From: Greg Kroah-Hartman Date: Wed, 7 Aug 2024 14:35:07 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v6.1.104~18 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=012e022e3dd527ba1001b04d6ec32479e1e15fa2;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: alsa-hda-realtek-add-quirk-for-acer-aspire-e5-574g.patch alsa-usb-audio-correct-surround-channels-in-uac1-channel-map.patch hid-wacom-modify-pen-ids.patch net-usb-sr9700-fix-uninitialized-variable-use-in-sr_mdio_read.patch protect-the-fetch-of-fd-in-do_dup2-from-mispredictions.patch --- diff --git a/queue-5.4/alsa-hda-realtek-add-quirk-for-acer-aspire-e5-574g.patch b/queue-5.4/alsa-hda-realtek-add-quirk-for-acer-aspire-e5-574g.patch new file mode 100644 index 00000000000..57fe8bdc963 --- /dev/null +++ b/queue-5.4/alsa-hda-realtek-add-quirk-for-acer-aspire-e5-574g.patch @@ -0,0 +1,31 @@ +From 3c0b6f924e1259ade38587ea719b693f6f6f2f3e Mon Sep 17 00:00:00 2001 +From: Mavroudis Chatzilazaridis +Date: Sun, 28 Jul 2024 12:36:04 +0000 +Subject: ALSA: hda/realtek: Add quirk for Acer Aspire E5-574G + +From: Mavroudis Chatzilazaridis + +commit 3c0b6f924e1259ade38587ea719b693f6f6f2f3e upstream. + +ALC255_FIXUP_ACER_LIMIT_INT_MIC_BOOST fixes combo jack detection and +limits the internal microphone boost that causes clipping on this model. + +Signed-off-by: Mavroudis Chatzilazaridis +Cc: +Link: https://patch.msgid.link/20240728123601.144017-1-mavchatz@protonmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8110,6 +8110,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS), + SND_PCI_QUIRK(0x1025, 0x080d, "Acer Aspire V5-122P", ALC269_FIXUP_ASPIRE_HEADSET_MIC), + SND_PCI_QUIRK(0x1025, 0x0840, "Acer Aspire E1", ALC269VB_FIXUP_ASPIRE_E1_COEF), ++ SND_PCI_QUIRK(0x1025, 0x100c, "Acer Aspire E5-574G", ALC255_FIXUP_ACER_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x1025, 0x101c, "Acer Veriton N2510G", ALC269_FIXUP_LIFEBOOK), + SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1065, "Acer Aspire C20-820", ALC269VC_FIXUP_ACER_HEADSET_MIC), diff --git a/queue-5.4/alsa-usb-audio-correct-surround-channels-in-uac1-channel-map.patch b/queue-5.4/alsa-usb-audio-correct-surround-channels-in-uac1-channel-map.patch new file mode 100644 index 00000000000..d9bf5fbf612 --- /dev/null +++ b/queue-5.4/alsa-usb-audio-correct-surround-channels-in-uac1-channel-map.patch @@ -0,0 +1,41 @@ +From b7b7e1ab7619deb3b299b5e5c619c3e6f183a12d Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 31 Jul 2024 16:19:41 +0200 +Subject: ALSA: usb-audio: Correct surround channels in UAC1 channel map + +From: Takashi Iwai + +commit b7b7e1ab7619deb3b299b5e5c619c3e6f183a12d upstream. + +USB-audio driver puts SNDRV_CHMAP_SL and _SR as left and right +surround channels for UAC1 channel map, respectively. But they should +have been SNDRV_CHMAP_RL and _RR; the current value *_SL and _SR are +rather "side" channels, not "surround". I guess I took those +mistakenly when I read the spec mentioning "surround left". + +This patch corrects those entries to be the right channels. + +Suggested-by: Sylvain BERTRAND +Closes: https://lore.kernel.orgZ/qIyJD8lhd8hFhlC@freedom +Fixes: 04324ccc75f9 ("ALSA: usb-audio: add channel map support") +Cc: +Link: https://patch.msgid.link/20240731142018.24750-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/stream.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/usb/stream.c ++++ b/sound/usb/stream.c +@@ -245,8 +245,8 @@ static struct snd_pcm_chmap_elem *conver + SNDRV_CHMAP_FR, /* right front */ + SNDRV_CHMAP_FC, /* center front */ + SNDRV_CHMAP_LFE, /* LFE */ +- SNDRV_CHMAP_SL, /* left surround */ +- SNDRV_CHMAP_SR, /* right surround */ ++ SNDRV_CHMAP_RL, /* left surround */ ++ SNDRV_CHMAP_RR, /* right surround */ + SNDRV_CHMAP_FLC, /* left of center */ + SNDRV_CHMAP_FRC, /* right of center */ + SNDRV_CHMAP_RC, /* surround */ diff --git a/queue-5.4/hid-wacom-modify-pen-ids.patch b/queue-5.4/hid-wacom-modify-pen-ids.patch new file mode 100644 index 00000000000..500fc69fc91 --- /dev/null +++ b/queue-5.4/hid-wacom-modify-pen-ids.patch @@ -0,0 +1,43 @@ +From f0d17d696dfce77c9abc830e4ac2d677890a2dad Mon Sep 17 00:00:00 2001 +From: Tatsunosuke Tobita +Date: Tue, 9 Jul 2024 14:57:28 +0900 +Subject: HID: wacom: Modify pen IDs + +From: Tatsunosuke Tobita + +commit f0d17d696dfce77c9abc830e4ac2d677890a2dad upstream. + +The pen ID, 0x80842, was not the correct ID for wacom driver to +treat. The ID was corrected to 0x8842. +Also, 0x4200 was not the expected ID used on any Wacom device. +Therefore, 0x4200 was removed. + +Signed-off-by: Tatsunosuke Tobita +Signed-off-by: Tatsunosuke Tobita +Fixes: bfdc750c4cb2 ("HID: wacom: add three styli to wacom_intuos_get_tool_type") +Cc: stable@kernel.org #6.2 +Reviewed-by: Ping Cheng +Link: https://patch.msgid.link/20240709055729.17158-1-tatsunosuke.wacom@gmail.com +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/wacom_wac.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -714,13 +714,12 @@ static int wacom_intuos_get_tool_type(in + case 0x8e2: /* IntuosHT2 pen */ + case 0x022: + case 0x200: /* Pro Pen 3 */ +- case 0x04200: /* Pro Pen 3 */ + case 0x10842: /* MobileStudio Pro Pro Pen slim */ + case 0x14802: /* Intuos4/5 13HD/24HD Classic Pen */ + case 0x16802: /* Cintiq 13HD Pro Pen */ + case 0x18802: /* DTH2242 Pen */ + case 0x10802: /* Intuos4/5 13HD/24HD General Pen */ +- case 0x80842: /* Intuos Pro and Cintiq Pro 3D Pen */ ++ case 0x8842: /* Intuos Pro and Cintiq Pro 3D Pen */ + tool_type = BTN_TOOL_PEN; + break; + diff --git a/queue-5.4/net-usb-sr9700-fix-uninitialized-variable-use-in-sr_mdio_read.patch b/queue-5.4/net-usb-sr9700-fix-uninitialized-variable-use-in-sr_mdio_read.patch new file mode 100644 index 00000000000..fb04939bb84 --- /dev/null +++ b/queue-5.4/net-usb-sr9700-fix-uninitialized-variable-use-in-sr_mdio_read.patch @@ -0,0 +1,60 @@ +From 08f3a5c38087d1569e982a121aad1e6acbf145ce Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Thu, 25 Jul 2024 10:29:42 +0800 +Subject: net: usb: sr9700: fix uninitialized variable use in sr_mdio_read + +From: Ma Ke + +commit 08f3a5c38087d1569e982a121aad1e6acbf145ce upstream. + +It could lead to error happen because the variable res is not updated if +the call to sr_share_read_word returns an error. In this particular case +error code was returned and res stayed uninitialized. Same issue also +applies to sr_read_reg. + +This can be avoided by checking the return value of sr_share_read_word +and sr_read_reg, and propagating the error if the read operation failed. + +Found by code review. + +Cc: stable@vger.kernel.org +Fixes: c9b37458e956 ("USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support") +Signed-off-by: Ma Ke +Reviewed-by: Shigeru Yoshida +Reviewed-by: Hariprasad Kelam +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/sr9700.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/net/usb/sr9700.c ++++ b/drivers/net/usb/sr9700.c +@@ -178,6 +178,7 @@ static int sr_mdio_read(struct net_devic + struct usbnet *dev = netdev_priv(netdev); + __le16 res; + int rc = 0; ++ int err; + + if (phy_id) { + netdev_dbg(netdev, "Only internal phy supported\n"); +@@ -188,11 +189,17 @@ static int sr_mdio_read(struct net_devic + if (loc == MII_BMSR) { + u8 value; + +- sr_read_reg(dev, SR_NSR, &value); ++ err = sr_read_reg(dev, SR_NSR, &value); ++ if (err < 0) ++ return err; ++ + if (value & NSR_LINKST) + rc = 1; + } +- sr_share_read_word(dev, 1, loc, &res); ++ err = sr_share_read_word(dev, 1, loc, &res); ++ if (err < 0) ++ return err; ++ + if (rc == 1) + res = le16_to_cpu(res) | BMSR_LSTATUS; + else diff --git a/queue-5.4/protect-the-fetch-of-fd-in-do_dup2-from-mispredictions.patch b/queue-5.4/protect-the-fetch-of-fd-in-do_dup2-from-mispredictions.patch new file mode 100644 index 00000000000..17dbb4ef6a6 --- /dev/null +++ b/queue-5.4/protect-the-fetch-of-fd-in-do_dup2-from-mispredictions.patch @@ -0,0 +1,34 @@ +From 8aa37bde1a7b645816cda8b80df4753ecf172bf1 Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Thu, 1 Aug 2024 15:22:22 -0400 +Subject: protect the fetch of ->fd[fd] in do_dup2() from mispredictions + +From: Al Viro + +commit 8aa37bde1a7b645816cda8b80df4753ecf172bf1 upstream. + +both callers have verified that fd is not greater than ->max_fds; +however, misprediction might end up with + tofree = fdt->fd[fd]; +being speculatively executed. That's wrong for the same reasons +why it's wrong in close_fd()/file_close_fd_locked(); the same +solution applies - array_index_nospec(fd, fdt->max_fds) could differ +from fd only in case of speculative execution on mispredicted path. + +Cc: stable@vger.kernel.org +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman +--- + fs/file.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/file.c ++++ b/fs/file.c +@@ -908,6 +908,7 @@ __releases(&files->file_lock) + * tables and this condition does not arise without those. + */ + fdt = files_fdtable(files); ++ fd = array_index_nospec(fd, fdt->max_fds); + tofree = fdt->fd[fd]; + if (!tofree && fd_is_open(fd, fdt)) + goto Ebusy; diff --git a/queue-5.4/series b/queue-5.4/series index f6bad591bf9..2384826cb64 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -176,3 +176,8 @@ drm-vmwgfx-fix-overlay-when-using-screen-targets.patch net-iucv-fix-use-after-free-in-iucv_sock_close.patch net-mlx5e-add-a-check-for-the-return-value-from-mlx5.patch ipv6-fix-ndisc_is_useropt-handling-for-pio.patch +hid-wacom-modify-pen-ids.patch +protect-the-fetch-of-fd-in-do_dup2-from-mispredictions.patch +alsa-usb-audio-correct-surround-channels-in-uac1-channel-map.patch +alsa-hda-realtek-add-quirk-for-acer-aspire-e5-574g.patch +net-usb-sr9700-fix-uninitialized-variable-use-in-sr_mdio_read.patch