From a4e8793a901b792e677d6e08346bc5f18275af86 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 26 Dec 2021 22:37:34 -0500 Subject: [PATCH] Fixes for 5.4 Signed-off-by: Sasha Levin --- ...lm90-add-basic-support-for-ti-tmp461.patch | 187 +++++++++++++++ ...0-add-max6654-support-to-lm90-driver.patch | 209 ++++++++++++++++ ...critical-attribute-support-for-max66.patch | 224 ++++++++++++++++++ ...sage-of-config2-register-in-detect-f.patch | 50 ++++ ...duce-flag-indicating-extended-temper.patch | 117 +++++++++ ...ix-stack-out-of-bound-access-in-elan.patch | 139 +++++++++++ queue-5.4/series | 6 + 7 files changed, 932 insertions(+) create mode 100644 queue-5.4/hwmon-lm90-add-basic-support-for-ti-tmp461.patch create mode 100644 queue-5.4/hwmon-lm90-add-max6654-support-to-lm90-driver.patch create mode 100644 queue-5.4/hwmon-lm90-drop-critical-attribute-support-for-max66.patch create mode 100644 queue-5.4/hwmon-lm90-fix-usage-of-config2-register-in-detect-f.patch create mode 100644 queue-5.4/hwmon-lm90-introduce-flag-indicating-extended-temper.patch create mode 100644 queue-5.4/input-elantech-fix-stack-out-of-bound-access-in-elan.patch diff --git a/queue-5.4/hwmon-lm90-add-basic-support-for-ti-tmp461.patch b/queue-5.4/hwmon-lm90-add-basic-support-for-ti-tmp461.patch new file mode 100644 index 00000000000..e963298c50f --- /dev/null +++ b/queue-5.4/hwmon-lm90-add-basic-support-for-ti-tmp461.patch @@ -0,0 +1,187 @@ +From 6ad4a014c60dda6a1cb569be8230d12a255a8456 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Oct 2021 20:03:32 -0700 +Subject: hwmon: (lm90) Add basic support for TI TMP461 + +From: Guenter Roeck + +[ Upstream commit f8344f7693a25d9025a59d164450b50c6f5aa3c0 ] + +TMP461 is almost identical to TMP451 and was actually detected as TMP451 +with the existing lm90 driver if its I2C address is 0x4c. Add support +for it to the lm90 driver. At the same time, improve the chip detection +function to at least try to distinguish between TMP451 and TMP461. + +As a side effect, this fixes commit 24333ac26d01 ("hwmon: (tmp401) use +smb word operations instead of 2 smb byte operations"). TMP461 does not +support word operations on temperature registers, which causes bad +temperature readings with the tmp401 driver. The lm90 driver does not +perform word operations on temperature registers and thus does not have +this problem. + +Support is listed as basic because TMP461 supports a sensor resolution +of 0.0625 degrees C, while the lm90 driver assumes a resolution of 0.125 +degrees C. Also, the TMP461 supports negative temperatures with its +default temperature range, which is not the case for similar chips +supported by the lm90 and the tmp401 drivers. Those limitations will be +addressed with follow-up patches. + +Fixes: 24333ac26d01 ("hwmon: (tmp401) use smb word operations instead of 2 smb byte operations") +Reported-by: David T. Wilson +Cc: David T. Wilson +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + Documentation/hwmon/lm90.rst | 10 +++++++ + drivers/hwmon/Kconfig | 2 +- + drivers/hwmon/lm90.c | 54 ++++++++++++++++++++++++++---------- + 3 files changed, 50 insertions(+), 16 deletions(-) + +diff --git a/Documentation/hwmon/lm90.rst b/Documentation/hwmon/lm90.rst +index 78dfc01b47a23..03851cbe637ce 100644 +--- a/Documentation/hwmon/lm90.rst ++++ b/Documentation/hwmon/lm90.rst +@@ -265,6 +265,16 @@ Supported chips: + + http://www.ti.com/litv/pdf/sbos686 + ++ * Texas Instruments TMP461 ++ ++ Prefix: 'tmp461' ++ ++ Addresses scanned: I2C 0x48 through 0x4F ++ ++ Datasheet: Publicly available at TI website ++ ++ https://www.ti.com/lit/gpn/tmp461 ++ + Author: Jean Delvare + + +diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig +index fdf8fab7eb396..049563d503b68 100644 +--- a/drivers/hwmon/Kconfig ++++ b/drivers/hwmon/Kconfig +@@ -1135,7 +1135,7 @@ config SENSORS_LM90 + Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6654, MAX6657, MAX6658, + MAX6659, MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, + ON Semiconductor NCT1008, Winbond/Nuvoton W83L771W/G/AWG/ASG, +- Philips SA56004, GMT G781, and Texas Instruments TMP451 ++ Philips SA56004, GMT G781, Texas Instruments TMP451 and TMP461 + sensor chips. + + This driver can also be built as a module. If so, the module +diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c +index 9d48a7405932f..e085e2a4fa16c 100644 +--- a/drivers/hwmon/lm90.c ++++ b/drivers/hwmon/lm90.c +@@ -69,10 +69,10 @@ + * This driver also supports the G781 from GMT. This device is compatible + * with the ADM1032. + * +- * This driver also supports TMP451 from Texas Instruments. This device is +- * supported in both compatibility and extended mode. It's mostly compatible +- * with ADT7461 except for local temperature low byte register and max +- * conversion rate. ++ * This driver also supports TMP451 and TMP461 from Texas Instruments. ++ * Those devices are supported in both compatibility and extended mode. ++ * They are mostly compatible with ADT7461 except for local temperature ++ * low byte register and max conversion rate. + * + * Since the LM90 was the first chipset supported by this driver, most + * comments will refer to this chipset, but are actually general and +@@ -112,7 +112,7 @@ static const unsigned short normal_i2c[] = { + 0x4d, 0x4e, 0x4f, I2C_CLIENT_END }; + + enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, +- max6646, w83l771, max6696, sa56004, g781, tmp451, max6654 }; ++ max6646, w83l771, max6696, sa56004, g781, tmp451, tmp461, max6654 }; + + /* + * The LM90 registers +@@ -168,8 +168,12 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, + + #define LM90_MAX_CONVRATE_MS 16000 /* Maximum conversion rate in ms */ + +-/* TMP451 registers */ ++/* TMP451/TMP461 registers */ + #define TMP451_REG_R_LOCAL_TEMPL 0x15 ++#define TMP451_REG_CONALERT 0x22 ++ ++#define TMP461_REG_CHEN 0x16 ++#define TMP461_REG_DFC 0x24 + + /* + * Device flags +@@ -229,6 +233,7 @@ static const struct i2c_device_id lm90_id[] = { + { "w83l771", w83l771 }, + { "sa56004", sa56004 }, + { "tmp451", tmp451 }, ++ { "tmp461", tmp461 }, + { } + }; + MODULE_DEVICE_TABLE(i2c, lm90_id); +@@ -326,6 +331,10 @@ static const struct of_device_id __maybe_unused lm90_of_match[] = { + .compatible = "ti,tmp451", + .data = (void *)tmp451 + }, ++ { ++ .compatible = "ti,tmp461", ++ .data = (void *)tmp461 ++ }, + { }, + }; + MODULE_DEVICE_TABLE(of, lm90_of_match); +@@ -427,6 +436,13 @@ static const struct lm90_params lm90_params[] = { + .max_convrate = 9, + .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL, + }, ++ [tmp461] = { ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP, ++ .alert_alarms = 0x7c, ++ .max_convrate = 9, ++ .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL, ++ }, + }; + + /* +@@ -1616,18 +1632,26 @@ static int lm90_detect(struct i2c_client *client, + && convrate <= 0x08) + name = "g781"; + } else +- if (address == 0x4C +- && man_id == 0x55) { /* Texas Instruments */ +- int local_ext; ++ if (man_id == 0x55 && chip_id == 0x00 && ++ (config1 & 0x1B) == 0x00 && convrate <= 0x09) { ++ int local_ext, conalert, chen, dfc; + + local_ext = i2c_smbus_read_byte_data(client, + TMP451_REG_R_LOCAL_TEMPL); +- +- if (chip_id == 0x00 /* TMP451 */ +- && (config1 & 0x1B) == 0x00 +- && convrate <= 0x09 +- && (local_ext & 0x0F) == 0x00) +- name = "tmp451"; ++ conalert = i2c_smbus_read_byte_data(client, ++ TMP451_REG_CONALERT); ++ chen = i2c_smbus_read_byte_data(client, TMP461_REG_CHEN); ++ dfc = i2c_smbus_read_byte_data(client, TMP461_REG_DFC); ++ ++ if ((local_ext & 0x0F) == 0x00 && ++ (conalert & 0xf1) == 0x01 && ++ (chen & 0xfc) == 0x00 && ++ (dfc & 0xfc) == 0x00) { ++ if (address == 0x4c && !(chen & 0x03)) ++ name = "tmp451"; ++ else if (address >= 0x48 && address <= 0x4f) ++ name = "tmp461"; ++ } + } + + if (!name) { /* identification failed */ +-- +2.34.1 + diff --git a/queue-5.4/hwmon-lm90-add-max6654-support-to-lm90-driver.patch b/queue-5.4/hwmon-lm90-add-max6654-support-to-lm90-driver.patch new file mode 100644 index 00000000000..9f9c7022959 --- /dev/null +++ b/queue-5.4/hwmon-lm90-add-max6654-support-to-lm90-driver.patch @@ -0,0 +1,209 @@ +From 6a5758315031498c829867d6e074ad6c86b4e937 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 May 2020 11:42:48 -0700 +Subject: hwmon: (lm90) Add max6654 support to lm90 driver + +From: Josh Lehan + +[ Upstream commit 229d495d8189ae785dacee72e5633a58edc25ddf ] + +Add support for the Maxim MAX6654 to the lm90 driver. + +The MAX6654 is a temperature sensor, similar to the others, +but with some differences regarding the configuration +register, and the sampling rate at which extended resolution +becomes possible. + +Signed-off-by: Josh Lehan +Link: https://lore.kernel.org/r/20200513184248.145765-1-krellan@google.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + Documentation/hwmon/lm90.rst | 23 ++++++++++++++++-- + drivers/hwmon/Kconfig | 9 ++++---- + drivers/hwmon/lm90.c | 45 ++++++++++++++++++++++++++++++++---- + 3 files changed, 67 insertions(+), 10 deletions(-) + +diff --git a/Documentation/hwmon/lm90.rst b/Documentation/hwmon/lm90.rst +index 953315987c06e..78dfc01b47a23 100644 +--- a/Documentation/hwmon/lm90.rst ++++ b/Documentation/hwmon/lm90.rst +@@ -123,6 +123,18 @@ Supported chips: + + http://www.maxim-ic.com/quick_view2.cfm/qv_pk/3497 + ++ * Maxim MAX6654 ++ ++ Prefix: 'max6654' ++ ++ Addresses scanned: I2C 0x18, 0x19, 0x1a, 0x29, 0x2a, 0x2b, ++ ++ 0x4c, 0x4d and 0x4e ++ ++ Datasheet: Publicly available at the Maxim website ++ ++ https://www.maximintegrated.com/en/products/sensors/MAX6654.html ++ + * Maxim MAX6657 + + Prefix: 'max6657' +@@ -301,6 +313,13 @@ ADT7461, ADT7461A, NCT1008: + * Extended temperature range (breaks compatibility) + * Lower resolution for remote temperature + ++MAX6654: ++ * Better local resolution ++ * Selectable address ++ * Remote sensor type selection ++ * Extended temperature range ++ * Extended resolution only available when conversion rate <= 1 Hz ++ + MAX6657 and MAX6658: + * Better local resolution + * Remote sensor type selection +@@ -336,8 +355,8 @@ SA56004X: + + All temperature values are given in degrees Celsius. Resolution + is 1.0 degree for the local temperature, 0.125 degree for the remote +-temperature, except for the MAX6657, MAX6658 and MAX6659 which have a +-resolution of 0.125 degree for both temperatures. ++temperature, except for the MAX6654, MAX6657, MAX6658 and MAX6659 which have ++a resolution of 0.125 degree for both temperatures. + + Each sensor has its own high and low limits, plus a critical limit. + Additionally, there is a relative hysteresis value common to both critical +diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig +index 13a6b4afb4b36..fdf8fab7eb396 100644 +--- a/drivers/hwmon/Kconfig ++++ b/drivers/hwmon/Kconfig +@@ -1132,10 +1132,11 @@ config SENSORS_LM90 + help + If you say yes here you get support for National Semiconductor LM90, + LM86, LM89 and LM99, Analog Devices ADM1032, ADT7461, and ADT7461A, +- Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6657, MAX6658, MAX6659, +- MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, ON Semiconductor NCT1008, +- Winbond/Nuvoton W83L771W/G/AWG/ASG, Philips SA56004, GMT G781, and +- Texas Instruments TMP451 sensor chips. ++ Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6654, MAX6657, MAX6658, ++ MAX6659, MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, ++ ON Semiconductor NCT1008, Winbond/Nuvoton W83L771W/G/AWG/ASG, ++ Philips SA56004, GMT G781, and Texas Instruments TMP451 ++ sensor chips. + + This driver can also be built as a module. If so, the module + will be called lm90. +diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c +index 6d6f543baea68..9d48a7405932f 100644 +--- a/drivers/hwmon/lm90.c ++++ b/drivers/hwmon/lm90.c +@@ -35,6 +35,14 @@ + * explicitly as max6659, or if its address is not 0x4c. + * These chips lack the remote temperature offset feature. + * ++ * This driver also supports the MAX6654 chip made by Maxim. This chip can ++ * be at 9 different addresses, similar to MAX6680/MAX6681. The MAX6654 is ++ * otherwise similar to MAX6657/MAX6658/MAX6659. Extended range is available ++ * by setting the configuration register accordingly, and is done during ++ * initialization. Extended precision is only available at conversion rates ++ * of 1 Hz and slower. Note that extended precision is not enabled by ++ * default, as this driver initializes all chips to 2 Hz by design. ++ * + * This driver also supports the MAX6646, MAX6647, MAX6648, MAX6649 and + * MAX6692 chips made by Maxim. These are again similar to the LM86, + * but they use unsigned temperature values and can report temperatures +@@ -94,8 +102,8 @@ + * have address 0x4d. + * MAX6647 has address 0x4e. + * MAX6659 can have address 0x4c, 0x4d or 0x4e. +- * MAX6680 and MAX6681 can have address 0x18, 0x19, 0x1a, 0x29, 0x2a, 0x2b, +- * 0x4c, 0x4d or 0x4e. ++ * MAX6654, MAX6680, and MAX6681 can have address 0x18, 0x19, 0x1a, 0x29, ++ * 0x2a, 0x2b, 0x4c, 0x4d or 0x4e. + * SA56004 can have address 0x48 through 0x4F. + */ + +@@ -104,7 +112,7 @@ static const unsigned short normal_i2c[] = { + 0x4d, 0x4e, 0x4f, I2C_CLIENT_END }; + + enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, +- max6646, w83l771, max6696, sa56004, g781, tmp451 }; ++ max6646, w83l771, max6696, sa56004, g781, tmp451, max6654 }; + + /* + * The LM90 registers +@@ -145,7 +153,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, + #define LM90_REG_R_TCRIT_HYST 0x21 + #define LM90_REG_W_TCRIT_HYST 0x21 + +-/* MAX6646/6647/6649/6657/6658/6659/6695/6696 registers */ ++/* MAX6646/6647/6649/6654/6657/6658/6659/6695/6696 registers */ + + #define MAX6657_REG_R_LOCAL_TEMPL 0x11 + #define MAX6696_REG_R_STATUS2 0x12 +@@ -209,6 +217,7 @@ static const struct i2c_device_id lm90_id[] = { + { "max6646", max6646 }, + { "max6647", max6646 }, + { "max6649", max6646 }, ++ { "max6654", max6654 }, + { "max6657", max6657 }, + { "max6658", max6657 }, + { "max6659", max6659 }, +@@ -269,6 +278,10 @@ static const struct of_device_id __maybe_unused lm90_of_match[] = { + .compatible = "dallas,max6649", + .data = (void *)max6646 + }, ++ { ++ .compatible = "dallas,max6654", ++ .data = (void *)max6654 ++ }, + { + .compatible = "dallas,max6657", + .data = (void *)max6657 +@@ -367,6 +380,11 @@ static const struct lm90_params lm90_params[] = { + .max_convrate = 6, + .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, + }, ++ [max6654] = { ++ .alert_alarms = 0x7c, ++ .max_convrate = 7, ++ .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, ++ }, + [max6657] = { + .flags = LM90_PAUSE_FOR_CONFIG, + .alert_alarms = 0x7c, +@@ -1556,6 +1574,16 @@ static int lm90_detect(struct i2c_client *client, + && (config1 & 0x3f) == 0x00 + && convrate <= 0x07) { + name = "max6646"; ++ } else ++ /* ++ * The chip_id of the MAX6654 holds the revision of the chip. ++ * The lowest 3 bits of the config1 register are unused and ++ * should return zero when read. ++ */ ++ if (chip_id == 0x08 ++ && (config1 & 0x07) == 0x00 ++ && convrate <= 0x07) { ++ name = "max6654"; + } + } else + if (address == 0x4C +@@ -1659,6 +1687,15 @@ static int lm90_init_client(struct i2c_client *client, struct lm90_data *data) + if (data->kind == max6680) + config |= 0x18; + ++ /* ++ * Put MAX6654 into extended range (0x20, extend minimum range from ++ * 0 degrees to -64 degrees). Note that extended resolution is not ++ * possible on the MAX6654 unless conversion rate is set to 1 Hz or ++ * slower, which is intentionally not done by default. ++ */ ++ if (data->kind == max6654) ++ config |= 0x20; ++ + /* + * Select external channel 0 for max6695/96 + */ +-- +2.34.1 + diff --git a/queue-5.4/hwmon-lm90-drop-critical-attribute-support-for-max66.patch b/queue-5.4/hwmon-lm90-drop-critical-attribute-support-for-max66.patch new file mode 100644 index 00000000000..64a074035b5 --- /dev/null +++ b/queue-5.4/hwmon-lm90-drop-critical-attribute-support-for-max66.patch @@ -0,0 +1,224 @@ +From 2738a110e20ba603e6ffe5b3345ef3e654094d51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Nov 2021 08:55:06 -0800 +Subject: hwmon: (lm90) Drop critical attribute support for MAX6654 + +From: Guenter Roeck + +[ Upstream commit 16ba51b5dcd3f6dde2e51d5ccc86313119dcf889 ] + +Tests with a real chip and a closer look into the datasheet show that +MAX6654 does not support CRIT/THERM/OVERTEMP limits, so drop support +of the respective attributes for this chip. + +Introduce LM90_HAVE_CRIT flag and use it to instantiate critical limit +attributes to solve the problem. + +Cc: Josh Lehan +Fixes: 229d495d8189 ("hwmon: (lm90) Add max6654 support to lm90 driver") +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/lm90.c | 86 +++++++++++++++++++++++++------------------- + 1 file changed, 49 insertions(+), 37 deletions(-) + +diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c +index c4d8012806fe2..3ce83f2f5d82f 100644 +--- a/drivers/hwmon/lm90.c ++++ b/drivers/hwmon/lm90.c +@@ -35,13 +35,14 @@ + * explicitly as max6659, or if its address is not 0x4c. + * These chips lack the remote temperature offset feature. + * +- * This driver also supports the MAX6654 chip made by Maxim. This chip can +- * be at 9 different addresses, similar to MAX6680/MAX6681. The MAX6654 is +- * otherwise similar to MAX6657/MAX6658/MAX6659. Extended range is available +- * by setting the configuration register accordingly, and is done during +- * initialization. Extended precision is only available at conversion rates +- * of 1 Hz and slower. Note that extended precision is not enabled by +- * default, as this driver initializes all chips to 2 Hz by design. ++ * This driver also supports the MAX6654 chip made by Maxim. This chip can be ++ * at 9 different addresses, similar to MAX6680/MAX6681. The MAX6654 is similar ++ * to MAX6657/MAX6658/MAX6659, but does not support critical temperature ++ * limits. Extended range is available by setting the configuration register ++ * accordingly, and is done during initialization. Extended precision is only ++ * available at conversion rates of 1 Hz and slower. Note that extended ++ * precision is not enabled by default, as this driver initializes all chips ++ * to 2 Hz by design. + * + * This driver also supports the MAX6646, MAX6647, MAX6648, MAX6649 and + * MAX6692 chips made by Maxim. These are again similar to the LM86, +@@ -188,6 +189,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, + #define LM90_HAVE_BROKEN_ALERT (1 << 7) /* Broken alert */ + #define LM90_HAVE_EXTENDED_TEMP (1 << 8) /* extended temperature support*/ + #define LM90_PAUSE_FOR_CONFIG (1 << 9) /* Pause conversion for config */ ++#define LM90_HAVE_CRIT (1 << 10)/* Chip supports CRIT/OVERT register */ + + /* LM90 status */ + #define LM90_STATUS_LTHRM (1 << 0) /* local THERM limit tripped */ +@@ -354,38 +356,43 @@ struct lm90_params { + static const struct lm90_params lm90_params[] = { + [adm1032] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT +- | LM90_HAVE_BROKEN_ALERT, ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 10, + }, + [adt7461] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT +- | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP, ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP ++ | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 10, + }, + [g781] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT +- | LM90_HAVE_BROKEN_ALERT, ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 8, + }, + [lm86] = { +- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT ++ | LM90_HAVE_CRIT, + .alert_alarms = 0x7b, + .max_convrate = 9, + }, + [lm90] = { +- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT ++ | LM90_HAVE_CRIT, + .alert_alarms = 0x7b, + .max_convrate = 9, + }, + [lm99] = { +- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT ++ | LM90_HAVE_CRIT, + .alert_alarms = 0x7b, + .max_convrate = 9, + }, + [max6646] = { ++ .flags = LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 6, + .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, +@@ -396,50 +403,50 @@ static const struct lm90_params lm90_params[] = { + .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, + }, + [max6657] = { +- .flags = LM90_PAUSE_FOR_CONFIG, ++ .flags = LM90_PAUSE_FOR_CONFIG | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 8, + .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, + }, + [max6659] = { +- .flags = LM90_HAVE_EMERGENCY, ++ .flags = LM90_HAVE_EMERGENCY | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 8, + .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, + }, + [max6680] = { +- .flags = LM90_HAVE_OFFSET, ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 7, + }, + [max6696] = { + .flags = LM90_HAVE_EMERGENCY +- | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3, ++ | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3 | LM90_HAVE_CRIT, + .alert_alarms = 0x1c7c, + .max_convrate = 6, + .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL, + }, + [w83l771] = { +- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 8, + }, + [sa56004] = { +- .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, ++ .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT | LM90_HAVE_CRIT, + .alert_alarms = 0x7b, + .max_convrate = 9, + .reg_local_ext = SA56004_REG_R_LOCAL_TEMPL, + }, + [tmp451] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT +- | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP, ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 9, + .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL, + }, + [tmp461] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT +- | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP, ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP | LM90_HAVE_CRIT, + .alert_alarms = 0x7c, + .max_convrate = 9, + .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL, +@@ -667,20 +674,22 @@ static int lm90_update_limits(struct device *dev) + struct i2c_client *client = data->client; + int val; + +- val = lm90_read_reg(client, LM90_REG_R_LOCAL_CRIT); +- if (val < 0) +- return val; +- data->temp8[LOCAL_CRIT] = val; ++ if (data->flags & LM90_HAVE_CRIT) { ++ val = lm90_read_reg(client, LM90_REG_R_LOCAL_CRIT); ++ if (val < 0) ++ return val; ++ data->temp8[LOCAL_CRIT] = val; + +- val = lm90_read_reg(client, LM90_REG_R_REMOTE_CRIT); +- if (val < 0) +- return val; +- data->temp8[REMOTE_CRIT] = val; ++ val = lm90_read_reg(client, LM90_REG_R_REMOTE_CRIT); ++ if (val < 0) ++ return val; ++ data->temp8[REMOTE_CRIT] = val; + +- val = lm90_read_reg(client, LM90_REG_R_TCRIT_HYST); +- if (val < 0) +- return val; +- data->temp_hyst = val; ++ val = lm90_read_reg(client, LM90_REG_R_TCRIT_HYST); ++ if (val < 0) ++ return val; ++ data->temp_hyst = val; ++ } + + val = lm90_read_reg(client, LM90_REG_R_REMOTE_LOWH); + if (val < 0) +@@ -1867,11 +1876,14 @@ static int lm90_probe(struct i2c_client *client, + info->config = data->channel_config; + + data->channel_config[0] = HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX | +- HWMON_T_CRIT | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM | +- HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM; ++ HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM; + data->channel_config[1] = HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX | +- HWMON_T_CRIT | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM | +- HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM | HWMON_T_FAULT; ++ HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM | HWMON_T_FAULT; ++ ++ if (data->flags & LM90_HAVE_CRIT) { ++ data->channel_config[0] |= HWMON_T_CRIT | HWMON_T_CRIT_ALARM | HWMON_T_CRIT_HYST; ++ data->channel_config[1] |= HWMON_T_CRIT | HWMON_T_CRIT_ALARM | HWMON_T_CRIT_HYST; ++ } + + if (data->flags & LM90_HAVE_OFFSET) + data->channel_config[1] |= HWMON_T_OFFSET; +-- +2.34.1 + diff --git a/queue-5.4/hwmon-lm90-fix-usage-of-config2-register-in-detect-f.patch b/queue-5.4/hwmon-lm90-fix-usage-of-config2-register-in-detect-f.patch new file mode 100644 index 00000000000..38d06f0aa6d --- /dev/null +++ b/queue-5.4/hwmon-lm90-fix-usage-of-config2-register-in-detect-f.patch @@ -0,0 +1,50 @@ +From 7ad7d50b88fbe4378e75ec268d0e6c7429ffc4b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Nov 2021 10:02:44 -0700 +Subject: hwmon: (lm90) Fix usage of CONFIG2 register in detect function + +From: Guenter Roeck + +[ Upstream commit fce15c45d3fbd9fc1feaaf3210d8e3f8b33dfd3a ] + +The detect function had a comment "Make compiler happy" when id did not +read the second configuration register. As it turns out, the code was +checking the contents of this register for manufacturer ID 0xA1 (NXP +Semiconductor/Philips), but never actually read the register. So it +wasn't surprising that the compiler complained, and it indeed had a point. +Fix the code to read the register contents for manufacturer ID 0xa1. + +At the same time, the code was reading the register for manufacturer ID +0x41 (Analog Devices), but it was not using the results. In effect it was +just checking if reading the register returned an error. That doesn't +really add much if any value, so stop doing that. + +Fixes: f90be42fb383 ("hwmon: (lm90) Refactor reading of config2 register") +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/lm90.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c +index 9b3c9f390ef81..6d6f543baea68 100644 +--- a/drivers/hwmon/lm90.c ++++ b/drivers/hwmon/lm90.c +@@ -1420,12 +1420,11 @@ static int lm90_detect(struct i2c_client *client, + if (man_id < 0 || chip_id < 0 || config1 < 0 || convrate < 0) + return -ENODEV; + +- if (man_id == 0x01 || man_id == 0x5C || man_id == 0x41) { ++ if (man_id == 0x01 || man_id == 0x5C || man_id == 0xA1) { + config2 = i2c_smbus_read_byte_data(client, LM90_REG_R_CONFIG2); + if (config2 < 0) + return -ENODEV; +- } else +- config2 = 0; /* Make compiler happy */ ++ } + + if ((address == 0x4C || address == 0x4D) + && man_id == 0x01) { /* National Semiconductor */ +-- +2.34.1 + diff --git a/queue-5.4/hwmon-lm90-introduce-flag-indicating-extended-temper.patch b/queue-5.4/hwmon-lm90-introduce-flag-indicating-extended-temper.patch new file mode 100644 index 00000000000..acb7e1ea3f5 --- /dev/null +++ b/queue-5.4/hwmon-lm90-introduce-flag-indicating-extended-temper.patch @@ -0,0 +1,117 @@ +From dca5864b5158de65e18210a36571c618be633d28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Oct 2021 01:49:50 -0700 +Subject: hwmon: (lm90) Introduce flag indicating extended temperature support + +From: Guenter Roeck + +[ Upstream commit f347e249fcf920ad6974cbd898e2ec0b366a1c34 ] + +A flag indicating extended temperature support makes it easier +to add support for additional chips with this functionality. + +Cc: David T. Wilson +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/lm90.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c +index e085e2a4fa16c..c4d8012806fe2 100644 +--- a/drivers/hwmon/lm90.c ++++ b/drivers/hwmon/lm90.c +@@ -186,7 +186,8 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680, + #define LM90_HAVE_EMERGENCY_ALARM (1 << 5)/* emergency alarm */ + #define LM90_HAVE_TEMP3 (1 << 6) /* 3rd temperature sensor */ + #define LM90_HAVE_BROKEN_ALERT (1 << 7) /* Broken alert */ +-#define LM90_PAUSE_FOR_CONFIG (1 << 8) /* Pause conversion for config */ ++#define LM90_HAVE_EXTENDED_TEMP (1 << 8) /* extended temperature support*/ ++#define LM90_PAUSE_FOR_CONFIG (1 << 9) /* Pause conversion for config */ + + /* LM90 status */ + #define LM90_STATUS_LTHRM (1 << 0) /* local THERM limit tripped */ +@@ -359,7 +360,7 @@ static const struct lm90_params lm90_params[] = { + }, + [adt7461] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT +- | LM90_HAVE_BROKEN_ALERT, ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP, + .alert_alarms = 0x7c, + .max_convrate = 10, + }, +@@ -431,7 +432,7 @@ static const struct lm90_params lm90_params[] = { + }, + [tmp451] = { + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT +- | LM90_HAVE_BROKEN_ALERT, ++ | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP, + .alert_alarms = 0x7c, + .max_convrate = 9, + .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL, +@@ -1013,7 +1014,7 @@ static int lm90_get_temp11(struct lm90_data *data, int index) + s16 temp11 = data->temp11[index]; + int temp; + +- if (data->kind == adt7461 || data->kind == tmp451) ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) + temp = temp_from_u16_adt7461(data, temp11); + else if (data->kind == max6646) + temp = temp_from_u16(temp11); +@@ -1047,7 +1048,7 @@ static int lm90_set_temp11(struct lm90_data *data, int index, long val) + if (data->kind == lm99 && index <= 2) + val -= 16000; + +- if (data->kind == adt7461 || data->kind == tmp451) ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) + data->temp11[index] = temp_to_u16_adt7461(data, val); + else if (data->kind == max6646) + data->temp11[index] = temp_to_u8(val) << 8; +@@ -1074,7 +1075,7 @@ static int lm90_get_temp8(struct lm90_data *data, int index) + s8 temp8 = data->temp8[index]; + int temp; + +- if (data->kind == adt7461 || data->kind == tmp451) ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) + temp = temp_from_u8_adt7461(data, temp8); + else if (data->kind == max6646) + temp = temp_from_u8(temp8); +@@ -1107,7 +1108,7 @@ static int lm90_set_temp8(struct lm90_data *data, int index, long val) + if (data->kind == lm99 && index == 3) + val -= 16000; + +- if (data->kind == adt7461 || data->kind == tmp451) ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) + data->temp8[index] = temp_to_u8_adt7461(data, val); + else if (data->kind == max6646) + data->temp8[index] = temp_to_u8(val); +@@ -1125,7 +1126,7 @@ static int lm90_get_temphyst(struct lm90_data *data, int index) + { + int temp; + +- if (data->kind == adt7461 || data->kind == tmp451) ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) + temp = temp_from_u8_adt7461(data, data->temp8[index]); + else if (data->kind == max6646) + temp = temp_from_u8(data->temp8[index]); +@@ -1145,7 +1146,7 @@ static int lm90_set_temphyst(struct lm90_data *data, long val) + int temp; + int err; + +- if (data->kind == adt7461 || data->kind == tmp451) ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) + temp = temp_from_u8_adt7461(data, data->temp8[LOCAL_CRIT]); + else if (data->kind == max6646) + temp = temp_from_u8(data->temp8[LOCAL_CRIT]); +@@ -1698,7 +1699,7 @@ static int lm90_init_client(struct i2c_client *client, struct lm90_data *data) + lm90_set_convrate(client, data, 500); /* 500ms; 2Hz conversion rate */ + + /* Check Temperature Range Select */ +- if (data->kind == adt7461 || data->kind == tmp451) { ++ if (data->flags & LM90_HAVE_EXTENDED_TEMP) { + if (config & 0x04) + data->flags |= LM90_FLAG_ADT7461_EXT; + } +-- +2.34.1 + diff --git a/queue-5.4/input-elantech-fix-stack-out-of-bound-access-in-elan.patch b/queue-5.4/input-elantech-fix-stack-out-of-bound-access-in-elan.patch new file mode 100644 index 00000000000..937183ef971 --- /dev/null +++ b/queue-5.4/input-elantech-fix-stack-out-of-bound-access-in-elan.patch @@ -0,0 +1,139 @@ +From fd88d027fbebc9ec9e9ad3b9b048dfbac879d33f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Nov 2021 00:08:13 -0800 +Subject: Input: elantech - fix stack out of bound access in + elantech_change_report_id() + +From: Andrea Righi + +[ Upstream commit 1d72d9f960ccf1052a0630a68c3d358791dbdaaa ] + +The array param[] in elantech_change_report_id() must be at least 3 +bytes, because elantech_read_reg_params() is calling ps2_command() with +PSMOUSE_CMD_GETINFO, that is going to access 3 bytes from param[], but +it's defined in the stack as an array of 2 bytes, therefore we have a +potential stack out-of-bounds access here, also confirmed by KASAN: + +[ 6.512374] BUG: KASAN: stack-out-of-bounds in __ps2_command+0x372/0x7e0 +[ 6.512397] Read of size 1 at addr ffff8881024d77c2 by task kworker/2:1/118 + +[ 6.512416] CPU: 2 PID: 118 Comm: kworker/2:1 Not tainted 5.13.0-22-generic #22+arighi20211110 +[ 6.512428] Hardware name: LENOVO 20T8000QGE/20T8000QGE, BIOS R1AET32W (1.08 ) 08/14/2020 +[ 6.512436] Workqueue: events_long serio_handle_event +[ 6.512453] Call Trace: +[ 6.512462] show_stack+0x52/0x58 +[ 6.512474] dump_stack+0xa1/0xd3 +[ 6.512487] print_address_description.constprop.0+0x1d/0x140 +[ 6.512502] ? __ps2_command+0x372/0x7e0 +[ 6.512516] __kasan_report.cold+0x7d/0x112 +[ 6.512527] ? _raw_write_lock_irq+0x20/0xd0 +[ 6.512539] ? __ps2_command+0x372/0x7e0 +[ 6.512552] kasan_report+0x3c/0x50 +[ 6.512564] __asan_load1+0x6a/0x70 +[ 6.512575] __ps2_command+0x372/0x7e0 +[ 6.512589] ? ps2_drain+0x240/0x240 +[ 6.512601] ? dev_printk_emit+0xa2/0xd3 +[ 6.512612] ? dev_vprintk_emit+0xc5/0xc5 +[ 6.512621] ? __kasan_check_write+0x14/0x20 +[ 6.512634] ? mutex_lock+0x8f/0xe0 +[ 6.512643] ? __mutex_lock_slowpath+0x20/0x20 +[ 6.512655] ps2_command+0x52/0x90 +[ 6.512670] elantech_ps2_command+0x4f/0xc0 [psmouse] +[ 6.512734] elantech_change_report_id+0x1e6/0x256 [psmouse] +[ 6.512799] ? elantech_report_trackpoint.constprop.0.cold+0xd/0xd [psmouse] +[ 6.512863] ? ps2_command+0x7f/0x90 +[ 6.512877] elantech_query_info.cold+0x6bd/0x9ed [psmouse] +[ 6.512943] ? elantech_setup_ps2+0x460/0x460 [psmouse] +[ 6.513005] ? psmouse_reset+0x69/0xb0 [psmouse] +[ 6.513064] ? psmouse_attr_set_helper+0x2a0/0x2a0 [psmouse] +[ 6.513122] ? phys_pmd_init+0x30e/0x521 +[ 6.513137] elantech_init+0x8a/0x200 [psmouse] +[ 6.513200] ? elantech_init_ps2+0xf0/0xf0 [psmouse] +[ 6.513249] ? elantech_query_info+0x440/0x440 [psmouse] +[ 6.513296] ? synaptics_send_cmd+0x60/0x60 [psmouse] +[ 6.513342] ? elantech_query_info+0x440/0x440 [psmouse] +[ 6.513388] ? psmouse_try_protocol+0x11e/0x170 [psmouse] +[ 6.513432] psmouse_extensions+0x65d/0x6e0 [psmouse] +[ 6.513476] ? psmouse_try_protocol+0x170/0x170 [psmouse] +[ 6.513519] ? mutex_unlock+0x22/0x40 +[ 6.513526] ? ps2_command+0x7f/0x90 +[ 6.513536] ? psmouse_probe+0xa3/0xf0 [psmouse] +[ 6.513580] psmouse_switch_protocol+0x27d/0x2e0 [psmouse] +[ 6.513624] psmouse_connect+0x272/0x530 [psmouse] +[ 6.513669] serio_driver_probe+0x55/0x70 +[ 6.513679] really_probe+0x190/0x720 +[ 6.513689] driver_probe_device+0x160/0x1f0 +[ 6.513697] device_driver_attach+0x119/0x130 +[ 6.513705] ? device_driver_attach+0x130/0x130 +[ 6.513713] __driver_attach+0xe7/0x1a0 +[ 6.513720] ? device_driver_attach+0x130/0x130 +[ 6.513728] bus_for_each_dev+0xfb/0x150 +[ 6.513738] ? subsys_dev_iter_exit+0x10/0x10 +[ 6.513748] ? _raw_write_unlock_bh+0x30/0x30 +[ 6.513757] driver_attach+0x2d/0x40 +[ 6.513764] serio_handle_event+0x199/0x3d0 +[ 6.513775] process_one_work+0x471/0x740 +[ 6.513785] worker_thread+0x2d2/0x790 +[ 6.513794] ? process_one_work+0x740/0x740 +[ 6.513802] kthread+0x1b4/0x1e0 +[ 6.513809] ? set_kthread_struct+0x80/0x80 +[ 6.513816] ret_from_fork+0x22/0x30 + +[ 6.513832] The buggy address belongs to the page: +[ 6.513838] page:00000000bc35e189 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1024d7 +[ 6.513847] flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) +[ 6.513860] raw: 0017ffffc0000000 dead000000000100 dead000000000122 0000000000000000 +[ 6.513867] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 +[ 6.513872] page dumped because: kasan: bad access detected + +[ 6.513879] addr ffff8881024d77c2 is located in stack of task kworker/2:1/118 at offset 34 in frame: +[ 6.513887] elantech_change_report_id+0x0/0x256 [psmouse] + +[ 6.513941] this frame has 1 object: +[ 6.513947] [32, 34) 'param' + +[ 6.513956] Memory state around the buggy address: +[ 6.513962] ffff8881024d7680: f2 f2 f2 f2 f2 00 00 f3 f3 00 00 00 00 00 00 00 +[ 6.513969] ffff8881024d7700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 6.513976] >ffff8881024d7780: 00 00 00 00 f1 f1 f1 f1 02 f3 f3 f3 00 00 00 00 +[ 6.513982] ^ +[ 6.513988] ffff8881024d7800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 6.513995] ffff8881024d7880: 00 f1 f1 f1 f1 03 f2 03 f2 03 f3 f3 f3 00 00 00 +[ 6.514000] ================================================================== + +Define param[] in elantech_change_report_id() as an array of 3 bytes to +prevent the out-of-bounds access in the stack. + +Fixes: e4c9062717fe ("Input: elantech - fix protocol errors for some trackpoints in SMBus mode") +BugLink: https://bugs.launchpad.net/bugs/1945590 +Signed-off-by: Andrea Righi +Reviewed-by: Wolfram Sang +Link: https://lore.kernel.org/r/20211116095559.24395-1-andrea.righi@canonical.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/elantech.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 0b5ed963cb0e1..3e78c26025815 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1588,7 +1588,13 @@ static const struct dmi_system_id no_hw_res_dmi_table[] = { + */ + static int elantech_change_report_id(struct psmouse *psmouse) + { +- unsigned char param[2] = { 0x10, 0x03 }; ++ /* ++ * NOTE: the code is expecting to receive param[] as an array of 3 ++ * items (see __ps2_command()), even if in this case only 2 are ++ * actually needed. Make sure the array size is 3 to avoid potential ++ * stack out-of-bound accesses. ++ */ ++ unsigned char param[3] = { 0x10, 0x03 }; + + if (elantech_write_reg_params(psmouse, 0x7, param) || + elantech_read_reg_params(psmouse, 0x7, param) || +-- +2.34.1 + diff --git a/queue-5.4/series b/queue-5.4/series index 0ce466e3edc..2e5d863b739 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -13,3 +13,9 @@ bonding-fix-ad_actor_system-option-setting-to-defaul.patch fjes-check-for-error-irq.patch drivers-net-smc911x-check-for-error-irq.patch sfc-falcon-check-null-pointer-of-rx_queue-page_ring.patch +input-elantech-fix-stack-out-of-bound-access-in-elan.patch +hwmon-lm90-fix-usage-of-config2-register-in-detect-f.patch +hwmon-lm90-add-max6654-support-to-lm90-driver.patch +hwmon-lm90-add-basic-support-for-ti-tmp461.patch +hwmon-lm90-introduce-flag-indicating-extended-temper.patch +hwmon-lm90-drop-critical-attribute-support-for-max66.patch -- 2.39.5