From: Greg Kroah-Hartman Date: Sun, 6 Dec 2020 10:20:02 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.14.211~6 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7d298e6037c9f72b2682fc9781f3e0b6c7eb0693;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: input-i8042-add-bytespeed-touchpad-to-noloop-table.patch input-xpad-support-ardwiino-controllers.patch rdma-i40iw-address-an-mmap-handler-exploit-in-i40iw.patch spi-fix-controller-unregister-order-harder.patch --- diff --git a/queue-4.9/input-i8042-add-bytespeed-touchpad-to-noloop-table.patch b/queue-4.9/input-i8042-add-bytespeed-touchpad-to-noloop-table.patch new file mode 100644 index 00000000000..186eec40a03 --- /dev/null +++ b/queue-4.9/input-i8042-add-bytespeed-touchpad-to-noloop-table.patch @@ -0,0 +1,38 @@ +From a48491c65b513e5cdc3e7a886a4db915f848a5f5 Mon Sep 17 00:00:00 2001 +From: Po-Hsu Lin +Date: Mon, 30 Nov 2020 22:39:40 -0800 +Subject: Input: i8042 - add ByteSpeed touchpad to noloop table + +From: Po-Hsu Lin + +commit a48491c65b513e5cdc3e7a886a4db915f848a5f5 upstream. + +It looks like the C15B laptop got another vendor: ByteSpeed LLC. + +Avoid AUX loopback on this touchpad as well, thus input subsystem will +be able to recognize a Synaptics touchpad in the AUX port. + +BugLink: https://bugs.launchpad.net/bugs/1906128 +Signed-off-by: Po-Hsu Lin +Link: https://lore.kernel.org/r/20201201054723.5939-1-po-hsu.lin@canonical.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/serio/i8042-x86ia64io.h | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -223,6 +223,10 @@ static const struct dmi_system_id __init + DMI_MATCH(DMI_SYS_VENDOR, "PEGATRON CORPORATION"), + DMI_MATCH(DMI_PRODUCT_NAME, "C15B"), + }, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ByteSpeed LLC"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "ByteSpeed Laptop C15B"), ++ }, + }, + { } + }; diff --git a/queue-4.9/input-xpad-support-ardwiino-controllers.patch b/queue-4.9/input-xpad-support-ardwiino-controllers.patch new file mode 100644 index 00000000000..bb9550a1f95 --- /dev/null +++ b/queue-4.9/input-xpad-support-ardwiino-controllers.patch @@ -0,0 +1,39 @@ +From 2aab1561439032be2e98811dd0ddbeb5b2ae4c61 Mon Sep 17 00:00:00 2001 +From: Sanjay Govind +Date: Mon, 30 Nov 2020 23:41:48 -0800 +Subject: Input: xpad - support Ardwiino Controllers + +From: Sanjay Govind + +commit 2aab1561439032be2e98811dd0ddbeb5b2ae4c61 upstream. + +This commit adds support for Ardwiino Controllers + +Signed-off-by: Sanjay Govind +Link: https://lore.kernel.org/r/20201201071922.131666-1-sanjay.govind9@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/joystick/xpad.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -258,6 +258,7 @@ static const struct xpad_device { + { 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 }, + { 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 }, + { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 }, ++ { 0x1209, 0x2882, "Ardwiino Controller", 0, XTYPE_XBOX360 }, + { 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 }, + { 0x12ab, 0x0303, "Mortal Kombat Klassic FightStick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, +@@ -435,6 +436,7 @@ static const struct usb_device_id xpad_t + XPAD_XBOXONE_VENDOR(0x0f0d), /* Hori Controllers */ + XPAD_XBOX360_VENDOR(0x1038), /* SteelSeries Controllers */ + XPAD_XBOX360_VENDOR(0x11c9), /* Nacon GC100XF */ ++ XPAD_XBOX360_VENDOR(0x1209), /* Ardwiino Controllers */ + XPAD_XBOX360_VENDOR(0x12ab), /* X-Box 360 dance pads */ + XPAD_XBOX360_VENDOR(0x1430), /* RedOctane X-Box 360 controllers */ + XPAD_XBOX360_VENDOR(0x146b), /* BigBen Interactive Controllers */ diff --git a/queue-4.9/rdma-i40iw-address-an-mmap-handler-exploit-in-i40iw.patch b/queue-4.9/rdma-i40iw-address-an-mmap-handler-exploit-in-i40iw.patch new file mode 100644 index 00000000000..b32bc9de147 --- /dev/null +++ b/queue-4.9/rdma-i40iw-address-an-mmap-handler-exploit-in-i40iw.patch @@ -0,0 +1,106 @@ +From 2ed381439e89fa6d1a0839ef45ccd45d99d8e915 Mon Sep 17 00:00:00 2001 +From: Shiraz Saleem +Date: Tue, 24 Nov 2020 18:56:16 -0600 +Subject: RDMA/i40iw: Address an mmap handler exploit in i40iw + +From: Shiraz Saleem + +commit 2ed381439e89fa6d1a0839ef45ccd45d99d8e915 upstream. + +i40iw_mmap manipulates the vma->vm_pgoff to differentiate a push page mmap +vs a doorbell mmap, and uses it to compute the pfn in remap_pfn_range +without any validation. This is vulnerable to an mmap exploit as described +in: https://lore.kernel.org/r/20201119093523.7588-1-zhudi21@huawei.com + +The push feature is disabled in the driver currently and therefore no push +mmaps are issued from user-space. The feature does not work as expected in +the x722 product. + +Remove the push module parameter and all VMA attribute manipulations for +this feature in i40iw_mmap. Update i40iw_mmap to only allow DB user +mmapings at offset = 0. Check vm_pgoff for zero and if the mmaps are bound +to a single page. + +Cc: +Fixes: d37498417947 ("i40iw: add files for iwarp interface") +Link: https://lore.kernel.org/r/20201125005616.1800-2-shiraz.saleem@intel.com +Reported-by: Di Zhu +Signed-off-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/infiniband/hw/i40iw/i40iw_main.c | 5 ---- + drivers/infiniband/hw/i40iw/i40iw_verbs.c | 36 +++++------------------------- + 2 files changed, 7 insertions(+), 34 deletions(-) + +--- a/drivers/infiniband/hw/i40iw/i40iw_main.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_main.c +@@ -54,10 +54,6 @@ + #define DRV_VERSION __stringify(DRV_VERSION_MAJOR) "." \ + __stringify(DRV_VERSION_MINOR) "." __stringify(DRV_VERSION_BUILD) + +-static int push_mode; +-module_param(push_mode, int, 0644); +-MODULE_PARM_DESC(push_mode, "Low latency mode: 0=disabled (default), 1=enabled)"); +- + static int debug; + module_param(debug, int, 0644); + MODULE_PARM_DESC(debug, "debug flags: 0=disabled (default), 0x7fffffff=all"); +@@ -1524,7 +1520,6 @@ static enum i40iw_status_code i40iw_setu + if (status) + goto exit; + iwdev->obj_next = iwdev->obj_mem; +- iwdev->push_mode = push_mode; + + init_waitqueue_head(&iwdev->vchnl_waitq); + init_waitqueue_head(&dev->vf_reqs); +--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c +@@ -208,38 +208,16 @@ static int i40iw_dealloc_ucontext(struct + */ + static int i40iw_mmap(struct ib_ucontext *context, struct vm_area_struct *vma) + { +- struct i40iw_ucontext *ucontext; +- u64 db_addr_offset; +- u64 push_offset; ++ struct i40iw_ucontext *ucontext = to_ucontext(context); ++ u64 dbaddr; + +- ucontext = to_ucontext(context); +- if (ucontext->iwdev->sc_dev.is_pf) { +- db_addr_offset = I40IW_DB_ADDR_OFFSET; +- push_offset = I40IW_PUSH_OFFSET; +- if (vma->vm_pgoff) +- vma->vm_pgoff += I40IW_PF_FIRST_PUSH_PAGE_INDEX - 1; +- } else { +- db_addr_offset = I40IW_VF_DB_ADDR_OFFSET; +- push_offset = I40IW_VF_PUSH_OFFSET; +- if (vma->vm_pgoff) +- vma->vm_pgoff += I40IW_VF_FIRST_PUSH_PAGE_INDEX - 1; +- } ++ if (vma->vm_pgoff || vma->vm_end - vma->vm_start != PAGE_SIZE) ++ return -EINVAL; + +- vma->vm_pgoff += db_addr_offset >> PAGE_SHIFT; ++ dbaddr = I40IW_DB_ADDR_OFFSET + pci_resource_start(ucontext->iwdev->ldev->pcidev, 0); + +- if (vma->vm_pgoff == (db_addr_offset >> PAGE_SHIFT)) { +- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); +- vma->vm_private_data = ucontext; +- } else { +- if ((vma->vm_pgoff - (push_offset >> PAGE_SHIFT)) % 2) +- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); +- else +- vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot); +- } +- +- if (io_remap_pfn_range(vma, vma->vm_start, +- vma->vm_pgoff + (pci_resource_start(ucontext->iwdev->ldev->pcidev, 0) >> PAGE_SHIFT), +- PAGE_SIZE, vma->vm_page_prot)) ++ if (io_remap_pfn_range(vma, vma->vm_start, dbaddr >> PAGE_SHIFT, PAGE_SIZE, ++ pgprot_noncached(vma->vm_page_prot))) + return -EAGAIN; + + return 0; diff --git a/queue-4.9/series b/queue-4.9/series index a03e6140b12..b574227e643 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -10,3 +10,7 @@ cxgb3-fix-error-return-code-in-t3_sge_alloc_qset.patch net-pasemi-fix-error-return-code-in-pasemi_mac_open.patch net-mlx5-fix-wrong-address-reclaim-when-command-interface-is-down.patch dt-bindings-net-correct-interrupt-flags-in-examples.patch +input-xpad-support-ardwiino-controllers.patch +input-i8042-add-bytespeed-touchpad-to-noloop-table.patch +spi-fix-controller-unregister-order-harder.patch +rdma-i40iw-address-an-mmap-handler-exploit-in-i40iw.patch diff --git a/queue-4.9/spi-fix-controller-unregister-order-harder.patch b/queue-4.9/spi-fix-controller-unregister-order-harder.patch new file mode 100644 index 00000000000..f5d8fd4d5e0 --- /dev/null +++ b/queue-4.9/spi-fix-controller-unregister-order-harder.patch @@ -0,0 +1,39 @@ +From lukas@wunner.de Sun Dec 6 10:46:40 2020 +From: Lukas Wunner +Date: Sat, 5 Dec 2020 18:42:07 +0100 +To: yangerkun , sashal@kernel.org, gregkh@linuxfoundation.org +Cc: linux-kernel@vger.kernel.org, chenwenyong2@huawei.com, stable@vger.kernel.org, "zhangyi (F)" +Message-ID: <20201205174207.GA4028@wunner.de> +Subject: spi: Fix controller unregister order harder + +From: Lukas Wunner + +Commit c7e41e1caa71 sought to backport upstream commit 84855678add8 to +the 4.9-stable tree but erroneously inserted a line at the wrong place. +Fix it. + +Fixes: c7e41e1caa71 ("spi: Fix controller unregister order") +Reported-by: yangerkun +Signed-off-by: Lukas Wunner +--- + drivers/spi/spi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -2025,13 +2025,13 @@ static int __unregister(struct device *d + */ + void spi_unregister_master(struct spi_master *master) + { ++ device_for_each_child(&master->dev, NULL, __unregister); ++ + if (master->queued) { + if (spi_destroy_queue(master)) + dev_err(&master->dev, "queue remove failed\n"); + } + +- device_for_each_child(&master->dev, NULL, __unregister); +- + mutex_lock(&board_lock); + list_del(&master->list); + mutex_unlock(&board_lock);