From 73769232846d0a3ddec1ac9243cc6cac0a0c8b7f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 15 Jun 2019 17:44:32 +0200 Subject: [PATCH] 5.1-stable patches added patches: alsa-firewire-motu-fix-destruction-of-data-for-isochronous-resources.patch alsa-hda-realtek-update-headset-mode-for-alc256.patch alsa-ice1712-check-correct-return-value-to-snd_i2c_sendbytes-ews-dmx-6fire.patch alsa-oxfw-allow-pcm-capture-for-stanton-scs.1m.patch drm-nouveau-add-kconfig-option-to-turn-off-nouveau-legacy-contexts.-v3.patch hid-input-fix-assignment-of-.value.patch hid-input-make-sure-the-wheel-high-resolution-multiplier-is-set.patch hid-multitouch-handle-faulty-elo-touch-device.patch hid-wacom-correct-button-numbering-2nd-gen-intuos-pro-over-bluetooth.patch hid-wacom-don-t-report-anything-prior-to-the-tool-entering-range.patch hid-wacom-don-t-set-tool-type-until-we-re-in-range.patch hid-wacom-send-btn_touch-in-response-to-intuosp2_bt-eraser-contact.patch hid-wacom-sync-intuosp2_bt-touch-state-after-each-frame-if-necessary.patch io_uring-fix-memory-leak-of-unix-domain-socket-inode.patch libata-extend-quirks-for-the-st1000lm024-drives-with-nolpm-quirk.patch nouveau-fix-build-with-config_nouveau_legacy_ctx_support-disabled.patch revert-alsa-hda-realtek-improve-the-headset-mic-for-acer-aspire-laptops.patch revert-hid-increase-maximum-report-size-allowed-by-hid_field_extract.patch selinux-fix-a-missing-check-bug-in-selinux_add_mnt_opt.patch selinux-fix-a-missing-check-bug-in-selinux_sb_eat_lsm_opts.patch selinux-log-raw-contexts-as-untrusted-strings.patch --- ...on-of-data-for-isochronous-resources.patch | 33 +++ ...altek-update-headset-mode-for-alc256.patch | 190 ++++++++++++++++++ ...e-to-snd_i2c_sendbytes-ews-dmx-6fire.patch | 43 ++++ ...allow-pcm-capture-for-stanton-scs.1m.patch | 38 ++++ ...turn-off-nouveau-legacy-contexts.-v3.patch | 112 +++++++++++ .../hid-input-fix-assignment-of-.value.patch | 36 ++++ ...el-high-resolution-multiplier-is-set.patch | 177 ++++++++++++++++ ...touch-handle-faulty-elo-touch-device.patch | 49 +++++ ...ng-2nd-gen-intuos-pro-over-bluetooth.patch | 69 +++++++ ...ing-prior-to-the-tool-entering-range.patch | 73 +++++++ ...t-set-tool-type-until-we-re-in-range.patch | 71 +++++++ ...sponse-to-intuosp2_bt-eraser-contact.patch | 38 ++++ ...-state-after-each-frame-if-necessary.patch | 51 +++++ ...ory-leak-of-unix-domain-socket-inode.patch | 44 ++++ ...-st1000lm024-drives-with-nolpm-quirk.patch | 42 ++++ ..._nouveau_legacy_ctx_support-disabled.patch | 54 +++++ ...-headset-mic-for-acer-aspire-laptops.patch | 59 ++++++ ...rt-size-allowed-by-hid_field_extract.patch | 45 +++++ ...ing-check-bug-in-selinux_add_mnt_opt.patch | 56 ++++++ ...check-bug-in-selinux_sb_eat_lsm_opts.patch | 73 +++++++ ...og-raw-contexts-as-untrusted-strings.patch | 64 ++++++ 21 files changed, 1417 insertions(+) create mode 100644 queue-5.1/alsa-firewire-motu-fix-destruction-of-data-for-isochronous-resources.patch create mode 100644 queue-5.1/alsa-hda-realtek-update-headset-mode-for-alc256.patch create mode 100644 queue-5.1/alsa-ice1712-check-correct-return-value-to-snd_i2c_sendbytes-ews-dmx-6fire.patch create mode 100644 queue-5.1/alsa-oxfw-allow-pcm-capture-for-stanton-scs.1m.patch create mode 100644 queue-5.1/drm-nouveau-add-kconfig-option-to-turn-off-nouveau-legacy-contexts.-v3.patch create mode 100644 queue-5.1/hid-input-fix-assignment-of-.value.patch create mode 100644 queue-5.1/hid-input-make-sure-the-wheel-high-resolution-multiplier-is-set.patch create mode 100644 queue-5.1/hid-multitouch-handle-faulty-elo-touch-device.patch create mode 100644 queue-5.1/hid-wacom-correct-button-numbering-2nd-gen-intuos-pro-over-bluetooth.patch create mode 100644 queue-5.1/hid-wacom-don-t-report-anything-prior-to-the-tool-entering-range.patch create mode 100644 queue-5.1/hid-wacom-don-t-set-tool-type-until-we-re-in-range.patch create mode 100644 queue-5.1/hid-wacom-send-btn_touch-in-response-to-intuosp2_bt-eraser-contact.patch create mode 100644 queue-5.1/hid-wacom-sync-intuosp2_bt-touch-state-after-each-frame-if-necessary.patch create mode 100644 queue-5.1/io_uring-fix-memory-leak-of-unix-domain-socket-inode.patch create mode 100644 queue-5.1/libata-extend-quirks-for-the-st1000lm024-drives-with-nolpm-quirk.patch create mode 100644 queue-5.1/nouveau-fix-build-with-config_nouveau_legacy_ctx_support-disabled.patch create mode 100644 queue-5.1/revert-alsa-hda-realtek-improve-the-headset-mic-for-acer-aspire-laptops.patch create mode 100644 queue-5.1/revert-hid-increase-maximum-report-size-allowed-by-hid_field_extract.patch create mode 100644 queue-5.1/selinux-fix-a-missing-check-bug-in-selinux_add_mnt_opt.patch create mode 100644 queue-5.1/selinux-fix-a-missing-check-bug-in-selinux_sb_eat_lsm_opts.patch create mode 100644 queue-5.1/selinux-log-raw-contexts-as-untrusted-strings.patch diff --git a/queue-5.1/alsa-firewire-motu-fix-destruction-of-data-for-isochronous-resources.patch b/queue-5.1/alsa-firewire-motu-fix-destruction-of-data-for-isochronous-resources.patch new file mode 100644 index 00000000000..e771e2bae6b --- /dev/null +++ b/queue-5.1/alsa-firewire-motu-fix-destruction-of-data-for-isochronous-resources.patch @@ -0,0 +1,33 @@ +From 0e3fb6995bfabb23c172e8b883bf5ac57102678e Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Sat, 1 Jun 2019 12:08:01 +0900 +Subject: ALSA: firewire-motu: fix destruction of data for isochronous resources + +From: Takashi Sakamoto + +commit 0e3fb6995bfabb23c172e8b883bf5ac57102678e upstream. + +The data for isochronous resources is not destroyed in expected place. +This commit fixes the bug. + +Cc: # v4.12+ +Fixes: 9b2bb4f2f4a2 ("ALSA: firewire-motu: add stream management functionality") +Signed-off-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/firewire/motu/motu-stream.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/firewire/motu/motu-stream.c ++++ b/sound/firewire/motu/motu-stream.c +@@ -345,7 +345,7 @@ static void destroy_stream(struct snd_mo + } + + amdtp_stream_destroy(stream); +- fw_iso_resources_free(resources); ++ fw_iso_resources_destroy(resources); + } + + int snd_motu_stream_init_duplex(struct snd_motu *motu) diff --git a/queue-5.1/alsa-hda-realtek-update-headset-mode-for-alc256.patch b/queue-5.1/alsa-hda-realtek-update-headset-mode-for-alc256.patch new file mode 100644 index 00000000000..97df4159a5a --- /dev/null +++ b/queue-5.1/alsa-hda-realtek-update-headset-mode-for-alc256.patch @@ -0,0 +1,190 @@ +From 717f43d81afc1250300479075952a0e36d74ded3 Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Fri, 31 May 2019 17:16:53 +0800 +Subject: ALSA: hda/realtek - Update headset mode for ALC256 + +From: Kailang Yang + +commit 717f43d81afc1250300479075952a0e36d74ded3 upstream. + +ALC255 and ALC256 were some difference for hidden register. +This update was suitable for ALC256. + +Fixes: e69e7e03ed22 ("ALSA: hda/realtek - ALC256 speaker noise issue") +Signed-off-by: Kailang Yang +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 75 +++++++++++++++++++++++++++++++++--------- + 1 file changed, 60 insertions(+), 15 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4084,18 +4084,19 @@ static struct coef_fw alc225_pre_hsmode[ + static void alc_headset_mode_unplugged(struct hda_codec *codec) + { + static struct coef_fw coef0255[] = { ++ WRITE_COEF(0x1b, 0x0c0b), /* LDO and MISC control */ + WRITE_COEF(0x45, 0xd089), /* UAJ function set to menual mode */ + UPDATE_COEFEX(0x57, 0x05, 1<<14, 0), /* Direct Drive HP Amp control(Set to verb control)*/ + WRITE_COEF(0x06, 0x6104), /* Set MIC2 Vref gate with HP */ + WRITE_COEFEX(0x57, 0x03, 0x8aa6), /* Direct Drive HP Amp control */ + {} + }; +- static struct coef_fw coef0255_1[] = { +- WRITE_COEF(0x1b, 0x0c0b), /* LDO and MISC control */ +- {} +- }; + static struct coef_fw coef0256[] = { + WRITE_COEF(0x1b, 0x0c4b), /* LDO and MISC control */ ++ WRITE_COEF(0x45, 0xd089), /* UAJ function set to menual mode */ ++ WRITE_COEF(0x06, 0x6104), /* Set MIC2 Vref gate with HP */ ++ WRITE_COEFEX(0x57, 0x03, 0x09a3), /* Direct Drive HP Amp control */ ++ UPDATE_COEFEX(0x57, 0x05, 1<<14, 0), /* Direct Drive HP Amp control(Set to verb control)*/ + {} + }; + static struct coef_fw coef0233[] = { +@@ -4158,13 +4159,11 @@ static void alc_headset_mode_unplugged(s + + switch (codec->core.vendor_id) { + case 0x10ec0255: +- alc_process_coef_fw(codec, coef0255_1); + alc_process_coef_fw(codec, coef0255); + break; + case 0x10ec0236: + case 0x10ec0256: + alc_process_coef_fw(codec, coef0256); +- alc_process_coef_fw(codec, coef0255); + break; + case 0x10ec0234: + case 0x10ec0274: +@@ -4217,6 +4216,12 @@ static void alc_headset_mode_mic_in(stru + WRITE_COEF(0x06, 0x6100), /* Set MIC2 Vref gate to normal */ + {} + }; ++ static struct coef_fw coef0256[] = { ++ UPDATE_COEFEX(0x57, 0x05, 1<<14, 1<<14), /* Direct Drive HP Amp control(Set to verb control)*/ ++ WRITE_COEFEX(0x57, 0x03, 0x09a3), ++ WRITE_COEF(0x06, 0x6100), /* Set MIC2 Vref gate to normal */ ++ {} ++ }; + static struct coef_fw coef0233[] = { + UPDATE_COEF(0x35, 0, 1<<14), + WRITE_COEF(0x06, 0x2100), +@@ -4264,14 +4269,19 @@ static void alc_headset_mode_mic_in(stru + }; + + switch (codec->core.vendor_id) { +- case 0x10ec0236: + case 0x10ec0255: +- case 0x10ec0256: + alc_write_coef_idx(codec, 0x45, 0xc489); + snd_hda_set_pin_ctl_cache(codec, hp_pin, 0); + alc_process_coef_fw(codec, coef0255); + snd_hda_set_pin_ctl_cache(codec, mic_pin, PIN_VREF50); + break; ++ case 0x10ec0236: ++ case 0x10ec0256: ++ alc_write_coef_idx(codec, 0x45, 0xc489); ++ snd_hda_set_pin_ctl_cache(codec, hp_pin, 0); ++ alc_process_coef_fw(codec, coef0256); ++ snd_hda_set_pin_ctl_cache(codec, mic_pin, PIN_VREF50); ++ break; + case 0x10ec0234: + case 0x10ec0274: + case 0x10ec0294: +@@ -4353,6 +4363,14 @@ static void alc_headset_mode_default(str + WRITE_COEF(0x49, 0x0049), + {} + }; ++ static struct coef_fw coef0256[] = { ++ WRITE_COEF(0x45, 0xc489), ++ WRITE_COEFEX(0x57, 0x03, 0x0da3), ++ WRITE_COEF(0x49, 0x0049), ++ UPDATE_COEFEX(0x57, 0x05, 1<<14, 0), /* Direct Drive HP Amp control(Set to verb control)*/ ++ WRITE_COEF(0x06, 0x6100), ++ {} ++ }; + static struct coef_fw coef0233[] = { + WRITE_COEF(0x06, 0x2100), + WRITE_COEF(0x32, 0x4ea3), +@@ -4403,11 +4421,16 @@ static void alc_headset_mode_default(str + alc_process_coef_fw(codec, alc225_pre_hsmode); + alc_process_coef_fw(codec, coef0225); + break; +- case 0x10ec0236: + case 0x10ec0255: +- case 0x10ec0256: + alc_process_coef_fw(codec, coef0255); + break; ++ case 0x10ec0236: ++ case 0x10ec0256: ++ alc_write_coef_idx(codec, 0x1b, 0x0e4b); ++ alc_write_coef_idx(codec, 0x45, 0xc089); ++ msleep(50); ++ alc_process_coef_fw(codec, coef0256); ++ break; + case 0x10ec0234: + case 0x10ec0274: + case 0x10ec0294: +@@ -4451,8 +4474,7 @@ static void alc_headset_mode_ctia(struct + }; + static struct coef_fw coef0256[] = { + WRITE_COEF(0x45, 0xd489), /* Set to CTIA type */ +- WRITE_COEF(0x1b, 0x0c6b), +- WRITE_COEFEX(0x57, 0x03, 0x8ea6), ++ WRITE_COEF(0x1b, 0x0e6b), + {} + }; + static struct coef_fw coef0233[] = { +@@ -4570,8 +4592,7 @@ static void alc_headset_mode_omtp(struct + }; + static struct coef_fw coef0256[] = { + WRITE_COEF(0x45, 0xe489), /* Set to OMTP Type */ +- WRITE_COEF(0x1b, 0x0c6b), +- WRITE_COEFEX(0x57, 0x03, 0x8ea6), ++ WRITE_COEF(0x1b, 0x0e6b), + {} + }; + static struct coef_fw coef0233[] = { +@@ -4703,13 +4724,37 @@ static void alc_determine_headset_type(s + }; + + switch (codec->core.vendor_id) { +- case 0x10ec0236: + case 0x10ec0255: ++ alc_process_coef_fw(codec, coef0255); ++ msleep(300); ++ val = alc_read_coef_idx(codec, 0x46); ++ is_ctia = (val & 0x0070) == 0x0070; ++ break; ++ case 0x10ec0236: + case 0x10ec0256: ++ alc_write_coef_idx(codec, 0x1b, 0x0e4b); ++ alc_write_coef_idx(codec, 0x06, 0x6104); ++ alc_write_coefex_idx(codec, 0x57, 0x3, 0x09a3); ++ ++ snd_hda_codec_write(codec, 0x21, 0, ++ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE); ++ msleep(80); ++ snd_hda_codec_write(codec, 0x21, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0); ++ + alc_process_coef_fw(codec, coef0255); + msleep(300); + val = alc_read_coef_idx(codec, 0x46); + is_ctia = (val & 0x0070) == 0x0070; ++ ++ alc_write_coefex_idx(codec, 0x57, 0x3, 0x0da3); ++ alc_update_coefex_idx(codec, 0x57, 0x5, 1<<14, 0); ++ ++ snd_hda_codec_write(codec, 0x21, 0, ++ AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT); ++ msleep(80); ++ snd_hda_codec_write(codec, 0x21, 0, ++ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE); + break; + case 0x10ec0234: + case 0x10ec0274: diff --git a/queue-5.1/alsa-ice1712-check-correct-return-value-to-snd_i2c_sendbytes-ews-dmx-6fire.patch b/queue-5.1/alsa-ice1712-check-correct-return-value-to-snd_i2c_sendbytes-ews-dmx-6fire.patch new file mode 100644 index 00000000000..b57449239c4 --- /dev/null +++ b/queue-5.1/alsa-ice1712-check-correct-return-value-to-snd_i2c_sendbytes-ews-dmx-6fire.patch @@ -0,0 +1,43 @@ +From 352bcae97f9ba87801f497571cdec20af190efe1 Mon Sep 17 00:00:00 2001 +From: Rui Nuno Capela +Date: Fri, 7 Jun 2019 15:13:37 +0100 +Subject: ALSA: ice1712: Check correct return value to snd_i2c_sendbytes (EWS/DMX 6Fire) + +From: Rui Nuno Capela + +commit 352bcae97f9ba87801f497571cdec20af190efe1 upstream. + +Check for exact and correct return value to snd_i2c_sendbytes +call for EWS/DMX 6Fire (snd_ice1712). + +Fixes a systemic error on every boot starting from kernel 5.1 +onwards to snd_ice1712 driver ("cannot send pca") on Terratec +EWS/DMX 6Fire PCI soundcards. + +Check for exact and correct return value to snd_i2c_sendbytes +call for EWS/DMX 6Fire (snd_ice1712). + +Fixes a systemic error on every boot to snd_ice1712 driver +("cannot send pca") on Terratec EWS/DMX 6Fire PCI soundcards. + +Fixes: c99776cc4018 ("ALSA: ice1712: fix a missing check of snd_i2c_sendbytes") +Signed-off-by: Rui Nuno Capela +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/ice1712/ews.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/pci/ice1712/ews.c ++++ b/sound/pci/ice1712/ews.c +@@ -826,7 +826,7 @@ static int snd_ice1712_6fire_read_pca(st + + snd_i2c_lock(ice->i2c); + byte = reg; +- if (snd_i2c_sendbytes(spec->i2cdevs[EWS_I2C_6FIRE], &byte, 1)) { ++ if (snd_i2c_sendbytes(spec->i2cdevs[EWS_I2C_6FIRE], &byte, 1) != 1) { + snd_i2c_unlock(ice->i2c); + dev_err(ice->card->dev, "cannot send pca\n"); + return -EIO; diff --git a/queue-5.1/alsa-oxfw-allow-pcm-capture-for-stanton-scs.1m.patch b/queue-5.1/alsa-oxfw-allow-pcm-capture-for-stanton-scs.1m.patch new file mode 100644 index 00000000000..47f2a8bc632 --- /dev/null +++ b/queue-5.1/alsa-oxfw-allow-pcm-capture-for-stanton-scs.1m.patch @@ -0,0 +1,38 @@ +From d8fa87c368f5b4096c4746894fdcc195da285df1 Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Sun, 9 Jun 2019 19:29:12 +0900 +Subject: ALSA: oxfw: allow PCM capture for Stanton SCS.1m + +From: Takashi Sakamoto + +commit d8fa87c368f5b4096c4746894fdcc195da285df1 upstream. + +Stanton SCS.1m can transfer isochronous packet with Multi Bit Linear +Audio data channels, therefore it allows software to capture PCM +substream. However, ALSA oxfw driver doesn't. + +This commit changes the driver to add one PCM substream for capture +direction. + +Fixes: de5126cc3c0b ("ALSA: oxfw: add stream format quirk for SCS.1 models") +Cc: # v4.5+ +Signed-off-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/firewire/oxfw/oxfw.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/sound/firewire/oxfw/oxfw.c ++++ b/sound/firewire/oxfw/oxfw.c +@@ -148,9 +148,6 @@ static int detect_quirks(struct snd_oxfw + oxfw->midi_input_ports = 0; + oxfw->midi_output_ports = 0; + +- /* Output stream exists but no data channels are useful. */ +- oxfw->has_output = false; +- + return snd_oxfw_scs1x_add(oxfw); + } + diff --git a/queue-5.1/drm-nouveau-add-kconfig-option-to-turn-off-nouveau-legacy-contexts.-v3.patch b/queue-5.1/drm-nouveau-add-kconfig-option-to-turn-off-nouveau-legacy-contexts.-v3.patch new file mode 100644 index 00000000000..f91c0160e28 --- /dev/null +++ b/queue-5.1/drm-nouveau-add-kconfig-option-to-turn-off-nouveau-legacy-contexts.-v3.patch @@ -0,0 +1,112 @@ +From b30a43ac7132cdda833ac4b13dd1ebd35ace14b7 Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Thu, 18 Apr 2019 16:45:15 +1000 +Subject: drm/nouveau: add kconfig option to turn off nouveau legacy contexts. (v3) + +From: Dave Airlie + +commit b30a43ac7132cdda833ac4b13dd1ebd35ace14b7 upstream. + +There was a nouveau DDX that relied on legacy context ioctls to work, +but we fixed it years ago, give distros that have a modern DDX the +option to break the uAPI and close the mess of holes that legacy +context support is. + +Full context of the story: + +commit 0e975980d435d58df2d430d688b8c18778b42218 +Author: Peter Antoine +Date: Tue Jun 23 08:18:49 2015 +0100 + + drm: Turn off Legacy Context Functions + + The context functions are not used by the i915 driver and should not + be used by modeset drivers. These driver functions contain several bugs + and security holes. This change makes these functions optional can be + turned on by a setting, they are turned off by default for modeset + driver with the exception of the nouvea driver that may require them with + an old version of libdrm. + + The previous attempt was + + commit 7c510133d93dd6f15ca040733ba7b2891ed61fd1 + Author: Daniel Vetter + Date: Thu Aug 8 15:41:21 2013 +0200 + + drm: mark context support as a legacy subsystem + + but this had to be reverted + + commit c21eb21cb50d58e7cbdcb8b9e7ff68b85cfa5095 + Author: Dave Airlie + Date: Fri Sep 20 08:32:59 2013 +1000 + + Revert "drm: mark context support as a legacy subsystem" + + v2: remove returns from void function, and formatting (Daniel Vetter) + + v3: + - s/Nova/nouveau/ in the commit message, and add references to the + previous attempts + - drop the part touching the drm hw lock, that should be a separate + patch. + + Signed-off-by: Peter Antoine (v2) + Cc: Peter Antoine (v2) + Reviewed-by: Peter Antoine + Signed-off-by: Daniel Vetter + +v2: move DRM_VM dependency into legacy config. +v3: fix missing dep (kbuild robot) + +Cc: stable@vger.kernel.org +Reviewed-by: Daniel Vetter +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/nouveau/Kconfig | 13 ++++++++++++- + drivers/gpu/drm/nouveau/nouveau_drm.c | 7 +++++-- + 2 files changed, 17 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/nouveau/Kconfig ++++ b/drivers/gpu/drm/nouveau/Kconfig +@@ -17,10 +17,21 @@ config DRM_NOUVEAU + select INPUT if ACPI && X86 + select THERMAL if ACPI && X86 + select ACPI_VIDEO if ACPI && X86 +- select DRM_VM + help + Choose this option for open-source NVIDIA support. + ++config NOUVEAU_LEGACY_CTX_SUPPORT ++ bool "Nouveau legacy context support" ++ depends on DRM_NOUVEAU ++ select DRM_VM ++ default y ++ help ++ There was a version of the nouveau DDX that relied on legacy ++ ctx ioctls not erroring out. But that was back in time a long ++ ways, so offer a way to disable it now. For uapi compat with ++ old nouveau ddx this should be on by default, but modern distros ++ should consider turning it off. ++ + config NOUVEAU_PLATFORM_DRIVER + bool "Nouveau (NVIDIA) SoC GPUs" + depends on DRM_NOUVEAU && ARCH_TEGRA +--- a/drivers/gpu/drm/nouveau/nouveau_drm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c +@@ -1094,8 +1094,11 @@ nouveau_driver_fops = { + static struct drm_driver + driver_stub = { + .driver_features = +- DRIVER_GEM | DRIVER_MODESET | DRIVER_PRIME | DRIVER_RENDER | +- DRIVER_KMS_LEGACY_CONTEXT, ++ DRIVER_GEM | DRIVER_MODESET | DRIVER_PRIME | DRIVER_RENDER ++#if defined(CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT) ++ | DRIVER_KMS_LEGACY_CONTEXT ++#endif ++ , + + .open = nouveau_drm_open, + .postclose = nouveau_drm_postclose, diff --git a/queue-5.1/hid-input-fix-assignment-of-.value.patch b/queue-5.1/hid-input-fix-assignment-of-.value.patch new file mode 100644 index 00000000000..9aa5d5822b6 --- /dev/null +++ b/queue-5.1/hid-input-fix-assignment-of-.value.patch @@ -0,0 +1,36 @@ +From 39b3c3a5fbc5d744114e497d35bf0c12f798c134 Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Thu, 18 Apr 2019 09:47:41 +0200 +Subject: HID: input: fix assignment of .value + +From: Benjamin Tissoires + +commit 39b3c3a5fbc5d744114e497d35bf0c12f798c134 upstream. + +The value field is actually an array of .maxfield. We should assign the +correct number to the correct usage. + +Not that we never encounter a device that requires this ATM, but better +have the proper code path. + +Fixes: 2dc702c991e377 ("HID: input: use the Resolution Multiplier for + high-resolution scrolling") +Cc: stable@vger.kernel.org # v5.0+ +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-input.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -1595,7 +1595,7 @@ static bool __hidinput_change_resolution + if (usage->hid != HID_GD_RESOLUTION_MULTIPLIER) + continue; + +- *report->field[i]->value = value; ++ report->field[i]->value[j] = value; + update_needed = true; + } + } diff --git a/queue-5.1/hid-input-make-sure-the-wheel-high-resolution-multiplier-is-set.patch b/queue-5.1/hid-input-make-sure-the-wheel-high-resolution-multiplier-is-set.patch new file mode 100644 index 00000000000..4778babba23 --- /dev/null +++ b/queue-5.1/hid-input-make-sure-the-wheel-high-resolution-multiplier-is-set.patch @@ -0,0 +1,177 @@ +From d43c17ead879ba7c076dc2f5fd80cd76047c9ff4 Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Wed, 3 Apr 2019 16:20:20 +0200 +Subject: HID: input: make sure the wheel high resolution multiplier is set + +From: Benjamin Tissoires + +commit d43c17ead879ba7c076dc2f5fd80cd76047c9ff4 upstream. + +Some old mice have a tendency to not accept the high resolution multiplier. +They reply with a -EPIPE which was previously ignored. + +Force the call to resolution multiplier to be synchronous and actually +check for the answer. If this fails, consider the mouse like a normal one. + +Fixes: 2dc702c991e377 ("HID: input: use the Resolution Multiplier for + high-resolution scrolling") +Link: https://bugzilla.redhat.com/show_bug.cgi?id=1700071 +Reported-and-tested-by: James Feeney +Cc: stable@vger.kernel.org # v5.0+ +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-core.c | 7 ++-- + drivers/hid/hid-input.c | 81 +++++++++++++++++++++++++++++------------------- + include/linux/hid.h | 2 - + 3 files changed, 56 insertions(+), 34 deletions(-) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1636,7 +1636,7 @@ static struct hid_report *hid_get_report + * Implement a generic .request() callback, using .raw_request() + * DO NOT USE in hid drivers directly, but through hid_hw_request instead. + */ +-void __hid_request(struct hid_device *hid, struct hid_report *report, ++int __hid_request(struct hid_device *hid, struct hid_report *report, + int reqtype) + { + char *buf; +@@ -1645,7 +1645,7 @@ void __hid_request(struct hid_device *hi + + buf = hid_alloc_report_buf(report, GFP_KERNEL); + if (!buf) +- return; ++ return -ENOMEM; + + len = hid_report_len(report); + +@@ -1662,8 +1662,11 @@ void __hid_request(struct hid_device *hi + if (reqtype == HID_REQ_GET_REPORT) + hid_input_report(hid, report->type, buf, ret, 0); + ++ ret = 0; ++ + out: + kfree(buf); ++ return ret; + } + EXPORT_SYMBOL_GPL(__hid_request); + +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -1557,52 +1557,71 @@ static void hidinput_close(struct input_ + hid_hw_close(hid); + } + +-static void hidinput_change_resolution_multipliers(struct hid_device *hid) ++static bool __hidinput_change_resolution_multipliers(struct hid_device *hid, ++ struct hid_report *report, bool use_logical_max) + { +- struct hid_report_enum *rep_enum; +- struct hid_report *rep; + struct hid_usage *usage; ++ bool update_needed = false; + int i, j; + +- rep_enum = &hid->report_enum[HID_FEATURE_REPORT]; +- list_for_each_entry(rep, &rep_enum->report_list, list) { +- bool update_needed = false; ++ if (report->maxfield == 0) ++ return false; + +- if (rep->maxfield == 0) +- continue; ++ /* ++ * If we have more than one feature within this report we ++ * need to fill in the bits from the others before we can ++ * overwrite the ones for the Resolution Multiplier. ++ */ ++ if (report->maxfield > 1) { ++ hid_hw_request(hid, report, HID_REQ_GET_REPORT); ++ hid_hw_wait(hid); ++ } + +- /* +- * If we have more than one feature within this report we +- * need to fill in the bits from the others before we can +- * overwrite the ones for the Resolution Multiplier. ++ for (i = 0; i < report->maxfield; i++) { ++ __s32 value = use_logical_max ? ++ report->field[i]->logical_maximum : ++ report->field[i]->logical_minimum; ++ ++ /* There is no good reason for a Resolution ++ * Multiplier to have a count other than 1. ++ * Ignore that case. + */ +- if (rep->maxfield > 1) { +- hid_hw_request(hid, rep, HID_REQ_GET_REPORT); +- hid_hw_wait(hid); +- } ++ if (report->field[i]->report_count != 1) ++ continue; + +- for (i = 0; i < rep->maxfield; i++) { +- __s32 logical_max = rep->field[i]->logical_maximum; ++ for (j = 0; j < report->field[i]->maxusage; j++) { ++ usage = &report->field[i]->usage[j]; + +- /* There is no good reason for a Resolution +- * Multiplier to have a count other than 1. +- * Ignore that case. +- */ +- if (rep->field[i]->report_count != 1) ++ if (usage->hid != HID_GD_RESOLUTION_MULTIPLIER) + continue; + +- for (j = 0; j < rep->field[i]->maxusage; j++) { +- usage = &rep->field[i]->usage[j]; ++ *report->field[i]->value = value; ++ update_needed = true; ++ } ++ } ++ ++ return update_needed; ++} ++ ++static void hidinput_change_resolution_multipliers(struct hid_device *hid) ++{ ++ struct hid_report_enum *rep_enum; ++ struct hid_report *rep; ++ int ret; + +- if (usage->hid != HID_GD_RESOLUTION_MULTIPLIER) +- continue; ++ rep_enum = &hid->report_enum[HID_FEATURE_REPORT]; ++ list_for_each_entry(rep, &rep_enum->report_list, list) { ++ bool update_needed = __hidinput_change_resolution_multipliers(hid, ++ rep, true); + +- *rep->field[i]->value = logical_max; +- update_needed = true; ++ if (update_needed) { ++ ret = __hid_request(hid, rep, HID_REQ_SET_REPORT); ++ if (ret) { ++ __hidinput_change_resolution_multipliers(hid, ++ rep, false); ++ return; + } + } +- if (update_needed) +- hid_hw_request(hid, rep, HID_REQ_SET_REPORT); + } + + /* refresh our structs */ +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -894,7 +894,7 @@ struct hid_field *hidinput_get_led_field + unsigned int hidinput_count_leds(struct hid_device *hid); + __s32 hidinput_calc_abs_res(const struct hid_field *field, __u16 code); + void hid_output_report(struct hid_report *report, __u8 *data); +-void __hid_request(struct hid_device *hid, struct hid_report *rep, int reqtype); ++int __hid_request(struct hid_device *hid, struct hid_report *rep, int reqtype); + u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags); + struct hid_device *hid_allocate_device(void); + struct hid_report *hid_register_report(struct hid_device *device, diff --git a/queue-5.1/hid-multitouch-handle-faulty-elo-touch-device.patch b/queue-5.1/hid-multitouch-handle-faulty-elo-touch-device.patch new file mode 100644 index 00000000000..012d4ea4d8d --- /dev/null +++ b/queue-5.1/hid-multitouch-handle-faulty-elo-touch-device.patch @@ -0,0 +1,49 @@ +From 81bcbad53bab4bf9f200eda303d7a05cdb9bd73b Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Tue, 21 May 2019 15:38:31 +0200 +Subject: HID: multitouch: handle faulty Elo touch device + +From: Benjamin Tissoires + +commit 81bcbad53bab4bf9f200eda303d7a05cdb9bd73b upstream. + +Since kernel v5.0, one single win8 touchscreen device failed. +And it turns out this is because it reports 2 InRange usage per touch. + +It's a first, and I *really* wonder how this was allowed by Microsoft in +the first place. But IIRC, Breno told me this happened *after* a firmware +upgrade... + +Anyway, better be safe for those crappy devices, and make sure we have +a full slot before jumping to the next. +This won't prevent all crappy devices to fail here, but at least we will +have a safeguard as long as the contact ID and the X and Y coordinates +are placed in the report after the grabage. + +Fixes: 01eaac7e5713 ("HID: multitouch: remove one copy of values") +CC: stable@vger.kernel.org # v5.0+ +Reported-and-tested-by: Breno Leitao +Signed-off-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-multitouch.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -641,6 +641,13 @@ static void mt_store_field(struct hid_de + if (*target != DEFAULT_TRUE && + *target != DEFAULT_FALSE && + *target != DEFAULT_ZERO) { ++ if (usage->contactid == DEFAULT_ZERO || ++ usage->x == DEFAULT_ZERO || ++ usage->y == DEFAULT_ZERO) { ++ hid_dbg(hdev, ++ "ignoring duplicate usage on incomplete"); ++ return; ++ } + usage = mt_allocate_usage(hdev, application); + if (!usage) + return; diff --git a/queue-5.1/hid-wacom-correct-button-numbering-2nd-gen-intuos-pro-over-bluetooth.patch b/queue-5.1/hid-wacom-correct-button-numbering-2nd-gen-intuos-pro-over-bluetooth.patch new file mode 100644 index 00000000000..175edc9ab12 --- /dev/null +++ b/queue-5.1/hid-wacom-correct-button-numbering-2nd-gen-intuos-pro-over-bluetooth.patch @@ -0,0 +1,69 @@ +From 6441fc781c344df61402be1fde582c4491fa35fa Mon Sep 17 00:00:00 2001 +From: Jason Gerecke +Date: Tue, 7 May 2019 11:53:21 -0700 +Subject: HID: wacom: Correct button numbering 2nd-gen Intuos Pro over Bluetooth + +From: Jason Gerecke + +commit 6441fc781c344df61402be1fde582c4491fa35fa upstream. + +The button numbering of the 2nd-gen Intuos Pro is not consistent between +the USB and Bluetooth interfaces. Over USB, the HID_GENERIC codepath +enumerates the eight ExpressKeys first (BTN_0 - BTN_7) followed by the +center modeswitch button (BTN_8). The Bluetooth codepath, however, has +the center modeswitch button as BTN_0 and the the eight ExpressKeys as +BTN_1 - BTN_8. To ensure userspace button mappings do not change +depending on how the tablet is connected, modify the Bluetooth codepath +to report buttons in the same order as USB. + +To ensure the mode switch LED continues to toggle in response to the +mode switch button, the `wacom_is_led_toggled` function also requires +a small update. + +Link: https://github.com/linuxwacom/input-wacom/pull/79 +Fixes: 4922cd26f03c ("HID: wacom: Support 2nd-gen Intuos Pro's Bluetooth classic interface") +Cc: # 4.11+ +Signed-off-by: Jason Gerecke +Reviewed-by: Aaron Skomra +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/wacom_wac.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -1383,7 +1383,7 @@ static void wacom_intuos_pro2_bt_pad(str + struct input_dev *pad_input = wacom->pad_input; + unsigned char *data = wacom->data; + +- int buttons = (data[282] << 1) | ((data[281] >> 6) & 0x01); ++ int buttons = data[282] | ((data[281] & 0x40) << 2); + int ring = data[285] & 0x7F; + bool ringstatus = data[285] & 0x80; + bool prox = buttons || ringstatus; +@@ -3832,7 +3832,7 @@ static void wacom_24hd_update_leds(struc + static bool wacom_is_led_toggled(struct wacom *wacom, int button_count, + int mask, int group) + { +- int button_per_group; ++ int group_button; + + /* + * 21UX2 has LED group 1 to the left and LED group 0 +@@ -3842,9 +3842,12 @@ static bool wacom_is_led_toggled(struct + if (wacom->wacom_wac.features.type == WACOM_21UX2) + group = 1 - group; + +- button_per_group = button_count/wacom->led.count; ++ group_button = group * (button_count/wacom->led.count); + +- return mask & (1 << (group * button_per_group)); ++ if (wacom->wacom_wac.features.type == INTUOSP2_BT) ++ group_button = 8; ++ ++ return mask & (1 << group_button); + } + + static void wacom_update_led(struct wacom *wacom, int button_count, int mask, diff --git a/queue-5.1/hid-wacom-don-t-report-anything-prior-to-the-tool-entering-range.patch b/queue-5.1/hid-wacom-don-t-report-anything-prior-to-the-tool-entering-range.patch new file mode 100644 index 00000000000..501a2aafb72 --- /dev/null +++ b/queue-5.1/hid-wacom-don-t-report-anything-prior-to-the-tool-entering-range.patch @@ -0,0 +1,73 @@ +From e92a7be7fe5b2510fa60965eaf25f9e3dc08b8cc Mon Sep 17 00:00:00 2001 +From: Jason Gerecke +Date: Wed, 24 Apr 2019 15:12:58 -0700 +Subject: HID: wacom: Don't report anything prior to the tool entering range + +From: Jason Gerecke + +commit e92a7be7fe5b2510fa60965eaf25f9e3dc08b8cc upstream. + +If the tool spends some time in prox before entering range, a series of +events (e.g. ABS_DISTANCE, MSC_SERIAL) can be sent before we or userspace +have any clue about the pen whose data is being reported. We need to hold +off on reporting anything until the pen has entered range. Since we still +want to report events that occur "in prox" after the pen has *left* range +we use 'wacom-tool[0]' as the indicator that the pen did at one point +enter range and provide us/userspace with tool type and serial number +information. + +Fixes: a48324de6d4d ("HID: wacom: Bluetooth IRQ for Intuos Pro should handle prox/range") +Cc: # 4.11+ +Signed-off-by: Jason Gerecke +Reviewed-by: Aaron Armstrong Skomra +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/wacom_wac.c | 33 ++++++++++++++++++--------------- + 1 file changed, 18 insertions(+), 15 deletions(-) + +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -1290,23 +1290,26 @@ static void wacom_intuos_pro2_bt_pen(str + get_unaligned_le16(&frame[11])); + } + } +- input_report_abs(pen_input, ABS_PRESSURE, get_unaligned_le16(&frame[5])); +- if (wacom->features.type == INTUOSP2_BT) { +- input_report_abs(pen_input, ABS_DISTANCE, +- range ? frame[13] : wacom->features.distance_max); +- } else { +- input_report_abs(pen_input, ABS_DISTANCE, +- range ? frame[7] : wacom->features.distance_max); +- } + +- input_report_key(pen_input, BTN_TOUCH, frame[0] & 0x01); +- input_report_key(pen_input, BTN_STYLUS, frame[0] & 0x02); +- input_report_key(pen_input, BTN_STYLUS2, frame[0] & 0x04); ++ if (wacom->tool[0]) { ++ input_report_abs(pen_input, ABS_PRESSURE, get_unaligned_le16(&frame[5])); ++ if (wacom->features.type == INTUOSP2_BT) { ++ input_report_abs(pen_input, ABS_DISTANCE, ++ range ? frame[13] : wacom->features.distance_max); ++ } else { ++ input_report_abs(pen_input, ABS_DISTANCE, ++ range ? frame[7] : wacom->features.distance_max); ++ } ++ ++ input_report_key(pen_input, BTN_TOUCH, frame[0] & 0x01); ++ input_report_key(pen_input, BTN_STYLUS, frame[0] & 0x02); ++ input_report_key(pen_input, BTN_STYLUS2, frame[0] & 0x04); + +- input_report_key(pen_input, wacom->tool[0], prox); +- input_event(pen_input, EV_MSC, MSC_SERIAL, wacom->serial[0]); +- input_report_abs(pen_input, ABS_MISC, +- wacom_intuos_id_mangle(wacom->id[0])); /* report tool id */ ++ input_report_key(pen_input, wacom->tool[0], prox); ++ input_event(pen_input, EV_MSC, MSC_SERIAL, wacom->serial[0]); ++ input_report_abs(pen_input, ABS_MISC, ++ wacom_intuos_id_mangle(wacom->id[0])); /* report tool id */ ++ } + + wacom->shared->stylus_in_proximity = prox; + diff --git a/queue-5.1/hid-wacom-don-t-set-tool-type-until-we-re-in-range.patch b/queue-5.1/hid-wacom-don-t-set-tool-type-until-we-re-in-range.patch new file mode 100644 index 00000000000..e334cc459e7 --- /dev/null +++ b/queue-5.1/hid-wacom-don-t-set-tool-type-until-we-re-in-range.patch @@ -0,0 +1,71 @@ +From 2cc08800a6b9fcda7c7afbcf2da1a6e8808da725 Mon Sep 17 00:00:00 2001 +From: Jason Gerecke +Date: Wed, 24 Apr 2019 15:12:57 -0700 +Subject: HID: wacom: Don't set tool type until we're in range + +From: Jason Gerecke + +commit 2cc08800a6b9fcda7c7afbcf2da1a6e8808da725 upstream. + +The serial number and tool type information that is reported by the tablet +while a pen is merely "in prox" instead of fully "in range" can be stale +and cause us to report incorrect tool information. Serial number, tool +type, and other information is only valid once the pen comes fully in range +so we should be careful to not use this information until that point. + +In particular, this issue may cause the driver to incorectly report +BTN_TOOL_RUBBER after switching from the eraser tool back to the pen. + +Fixes: a48324de6d4d ("HID: wacom: Bluetooth IRQ for Intuos Pro should handle prox/range") +Cc: # 4.11+ +Signed-off-by: Jason Gerecke +Reviewed-by: Aaron Armstrong Skomra +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/wacom_wac.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -1236,13 +1236,13 @@ static void wacom_intuos_pro2_bt_pen(str + /* Add back in missing bits of ID for non-USI pens */ + wacom->id[0] |= (wacom->serial[0] >> 32) & 0xFFFFF; + } +- wacom->tool[0] = wacom_intuos_get_tool_type(wacom_intuos_id_mangle(wacom->id[0])); + + for (i = 0; i < pen_frames; i++) { + unsigned char *frame = &data[i*pen_frame_len + 1]; + bool valid = frame[0] & 0x80; + bool prox = frame[0] & 0x40; + bool range = frame[0] & 0x20; ++ bool invert = frame[0] & 0x10; + + if (!valid) + continue; +@@ -1251,9 +1251,24 @@ static void wacom_intuos_pro2_bt_pen(str + wacom->shared->stylus_in_proximity = false; + wacom_exit_report(wacom); + input_sync(pen_input); ++ ++ wacom->tool[0] = 0; ++ wacom->id[0] = 0; ++ wacom->serial[0] = 0; + return; + } ++ + if (range) { ++ if (!wacom->tool[0]) { /* first in range */ ++ /* Going into range select tool */ ++ if (invert) ++ wacom->tool[0] = BTN_TOOL_RUBBER; ++ else if (wacom->id[0]) ++ wacom->tool[0] = wacom_intuos_get_tool_type(wacom->id[0]); ++ else ++ wacom->tool[0] = BTN_TOOL_PEN; ++ } ++ + input_report_abs(pen_input, ABS_X, get_unaligned_le16(&frame[1])); + input_report_abs(pen_input, ABS_Y, get_unaligned_le16(&frame[3])); + diff --git a/queue-5.1/hid-wacom-send-btn_touch-in-response-to-intuosp2_bt-eraser-contact.patch b/queue-5.1/hid-wacom-send-btn_touch-in-response-to-intuosp2_bt-eraser-contact.patch new file mode 100644 index 00000000000..d9c16d7e9da --- /dev/null +++ b/queue-5.1/hid-wacom-send-btn_touch-in-response-to-intuosp2_bt-eraser-contact.patch @@ -0,0 +1,38 @@ +From fe7f8d73d1af19b678171170e4e5384deb57833d Mon Sep 17 00:00:00 2001 +From: Jason Gerecke +Date: Tue, 7 May 2019 11:53:20 -0700 +Subject: HID: wacom: Send BTN_TOUCH in response to INTUOSP2_BT eraser contact + +From: Jason Gerecke + +commit fe7f8d73d1af19b678171170e4e5384deb57833d upstream. + +The Bluetooth reports from the 2nd-gen Intuos Pro have separate bits for +indicating if the tip or eraser is in contact with the tablet. At the +moment, only the tip contact bit controls the state of the BTN_TOUCH +event. This prevents the eraser from working as expected. This commit +changes the driver to send BTN_TOUCH whenever either the tip or eraser +contact bit is set. + +Fixes: 4922cd26f03c ("HID: wacom: Support 2nd-gen Intuos Pro's Bluetooth classic interface") +Cc: # 4.11+ +Signed-off-by: Jason Gerecke +Reviewed-by: Aaron Skomra +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/wacom_wac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -1301,7 +1301,7 @@ static void wacom_intuos_pro2_bt_pen(str + range ? frame[7] : wacom->features.distance_max); + } + +- input_report_key(pen_input, BTN_TOUCH, frame[0] & 0x01); ++ input_report_key(pen_input, BTN_TOUCH, frame[0] & 0x09); + input_report_key(pen_input, BTN_STYLUS, frame[0] & 0x02); + input_report_key(pen_input, BTN_STYLUS2, frame[0] & 0x04); + diff --git a/queue-5.1/hid-wacom-sync-intuosp2_bt-touch-state-after-each-frame-if-necessary.patch b/queue-5.1/hid-wacom-sync-intuosp2_bt-touch-state-after-each-frame-if-necessary.patch new file mode 100644 index 00000000000..2747439e238 --- /dev/null +++ b/queue-5.1/hid-wacom-sync-intuosp2_bt-touch-state-after-each-frame-if-necessary.patch @@ -0,0 +1,51 @@ +From 69dbdfffef20c715df9f381b2cee4e9e0a4efd93 Mon Sep 17 00:00:00 2001 +From: Jason Gerecke +Date: Tue, 7 May 2019 11:53:22 -0700 +Subject: HID: wacom: Sync INTUOSP2_BT touch state after each frame if necessary + +From: Jason Gerecke + +commit 69dbdfffef20c715df9f381b2cee4e9e0a4efd93 upstream. + +The Bluetooth interface of the 2nd-gen Intuos Pro batches together four +independent "frames" of finger data into a single report. Each frame +is essentially equivalent to a single USB report, with the up-to-10 +fingers worth of information being spread across two frames. At the +moment the driver only calls `input_sync` after processing all four +frames have been processed, which can result in the driver sending +multiple updates for a single slot within the same SYN_REPORT. This +can confuse userspace, so modify the driver to sync more often if +necessary (i.e., after reporting the state of all fingers). + +Fixes: 4922cd26f03c ("HID: wacom: Support 2nd-gen Intuos Pro's Bluetooth classic interface") +Cc: # 4.11+ +Signed-off-by: Jason Gerecke +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/wacom_wac.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -1371,11 +1371,17 @@ static void wacom_intuos_pro2_bt_touch(s + if (wacom->num_contacts_left <= 0) { + wacom->num_contacts_left = 0; + wacom->shared->touch_down = wacom_wac_finger_count_touches(wacom); ++ input_sync(touch_input); + } + } + +- input_report_switch(touch_input, SW_MUTE_DEVICE, !(data[281] >> 7)); +- input_sync(touch_input); ++ if (wacom->num_contacts_left == 0) { ++ // Be careful that we don't accidentally call input_sync with ++ // only a partial set of fingers of processed ++ input_report_switch(touch_input, SW_MUTE_DEVICE, !(data[281] >> 7)); ++ input_sync(touch_input); ++ } ++ + } + + static void wacom_intuos_pro2_bt_pad(struct wacom_wac *wacom) diff --git a/queue-5.1/io_uring-fix-memory-leak-of-unix-domain-socket-inode.patch b/queue-5.1/io_uring-fix-memory-leak-of-unix-domain-socket-inode.patch new file mode 100644 index 00000000000..40ebb5a9128 --- /dev/null +++ b/queue-5.1/io_uring-fix-memory-leak-of-unix-domain-socket-inode.patch @@ -0,0 +1,44 @@ +From 355e8d26f719c207aa2e00e6f3cfab3acf21769b Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Wed, 12 Jun 2019 14:58:43 -0700 +Subject: io_uring: fix memory leak of UNIX domain socket inode + +From: Eric Biggers + +commit 355e8d26f719c207aa2e00e6f3cfab3acf21769b upstream. + +Opening and closing an io_uring instance leaks a UNIX domain socket +inode. This is because the ->file of the io_uring instance's internal +UNIX domain socket is set to point to the io_uring file, but then +sock_release() sees the non-NULL ->file and assumes the inode reference +is held by the file so doesn't call iput(). That's not the case here, +since the reference is still meant to be held by the socket; the actual +inode of the io_uring file is different. + +Fix this leak by NULL-ing out ->file before releasing the socket. + +Reported-by: syzbot+111cb28d9f583693aefa@syzkaller.appspotmail.com +Fixes: 2b188cc1bb85 ("Add io_uring IO interface") +Cc: # v5.1+ +Signed-off-by: Eric Biggers +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + fs/io_uring.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -2633,8 +2633,10 @@ static void io_ring_ctx_free(struct io_r + io_sqe_files_unregister(ctx); + + #if defined(CONFIG_UNIX) +- if (ctx->ring_sock) ++ if (ctx->ring_sock) { ++ ctx->ring_sock->file = NULL; /* so that iput() is called */ + sock_release(ctx->ring_sock); ++ } + #endif + + io_mem_free(ctx->sq_ring); diff --git a/queue-5.1/libata-extend-quirks-for-the-st1000lm024-drives-with-nolpm-quirk.patch b/queue-5.1/libata-extend-quirks-for-the-st1000lm024-drives-with-nolpm-quirk.patch new file mode 100644 index 00000000000..d618588ac2b --- /dev/null +++ b/queue-5.1/libata-extend-quirks-for-the-st1000lm024-drives-with-nolpm-quirk.patch @@ -0,0 +1,42 @@ +From 31f6264e225fb92cf6f4b63031424f20797c297d Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Tue, 11 Jun 2019 16:32:59 +0200 +Subject: libata: Extend quirks for the ST1000LM024 drives with NOLPM quirk + +From: Hans de Goede + +commit 31f6264e225fb92cf6f4b63031424f20797c297d upstream. + +We've received a bugreport that using LPM with ST1000LM024 drives leads +to system lockups. So it seems that these models are buggy in more then +1 way. Add NOLPM quirk to the existing quirks entry for BROKEN_FPDMA_AA. + +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1571330 +Cc: stable@vger.kernel.org +Reviewed-by: Martin K. Petersen +Signed-off-by: Hans de Goede +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4476,9 +4476,12 @@ static const struct ata_blacklist_entry + { "ST3320[68]13AS", "SD1[5-9]", ATA_HORKAGE_NONCQ | + ATA_HORKAGE_FIRMWARE_WARN }, + +- /* drives which fail FPDMA_AA activation (some may freeze afterwards) */ +- { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA }, +- { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA }, ++ /* drives which fail FPDMA_AA activation (some may freeze afterwards) ++ the ST disks also have LPM issues */ ++ { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA | ++ ATA_HORKAGE_NOLPM, }, ++ { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA | ++ ATA_HORKAGE_NOLPM, }, + { "VB0250EAVER", "HPG7", ATA_HORKAGE_BROKEN_FPDMA_AA }, + + /* Blacklist entries taken from Silicon Image 3124/3132 diff --git a/queue-5.1/nouveau-fix-build-with-config_nouveau_legacy_ctx_support-disabled.patch b/queue-5.1/nouveau-fix-build-with-config_nouveau_legacy_ctx_support-disabled.patch new file mode 100644 index 00000000000..04d19328d87 --- /dev/null +++ b/queue-5.1/nouveau-fix-build-with-config_nouveau_legacy_ctx_support-disabled.patch @@ -0,0 +1,54 @@ +From 0d91b155a7f9c1f4a2b360bc2b79dc728aee8b48 Mon Sep 17 00:00:00 2001 +From: Thomas Backlund +Date: Sat, 15 Jun 2019 12:22:44 +0300 +Subject: nouveau: Fix build with CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT disabled + +From: Thomas Backlund + +Not-entirely-upstream-sha1-but-equivalent: bed2dd8421 +("drm/ttm: Quick-test mmap offset in ttm_bo_mmap()") + +Setting CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT=n (added by commit: b30a43ac7132) +causes the build to fail with: + +ERROR: "drm_legacy_mmap" [drivers/gpu/drm/nouveau/nouveau.ko] undefined! + +This does not happend upstream as the offending code got removed in: +bed2dd8421 ("drm/ttm: Quick-test mmap offset in ttm_bo_mmap()") + +Fix that by adding check for CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT around +the drm_legacy_mmap() call. + +Also, as Sven Joachim pointed out, we need to make the check in +CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT=n case return -EINVAL as its done +for basically all other gpu drivers, especially in upstream kernels +drivers/gpu/drm/ttm/ttm_bo_vm.c as of the upstream commit bed2dd8421. + +NOTE. This is a minimal stable-only fix for trees where b30a43ac7132 is +backported as the build error affects nouveau only. + +Fixes: b30a43ac7132 ("drm/nouveau: add kconfig option to turn off nouveau + legacy contexts. (v3)") +Signed-off-by: Thomas Backlund +Cc: stable@vger.kernel.org +Cc: Daniel Vetter +Cc: Sven Joachim +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/nouveau_ttm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c +@@ -169,7 +169,11 @@ nouveau_ttm_mmap(struct file *filp, stru + struct nouveau_drm *drm = nouveau_drm(file_priv->minor->dev); + + if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET)) ++#if defined(CONFIG_NOUVEAU_LEGACY_CTX_SUPPORT) + return drm_legacy_mmap(filp, vma); ++#else ++ return -EINVAL; ++#endif + + return ttm_bo_mmap(filp, vma, &drm->ttm.bdev); + } diff --git a/queue-5.1/revert-alsa-hda-realtek-improve-the-headset-mic-for-acer-aspire-laptops.patch b/queue-5.1/revert-alsa-hda-realtek-improve-the-headset-mic-for-acer-aspire-laptops.patch new file mode 100644 index 00000000000..bfe2795e0d9 --- /dev/null +++ b/queue-5.1/revert-alsa-hda-realtek-improve-the-headset-mic-for-acer-aspire-laptops.patch @@ -0,0 +1,59 @@ +From 17d304604a88cf20c8dfd2c95d3decb9c4f8bca4 Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Fri, 14 Jun 2019 16:44:12 +0800 +Subject: Revert "ALSA: hda/realtek - Improve the headset mic for Acer Aspire laptops" + +From: Hui Wang + +commit 17d304604a88cf20c8dfd2c95d3decb9c4f8bca4 upstream. + +This reverts commit 9cb40eb184c4220d244a532bd940c6345ad9dbd9. + +This patch introduces noise and headphone playback issue after +rebooting or suspending/resuming. Let us revert it. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=203831 +Fixes: 9cb40eb184c4 ("ALSA: hda/realtek - Improve the headset mic for Acer Aspire laptops") +Cc: +Signed-off-by: Hui Wang +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 16 +++++----------- + 1 file changed, 5 insertions(+), 11 deletions(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6166,15 +6166,13 @@ static const struct hda_fixup alc269_fix + .chain_id = ALC269_FIXUP_THINKPAD_ACPI, + }, + [ALC255_FIXUP_ACER_MIC_NO_PRESENCE] = { +- .type = HDA_FIXUP_VERBS, +- .v.verbs = (const struct hda_verb[]) { +- /* Enable the Mic */ +- { 0x20, AC_VERB_SET_COEF_INDEX, 0x45 }, +- { 0x20, AC_VERB_SET_PROC_COEF, 0x5089 }, +- {} ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */ ++ { } + }, + .chained = true, +- .chain_id = ALC269_FIXUP_LIFEBOOK_EXTMIC ++ .chain_id = ALC255_FIXUP_HEADSET_MODE + }, + [ALC255_FIXUP_ASUS_MIC_NO_PRESENCE] = { + .type = HDA_FIXUP_PINS, +@@ -7220,10 +7218,6 @@ static const struct snd_hda_pin_quirk al + {0x19, 0x0181303F}, + {0x21, 0x0221102f}), + SND_HDA_PIN_QUIRK(0x10ec0255, 0x1025, "Acer", ALC255_FIXUP_ACER_MIC_NO_PRESENCE, +- {0x12, 0x90a60140}, +- {0x14, 0x90170120}, +- {0x21, 0x02211030}), +- SND_HDA_PIN_QUIRK(0x10ec0255, 0x1025, "Acer", ALC255_FIXUP_ACER_MIC_NO_PRESENCE, + {0x12, 0x90a601c0}, + {0x14, 0x90171120}, + {0x21, 0x02211030}), diff --git a/queue-5.1/revert-hid-increase-maximum-report-size-allowed-by-hid_field_extract.patch b/queue-5.1/revert-hid-increase-maximum-report-size-allowed-by-hid_field_extract.patch new file mode 100644 index 00000000000..314be264881 --- /dev/null +++ b/queue-5.1/revert-hid-increase-maximum-report-size-allowed-by-hid_field_extract.patch @@ -0,0 +1,45 @@ +From 15fc1b5c86128f91c8c6699c3b0d9615740b13f1 Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Wed, 5 Jun 2019 14:44:05 +0200 +Subject: Revert "HID: Increase maximum report size allowed by hid_field_extract()" + +From: Benjamin Tissoires + +commit 15fc1b5c86128f91c8c6699c3b0d9615740b13f1 upstream. + +This reverts commit 94a9992f7dbdfb28976b565af220e0c4a117144a. + +The commit allows for more than 32 bits in hid_field_extract(), +but the return value is a 32 bits int. +So basically what this commit is doing is just silencing those +legitimate errors. + +Revert to a previous situation in the hope that a proper +fix will be impletemented. + +Fixes: 94a9992f7dbd ("HID: Increase maximum report size allowed by hid_field_extract()") +Cc: stable@vger.kernel.org # v5.1 +Acked-by: Jiri Kosina +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1313,10 +1313,10 @@ static u32 __extract(u8 *report, unsigne + u32 hid_field_extract(const struct hid_device *hid, u8 *report, + unsigned offset, unsigned n) + { +- if (n > 256) { +- hid_warn(hid, "hid_field_extract() called with n (%d) > 256! (%s)\n", ++ if (n > 32) { ++ hid_warn(hid, "hid_field_extract() called with n (%d) > 32! (%s)\n", + n, current->comm); +- n = 256; ++ n = 32; + } + + return __extract(report, offset, n); diff --git a/queue-5.1/selinux-fix-a-missing-check-bug-in-selinux_add_mnt_opt.patch b/queue-5.1/selinux-fix-a-missing-check-bug-in-selinux_add_mnt_opt.patch new file mode 100644 index 00000000000..1f180c86ccd --- /dev/null +++ b/queue-5.1/selinux-fix-a-missing-check-bug-in-selinux_add_mnt_opt.patch @@ -0,0 +1,56 @@ +From e2e0e09758a6f7597de0f9b819647addfb71b6bd Mon Sep 17 00:00:00 2001 +From: Gen Zhang +Date: Wed, 12 Jun 2019 21:28:21 +0800 +Subject: selinux: fix a missing-check bug in selinux_add_mnt_opt( ) + +From: Gen Zhang + +commit e2e0e09758a6f7597de0f9b819647addfb71b6bd upstream. + +In selinux_add_mnt_opt(), 'val' is allocated by kmemdup_nul(). It returns +NULL when fails. So 'val' should be checked. And 'mnt_opts' should be +freed when error. + +Signed-off-by: Gen Zhang +Fixes: 757cbe597fe8 ("LSM: new method: ->sb_add_mnt_opt()") +Cc: +[PM: fixed some indenting problems] +Signed-off-by: Paul Moore +Signed-off-by: Greg Kroah-Hartman + +--- + security/selinux/hooks.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -1048,15 +1048,24 @@ static int selinux_add_mnt_opt(const cha + if (token == Opt_error) + return -EINVAL; + +- if (token != Opt_seclabel) ++ if (token != Opt_seclabel) { + val = kmemdup_nul(val, len, GFP_KERNEL); ++ if (!val) { ++ rc = -ENOMEM; ++ goto free_opt; ++ } ++ } + rc = selinux_add_opt(token, val, mnt_opts); + if (unlikely(rc)) { + kfree(val); +- if (*mnt_opts) { +- selinux_free_mnt_opts(*mnt_opts); +- *mnt_opts = NULL; +- } ++ goto free_opt; ++ } ++ return rc; ++ ++free_opt: ++ if (*mnt_opts) { ++ selinux_free_mnt_opts(*mnt_opts); ++ *mnt_opts = NULL; + } + return rc; + } diff --git a/queue-5.1/selinux-fix-a-missing-check-bug-in-selinux_sb_eat_lsm_opts.patch b/queue-5.1/selinux-fix-a-missing-check-bug-in-selinux_sb_eat_lsm_opts.patch new file mode 100644 index 00000000000..903d9c39b60 --- /dev/null +++ b/queue-5.1/selinux-fix-a-missing-check-bug-in-selinux_sb_eat_lsm_opts.patch @@ -0,0 +1,73 @@ +From fec6375320c6399c708fa9801f8cfbf950fee623 Mon Sep 17 00:00:00 2001 +From: Gen Zhang +Date: Wed, 12 Jun 2019 21:55:38 +0800 +Subject: selinux: fix a missing-check bug in selinux_sb_eat_lsm_opts() + +From: Gen Zhang + +commit fec6375320c6399c708fa9801f8cfbf950fee623 upstream. + +In selinux_sb_eat_lsm_opts(), 'arg' is allocated by kmemdup_nul(). It +returns NULL when fails. So 'arg' should be checked. And 'mnt_opts' +should be freed when error. + +Signed-off-by: Gen Zhang +Fixes: 99dbbb593fe6 ("selinux: rewrite selinux_sb_eat_lsm_opts()") +Cc: +Signed-off-by: Paul Moore +Signed-off-by: Greg Kroah-Hartman + +--- + security/selinux/hooks.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -2612,10 +2612,11 @@ static int selinux_sb_eat_lsm_opts(char + char *from = options; + char *to = options; + bool first = true; ++ int rc; + + while (1) { + int len = opt_len(from); +- int token, rc; ++ int token; + char *arg = NULL; + + token = match_opt_prefix(from, len, &arg); +@@ -2631,15 +2632,15 @@ static int selinux_sb_eat_lsm_opts(char + *q++ = c; + } + arg = kmemdup_nul(arg, q - arg, GFP_KERNEL); ++ if (!arg) { ++ rc = -ENOMEM; ++ goto free_opt; ++ } + } + rc = selinux_add_opt(token, arg, mnt_opts); + if (unlikely(rc)) { + kfree(arg); +- if (*mnt_opts) { +- selinux_free_mnt_opts(*mnt_opts); +- *mnt_opts = NULL; +- } +- return rc; ++ goto free_opt; + } + } else { + if (!first) { // copy with preceding comma +@@ -2657,6 +2658,13 @@ static int selinux_sb_eat_lsm_opts(char + } + *to = '\0'; + return 0; ++ ++free_opt: ++ if (*mnt_opts) { ++ selinux_free_mnt_opts(*mnt_opts); ++ *mnt_opts = NULL; ++ } ++ return rc; + } + + static int selinux_sb_remount(struct super_block *sb, void *mnt_opts) diff --git a/queue-5.1/selinux-log-raw-contexts-as-untrusted-strings.patch b/queue-5.1/selinux-log-raw-contexts-as-untrusted-strings.patch new file mode 100644 index 00000000000..ba76af3ca7b --- /dev/null +++ b/queue-5.1/selinux-log-raw-contexts-as-untrusted-strings.patch @@ -0,0 +1,64 @@ +From aff7ed4851680d0d28ad9f52cd2f99213e1371b2 Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Tue, 11 Jun 2019 10:07:19 +0200 +Subject: selinux: log raw contexts as untrusted strings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ondrej Mosnacek + +commit aff7ed4851680d0d28ad9f52cd2f99213e1371b2 upstream. + +These strings may come from untrusted sources (e.g. file xattrs) so they +need to be properly escaped. + +Reproducer: + # setenforce 0 + # touch /tmp/test + # setfattr -n security.selinux -v 'kuřecí řízek' /tmp/test + # runcon system_u:system_r:sshd_t:s0 cat /tmp/test + (look at the generated AVCs) + +Actual result: + type=AVC [...] trawcon=kuřecí řízek + +Expected result: + type=AVC [...] trawcon=6B75C5996563C3AD20C599C3AD7A656B + +Fixes: fede148324c3 ("selinux: log invalid contexts in AVCs") +Cc: stable@vger.kernel.org # v5.1+ +Signed-off-by: Ondrej Mosnacek +Acked-by: Richard Guy Briggs +Signed-off-by: Paul Moore +Signed-off-by: Greg Kroah-Hartman + +--- + security/selinux/avc.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/security/selinux/avc.c ++++ b/security/selinux/avc.c +@@ -739,14 +739,20 @@ static void avc_audit_post_callback(stru + rc = security_sid_to_context_inval(sad->state, sad->ssid, &scontext, + &scontext_len); + if (!rc && scontext) { +- audit_log_format(ab, " srawcon=%s", scontext); ++ if (scontext_len && scontext[scontext_len - 1] == '\0') ++ scontext_len--; ++ audit_log_format(ab, " srawcon="); ++ audit_log_n_untrustedstring(ab, scontext, scontext_len); + kfree(scontext); + } + + rc = security_sid_to_context_inval(sad->state, sad->tsid, &scontext, + &scontext_len); + if (!rc && scontext) { +- audit_log_format(ab, " trawcon=%s", scontext); ++ if (scontext_len && scontext[scontext_len - 1] == '\0') ++ scontext_len--; ++ audit_log_format(ab, " trawcon="); ++ audit_log_n_untrustedstring(ab, scontext, scontext_len); + kfree(scontext); + } + } -- 2.47.3