From: Greg Kroah-Hartman Date: Tue, 3 Dec 2019 21:17:02 +0000 (+0100) Subject: 4.14-stable patches X-Git-Tag: v5.4.2~10 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f0f311f58b47552802686b90995b2e232465f30a;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: platform-x86-hp-wmi-fix-acpi-errors-caused-by-passing-0-as-input-size.patch platform-x86-hp-wmi-fix-acpi-errors-caused-by-too-small-buffer.patch --- diff --git a/queue-4.14/platform-x86-hp-wmi-fix-acpi-errors-caused-by-passing-0-as-input-size.patch b/queue-4.14/platform-x86-hp-wmi-fix-acpi-errors-caused-by-passing-0-as-input-size.patch new file mode 100644 index 00000000000..8ac375f2e1b --- /dev/null +++ b/queue-4.14/platform-x86-hp-wmi-fix-acpi-errors-caused-by-passing-0-as-input-size.patch @@ -0,0 +1,63 @@ +From f3e4f3fc8ee9729c4b1b27a478c68b713df53c0c Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Fri, 22 Nov 2019 19:56:41 +0100 +Subject: platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input size + +From: Hans de Goede + +commit f3e4f3fc8ee9729c4b1b27a478c68b713df53c0c upstream. + +The AML code implementing the WMI methods creates a variable length +field to hold the input data we pass like this: + + CreateDWordField (Arg1, 0x0C, DSZI) + Local5 = DSZI /* \HWMC.DSZI */ + CreateField (Arg1, 0x80, (Local5 * 0x08), DAIN) + +If we pass 0 as bios_args.datasize argument then (Local5 * 0x08) +is 0 which results in these errors: + +[ 71.973305] ACPI BIOS Error (bug): Attempt to CreateField of length zero (20190816/dsopcode-133) +[ 71.973332] ACPI Error: Aborting method \HWMC due to previous error (AE_AML_OPERAND_VALUE) (20190816/psparse-529) +[ 71.973413] ACPI Error: Aborting method \_SB.WMID.WMAA due to previous error (AE_AML_OPERAND_VALUE) (20190816/psparse-529) + +And in our HPWMI_WIRELESS2_QUERY calls always failing. for read commands +like HPWMI_WIRELESS2_QUERY the DSZI value is not used / checked, except for +read commands where extra input is needed to specify exactly what to read. + +So for HPWMI_WIRELESS2_QUERY we can safely pass the size of the expected +output as insize to hp_wmi_perform_query(), as we are already doing for all +other HPWMI_READ commands we send. Doing so fixes these errors. + +Cc: stable@vger.kernel.org +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=197007 +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201981 +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1520703 +Signed-off-by: Hans de Goede +Signed-off-by: Andy Shevchenko +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/hp-wmi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/platform/x86/hp-wmi.c ++++ b/drivers/platform/x86/hp-wmi.c +@@ -393,7 +393,7 @@ static int hp_wmi_rfkill2_refresh(void) + int err, i; + + err = hp_wmi_perform_query(HPWMI_WIRELESS2_QUERY, HPWMI_READ, &state, +- 0, sizeof(state)); ++ sizeof(state), sizeof(state)); + if (err) + return err; + +@@ -790,7 +790,7 @@ static int __init hp_wmi_rfkill2_setup(s + int err, i; + + err = hp_wmi_perform_query(HPWMI_WIRELESS2_QUERY, HPWMI_READ, &state, +- 0, sizeof(state)); ++ sizeof(state), sizeof(state)); + if (err) + return err < 0 ? err : -EINVAL; + diff --git a/queue-4.14/platform-x86-hp-wmi-fix-acpi-errors-caused-by-too-small-buffer.patch b/queue-4.14/platform-x86-hp-wmi-fix-acpi-errors-caused-by-too-small-buffer.patch new file mode 100644 index 00000000000..e8d4c12efbc --- /dev/null +++ b/queue-4.14/platform-x86-hp-wmi-fix-acpi-errors-caused-by-too-small-buffer.patch @@ -0,0 +1,70 @@ +From 16245db1489cd9aa579506f64afeeeb13d825a93 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Fri, 22 Nov 2019 19:56:40 +0100 +Subject: platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer + +From: Hans de Goede + +commit 16245db1489cd9aa579506f64afeeeb13d825a93 upstream. + +The HP WMI calls may take up to 128 bytes of data as input, and +the AML methods implementing the WMI calls, declare a couple of fields for +accessing input in different sizes, specifycally the HWMC method contains: + + CreateField (Arg1, 0x80, 0x0400, D128) + +Even though we do not use any of the WMI command-types which need a buffer +of this size, the APCI interpreter still tries to create it as it is +declared in generoc code at the top of the HWMC method which runs before +the code looks at which command-type is requested. + +This results in many of these errors on many different HP laptop models: + +[ 14.459261] ACPI Error: Field [D128] at 1152 exceeds Buffer [NULL] size 160 (bits) (20170303/dsopcode-236) +[ 14.459268] ACPI Error: Method parse/execution failed [\HWMC] (Node ffff8edcc61507f8), AE_AML_BUFFER_LIMIT (20170303/psparse-543) +[ 14.459279] ACPI Error: Method parse/execution failed [\_SB.WMID.WMAA] (Node ffff8edcc61523c0), AE_AML_BUFFER_LIMIT (20170303/psparse-543) + +This commit increases the size of the data element of the bios_args struct +to 128 bytes fixing these errors. + +Cc: stable@vger.kernel.org +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=197007 +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201981 +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1520703 +Signed-off-by: Hans de Goede +Signed-off-by: Andy Shevchenko +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/hp-wmi.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/platform/x86/hp-wmi.c ++++ b/drivers/platform/x86/hp-wmi.c +@@ -78,7 +78,7 @@ struct bios_args { + u32 command; + u32 commandtype; + u32 datasize; +- u32 data; ++ u8 data[128]; + }; + + enum hp_wmi_commandtype { +@@ -229,7 +229,7 @@ static int hp_wmi_perform_query(int quer + .command = command, + .commandtype = query, + .datasize = insize, +- .data = 0, ++ .data = { 0 }, + }; + struct acpi_buffer input = { sizeof(struct bios_args), &args }; + struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; +@@ -241,7 +241,7 @@ static int hp_wmi_perform_query(int quer + + if (WARN_ON(insize > sizeof(args.data))) + return -EINVAL; +- memcpy(&args.data, buffer, insize); ++ memcpy(&args.data[0], buffer, insize); + + wmi_evaluate_method(HPWMI_BIOS_GUID, 0, mid, &input, &output); + diff --git a/queue-4.14/series b/queue-4.14/series index 899be58b69d..44dc5b9f858 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -205,3 +205,5 @@ pinctrl-stm32-fix-memory-leak-issue.patch asoc-stm32-i2s-fix-dma-configuration.patch asoc-stm32-i2s-fix-16-bit-format-support.patch asoc-stm32-i2s-fix-irq-clearing.patch +platform-x86-hp-wmi-fix-acpi-errors-caused-by-too-small-buffer.patch +platform-x86-hp-wmi-fix-acpi-errors-caused-by-passing-0-as-input-size.patch