From f942df26cdeb850bbd3866d3564c56677e2a372c Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 1 Sep 2022 20:51:00 +0200 Subject: [PATCH] 5.15-stable patches added patches: alsa-usb-audio-add-quirk-for-lh-labs-geek-out-hd-audio-1v5.patch hid-add-lenovo-yoga-c630-battery-quirk.patch hid-amd_sfh-add-a-dmi-quirk-entry-for-chromebooks.patch hid-asus-rog-nkey-ignore-portion-of-0x5a-report.patch hid-thrustmaster-add-sparco-wheel-and-fix-array-length.patch mm-rmap-fix-anon_vma-degree-ambiguity-leading-to-double-reuse.patch --- ...rk-for-lh-labs-geek-out-hd-audio-1v5.patch | 35 ++++ ...d-add-lenovo-yoga-c630-battery-quirk.patch | 45 +++++ ...dd-a-dmi-quirk-entry-for-chromebooks.patch | 57 ++++++ ...g-nkey-ignore-portion-of-0x5a-report.patch | 40 +++++ ...dd-sparco-wheel-and-fix-array-length.patch | 40 +++++ ...ee-ambiguity-leading-to-double-reuse.patch | 167 ++++++++++++++++++ queue-5.15/series | 6 + 7 files changed, 390 insertions(+) create mode 100644 queue-5.15/alsa-usb-audio-add-quirk-for-lh-labs-geek-out-hd-audio-1v5.patch create mode 100644 queue-5.15/hid-add-lenovo-yoga-c630-battery-quirk.patch create mode 100644 queue-5.15/hid-amd_sfh-add-a-dmi-quirk-entry-for-chromebooks.patch create mode 100644 queue-5.15/hid-asus-rog-nkey-ignore-portion-of-0x5a-report.patch create mode 100644 queue-5.15/hid-thrustmaster-add-sparco-wheel-and-fix-array-length.patch create mode 100644 queue-5.15/mm-rmap-fix-anon_vma-degree-ambiguity-leading-to-double-reuse.patch diff --git a/queue-5.15/alsa-usb-audio-add-quirk-for-lh-labs-geek-out-hd-audio-1v5.patch b/queue-5.15/alsa-usb-audio-add-quirk-for-lh-labs-geek-out-hd-audio-1v5.patch new file mode 100644 index 00000000000..e0e514d607a --- /dev/null +++ b/queue-5.15/alsa-usb-audio-add-quirk-for-lh-labs-geek-out-hd-audio-1v5.patch @@ -0,0 +1,35 @@ +From 5f3d9e8161bb8cb23ab3b4678cd13f6e90a06186 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sun, 28 Aug 2022 09:41:43 +0200 +Subject: ALSA: usb-audio: Add quirk for LH Labs Geek Out HD Audio 1V5 + +From: Takashi Iwai + +commit 5f3d9e8161bb8cb23ab3b4678cd13f6e90a06186 upstream. + +The USB DAC from LH Labs (2522:0007) seems requiring the same quirk as +Sony Walkman to set up the interface like UAC1; otherwise it gets the +constant errors "usb_set_interface failed (-71)". This patch adds a +quirk entry for addressing the buggy behavior. + +Reported-by: Lennert Van Alboom +Cc: +Link: https://lore.kernel.org/r/T3VPXtCc4uFws9Gfh2RjX6OdwM1RqfC6VqQr--_LMDyB2x5N3p9_q6AtPna17IXhHwBtcJVdXuS80ZZSCMjh_BafIbnzJPhbrkmhmWS6DlI=@vanalboom.org +Link: https://lore.kernel.org/r/20220828074143.14736-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/quirks.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1903,6 +1903,8 @@ static const struct usb_audio_quirk_flag + QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER), + DEVICE_FLG(0x21b4, 0x0081, /* AudioQuest DragonFly */ + QUIRK_FLAG_GET_SAMPLE_RATE), ++ DEVICE_FLG(0x2522, 0x0007, /* LH Labs Geek Out HD Audio 1V5 */ ++ QUIRK_FLAG_SET_IFACE_FIRST), + DEVICE_FLG(0x2708, 0x0002, /* Audient iD14 */ + QUIRK_FLAG_IGNORE_CTL_ERROR), + DEVICE_FLG(0x2912, 0x30c8, /* Audioengine D1 */ diff --git a/queue-5.15/hid-add-lenovo-yoga-c630-battery-quirk.patch b/queue-5.15/hid-add-lenovo-yoga-c630-battery-quirk.patch new file mode 100644 index 00000000000..c40ccc809ae --- /dev/null +++ b/queue-5.15/hid-add-lenovo-yoga-c630-battery-quirk.patch @@ -0,0 +1,45 @@ +From 3a47fa7b14c7d9613909a844aba27f99d3c58634 Mon Sep 17 00:00:00 2001 +From: Steev Klimaszewski +Date: Thu, 18 Aug 2022 21:39:24 -0500 +Subject: HID: add Lenovo Yoga C630 battery quirk + +From: Steev Klimaszewski + +commit 3a47fa7b14c7d9613909a844aba27f99d3c58634 upstream. + +Similar to the Surface Go devices, the Elantech touchscreen/digitizer in +the Lenovo Yoga C630 mistakenly reports the battery of the stylus, and +always reports an empty battery. + +Apply the HID_BATTERY_QUIRK_IGNORE quirk to ignore this battery and +prevent the erroneous low battery warnings. + +Signed-off-by: Steev Klimaszewski +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-input.c | 2 ++ + 2 files changed, 3 insertions(+) + +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -399,6 +399,7 @@ + #define USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN 0x2706 + #define I2C_DEVICE_ID_SURFACE_GO_TOUCHSCREEN 0x261A + #define I2C_DEVICE_ID_SURFACE_GO2_TOUCHSCREEN 0x2A1C ++#define I2C_DEVICE_ID_LENOVO_YOGA_C630_TOUCHSCREEN 0x279F + + #define USB_VENDOR_ID_ELECOM 0x056e + #define USB_DEVICE_ID_ELECOM_BM084 0x0061 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -335,6 +335,8 @@ static const struct hid_device_id hid_ba + HID_BATTERY_QUIRK_IGNORE }, + { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_SURFACE_GO2_TOUCHSCREEN), + HID_BATTERY_QUIRK_IGNORE }, ++ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_LENOVO_YOGA_C630_TOUCHSCREEN), ++ HID_BATTERY_QUIRK_IGNORE }, + {} + }; + diff --git a/queue-5.15/hid-amd_sfh-add-a-dmi-quirk-entry-for-chromebooks.patch b/queue-5.15/hid-amd_sfh-add-a-dmi-quirk-entry-for-chromebooks.patch new file mode 100644 index 00000000000..55229389f17 --- /dev/null +++ b/queue-5.15/hid-amd_sfh-add-a-dmi-quirk-entry-for-chromebooks.patch @@ -0,0 +1,57 @@ +From adada3f4930ac084740ea340bd8e94028eba4f22 Mon Sep 17 00:00:00 2001 +From: Akihiko Odaki +Date: Tue, 16 Aug 2022 19:21:20 +0900 +Subject: HID: AMD_SFH: Add a DMI quirk entry for Chromebooks + +From: Akihiko Odaki + +commit adada3f4930ac084740ea340bd8e94028eba4f22 upstream. + +Google Chromebooks use Chrome OS Embedded Controller Sensor Hub instead +of Sensor Hub Fusion and leaves MP2 uninitialized, which disables all +functionalities, even including the registers necessary for feature +detections. + +The behavior was observed with Lenovo ThinkPad C13 Yoga. + +Signed-off-by: Akihiko Odaki +Suggested-by: Mario Limonciello +Acked-by: Basavaraj Natikar +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +--- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c ++++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c +@@ -281,11 +281,29 @@ static int amd_sfh_irq_init(struct amd_m + return 0; + } + ++static const struct dmi_system_id dmi_nodevs[] = { ++ { ++ /* ++ * Google Chromebooks use Chrome OS Embedded Controller Sensor ++ * Hub instead of Sensor Hub Fusion and leaves MP2 ++ * uninitialized, which disables all functionalities, even ++ * including the registers necessary for feature detections. ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Google"), ++ }, ++ }, ++ { } ++}; ++ + static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + { + struct amd_mp2_dev *privdata; + int rc; + ++ if (dmi_first_match(dmi_nodevs)) ++ return -ENODEV; ++ + privdata = devm_kzalloc(&pdev->dev, sizeof(*privdata), GFP_KERNEL); + if (!privdata) + return -ENOMEM; diff --git a/queue-5.15/hid-asus-rog-nkey-ignore-portion-of-0x5a-report.patch b/queue-5.15/hid-asus-rog-nkey-ignore-portion-of-0x5a-report.patch new file mode 100644 index 00000000000..87914954e92 --- /dev/null +++ b/queue-5.15/hid-asus-rog-nkey-ignore-portion-of-0x5a-report.patch @@ -0,0 +1,40 @@ +From 1c0cc9d11c665020cbeb80e660fb8929164407f4 Mon Sep 17 00:00:00 2001 +From: Josh Kilmer +Date: Thu, 28 Jul 2022 12:51:11 -0500 +Subject: HID: asus: ROG NKey: Ignore portion of 0x5a report + +From: Josh Kilmer + +commit 1c0cc9d11c665020cbeb80e660fb8929164407f4 upstream. + +On an Asus G513QY, of the 5 bytes in a 0x5a report, only the first byte +is a meaningful keycode. The other bytes are zeroed out or hold garbage +from the last packet sent to the keyboard. + +This patch fixes up the report descriptor for this event so that the +general hid code will only process 1 byte for keycodes, avoiding +spurious key events and unmapped Asus vendor usagepage code warnings. + +Signed-off-by: Josh Kilmer +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-asus.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/hid/hid-asus.c ++++ b/drivers/hid/hid-asus.c +@@ -1212,6 +1212,13 @@ static __u8 *asus_report_fixup(struct hi + rdesc = new_rdesc; + } + ++ if (drvdata->quirks & QUIRK_ROG_NKEY_KEYBOARD && ++ *rsize == 331 && rdesc[190] == 0x85 && rdesc[191] == 0x5a && ++ rdesc[204] == 0x95 && rdesc[205] == 0x05) { ++ hid_info(hdev, "Fixing up Asus N-KEY keyb report descriptor\n"); ++ rdesc[205] = 0x01; ++ } ++ + return rdesc; + } + diff --git a/queue-5.15/hid-thrustmaster-add-sparco-wheel-and-fix-array-length.patch b/queue-5.15/hid-thrustmaster-add-sparco-wheel-and-fix-array-length.patch new file mode 100644 index 00000000000..062d38e2ca0 --- /dev/null +++ b/queue-5.15/hid-thrustmaster-add-sparco-wheel-and-fix-array-length.patch @@ -0,0 +1,40 @@ +From d9a17651f3749e69890db57ca66e677dfee70829 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michael=20H=C3=BCbner?= +Date: Fri, 5 Aug 2022 10:05:23 +0200 +Subject: HID: thrustmaster: Add sparco wheel and fix array length +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Hübner + +commit d9a17651f3749e69890db57ca66e677dfee70829 upstream. + +Add device id for the Sparco R383 Mod wheel. + +Fix wheel info array length to match actual wheel count present in the array. + +Signed-off-by: Michael Hübner +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-thrustmaster.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/hid/hid-thrustmaster.c ++++ b/drivers/hid/hid-thrustmaster.c +@@ -67,12 +67,13 @@ static const struct tm_wheel_info tm_whe + {0x0200, 0x0005, "Thrustmaster T300RS (Missing Attachment)"}, + {0x0206, 0x0005, "Thrustmaster T300RS"}, + {0x0209, 0x0005, "Thrustmaster T300RS (Open Wheel Attachment)"}, ++ {0x020a, 0x0005, "Thrustmaster T300RS (Sparco R383 Mod)"}, + {0x0204, 0x0005, "Thrustmaster T300 Ferrari Alcantara Edition"}, + {0x0002, 0x0002, "Thrustmaster T500RS"} + //{0x0407, 0x0001, "Thrustmaster TMX"} + }; + +-static const uint8_t tm_wheels_infos_length = 4; ++static const uint8_t tm_wheels_infos_length = 7; + + /* + * This structs contains (in little endian) the response data diff --git a/queue-5.15/mm-rmap-fix-anon_vma-degree-ambiguity-leading-to-double-reuse.patch b/queue-5.15/mm-rmap-fix-anon_vma-degree-ambiguity-leading-to-double-reuse.patch new file mode 100644 index 00000000000..49b194fb60e --- /dev/null +++ b/queue-5.15/mm-rmap-fix-anon_vma-degree-ambiguity-leading-to-double-reuse.patch @@ -0,0 +1,167 @@ +From 2555283eb40df89945557273121e9393ef9b542b Mon Sep 17 00:00:00 2001 +From: Jann Horn +Date: Wed, 31 Aug 2022 19:06:00 +0200 +Subject: mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse + +From: Jann Horn + +commit 2555283eb40df89945557273121e9393ef9b542b upstream. + +anon_vma->degree tracks the combined number of child anon_vmas and VMAs +that use the anon_vma as their ->anon_vma. + +anon_vma_clone() then assumes that for any anon_vma attached to +src->anon_vma_chain other than src->anon_vma, it is impossible for it to +be a leaf node of the VMA tree, meaning that for such VMAs ->degree is +elevated by 1 because of a child anon_vma, meaning that if ->degree +equals 1 there are no VMAs that use the anon_vma as their ->anon_vma. + +This assumption is wrong because the ->degree optimization leads to leaf +nodes being abandoned on anon_vma_clone() - an existing anon_vma is +reused and no new parent-child relationship is created. So it is +possible to reuse an anon_vma for one VMA while it is still tied to +another VMA. + +This is an issue because is_mergeable_anon_vma() and its callers assume +that if two VMAs have the same ->anon_vma, the list of anon_vmas +attached to the VMAs is guaranteed to be the same. When this assumption +is violated, vma_merge() can merge pages into a VMA that is not attached +to the corresponding anon_vma, leading to dangling page->mapping +pointers that will be dereferenced during rmap walks. + +Fix it by separately tracking the number of child anon_vmas and the +number of VMAs using the anon_vma as their ->anon_vma. + +Fixes: 7a3ef208e662 ("mm: prevent endless growth of anon_vma hierarchy") +Cc: stable@kernel.org +Acked-by: Michal Hocko +Acked-by: Vlastimil Babka +Signed-off-by: Jann Horn +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/rmap.h | 7 +++++-- + mm/rmap.c | 29 ++++++++++++++++------------- + 2 files changed, 21 insertions(+), 15 deletions(-) + +--- a/include/linux/rmap.h ++++ b/include/linux/rmap.h +@@ -39,12 +39,15 @@ struct anon_vma { + atomic_t refcount; + + /* +- * Count of child anon_vmas and VMAs which points to this anon_vma. ++ * Count of child anon_vmas. Equals to the count of all anon_vmas that ++ * have ->parent pointing to this one, including itself. + * + * This counter is used for making decision about reusing anon_vma + * instead of forking new one. See comments in function anon_vma_clone. + */ +- unsigned degree; ++ unsigned long num_children; ++ /* Count of VMAs whose ->anon_vma pointer points to this object. */ ++ unsigned long num_active_vmas; + + struct anon_vma *parent; /* Parent of this anon_vma */ + +--- a/mm/rmap.c ++++ b/mm/rmap.c +@@ -90,7 +90,8 @@ static inline struct anon_vma *anon_vma_ + anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL); + if (anon_vma) { + atomic_set(&anon_vma->refcount, 1); +- anon_vma->degree = 1; /* Reference for first vma */ ++ anon_vma->num_children = 0; ++ anon_vma->num_active_vmas = 0; + anon_vma->parent = anon_vma; + /* + * Initialise the anon_vma root to point to itself. If called +@@ -198,6 +199,7 @@ int __anon_vma_prepare(struct vm_area_st + anon_vma = anon_vma_alloc(); + if (unlikely(!anon_vma)) + goto out_enomem_free_avc; ++ anon_vma->num_children++; /* self-parent link for new root */ + allocated = anon_vma; + } + +@@ -207,8 +209,7 @@ int __anon_vma_prepare(struct vm_area_st + if (likely(!vma->anon_vma)) { + vma->anon_vma = anon_vma; + anon_vma_chain_link(vma, avc, anon_vma); +- /* vma reference or self-parent link for new root */ +- anon_vma->degree++; ++ anon_vma->num_active_vmas++; + allocated = NULL; + avc = NULL; + } +@@ -293,19 +294,19 @@ int anon_vma_clone(struct vm_area_struct + anon_vma_chain_link(dst, avc, anon_vma); + + /* +- * Reuse existing anon_vma if its degree lower than two, +- * that means it has no vma and only one anon_vma child. ++ * Reuse existing anon_vma if it has no vma and only one ++ * anon_vma child. + * +- * Do not chose parent anon_vma, otherwise first child +- * will always reuse it. Root anon_vma is never reused: ++ * Root anon_vma is never reused: + * it has self-parent reference and at least one child. + */ + if (!dst->anon_vma && src->anon_vma && +- anon_vma != src->anon_vma && anon_vma->degree < 2) ++ anon_vma->num_children < 2 && ++ anon_vma->num_active_vmas == 0) + dst->anon_vma = anon_vma; + } + if (dst->anon_vma) +- dst->anon_vma->degree++; ++ dst->anon_vma->num_active_vmas++; + unlock_anon_vma_root(root); + return 0; + +@@ -355,6 +356,7 @@ int anon_vma_fork(struct vm_area_struct + anon_vma = anon_vma_alloc(); + if (!anon_vma) + goto out_error; ++ anon_vma->num_active_vmas++; + avc = anon_vma_chain_alloc(GFP_KERNEL); + if (!avc) + goto out_error_free_anon_vma; +@@ -375,7 +377,7 @@ int anon_vma_fork(struct vm_area_struct + vma->anon_vma = anon_vma; + anon_vma_lock_write(anon_vma); + anon_vma_chain_link(vma, avc, anon_vma); +- anon_vma->parent->degree++; ++ anon_vma->parent->num_children++; + anon_vma_unlock_write(anon_vma); + + return 0; +@@ -407,7 +409,7 @@ void unlink_anon_vmas(struct vm_area_str + * to free them outside the lock. + */ + if (RB_EMPTY_ROOT(&anon_vma->rb_root.rb_root)) { +- anon_vma->parent->degree--; ++ anon_vma->parent->num_children--; + continue; + } + +@@ -415,7 +417,7 @@ void unlink_anon_vmas(struct vm_area_str + anon_vma_chain_free(avc); + } + if (vma->anon_vma) { +- vma->anon_vma->degree--; ++ vma->anon_vma->num_active_vmas--; + + /* + * vma would still be needed after unlink, and anon_vma will be prepared +@@ -433,7 +435,8 @@ void unlink_anon_vmas(struct vm_area_str + list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) { + struct anon_vma *anon_vma = avc->anon_vma; + +- VM_WARN_ON(anon_vma->degree); ++ VM_WARN_ON(anon_vma->num_children); ++ VM_WARN_ON(anon_vma->num_active_vmas); + put_anon_vma(anon_vma); + + list_del(&avc->same_vma); diff --git a/queue-5.15/series b/queue-5.15/series index 55b3334d02b..108e9f1d577 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -32,3 +32,9 @@ net-fix-refcount-bug-in-sk_psock_get-2.patch fbdev-fb_pm2fb-avoid-potential-divide-by-zero-error.patch ftrace-fix-null-pointer-dereference-in-is_ftrace_trampoline-when-ftrace-is-dead.patch bpf-don-t-redirect-packets-with-invalid-pkt_len.patch +mm-rmap-fix-anon_vma-degree-ambiguity-leading-to-double-reuse.patch +alsa-usb-audio-add-quirk-for-lh-labs-geek-out-hd-audio-1v5.patch +hid-add-lenovo-yoga-c630-battery-quirk.patch +hid-amd_sfh-add-a-dmi-quirk-entry-for-chromebooks.patch +hid-asus-rog-nkey-ignore-portion-of-0x5a-report.patch +hid-thrustmaster-add-sparco-wheel-and-fix-array-length.patch -- 2.47.3