4.4-stable patches

added patches:
	alsa-pcm-oss-avoid-potential-buffer-overflows.patch
	input-goodix-add-upside-down-quirk-for-teclast-x89-tablet.patch

diff --git a/queue-4.4/alsa-pcm-oss-avoid-potential-buffer-overflows.patch b/queue-4.4/alsa-pcm-oss-avoid-potential-buffer-overflows.patch
new file mode 100644 (file)
index 0000000..2156367
--- /dev/null
+++ b/queue-4.4/alsa-pcm-oss-avoid-potential-buffer-overflows.patch
@@ -0,0 +1,64 @@
+From 4cc8d6505ab82db3357613d36e6c58a297f57f7c Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 4 Dec 2019 15:48:24 +0100
+Subject: ALSA: pcm: oss: Avoid potential buffer overflows
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 4cc8d6505ab82db3357613d36e6c58a297f57f7c upstream.
+
+syzkaller reported an invalid access in PCM OSS read, and this seems
+to be an overflow of the internal buffer allocated for a plugin.
+Since the rate plugin adjusts its transfer size dynamically, the
+calculation for the chained plugin might be bigger than the given
+buffer size in some extreme cases, which lead to such an buffer
+overflow as caught by KASAN.
+
+Fix it by limiting the max transfer size properly by checking against
+the destination size in each plugin transfer callback.
+
+Reported-by: syzbot+f153bde47a62e0b05f83@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20191204144824.17801-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/oss/linear.c |    2 ++
+ sound/core/oss/mulaw.c  |    2 ++
+ sound/core/oss/route.c  |    2 ++
+ 3 files changed, 6 insertions(+)
+
+--- a/sound/core/oss/linear.c
++++ b/sound/core/oss/linear.c
+@@ -107,6 +107,8 @@ static snd_pcm_sframes_t linear_transfer
+               }
+       }
+ #endif
++      if (frames > dst_channels[0].frames)
++              frames = dst_channels[0].frames;
+       convert(plugin, src_channels, dst_channels, frames);
+       return frames;
+ }
+--- a/sound/core/oss/mulaw.c
++++ b/sound/core/oss/mulaw.c
+@@ -269,6 +269,8 @@ static snd_pcm_sframes_t mulaw_transfer(
+               }
+       }
+ #endif
++      if (frames > dst_channels[0].frames)
++              frames = dst_channels[0].frames;
+       data = (struct mulaw_priv *)plugin->extra_data;
+       data->func(plugin, src_channels, dst_channels, frames);
+       return frames;
+--- a/sound/core/oss/route.c
++++ b/sound/core/oss/route.c
+@@ -57,6 +57,8 @@ static snd_pcm_sframes_t route_transfer(
+               return -ENXIO;
+       if (frames == 0)
+               return 0;
++      if (frames > dst_channels[0].frames)
++              frames = dst_channels[0].frames;
+ 
+       nsrcs = plugin->src_format.channels;
+       ndsts = plugin->dst_format.channels;

diff --git a/queue-4.4/input-goodix-add-upside-down-quirk-for-teclast-x89-tablet.patch b/queue-4.4/input-goodix-add-upside-down-quirk-for-teclast-x89-tablet.patch
new file mode 100644 (file)
index 0000000..93ff4ca
--- /dev/null
+++ b/queue-4.4/input-goodix-add-upside-down-quirk-for-teclast-x89-tablet.patch
@@ -0,0 +1,43 @@
+From df5b5e555b356662a5e4a23c6774fdfce8547d54 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 2 Dec 2019 09:36:15 -0800
+Subject: Input: goodix - add upside-down quirk for Teclast X89 tablet
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit df5b5e555b356662a5e4a23c6774fdfce8547d54 upstream.
+
+The touchscreen on the Teclast X89 is mounted upside down in relation to
+the display orientation (the touchscreen itself is mounted upright, but the
+display is mounted upside-down). Add a quirk for this so that we send
+coordinates which match the display orientation.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Bastien Nocera <hadess@hadess.net>
+Link: https://lore.kernel.org/r/20191202085636.6650-1-hdegoede@redhat.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/touchscreen/goodix.c |    9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/input/touchscreen/goodix.c
++++ b/drivers/input/touchscreen/goodix.c
+@@ -69,6 +69,15 @@ static const unsigned long goodix_irq_fl
+ static const struct dmi_system_id rotated_screen[] = {
+ #if defined(CONFIG_DMI) && defined(CONFIG_X86)
+       {
++              .ident = "Teclast X89",
++              .matches = {
++                      /* tPAD is too generic, also match on bios date */
++                      DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"),
++                      DMI_MATCH(DMI_BOARD_NAME, "tPAD"),
++                      DMI_MATCH(DMI_BIOS_DATE, "12/19/2014"),
++              },
++      },
++      {
+               .ident = "WinBook TW100",
+               .matches = {
+                       DMI_MATCH(DMI_SYS_VENDOR, "WinBook"),

diff --git a/queue-4.4/series b/queue-4.4/series
index 27f2f03c66c9a7eb0474766e707da03d9953274d..0836baf36ebe9abd4cf19f9c4164aa14be8c0b76 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -53,3 +53,5 @@ arm-dts-sunxi-fix-pmu-compatible-strings.patch
 sched-fair-scale-bandwidth-quota-and-period-without-losing-quota-period-ratio-precision.patch
 fuse-verify-nlink.patch
 fuse-verify-attributes.patch
+alsa-pcm-oss-avoid-potential-buffer-overflows.patch
+input-goodix-add-upside-down-quirk-for-teclast-x89-tablet.patch