From 2a42841ac3be658f69f9128bdb7efe7a8f3cf97a Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 31 May 2020 22:48:47 -0400 Subject: [PATCH] Fixes for 4.4 Signed-off-by: Sasha Levin --- ...p-fix-a-left-shifting-1-by-31-ub-bug.patch | 47 +++++++++++ ...ixer-volume-quirk-for-ess-technology.patch | 52 ++++++++++++ ...et-cap_ambient-in-cap_bprm_set_creds.patch | 52 ++++++++++++ ...allocate-initialized-memory-in-fill_.patch | 45 ++++++++++ ...ect_put-when-kobject_init_and_add-fa.patch | 82 +++++++++++++++++++ ...ric-topology.h-guard-cpumask_of_node.patch | 48 +++++++++++ ...-input_flush_device-on-release-not-f.patch | 75 +++++++++++++++++ ...d-thinkpad-s230u-to-i8042-nomux-list.patch | 63 ++++++++++++++ ...d-thinkpad-s230u-to-i8042-reset-list.patch | 60 ++++++++++++++ ...uchscreen-add-support-for-bonxeon-tp.patch | 37 +++++++++ ...ustom-init-packet-for-xbox-one-s-con.patch | 59 +++++++++++++ ...ence-count-leak-in-iommu_group_alloc.patch | 38 +++++++++ queue-4.4/series | 12 +++ 13 files changed, 670 insertions(+) create mode 100644 queue-4.4/alsa-hwdep-fix-a-left-shifting-1-by-31-ub-bug.patch create mode 100644 queue-4.4/alsa-usb-audio-mixer-volume-quirk-for-ess-technology.patch create mode 100644 queue-4.4/exec-always-set-cap_ambient-in-cap_bprm_set_creds.patch create mode 100644 queue-4.4/fs-binfmt_elf.c-allocate-initialized-memory-in-fill_.patch create mode 100644 queue-4.4/ib-qib-call-kobject_put-when-kobject_init_and_add-fa.patch create mode 100644 queue-4.4/include-asm-generic-topology.h-guard-cpumask_of_node.patch create mode 100644 queue-4.4/input-evdev-call-input_flush_device-on-release-not-f.patch create mode 100644 queue-4.4/input-i8042-add-thinkpad-s230u-to-i8042-nomux-list.patch create mode 100644 queue-4.4/input-i8042-add-thinkpad-s230u-to-i8042-reset-list.patch create mode 100644 queue-4.4/input-usbtouchscreen-add-support-for-bonxeon-tp.patch create mode 100644 queue-4.4/input-xpad-add-custom-init-packet-for-xbox-one-s-con.patch create mode 100644 queue-4.4/iommu-fix-reference-count-leak-in-iommu_group_alloc.patch diff --git a/queue-4.4/alsa-hwdep-fix-a-left-shifting-1-by-31-ub-bug.patch b/queue-4.4/alsa-hwdep-fix-a-left-shifting-1-by-31-ub-bug.patch new file mode 100644 index 00000000000..d021ca8c41f --- /dev/null +++ b/queue-4.4/alsa-hwdep-fix-a-left-shifting-1-by-31-ub-bug.patch @@ -0,0 +1,47 @@ +From f4e414306b8f8eeb0ab9125aac03c225f57a1fc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 May 2020 00:39:21 +0000 +Subject: ALSA: hwdep: fix a left shifting 1 by 31 UB bug + +From: Changming Liu + +[ Upstream commit fb8cd6481ffd126f35e9e146a0dcf0c4e8899f2e ] + +The "info.index" variable can be 31 in "1 << info.index". +This might trigger an undefined behavior since 1 is signed. + +Fix this by casting 1 to 1u just to be sure "1u << 31" is defined. + +Signed-off-by: Changming Liu +Cc: +Link: https://lore.kernel.org/r/BL0PR06MB4548170B842CB055C9AF695DE5B00@BL0PR06MB4548.namprd06.prod.outlook.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/hwdep.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c +index 36d2416f90d9..96b737adf4d2 100644 +--- a/sound/core/hwdep.c ++++ b/sound/core/hwdep.c +@@ -228,14 +228,14 @@ static int snd_hwdep_dsp_load(struct snd_hwdep *hw, + if (copy_from_user(&info, _info, sizeof(info))) + return -EFAULT; + /* check whether the dsp was already loaded */ +- if (hw->dsp_loaded & (1 << info.index)) ++ if (hw->dsp_loaded & (1u << info.index)) + return -EBUSY; + if (!access_ok(VERIFY_READ, info.image, info.length)) + return -EFAULT; + err = hw->ops.dsp_load(hw, &info); + if (err < 0) + return err; +- hw->dsp_loaded |= (1 << info.index); ++ hw->dsp_loaded |= (1u << info.index); + return 0; + } + +-- +2.25.1 + diff --git a/queue-4.4/alsa-usb-audio-mixer-volume-quirk-for-ess-technology.patch b/queue-4.4/alsa-usb-audio-mixer-volume-quirk-for-ess-technology.patch new file mode 100644 index 00000000000..ebb042cdb05 --- /dev/null +++ b/queue-4.4/alsa-usb-audio-mixer-volume-quirk-for-ess-technology.patch @@ -0,0 +1,52 @@ +From c853af6a9899115dfb9a6f0a59c3fe7b3d34bf5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 May 2020 14:26:13 +0800 +Subject: ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC + +From: Chris Chiu + +[ Upstream commit 4020d1ccbe55bdf67b31d718d2400506eaf4b43f ] + +The Asus USB DAC is a USB type-C audio dongle for connecting to +the headset and headphone. The volume minimum value -23040 which +is 0xa600 in hexadecimal with the resolution value 1 indicates +this should be endianness issue caused by the firmware bug. Add +a volume quirk to fix the volume control problem. + +Also fixes this warning: + Warning! Unlikely big volume range (=23040), cval->res is probably wrong. + [5] FU [Headset Capture Volume] ch = 1, val = -23040/0/1 + Warning! Unlikely big volume range (=23040), cval->res is probably wrong. + [7] FU [Headset Playback Volume] ch = 1, val = -23040/0/1 + +Signed-off-by: Chris Chiu +Cc: +Link: https://lore.kernel.org/r/20200526062613.55401-1-chiu@endlessm.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index f191f4a3cf3b..9bbe84ce7d07 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -979,6 +979,14 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, + cval->res = 384; + } + break; ++ case USB_ID(0x0495, 0x3042): /* ESS Technology Asus USB DAC */ ++ if ((strstr(kctl->id.name, "Playback Volume") != NULL) || ++ strstr(kctl->id.name, "Capture Volume") != NULL) { ++ cval->min >>= 8; ++ cval->max = 0; ++ cval->res = 1; ++ } ++ break; + } + } + +-- +2.25.1 + diff --git a/queue-4.4/exec-always-set-cap_ambient-in-cap_bprm_set_creds.patch b/queue-4.4/exec-always-set-cap_ambient-in-cap_bprm_set_creds.patch new file mode 100644 index 00000000000..6bbdbae220f --- /dev/null +++ b/queue-4.4/exec-always-set-cap_ambient-in-cap_bprm_set_creds.patch @@ -0,0 +1,52 @@ +From f4d846796ba764692df27abe5fb46bd73b5ea61f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 May 2020 12:56:15 -0500 +Subject: exec: Always set cap_ambient in cap_bprm_set_creds + +From: Eric W. Biederman + +[ Upstream commit a4ae32c71fe90794127b32d26d7ad795813b502e ] + +An invariant of cap_bprm_set_creds is that every field in the new cred +structure that cap_bprm_set_creds might set, needs to be set every +time to ensure the fields does not get a stale value. + +The field cap_ambient is not set every time cap_bprm_set_creds is +called, which means that if there is a suid or sgid script with an +interpreter that has neither the suid nor the sgid bits set the +interpreter should be able to accept ambient credentials. +Unfortuantely because cap_ambient is not reset to it's original value +the interpreter can not accept ambient credentials. + +Given that the ambient capability set is expected to be controlled by +the caller, I don't think this is particularly serious. But it is +definitely worth fixing so the code works correctly. + +I have tested to verify my reading of the code is correct and the +interpreter of a sgid can receive ambient capabilities with this +change and cannot receive ambient capabilities without this change. + +Cc: stable@vger.kernel.org +Cc: Andy Lutomirski +Fixes: 58319057b784 ("capabilities: ambient capabilities") +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Sasha Levin +--- + security/commoncap.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/security/commoncap.c b/security/commoncap.c +index 48071ed7c445..b62f97d83fd8 100644 +--- a/security/commoncap.c ++++ b/security/commoncap.c +@@ -494,6 +494,7 @@ int cap_bprm_set_creds(struct linux_binprm *bprm) + int ret; + kuid_t root_uid; + ++ new->cap_ambient = old->cap_ambient; + if (WARN_ON(!cap_ambient_invariant_ok(old))) + return -EPERM; + +-- +2.25.1 + diff --git a/queue-4.4/fs-binfmt_elf.c-allocate-initialized-memory-in-fill_.patch b/queue-4.4/fs-binfmt_elf.c-allocate-initialized-memory-in-fill_.patch new file mode 100644 index 00000000000..429b763440c --- /dev/null +++ b/queue-4.4/fs-binfmt_elf.c-allocate-initialized-memory-in-fill_.patch @@ -0,0 +1,45 @@ +From fb26215ba9729135c1b52027ed0f049f0bab871d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 May 2020 22:20:52 -0700 +Subject: fs/binfmt_elf.c: allocate initialized memory in + fill_thread_core_info() + +From: Alexander Potapenko + +[ Upstream commit 1d605416fb7175e1adf094251466caa52093b413 ] + +KMSAN reported uninitialized data being written to disk when dumping +core. As a result, several kilobytes of kmalloc memory may be written +to the core file and then read by a non-privileged user. + +Reported-by: sam +Signed-off-by: Alexander Potapenko +Signed-off-by: Andrew Morton +Acked-by: Kees Cook +Cc: Al Viro +Cc: Alexey Dobriyan +Cc: +Link: http://lkml.kernel.org/r/20200419100848.63472-1-glider@google.com +Link: https://github.com/google/kmsan/issues/76 +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/binfmt_elf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index 164e5fedd7b6..eddf5746cf51 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -1726,7 +1726,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t, + (!regset->active || regset->active(t->task, regset) > 0)) { + int ret; + size_t size = regset->n * regset->size; +- void *data = kmalloc(size, GFP_KERNEL); ++ void *data = kzalloc(size, GFP_KERNEL); + if (unlikely(!data)) + return 0; + ret = regset->get(t->task, regset, +-- +2.25.1 + diff --git a/queue-4.4/ib-qib-call-kobject_put-when-kobject_init_and_add-fa.patch b/queue-4.4/ib-qib-call-kobject_put-when-kobject_init_and_add-fa.patch new file mode 100644 index 00000000000..2c24d0c9e20 --- /dev/null +++ b/queue-4.4/ib-qib-call-kobject_put-when-kobject_init_and_add-fa.patch @@ -0,0 +1,82 @@ +From b8f3a899bafe4260f22fc2763c2e59a4c5baddfa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 May 2020 23:13:28 -0400 +Subject: IB/qib: Call kobject_put() when kobject_init_and_add() fails + +From: Kaike Wan + +[ Upstream commit a35cd6447effd5c239b564c80fa109d05ff3d114 ] + +When kobject_init_and_add() returns an error in the function +qib_create_port_files(), the function kobject_put() is not called for the +corresponding kobject, which potentially leads to memory leak. + +This patch fixes the issue by calling kobject_put() even if +kobject_init_and_add() fails. In addition, the ppd->diagc_kobj is released +along with other kobjects when the sysfs is unregistered. + +Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters") +Link: https://lore.kernel.org/r/20200512031328.189865.48627.stgit@awfm-01.aw.intel.com +Cc: +Suggested-by: Lin Yi +Reviewed-by: Mike Marciniszyn +Signed-off-by: Kaike Wan +Signed-off-by: Dennis Dalessandro +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/qib/qib_sysfs.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c +index 3ae82202cdb5..b33565f4409f 100644 +--- a/drivers/infiniband/hw/qib/qib_sysfs.c ++++ b/drivers/infiniband/hw/qib/qib_sysfs.c +@@ -703,7 +703,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num, + qib_dev_err(dd, + "Skipping linkcontrol sysfs info, (err %d) port %u\n", + ret, port_num); +- goto bail; ++ goto bail_link; + } + kobject_uevent(&ppd->pport_kobj, KOBJ_ADD); + +@@ -713,7 +713,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num, + qib_dev_err(dd, + "Skipping sl2vl sysfs info, (err %d) port %u\n", + ret, port_num); +- goto bail_link; ++ goto bail_sl; + } + kobject_uevent(&ppd->sl2vl_kobj, KOBJ_ADD); + +@@ -723,7 +723,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num, + qib_dev_err(dd, + "Skipping diag_counters sysfs info, (err %d) port %u\n", + ret, port_num); +- goto bail_sl; ++ goto bail_diagc; + } + kobject_uevent(&ppd->diagc_kobj, KOBJ_ADD); + +@@ -736,7 +736,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num, + qib_dev_err(dd, + "Skipping Congestion Control sysfs info, (err %d) port %u\n", + ret, port_num); +- goto bail_diagc; ++ goto bail_cc; + } + + kobject_uevent(&ppd->pport_cc_kobj, KOBJ_ADD); +@@ -818,6 +818,7 @@ void qib_verbs_unregister_sysfs(struct qib_devdata *dd) + &cc_table_bin_attr); + kobject_put(&ppd->pport_cc_kobj); + } ++ kobject_put(&ppd->diagc_kobj); + kobject_put(&ppd->sl2vl_kobj); + kobject_put(&ppd->pport_kobj); + } +-- +2.25.1 + diff --git a/queue-4.4/include-asm-generic-topology.h-guard-cpumask_of_node.patch b/queue-4.4/include-asm-generic-topology.h-guard-cpumask_of_node.patch new file mode 100644 index 00000000000..f273e5a1519 --- /dev/null +++ b/queue-4.4/include-asm-generic-topology.h-guard-cpumask_of_node.patch @@ -0,0 +1,48 @@ +From fb30d56d8260213f7fba09f7845cea57953baf9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 May 2020 22:20:55 -0700 +Subject: include/asm-generic/topology.h: guard cpumask_of_node() macro + argument + +From: Arnd Bergmann + +[ Upstream commit 4377748c7b5187c3342a60fa2ceb60c8a57a8488 ] + +drivers/hwmon/amd_energy.c:195:15: error: invalid operands to binary expression ('void' and 'int') + (channel - data->nr_cpus)); + ~~~~~~~~~^~~~~~~~~~~~~~~~~ +include/asm-generic/topology.h:51:42: note: expanded from macro 'cpumask_of_node' + #define cpumask_of_node(node) ((void)node, cpu_online_mask) + ^~~~ +include/linux/cpumask.h:618:72: note: expanded from macro 'cpumask_first_and' + #define cpumask_first_and(src1p, src2p) cpumask_next_and(-1, (src1p), (src2p)) + ^~~~~ + +Fixes: f0b848ce6fe9 ("cpumask: Introduce cpumask_of_{node,pcibus} to replace {node,pcibus}_to_cpumask") +Fixes: 8abee9566b7e ("hwmon: Add amd_energy driver to report energy counters") +Signed-off-by: Arnd Bergmann +Signed-off-by: Andrew Morton +Acked-by: Guenter Roeck +Link: http://lkml.kernel.org/r/20200527134623.930247-1-arnd@arndb.de +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/asm-generic/topology.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/asm-generic/topology.h b/include/asm-generic/topology.h +index 5d2add1a6c96..864fcfa1df41 100644 +--- a/include/asm-generic/topology.h ++++ b/include/asm-generic/topology.h +@@ -51,7 +51,7 @@ + #ifdef CONFIG_NEED_MULTIPLE_NODES + #define cpumask_of_node(node) ((node) == 0 ? cpu_online_mask : cpu_none_mask) + #else +- #define cpumask_of_node(node) ((void)node, cpu_online_mask) ++ #define cpumask_of_node(node) ((void)(node), cpu_online_mask) + #endif + #endif + #ifndef pcibus_to_node +-- +2.25.1 + diff --git a/queue-4.4/input-evdev-call-input_flush_device-on-release-not-f.patch b/queue-4.4/input-evdev-call-input_flush_device-on-release-not-f.patch new file mode 100644 index 00000000000..b4ea6b5bc29 --- /dev/null +++ b/queue-4.4/input-evdev-call-input_flush_device-on-release-not-f.patch @@ -0,0 +1,75 @@ +From 2e8029ac9197394a56bd5587590e08e7180ff76d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Apr 2020 13:45:12 -0700 +Subject: Input: evdev - call input_flush_device() on release(), not flush() + +From: Brendan Shanks + +[ Upstream commit 09264098ff153f60866039d60b31d39b66f55a31 ] + +input_flush_device() should only be called once the struct file is being +released and no open descriptors remain, but evdev_flush() was calling +it whenever a file descriptor was closed. + +This caused uploaded force-feedback effects to be erased when a process +did a dup()/close() on the event FD, called system(), etc. + +Call input_flush_device() from evdev_release() instead. + +Reported-by: Mathieu Maret +Signed-off-by: Brendan Shanks +Link: https://lore.kernel.org/r/20200421231003.7935-1-bshanks@codeweavers.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/evdev.c | 19 ++++--------------- + 1 file changed, 4 insertions(+), 15 deletions(-) + +diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c +index e9ae3d500a55..700f018df668 100644 +--- a/drivers/input/evdev.c ++++ b/drivers/input/evdev.c +@@ -342,20 +342,6 @@ static int evdev_fasync(int fd, struct file *file, int on) + return fasync_helper(fd, file, on, &client->fasync); + } + +-static int evdev_flush(struct file *file, fl_owner_t id) +-{ +- struct evdev_client *client = file->private_data; +- struct evdev *evdev = client->evdev; +- +- mutex_lock(&evdev->mutex); +- +- if (evdev->exist && !client->revoked) +- input_flush_device(&evdev->handle, file); +- +- mutex_unlock(&evdev->mutex); +- return 0; +-} +- + static void evdev_free(struct device *dev) + { + struct evdev *evdev = container_of(dev, struct evdev, dev); +@@ -469,6 +455,10 @@ static int evdev_release(struct inode *inode, struct file *file) + unsigned int i; + + mutex_lock(&evdev->mutex); ++ ++ if (evdev->exist && !client->revoked) ++ input_flush_device(&evdev->handle, file); ++ + evdev_ungrab(evdev, client); + mutex_unlock(&evdev->mutex); + +@@ -1331,7 +1321,6 @@ static const struct file_operations evdev_fops = { + .compat_ioctl = evdev_ioctl_compat, + #endif + .fasync = evdev_fasync, +- .flush = evdev_flush, + .llseek = no_llseek, + }; + +-- +2.25.1 + diff --git a/queue-4.4/input-i8042-add-thinkpad-s230u-to-i8042-nomux-list.patch b/queue-4.4/input-i8042-add-thinkpad-s230u-to-i8042-nomux-list.patch new file mode 100644 index 00000000000..fd190fd9f74 --- /dev/null +++ b/queue-4.4/input-i8042-add-thinkpad-s230u-to-i8042-nomux-list.patch @@ -0,0 +1,63 @@ +From ce9dbb27f4296df193c88edc56db979956fb35c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Apr 2020 10:02:19 -0700 +Subject: Input: i8042 - add ThinkPad S230u to i8042 nomux list + +From: Kevin Locke + +[ Upstream commit 18931506465a762ffd3f4803d36a18d336a67da9 ] + +On the Lenovo ThinkPad Twist S230u (3347-4HU) with BIOS version +"GDETC1WW (1.81 ) 06/27/2019", whether booted in UEFI or Legacy/CSM mode +the keyboard, Synaptics TouchPad, and TrackPoint either do not function +or stop functioning a few minutes after boot. This problem has been +noted before, perhaps only occurring on BIOS 1.57 and +later.[1][2][3][4][5] + +This model does not have an external PS/2 port, so mux does not appear +to be useful. + +Odds of a BIOS fix appear to be low: 1.57 was released over 6 years ago +and although the [BIOS changelog] notes "Fixed an issue of UEFI +touchpad/trackpoint/keyboard/touchscreen" in 1.58, it appears to be +insufficient. + +Adding 33474HU to the nomux list avoids the issue on my system. + +[1]: https://bugs.launchpad.net/bugs/1210748 +[2]: https://bbs.archlinux.org/viewtopic.php?pid=1360425 +[3]: https://forums.linuxmint.com/viewtopic.php?f=46&t=41200 +[4]: https://forums.linuxmint.com/viewtopic.php?f=49&t=157115 +[5]: https://forums.lenovo.com/topic/findpost/27/1337119 +[BIOS changelog]: https://download.lenovo.com/pccbbs/mobiles/gduj33uc.txt + +Signed-off-by: Kevin Locke +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/feb8a8339a67025dab3850e6377eb6f3a0e782ba.1587400635.git.kevin@kevinlocke.name +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/serio/i8042-x86ia64io.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index a4e76084a2af..42330024da2f 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -545,6 +545,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5738"), + }, + }, ++ { ++ /* Lenovo ThinkPad Twist S230u */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"), ++ }, ++ }, + { } + }; + +-- +2.25.1 + diff --git a/queue-4.4/input-i8042-add-thinkpad-s230u-to-i8042-reset-list.patch b/queue-4.4/input-i8042-add-thinkpad-s230u-to-i8042-reset-list.patch new file mode 100644 index 00000000000..b08ecbb6d2a --- /dev/null +++ b/queue-4.4/input-i8042-add-thinkpad-s230u-to-i8042-reset-list.patch @@ -0,0 +1,60 @@ +From 991543108c27897fe2d05d56b15d190618ad446d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Apr 2020 18:07:20 -0700 +Subject: Input: i8042 - add ThinkPad S230u to i8042 reset list + +From: Kevin Locke + +[ Upstream commit 2712c91a54a1058d55c284152b4d93c979b67be6 ] + +On the Lenovo ThinkPad Twist S230u (3347-4HU) with BIOS version +"GDETC1WW (1.81 ) 06/27/2019", the keyboard, Synaptics TouchPad, and +TrackPoint either do not function or stop functioning a few minutes +after boot. This problem has been noted before, perhaps only occurring +with BIOS 1.57 and later.[1][2][3][4][5] + +Odds of a BIOS fix appear to be low: 1.57 was released over 6 years ago +and although the [BIOS changelog] notes "Fixed an issue of UEFI +touchpad/trackpoint/keyboard/touchscreen" in 1.58, it appears to be +insufficient. + +Setting i8042.reset=1 or adding 33474HU to the reset list avoids the +issue on my system from either warm or cold boot. + +[1]: https://bugs.launchpad.net/bugs/1210748 +[2]: https://bbs.archlinux.org/viewtopic.php?pid=1360425 +[3]: https://forums.linuxmint.com/viewtopic.php?f=46&t=41200 +[4]: https://forums.linuxmint.com/viewtopic.php?f=49&t=157115 +[5]: https://forums.lenovo.com/topic/findpost/27/1337119 +[BIOS changelog]: https://download.lenovo.com/pccbbs/mobiles/gduj33uc.txt + +Signed-off-by: Kevin Locke +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/94f384b0f75f90f71425d7dce7ac82c59ddb87a8.1587702636.git.kevin@kevinlocke.name +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/serio/i8042-x86ia64io.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index 42330024da2f..d15fd73dbd80 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -745,6 +745,13 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "P65xRP"), + }, + }, ++ { ++ /* Lenovo ThinkPad Twist S230u */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"), ++ }, ++ }, + { } + }; + +-- +2.25.1 + diff --git a/queue-4.4/input-usbtouchscreen-add-support-for-bonxeon-tp.patch b/queue-4.4/input-usbtouchscreen-add-support-for-bonxeon-tp.patch new file mode 100644 index 00000000000..c19724702e4 --- /dev/null +++ b/queue-4.4/input-usbtouchscreen-add-support-for-bonxeon-tp.patch @@ -0,0 +1,37 @@ +From 6d03d8865d578ad4ea8bed7cb3630b3096f954f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Apr 2020 21:17:12 -0700 +Subject: Input: usbtouchscreen - add support for BonXeon TP + +From: James Hilliard + +[ Upstream commit e3b4f94ef52ae1592cbe199bd38dbdc0d58b2217 ] + +Based on available information this uses the singletouch irtouch +protocol. This is tested and confirmed to be fully functional on +the BonXeon TP hardware I have. + +Signed-off-by: James Hilliard +Link: https://lore.kernel.org/r/20200413184217.55700-1-james.hilliard1@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/usbtouchscreen.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c +index 2c41107240de..499402a975b3 100644 +--- a/drivers/input/touchscreen/usbtouchscreen.c ++++ b/drivers/input/touchscreen/usbtouchscreen.c +@@ -197,6 +197,7 @@ static const struct usb_device_id usbtouch_devices[] = { + #endif + + #ifdef CONFIG_TOUCHSCREEN_USB_IRTOUCH ++ {USB_DEVICE(0x255e, 0x0001), .driver_info = DEVTYPE_IRTOUCH}, + {USB_DEVICE(0x595a, 0x0001), .driver_info = DEVTYPE_IRTOUCH}, + {USB_DEVICE(0x6615, 0x0001), .driver_info = DEVTYPE_IRTOUCH}, + {USB_DEVICE(0x6615, 0x0012), .driver_info = DEVTYPE_IRTOUCH_HIRES}, +-- +2.25.1 + diff --git a/queue-4.4/input-xpad-add-custom-init-packet-for-xbox-one-s-con.patch b/queue-4.4/input-xpad-add-custom-init-packet-for-xbox-one-s-con.patch new file mode 100644 index 00000000000..0f8470f4ee2 --- /dev/null +++ b/queue-4.4/input-xpad-add-custom-init-packet-for-xbox-one-s-con.patch @@ -0,0 +1,59 @@ +From eba8d8220960e351a19021a3c43619dc4a25241e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Apr 2020 14:13:09 -0700 +Subject: Input: xpad - add custom init packet for Xbox One S controllers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Łukasz Patron + +[ Upstream commit 764f7f911bf72450c51eb74cbb262ad9933741d8 ] + +Sending [ 0x05, 0x20, 0x00, 0x0f, 0x06 ] packet for Xbox One S controllers +fixes an issue where controller is stuck in Bluetooth mode and not sending +any inputs. + +Signed-off-by: Łukasz Patron +Reviewed-by: Cameron Gutman +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20200422075206.18229-1-priv.luk@gmail.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/joystick/xpad.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index 26476a64e663..54a6691d7d87 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -475,6 +475,16 @@ static const u8 xboxone_fw2015_init[] = { + 0x05, 0x20, 0x00, 0x01, 0x00 + }; + ++/* ++ * This packet is required for Xbox One S (0x045e:0x02ea) ++ * and Xbox One Elite Series 2 (0x045e:0x0b00) pads to ++ * initialize the controller that was previously used in ++ * Bluetooth mode. ++ */ ++static const u8 xboxone_s_init[] = { ++ 0x05, 0x20, 0x00, 0x0f, 0x06 ++}; ++ + /* + * This packet is required for the Titanfall 2 Xbox One pads + * (0x0e6f:0x0165) to finish initialization and for Hori pads +@@ -533,6 +543,8 @@ static const struct xboxone_init_packet xboxone_init_packets[] = { + XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_init), + XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_init), + XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_fw2015_init), ++ XBOXONE_INIT_PKT(0x045e, 0x02ea, xboxone_s_init), ++ XBOXONE_INIT_PKT(0x045e, 0x0b00, xboxone_s_init), + XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init1), + XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init2), + XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init), +-- +2.25.1 + diff --git a/queue-4.4/iommu-fix-reference-count-leak-in-iommu_group_alloc.patch b/queue-4.4/iommu-fix-reference-count-leak-in-iommu_group_alloc.patch new file mode 100644 index 00000000000..d24c6d4fedd --- /dev/null +++ b/queue-4.4/iommu-fix-reference-count-leak-in-iommu_group_alloc.patch @@ -0,0 +1,38 @@ +From e2bbaac05b8195e67074a08d24875faac61d514e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 May 2020 16:00:19 -0500 +Subject: iommu: Fix reference count leak in iommu_group_alloc. + +From: Qiushi Wu + +[ Upstream commit 7cc31613734c4870ae32f5265d576ef296621343 ] + +kobject_init_and_add() takes reference even when it fails. +Thus, when kobject_init_and_add() returns an error, +kobject_put() must be called to properly clean up the kobject. + +Fixes: d72e31c93746 ("iommu: IOMMU Groups") +Signed-off-by: Qiushi Wu +Link: https://lore.kernel.org/r/20200527210020.6522-1-wu000273@umn.edu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index 589207176ffa..a1e7a73930fa 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -206,7 +206,7 @@ again: + mutex_lock(&iommu_group_mutex); + ida_remove(&iommu_group_ida, group->id); + mutex_unlock(&iommu_group_mutex); +- kfree(group); ++ kobject_put(&group->kobj); + return ERR_PTR(ret); + } + +-- +2.25.1 + diff --git a/queue-4.4/series b/queue-4.4/series index 007301518b3..8bf6f1f9409 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -10,3 +10,15 @@ gfs2-don-t-call-quota_unhold-if-quotas-are-not-locke.patch cachefiles-fix-race-between-read_waiter-and-read_cop.patch usb-gadget-legacy-fix-redundant-initialization-warni.patch cifs-fix-null-pointer-check-in-cifs_read.patch +input-usbtouchscreen-add-support-for-bonxeon-tp.patch +input-i8042-add-thinkpad-s230u-to-i8042-nomux-list.patch +input-evdev-call-input_flush_device-on-release-not-f.patch +input-xpad-add-custom-init-packet-for-xbox-one-s-con.patch +input-i8042-add-thinkpad-s230u-to-i8042-reset-list.patch +ib-qib-call-kobject_put-when-kobject_init_and_add-fa.patch +alsa-hwdep-fix-a-left-shifting-1-by-31-ub-bug.patch +alsa-usb-audio-mixer-volume-quirk-for-ess-technology.patch +exec-always-set-cap_ambient-in-cap_bprm_set_creds.patch +fs-binfmt_elf.c-allocate-initialized-memory-in-fill_.patch +include-asm-generic-topology.h-guard-cpumask_of_node.patch +iommu-fix-reference-count-leak-in-iommu_group_alloc.patch -- 2.47.3