4.9-stable patches

added patches:
	input-i8042-add-bytespeed-touchpad-to-noloop-table.patch
	input-xpad-support-ardwiino-controllers.patch
	rdma-i40iw-address-an-mmap-handler-exploit-in-i40iw.patch
	spi-fix-controller-unregister-order-harder.patch

diff --git a/queue-4.9/input-i8042-add-bytespeed-touchpad-to-noloop-table.patch b/queue-4.9/input-i8042-add-bytespeed-touchpad-to-noloop-table.patch
new file mode 100644 (file)
index 0000000..186eec4
--- /dev/null
+++ b/queue-4.9/input-i8042-add-bytespeed-touchpad-to-noloop-table.patch
@@ -0,0 +1,38 @@
+From a48491c65b513e5cdc3e7a886a4db915f848a5f5 Mon Sep 17 00:00:00 2001
+From: Po-Hsu Lin <po-hsu.lin@canonical.com>
+Date: Mon, 30 Nov 2020 22:39:40 -0800
+Subject: Input: i8042 - add ByteSpeed touchpad to noloop table
+
+From: Po-Hsu Lin <po-hsu.lin@canonical.com>
+
+commit a48491c65b513e5cdc3e7a886a4db915f848a5f5 upstream.
+
+It looks like the C15B laptop got another vendor: ByteSpeed LLC.
+
+Avoid AUX loopback on this touchpad as well, thus input subsystem will
+be able to recognize a Synaptics touchpad in the AUX port.
+
+BugLink: https://bugs.launchpad.net/bugs/1906128
+Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
+Link: https://lore.kernel.org/r/20201201054723.5939-1-po-hsu.lin@canonical.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/serio/i8042-x86ia64io.h |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -223,6 +223,10 @@ static const struct dmi_system_id __init
+                       DMI_MATCH(DMI_SYS_VENDOR, "PEGATRON CORPORATION"),
+                       DMI_MATCH(DMI_PRODUCT_NAME, "C15B"),
+               },
++              .matches = {
++                      DMI_MATCH(DMI_SYS_VENDOR, "ByteSpeed LLC"),
++                      DMI_MATCH(DMI_PRODUCT_NAME, "ByteSpeed Laptop C15B"),
++              },
+       },
+       { }
+ };

diff --git a/queue-4.9/input-xpad-support-ardwiino-controllers.patch b/queue-4.9/input-xpad-support-ardwiino-controllers.patch
new file mode 100644 (file)
index 0000000..bb9550a
--- /dev/null
+++ b/queue-4.9/input-xpad-support-ardwiino-controllers.patch
@@ -0,0 +1,39 @@
+From 2aab1561439032be2e98811dd0ddbeb5b2ae4c61 Mon Sep 17 00:00:00 2001
+From: Sanjay Govind <sanjay.govind9@gmail.com>
+Date: Mon, 30 Nov 2020 23:41:48 -0800
+Subject: Input: xpad - support Ardwiino Controllers
+
+From: Sanjay Govind <sanjay.govind9@gmail.com>
+
+commit 2aab1561439032be2e98811dd0ddbeb5b2ae4c61 upstream.
+
+This commit adds support for Ardwiino Controllers
+
+Signed-off-by: Sanjay Govind <sanjay.govind9@gmail.com>
+Link: https://lore.kernel.org/r/20201201071922.131666-1-sanjay.govind9@gmail.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/joystick/xpad.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -258,6 +258,7 @@ static const struct xpad_device {
+       { 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
+       { 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
+       { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 },
++      { 0x1209, 0x2882, "Ardwiino Controller", 0, XTYPE_XBOX360 },
+       { 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
+       { 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 },
+       { 0x12ab, 0x0303, "Mortal Kombat Klassic FightStick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+@@ -435,6 +436,7 @@ static const struct usb_device_id xpad_t
+       XPAD_XBOXONE_VENDOR(0x0f0d),            /* Hori Controllers */
+       XPAD_XBOX360_VENDOR(0x1038),            /* SteelSeries Controllers */
+       XPAD_XBOX360_VENDOR(0x11c9),            /* Nacon GC100XF */
++      XPAD_XBOX360_VENDOR(0x1209),            /* Ardwiino Controllers */
+       XPAD_XBOX360_VENDOR(0x12ab),            /* X-Box 360 dance pads */
+       XPAD_XBOX360_VENDOR(0x1430),            /* RedOctane X-Box 360 controllers */
+       XPAD_XBOX360_VENDOR(0x146b),            /* BigBen Interactive Controllers */

diff --git a/queue-4.9/rdma-i40iw-address-an-mmap-handler-exploit-in-i40iw.patch b/queue-4.9/rdma-i40iw-address-an-mmap-handler-exploit-in-i40iw.patch
new file mode 100644 (file)
index 0000000..b32bc9d
--- /dev/null
+++ b/queue-4.9/rdma-i40iw-address-an-mmap-handler-exploit-in-i40iw.patch
@@ -0,0 +1,106 @@
+From 2ed381439e89fa6d1a0839ef45ccd45d99d8e915 Mon Sep 17 00:00:00 2001
+From: Shiraz Saleem <shiraz.saleem@intel.com>
+Date: Tue, 24 Nov 2020 18:56:16 -0600
+Subject: RDMA/i40iw: Address an mmap handler exploit in i40iw
+
+From: Shiraz Saleem <shiraz.saleem@intel.com>
+
+commit 2ed381439e89fa6d1a0839ef45ccd45d99d8e915 upstream.
+
+i40iw_mmap manipulates the vma->vm_pgoff to differentiate a push page mmap
+vs a doorbell mmap, and uses it to compute the pfn in remap_pfn_range
+without any validation. This is vulnerable to an mmap exploit as described
+in: https://lore.kernel.org/r/20201119093523.7588-1-zhudi21@huawei.com
+
+The push feature is disabled in the driver currently and therefore no push
+mmaps are issued from user-space. The feature does not work as expected in
+the x722 product.
+
+Remove the push module parameter and all VMA attribute manipulations for
+this feature in i40iw_mmap. Update i40iw_mmap to only allow DB user
+mmapings at offset = 0. Check vm_pgoff for zero and if the mmaps are bound
+to a single page.
+
+Cc: <stable@kernel.org>
+Fixes: d37498417947 ("i40iw: add files for iwarp interface")
+Link: https://lore.kernel.org/r/20201125005616.1800-2-shiraz.saleem@intel.com
+Reported-by: Di Zhu <zhudi21@huawei.com>
+Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/infiniband/hw/i40iw/i40iw_main.c  |    5 ----
+ drivers/infiniband/hw/i40iw/i40iw_verbs.c |   36 +++++-------------------------
+ 2 files changed, 7 insertions(+), 34 deletions(-)
+
+--- a/drivers/infiniband/hw/i40iw/i40iw_main.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
+@@ -54,10 +54,6 @@
+ #define DRV_VERSION   __stringify(DRV_VERSION_MAJOR) "."              \
+       __stringify(DRV_VERSION_MINOR) "." __stringify(DRV_VERSION_BUILD)
+ 
+-static int push_mode;
+-module_param(push_mode, int, 0644);
+-MODULE_PARM_DESC(push_mode, "Low latency mode: 0=disabled (default), 1=enabled)");
+-
+ static int debug;
+ module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "debug flags: 0=disabled (default), 0x7fffffff=all");
+@@ -1524,7 +1520,6 @@ static enum i40iw_status_code i40iw_setu
+       if (status)
+               goto exit;
+       iwdev->obj_next = iwdev->obj_mem;
+-      iwdev->push_mode = push_mode;
+ 
+       init_waitqueue_head(&iwdev->vchnl_waitq);
+       init_waitqueue_head(&dev->vf_reqs);
+--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+@@ -208,38 +208,16 @@ static int i40iw_dealloc_ucontext(struct
+  */
+ static int i40iw_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
+ {
+-      struct i40iw_ucontext *ucontext;
+-      u64 db_addr_offset;
+-      u64 push_offset;
++      struct i40iw_ucontext *ucontext = to_ucontext(context);
++      u64 dbaddr;
+ 
+-      ucontext = to_ucontext(context);
+-      if (ucontext->iwdev->sc_dev.is_pf) {
+-              db_addr_offset = I40IW_DB_ADDR_OFFSET;
+-              push_offset = I40IW_PUSH_OFFSET;
+-              if (vma->vm_pgoff)
+-                      vma->vm_pgoff += I40IW_PF_FIRST_PUSH_PAGE_INDEX - 1;
+-      } else {
+-              db_addr_offset = I40IW_VF_DB_ADDR_OFFSET;
+-              push_offset = I40IW_VF_PUSH_OFFSET;
+-              if (vma->vm_pgoff)
+-                      vma->vm_pgoff += I40IW_VF_FIRST_PUSH_PAGE_INDEX - 1;
+-      }
++      if (vma->vm_pgoff || vma->vm_end - vma->vm_start != PAGE_SIZE)
++              return -EINVAL;
+ 
+-      vma->vm_pgoff += db_addr_offset >> PAGE_SHIFT;
++      dbaddr = I40IW_DB_ADDR_OFFSET + pci_resource_start(ucontext->iwdev->ldev->pcidev, 0);
+ 
+-      if (vma->vm_pgoff == (db_addr_offset >> PAGE_SHIFT)) {
+-              vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+-              vma->vm_private_data = ucontext;
+-      } else {
+-              if ((vma->vm_pgoff - (push_offset >> PAGE_SHIFT)) % 2)
+-                      vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+-              else
+-                      vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+-      }
+-
+-      if (io_remap_pfn_range(vma, vma->vm_start,
+-                             vma->vm_pgoff + (pci_resource_start(ucontext->iwdev->ldev->pcidev, 0) >> PAGE_SHIFT),
+-                             PAGE_SIZE, vma->vm_page_prot))
++      if (io_remap_pfn_range(vma, vma->vm_start, dbaddr >> PAGE_SHIFT, PAGE_SIZE,
++                             pgprot_noncached(vma->vm_page_prot)))
+               return -EAGAIN;
+ 
+       return 0;

diff --git a/queue-4.9/series b/queue-4.9/series
index a03e6140b12812eec24a01c6d67e4d89a28095fb..b574227e6437b4f300c5d47fa833e21ea1a7b9ec 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -10,3 +10,7 @@ cxgb3-fix-error-return-code-in-t3_sge_alloc_qset.patch
 net-pasemi-fix-error-return-code-in-pasemi_mac_open.patch
 net-mlx5-fix-wrong-address-reclaim-when-command-interface-is-down.patch
 dt-bindings-net-correct-interrupt-flags-in-examples.patch
+input-xpad-support-ardwiino-controllers.patch
+input-i8042-add-bytespeed-touchpad-to-noloop-table.patch
+spi-fix-controller-unregister-order-harder.patch
+rdma-i40iw-address-an-mmap-handler-exploit-in-i40iw.patch

diff --git a/queue-4.9/spi-fix-controller-unregister-order-harder.patch b/queue-4.9/spi-fix-controller-unregister-order-harder.patch
new file mode 100644 (file)
index 0000000..f5d8fd4
--- /dev/null
+++ b/queue-4.9/spi-fix-controller-unregister-order-harder.patch
@@ -0,0 +1,39 @@
+From lukas@wunner.de  Sun Dec  6 10:46:40 2020
+From: Lukas Wunner <lukas@wunner.de>
+Date: Sat, 5 Dec 2020 18:42:07 +0100
+To: yangerkun <yangerkun@huawei.com>, sashal@kernel.org, gregkh@linuxfoundation.org
+Cc: linux-kernel@vger.kernel.org, chenwenyong2@huawei.com, stable@vger.kernel.org, "zhangyi (F)" <yi.zhang@huawei.com>
+Message-ID: <20201205174207.GA4028@wunner.de>
+Subject: spi: Fix controller unregister order harder
+
+From: Lukas Wunner <lukas@wunner.de>
+
+Commit c7e41e1caa71 sought to backport upstream commit 84855678add8 to
+the 4.9-stable tree but erroneously inserted a line at the wrong place.
+Fix it.
+
+Fixes: c7e41e1caa71 ("spi: Fix controller unregister order")
+Reported-by: yangerkun <yangerkun@huawei.com>
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+---
+ drivers/spi/spi.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2025,13 +2025,13 @@ static int __unregister(struct device *d
+  */
+ void spi_unregister_master(struct spi_master *master)
+ {
++      device_for_each_child(&master->dev, NULL, __unregister);
++
+       if (master->queued) {
+               if (spi_destroy_queue(master))
+                       dev_err(&master->dev, "queue remove failed\n");
+       }
+ 
+-      device_for_each_child(&master->dev, NULL, __unregister);
+-
+       mutex_lock(&board_lock);
+       list_del(&master->list);
+       mutex_unlock(&board_lock);