 40410581 d7530ce3 a5e2817c a7617f00 a5e29404 a5e2817c 00000000 7f008324 +fda0: a5e28000 8044f59c a5fdd9d0 a5e2945c a46a4a00 a5e29668 a7455000 80454f10 +fdc0: 80909048 a5e29668 a5fdd9d0 a46a4a00 806316d0 00000000 a46a4a00 801df5f0 +fde0: 00000000 d7530ce3 a4c1fec0 a46a4a00 00000000 a5fdd9d0 a46a4a08 801df53c +fe00: 00000000 801d74bc a4c1fec0 00000000 a4c1ff70 00000000 a7038da8 00000000 +fe20: a46a4a00 801e91fc a411bbe0 801f2e88 00000004 00000000 80909048 00000041 +fe40: 00000000 00020000 00000000 dead4ead a6a88da0 00000000 ffffe000 806fcae8 +fe60: a4c1fec8 00000000 80909048 00000002 a5fdd9d0 a7660110 a411bab0 00000001 +fe80: dead4ead ffffffff ffffffff a4c1fe8c a4c1fe8c d7530ce3 20000013 80909048 +fea0: 80909048 a4c1ff70 00000001 fffff000 a4c1e000 00000005 00026038 801eabd8 +fec0: a7660110 a411bab0 b9394901 00000006 a696201b 76fb3000 00000000 a7039720 +fee0: a5fdd9d0 00000101 00000002 00000096 00000000 00000000 00000000 a4c1ff00 +ff00: a6b310f4 805cb174 a6b310f4 00000010 00000fe0 00000010 a4c1e000 d7530ce3 +ff20: 00000003 a5f41400 a5f41424 00000000 a6962000 00000000 00000003 00000002 +ff40: ffffff9c 000a0000 80909048 d7530ce3 a6962000 00000003 80909048 ffffff9c +ff60: a6962000 801d890c 00000000 00000000 00020000 a7590000 00000004 00000100 +ff80: 00000001 d7530ce3 000288b8 00026320 000288b8 00000005 80101204 a4c1e000 +ffa0: 00000005 80101000 000288b8 00026320 000288b8 000a0000 00000000 00000000 +ffc0: 000288b8 00026320 000288b8 00000005 7eef3bac 000264e8 00028ad8 00026038 +ffe0: 00000005 7eef3300 76f76e91 76f78546 800d0030 000288b8 00000000 00000000 +[<80450f70>] (input_event) from [] (0xa5e2817c) +Code: e1a08148 eaffffa8 e351001f 812fff1e (e590c018) +---[ end trace 1c691ee85f2ff243 ]--- + +Signed-off-by: Jonathan Bakker +Signed-off-by: Paweł Chmiel +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/misc/bma150.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/input/misc/bma150.c ++++ b/drivers/input/misc/bma150.c +@@ -483,13 +483,14 @@ static int bma150_register_input_device( + idev->close = bma150_irq_close; + input_set_drvdata(idev, bma150); + ++ bma150->input = idev; ++ + error = input_register_device(idev); + if (error) { + input_free_device(idev); + return error; + } + +- bma150->input = idev; + return 0; + } + +@@ -512,15 +513,15 @@ static int bma150_register_polled_device + + bma150_init_input_device(bma150, ipoll_dev->input); + ++ bma150->input_polled = ipoll_dev; ++ bma150->input = ipoll_dev->input; ++ + error = input_register_polled_device(ipoll_dev); + if (error) { + input_free_polled_device(ipoll_dev); + return error; + } + +- bma150->input_polled = ipoll_dev; +- bma150->input = ipoll_dev->input; +- + return 0; + } + diff --git a/queue-3.18/input-elantech-enable-3rd-button-support-on-fujitsu-celsius-h780.patch b/queue-3.18/input-elantech-enable-3rd-button-support-on-fujitsu-celsius-h780.patch new file mode 100644 index 00000000000..6519c1f87fc --- /dev/null +++ b/queue-3.18/input-elantech-enable-3rd-button-support-on-fujitsu-celsius-h780.patch @@ -0,0 +1,52 @@ +From e8b22d0a329f0fb5c7ef95406872d268f01ee3b1 Mon Sep 17 00:00:00 2001 +From: Matti Kurkela +Date: Thu, 7 Feb 2019 23:49:23 -0800 +Subject: Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780 + +From: Matti Kurkela + +commit e8b22d0a329f0fb5c7ef95406872d268f01ee3b1 upstream. + +Like Fujitsu CELSIUS H760, the H780 also has a three-button Elantech +touchpad, but the driver needs to be told so to enable the middle touchpad +button. + +The elantech_dmi_force_crc_enabled quirk was not necessary with the H780. + +Also document the fw_version and caps values detected for both H760 and +H780 models. + +Signed-off-by: Matti Kurkela +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/elantech.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1114,6 +1114,8 @@ static int elantech_get_resolution_v4(st + * Asus UX31 0x361f00 20, 15, 0e clickpad + * Asus UX32VD 0x361f02 00, 15, 0e clickpad + * Avatar AVIU-145A2 0x361f00 ? clickpad ++ * Fujitsu CELSIUS H760 0x570f02 40, 14, 0c 3 hw buttons (**) ++ * Fujitsu CELSIUS H780 0x5d0f02 41, 16, 0d 3 hw buttons (**) + * Fujitsu LIFEBOOK E544 0x470f00 d0, 12, 09 2 hw buttons + * Fujitsu LIFEBOOK E547 0x470f00 50, 12, 09 2 hw buttons + * Fujitsu LIFEBOOK E554 0x570f01 40, 14, 0c 2 hw buttons +@@ -1156,6 +1158,13 @@ static const struct dmi_system_id elante + DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H730"), + }, + }, ++ { ++ /* Fujitsu H780 also has a middle button */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H780"), ++ }, ++ }, + #endif + { } + }; diff --git a/queue-3.18/perf-core-fix-impossible-ring-buffer-sizes-warning.patch b/queue-3.18/perf-core-fix-impossible-ring-buffer-sizes-warning.patch new file mode 100644 index 00000000000..4987af4463d --- /dev/null +++ b/queue-3.18/perf-core-fix-impossible-ring-buffer-sizes-warning.patch @@ -0,0 +1,64 @@ +From 528871b456026e6127d95b1b2bd8e3a003dc1614 Mon Sep 17 00:00:00 2001 +From: Ingo Molnar +Date: Wed, 13 Feb 2019 07:57:02 +0100 +Subject: perf/core: Fix impossible ring-buffer sizes warning + +From: Ingo Molnar + +commit 528871b456026e6127d95b1b2bd8e3a003dc1614 upstream. + +The following commit: + + 9dff0aa95a32 ("perf/core: Don't WARN() for impossible ring-buffer sizes") + +results in perf recording failures with larger mmap areas: + + root@skl:/tmp# perf record -g -a + failed to mmap with 12 (Cannot allocate memory) + +The root cause is that the following condition is buggy: + + if (order_base_2(size) >= MAX_ORDER) + goto fail; + +The problem is that @size is in bytes and MAX_ORDER is in pages, +so the right test is: + + if (order_base_2(size) >= PAGE_SHIFT+MAX_ORDER) + goto fail; + +Fix it. + +Reported-by: "Jin, Yao" +Bisected-by: Borislav Petkov +Analyzed-by: Peter Zijlstra +Cc: Julien Thierry +Cc: Mark Rutland +Cc: Alexander Shishkin +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Linus Torvalds +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Greg Kroah-Hartman +Cc: +Fixes: 9dff0aa95a32 ("perf/core: Don't WARN() for impossible ring-buffer sizes") +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/events/ring_buffer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/events/ring_buffer.c ++++ b/kernel/events/ring_buffer.c +@@ -282,7 +282,7 @@ struct ring_buffer *rb_alloc(int nr_page + size = sizeof(struct ring_buffer); + size += nr_pages * sizeof(void *); + +- if (order_base_2(size) >= MAX_ORDER) ++ if (order_base_2(size) >= PAGE_SHIFT+MAX_ORDER) + goto fail; + + rb = kzalloc(size, GFP_KERNEL); diff --git a/queue-3.18/series b/queue-3.18/series index ce71d130992..d87608dd586 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -93,3 +93,7 @@ arm-dts-da850-evm-correct-the-sound-card-name.patch arm-dts-kirkwood-fix-polarity-of-gpio-fan-lines.patch gpio-pl061-handle-failed-allocations.patch cifs-limit-memory-used-by-lock-request-calls-to-a-pa.patch +perf-core-fix-impossible-ring-buffer-sizes-warning.patch +alsa-usb-audio-fix-implicit-fb-endpoint-setup-by-quirk.patch +input-bma150-register-input-device-after-setting-private-data.patch +input-elantech-enable-3rd-button-support-on-fujitsu-celsius-h780.patch