The `wacom_feature_mapping` function is careful to only set the the
touch_max value a single time, but this care does not extend to the
`wacom_wac_finger_event` function. In particular, if a device sends
multiple HID_DG_CONTACTMAX items in a single feature report, the
driver will end up retaining the value of last item.
The HID descriptor for the Cintiq Companion 2 does exactly this. It
incorrectly sets a "Report Count" of 2, which will cause the driver
to process two HID_DG_CONTACTCOUNT items. The first item has the actual
count, while the second item should have been declared as a constant
zero. The constant zero is the value the driver ends up using, however,
since it is the last HID_DG_CONTACTCOUNT in the report.
Report ID (16),
Usage (Contact Count Maximum), ; Contact count maximum (55h, static value)
Report Count (2),
Logical Maximum (10),
Feature (Variable),
To address this, we add a check that the touch_max is not already set
within the `wacom_wac_finger_event` function that processes the
HID_DG_TOUCHMAX item. We emit a warning if the value is set and ignore
the updated value.
This could potentially cause problems if there is a tablet which has
a similar issue but requires the last item to be used. This is unlikely,
however, since it would have to have a different non-zero value for
HID_DG_CONTACTMAX earlier in the same report, which makes no sense
except in the case of a firmware bug. Note that cases where the
HID_DG_CONTACTMAX items are in different reports is already handled
(and similarly ignored) by `wacom_feature_mapping` as mentioned above.
Link: https://github.com/linuxwacom/input-wacom/issues/223
Fixes: 184eccd40389 ("HID: wacom: generic: read HID_DG_CONTACTMAX from any feature report")
Signed-off-by: Jason Gerecke <jason.gerecke(a)wacom.com>
CC: stable(a)vger.kernel.org
---
drivers/hid/wacom_wac.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 1bd0eb71559c..44d715c12f6a 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -2600,7 +2600,12 @@ static void wacom_wac_finger_event(struct hid_device *hdev,
wacom_wac->is_invalid_bt_frame = !value;
return;
case HID_DG_CONTACTMAX:
- features->touch_max = value;
+ if (!features->touch_max) {
+ features->touch_max = value;
+ } else {
+ hid_warn(hdev, "%s: ignoring attempt to overwrite non-zero touch_max "
+ "%d -> %d\n", __func__, features->touch_max, value);
+ }
return;
}
--
2.30.1
Commit 65b709586e222fa6ffd4166ac7fdb5d5dad113ee upstream.
Before this patch, if 'offset + len' was equal to
sizeof(struct virtio_net_config), the entire buffer wasn't filled,
returning incorrect values to the caller.
Since 'vdpasim->config' type is 'struct virtio_net_config', we can
safely copy its content under this condition.
Commit 65b709586e22 ("vdpa_sim: add get_config callback in
vdpasim_dev_attr") unintentionally solved it upstream while
refactoring vdpa_sim.c to support multiple devices. But we don't want
to backport it to stable branches as it contains many changes.
Fixes: 2c53d0f64c06 ("vdpasim: vDPA device simulator")
Cc: <stable(a)vger.kernel.org> # 5.10.x
Signed-off-by: Stefano Garzarella <sgarzare(a)redhat.com>
---
drivers/vdpa/vdpa_sim/vdpa_sim.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vdpa/vdpa_sim/vdpa_sim.c b/drivers/vdpa/vdpa_sim/vdpa_sim.c
index 6a90fdb9cbfc..8ca178d7b02f 100644
--- a/drivers/vdpa/vdpa_sim/vdpa_sim.c
+++ b/drivers/vdpa/vdpa_sim/vdpa_sim.c
@@ -572,7 +572,7 @@ static void vdpasim_get_config(struct vdpa_device *vdpa, unsigned int offset,
{
struct vdpasim *vdpasim = vdpa_to_sim(vdpa);
- if (offset + len < sizeof(struct virtio_net_config))
+ if (offset + len <= sizeof(struct virtio_net_config))
memcpy(buf, (u8 *)&vdpasim->config + offset, len);
}
--
2.29.2
The upstream commit fef912bf860e8e7e48a2bfb978a356bba743a8b7 ("block:
genhd: add 'groups' argument to device_add_disk") and the following
patches fix a race condition of udev for several devices, including
nvme, aoe, zram and virtio.
The stable tree commit 9e07f4e243791e00a4086ad86e573705cf7b2c65("zram:
close udev startup race condition as default groups") only fixes zram,
leaving other devices unfixed.
This udev race issue indeed makes trouble. We recently found that this
issue can cause missing '/dev/disk/by-id/XXXX' symlink of virtio-blk
devices on 4.19.
Be noted that this patch set follows the idea of stable commit
9e07f4e243791e00a4086ad86e573705cf7b2c65 ("zram: close udev startup race
condition as default groups") of merging the preparation patch (commit
fef912bf860e) and the fixing patch (commit 98af4d4df889).
Jeffle Xu (3):
virtio-blk: close udev startup race condition as default groups
aoe: close udev startup race condition as default groups
nvme: close udev startup race condition as default groups
drivers/block/aoe/aoe.h | 1 -
drivers/block/aoe/aoeblk.c | 20 +++----
drivers/block/aoe/aoedev.c | 1 -
drivers/block/virtio_blk.c | 67 +++++++++++++---------
drivers/nvme/host/core.c | 20 +++----
drivers/nvme/host/lightnvm.c | 105 ++++++++++++++--------------------
drivers/nvme/host/multipath.c | 10 +---
drivers/nvme/host/nvme.h | 10 +---
8 files changed, 103 insertions(+), 131 deletions(-)
--
2.27.0
This is the start of the stable review cycle for the 5.10.16 release.
There are 54 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 13 Feb 2021 15:01:39 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.16-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.16-rc1
Phillip Lougher <phillip(a)squashfs.org.uk>
squashfs: add more sanity checks in xattr id lookup
Phillip Lougher <phillip(a)squashfs.org.uk>
squashfs: add more sanity checks in inode lookup
Phillip Lougher <phillip(a)squashfs.org.uk>
squashfs: add more sanity checks in id lookup
Phillip Lougher <phillip(a)squashfs.org.uk>
squashfs: avoid out of bounds writes in decompressors
Johannes Weiner <hannes(a)cmpxchg.org>
Revert "mm: memcontrol: avoid workload stalls when lowering memory.high"
Joachim Henke <joachim.henke(a)t-systems.com>
nilfs2: make splice write available again
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/i915: Skip vswing programming for TBT
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/i915: Fix ICL MG PHY vswing handling
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Fix verifier jsgt branch analysis on max bound
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Fix 32 bit src register truncation on div/mod
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Fix verifier jmp32 pruning decision logic
Mark Brown <broonie(a)kernel.org>
regulator: Fix lockdep warning resolving supplies
Baolin Wang <baolin.wang(a)linux.alibaba.com>
blk-cgroup: Use cond_resched() when destroy blkgs
Qii Wang <qii.wang(a)mediatek.com>
i2c: mediatek: Move suspend and resume handling to NOIRQ phase
Dave Wysochanski <dwysocha(a)redhat.com>
SUNRPC: Handle 0 length opaque XDR object data properly
Dave Wysochanski <dwysocha(a)redhat.com>
SUNRPC: Move simple_get_bytes and simple_get_netobj into private header
Johannes Berg <johannes.berg(a)intel.com>
iwlwifi: queue: bail out on invalid freeing
Johannes Berg <johannes.berg(a)intel.com>
iwlwifi: mvm: guard against device removal in reprobe
Luca Coelho <luciano.coelho(a)intel.com>
iwlwifi: pcie: add rules to match Qu with Hr2
Gregory Greenman <gregory.greenman(a)intel.com>
iwlwifi: mvm: invalidate IDs of internal stations at mvm start
Johannes Berg <johannes.berg(a)intel.com>
iwlwifi: pcie: fix context info memory leak
Emmanuel Grumbach <emmanuel.grumbach(a)intel.com>
iwlwifi: pcie: add a NULL check in iwl_pcie_txq_unmap
Johannes Berg <johannes.berg(a)intel.com>
iwlwifi: mvm: take mutex for calling iwl_mvm_get_sync_time()
Sara Sharon <sara.sharon(a)intel.com>
iwlwifi: mvm: skip power command when unbinding vif during CSA
Libin Yang <libin.yang(a)intel.com>
ASoC: Intel: sof_sdw: set proper flags for Dell TGL-H SKU 0A5E
Eliot Blennerhassett <eliot(a)blennerhassett.gen.nz>
ASoC: ak4458: correct reset polarity
Bard Liao <bard.liao(a)intel.com>
ALSA: hda: intel-dsp-config: add PCI id for TGL-H
Trond Myklebust <trond.myklebust(a)hammerspace.com>
pNFS/NFSv4: Improve rejection of out-of-order layouts
Trond Myklebust <trond.myklebust(a)hammerspace.com>
pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()
Pan Bian <bianpan2016(a)163.com>
chtls: Fix potential resource leak
Ricardo Ribalda <ribalda(a)chromium.org>
ASoC: Intel: Skylake: Zero snd_ctl_elem_value
Shay Bar <shay.bar(a)celeno.com>
mac80211: 160MHz with extended NSS BW in CSA
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/nvif: fix method count when pushing an array
James Schulman <james.schulman(a)cirrus.com>
ASoC: wm_adsp: Fix control name parsing for multi-fw
David Collins <collinsd(a)codeaurora.org>
regulator: core: avoid regulator_resolve_supply() race condition
Cong Wang <cong.wang(a)bytedance.com>
af_key: relax availability checks for skb size calculation
Raoni Fassina Firmino <raoni(a)linux.ibm.com>
powerpc/64/signal: Fix regression in __kernel_sigtramp_rt64() semantics
Kent Gibson <warthog618(a)gmail.com>
gpiolib: cdev: clear debounce period if line set to output
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: drop mm/files between task_work_submit
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: reinforce cancel on flush during exit
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: fix sqo ownership false positive warning
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: fix list corruption for splice file_get
Hao Xu <haoxu(a)linux.alibaba.com>
io_uring: fix flush cqring overflow list while TASK_INTERRUPTIBLE
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: fix cancellation taking mutex while TASK_UNINTERRUPTIBLE
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: replace inflight_wait with tctx->wait
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: fix __io_uring_files_cancel() with TASK_UNINTERRUPTIBLE
Jens Axboe <axboe(a)kernel.dk>
io_uring: if we see flush on exit, cancel related tasks
Jens Axboe <axboe(a)kernel.dk>
io_uring: account io_uring internal files as REQ_F_INFLIGHT
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: fix files cancellation
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: always batch cancel in *cancel_files()
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: pass files into kill timeouts/poll
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: don't iterate io_uring_cancel_files()
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: add a {task,files} pair matching helper
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: simplify io_task_match()
-------------
Diffstat:
Makefile | 4 +-
arch/powerpc/kernel/vdso.c | 2 +-
arch/powerpc/kernel/vdso64/sigtramp.S | 11 +-
arch/powerpc/kernel/vdso64/vdso64.lds.S | 1 +
block/blk-cgroup.c | 18 +-
drivers/gpio/gpiolib-cdev.c | 2 +
drivers/gpu/drm/i915/display/intel_ddi.c | 13 +-
drivers/gpu/drm/nouveau/include/nvif/push.h | 216 ++++++-------
drivers/i2c/busses/i2c-mt65xx.c | 19 +-
.../chelsio/inline_crypto/chtls/chtls_cm.c | 7 +-
drivers/net/wireless/intel/iwlwifi/cfg/22000.c | 25 ++
drivers/net/wireless/intel/iwlwifi/iwl-config.h | 3 +
.../net/wireless/intel/iwlwifi/mvm/debugfs-vif.c | 3 +
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 3 +
drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 7 +-
drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 6 +
.../wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c | 11 +-
drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 10 +
drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 5 +
drivers/net/wireless/intel/iwlwifi/queue/tx.c | 6 +-
drivers/regulator/core.c | 44 ++-
fs/io-wq.c | 10 -
fs/io-wq.h | 1 -
fs/io_uring.c | 360 ++++++++-------------
fs/nfs/pnfs.c | 30 +-
fs/nilfs2/file.c | 1 +
fs/squashfs/block.c | 8 +-
fs/squashfs/export.c | 41 ++-
fs/squashfs/id.c | 40 ++-
fs/squashfs/squashfs_fs_sb.h | 1 +
fs/squashfs/super.c | 6 +-
fs/squashfs/xattr.h | 10 +-
fs/squashfs/xattr_id.c | 66 +++-
include/linux/sunrpc/xdr.h | 3 +-
kernel/bpf/verifier.c | 38 +--
mm/memcontrol.c | 5 +-
net/key/af_key.c | 6 +-
net/mac80211/spectmgmt.c | 10 +-
net/sunrpc/auth_gss/auth_gss.c | 30 +-
net/sunrpc/auth_gss/auth_gss_internal.h | 45 +++
net/sunrpc/auth_gss/gss_krb5_mech.c | 31 +-
sound/hda/intel-dsp-config.c | 4 +
sound/soc/codecs/ak4458.c | 22 +-
sound/soc/codecs/wm_adsp.c | 3 +
sound/soc/intel/boards/sof_sdw.c | 10 +
sound/soc/intel/skylake/skl-topology.c | 2 +-
46 files changed, 683 insertions(+), 516 deletions(-)