The `wacom_feature_mapping` function is careful to only set the the
touch_max value a single time, but this care does not extend to the
`wacom_wac_finger_event` function. In particular, if a device sends
multiple HID_DG_CONTACTMAX items in a single feature report, the
driver will end up retaining the value of last item.
The HID descriptor for the Cintiq Companion 2 does exactly this. It
incorrectly sets a "Report Count" of 2, which will cause the driver
to process two HID_DG_CONTACTCOUNT items.…
[View More] The first item has the actual
count, while the second item should have been declared as a constant
zero. The constant zero is the value the driver ends up using, however,
since it is the last HID_DG_CONTACTCOUNT in the report.
Report ID (16),
Usage (Contact Count Maximum), ; Contact count maximum (55h, static value)
Report Count (2),
Logical Maximum (10),
Feature (Variable),
To address this, we add a check that the touch_max is not already set
within the `wacom_wac_finger_event` function that processes the
HID_DG_TOUCHMAX item. We emit a warning if the value is set and ignore
the updated value.
This could potentially cause problems if there is a tablet which has
a similar issue but requires the last item to be used. This is unlikely,
however, since it would have to have a different non-zero value for
HID_DG_CONTACTMAX earlier in the same report, which makes no sense
except in the case of a firmware bug. Note that cases where the
HID_DG_CONTACTMAX items are in different reports is already handled
(and similarly ignored) by `wacom_feature_mapping` as mentioned above.
Link: https://github.com/linuxwacom/input-wacom/issues/223
Fixes: 184eccd40389 ("HID: wacom: generic: read HID_DG_CONTACTMAX from any feature report")
Signed-off-by: Jason Gerecke <jason.gerecke(a)wacom.com>
CC: stable(a)vger.kernel.org
---
drivers/hid/wacom_wac.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 1bd0eb71559c..44d715c12f6a 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -2600,7 +2600,12 @@ static void wacom_wac_finger_event(struct hid_device *hdev,
wacom_wac->is_invalid_bt_frame = !value;
return;
case HID_DG_CONTACTMAX:
- features->touch_max = value;
+ if (!features->touch_max) {
+ features->touch_max = value;
+ } else {
+ hid_warn(hdev, "%s: ignoring attempt to overwrite non-zero touch_max "
+ "%d -> %d\n", __func__, features->touch_max, value);
+ }
return;
}
--
2.30.1
[View Less]
Commit 65b709586e222fa6ffd4166ac7fdb5d5dad113ee upstream.
Before this patch, if 'offset + len' was equal to
sizeof(struct virtio_net_config), the entire buffer wasn't filled,
returning incorrect values to the caller.
Since 'vdpasim->config' type is 'struct virtio_net_config', we can
safely copy its content under this condition.
Commit 65b709586e22 ("vdpa_sim: add get_config callback in
vdpasim_dev_attr") unintentionally solved it upstream while
refactoring vdpa_sim.c to support multiple …
[View More]devices. But we don't want
to backport it to stable branches as it contains many changes.
Fixes: 2c53d0f64c06 ("vdpasim: vDPA device simulator")
Cc: <stable(a)vger.kernel.org> # 5.10.x
Signed-off-by: Stefano Garzarella <sgarzare(a)redhat.com>
---
drivers/vdpa/vdpa_sim/vdpa_sim.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vdpa/vdpa_sim/vdpa_sim.c b/drivers/vdpa/vdpa_sim/vdpa_sim.c
index 6a90fdb9cbfc..8ca178d7b02f 100644
--- a/drivers/vdpa/vdpa_sim/vdpa_sim.c
+++ b/drivers/vdpa/vdpa_sim/vdpa_sim.c
@@ -572,7 +572,7 @@ static void vdpasim_get_config(struct vdpa_device *vdpa, unsigned int offset,
{
struct vdpasim *vdpasim = vdpa_to_sim(vdpa);
- if (offset + len < sizeof(struct virtio_net_config))
+ if (offset + len <= sizeof(struct virtio_net_config))
memcpy(buf, (u8 *)&vdpasim->config + offset, len);
}
--
2.29.2
[View Less]
The upstream commit fef912bf860e8e7e48a2bfb978a356bba743a8b7 ("block:
genhd: add 'groups' argument to device_add_disk") and the following
patches fix a race condition of udev for several devices, including
nvme, aoe, zram and virtio.
The stable tree commit 9e07f4e243791e00a4086ad86e573705cf7b2c65("zram:
close udev startup race condition as default groups") only fixes zram,
leaving other devices unfixed.
This udev race issue indeed makes trouble. We recently found that this
issue can cause …
[View More]missing '/dev/disk/by-id/XXXX' symlink of virtio-blk
devices on 4.19.
Be noted that this patch set follows the idea of stable commit
9e07f4e243791e00a4086ad86e573705cf7b2c65 ("zram: close udev startup race
condition as default groups") of merging the preparation patch (commit
fef912bf860e) and the fixing patch (commit 98af4d4df889).
Jeffle Xu (3):
virtio-blk: close udev startup race condition as default groups
aoe: close udev startup race condition as default groups
nvme: close udev startup race condition as default groups
drivers/block/aoe/aoe.h | 1 -
drivers/block/aoe/aoeblk.c | 20 +++----
drivers/block/aoe/aoedev.c | 1 -
drivers/block/virtio_blk.c | 67 +++++++++++++---------
drivers/nvme/host/core.c | 20 +++----
drivers/nvme/host/lightnvm.c | 105 ++++++++++++++--------------------
drivers/nvme/host/multipath.c | 10 +---
drivers/nvme/host/nvme.h | 10 +---
8 files changed, 103 insertions(+), 131 deletions(-)
--
2.27.0
[View Less]
This is the start of the stable review cycle for the 5.10.16 release.
There are 54 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 13 Feb 2021 15:01:39 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.16-rc…
or in the git tree and …
[View More]branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.16-rc1
Phillip Lougher <phillip(a)squashfs.org.uk>
squashfs: add more sanity checks in xattr id lookup
Phillip Lougher <phillip(a)squashfs.org.uk>
squashfs: add more sanity checks in inode lookup
Phillip Lougher <phillip(a)squashfs.org.uk>
squashfs: add more sanity checks in id lookup
Phillip Lougher <phillip(a)squashfs.org.uk>
squashfs: avoid out of bounds writes in decompressors
Johannes Weiner <hannes(a)cmpxchg.org>
Revert "mm: memcontrol: avoid workload stalls when lowering memory.high"
Joachim Henke <joachim.henke(a)t-systems.com>
nilfs2: make splice write available again
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/i915: Skip vswing programming for TBT
Ville Syrjälä <ville.syrjala(a)linux.intel.com>
drm/i915: Fix ICL MG PHY vswing handling
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Fix verifier jsgt branch analysis on max bound
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Fix 32 bit src register truncation on div/mod
Daniel Borkmann <daniel(a)iogearbox.net>
bpf: Fix verifier jmp32 pruning decision logic
Mark Brown <broonie(a)kernel.org>
regulator: Fix lockdep warning resolving supplies
Baolin Wang <baolin.wang(a)linux.alibaba.com>
blk-cgroup: Use cond_resched() when destroy blkgs
Qii Wang <qii.wang(a)mediatek.com>
i2c: mediatek: Move suspend and resume handling to NOIRQ phase
Dave Wysochanski <dwysocha(a)redhat.com>
SUNRPC: Handle 0 length opaque XDR object data properly
Dave Wysochanski <dwysocha(a)redhat.com>
SUNRPC: Move simple_get_bytes and simple_get_netobj into private header
Johannes Berg <johannes.berg(a)intel.com>
iwlwifi: queue: bail out on invalid freeing
Johannes Berg <johannes.berg(a)intel.com>
iwlwifi: mvm: guard against device removal in reprobe
Luca Coelho <luciano.coelho(a)intel.com>
iwlwifi: pcie: add rules to match Qu with Hr2
Gregory Greenman <gregory.greenman(a)intel.com>
iwlwifi: mvm: invalidate IDs of internal stations at mvm start
Johannes Berg <johannes.berg(a)intel.com>
iwlwifi: pcie: fix context info memory leak
Emmanuel Grumbach <emmanuel.grumbach(a)intel.com>
iwlwifi: pcie: add a NULL check in iwl_pcie_txq_unmap
Johannes Berg <johannes.berg(a)intel.com>
iwlwifi: mvm: take mutex for calling iwl_mvm_get_sync_time()
Sara Sharon <sara.sharon(a)intel.com>
iwlwifi: mvm: skip power command when unbinding vif during CSA
Libin Yang <libin.yang(a)intel.com>
ASoC: Intel: sof_sdw: set proper flags for Dell TGL-H SKU 0A5E
Eliot Blennerhassett <eliot(a)blennerhassett.gen.nz>
ASoC: ak4458: correct reset polarity
Bard Liao <bard.liao(a)intel.com>
ALSA: hda: intel-dsp-config: add PCI id for TGL-H
Trond Myklebust <trond.myklebust(a)hammerspace.com>
pNFS/NFSv4: Improve rejection of out-of-order layouts
Trond Myklebust <trond.myklebust(a)hammerspace.com>
pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()
Pan Bian <bianpan2016(a)163.com>
chtls: Fix potential resource leak
Ricardo Ribalda <ribalda(a)chromium.org>
ASoC: Intel: Skylake: Zero snd_ctl_elem_value
Shay Bar <shay.bar(a)celeno.com>
mac80211: 160MHz with extended NSS BW in CSA
Ben Skeggs <bskeggs(a)redhat.com>
drm/nouveau/nvif: fix method count when pushing an array
James Schulman <james.schulman(a)cirrus.com>
ASoC: wm_adsp: Fix control name parsing for multi-fw
David Collins <collinsd(a)codeaurora.org>
regulator: core: avoid regulator_resolve_supply() race condition
Cong Wang <cong.wang(a)bytedance.com>
af_key: relax availability checks for skb size calculation
Raoni Fassina Firmino <raoni(a)linux.ibm.com>
powerpc/64/signal: Fix regression in __kernel_sigtramp_rt64() semantics
Kent Gibson <warthog618(a)gmail.com>
gpiolib: cdev: clear debounce period if line set to output
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: drop mm/files between task_work_submit
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: reinforce cancel on flush during exit
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: fix sqo ownership false positive warning
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: fix list corruption for splice file_get
Hao Xu <haoxu(a)linux.alibaba.com>
io_uring: fix flush cqring overflow list while TASK_INTERRUPTIBLE
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: fix cancellation taking mutex while TASK_UNINTERRUPTIBLE
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: replace inflight_wait with tctx->wait
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: fix __io_uring_files_cancel() with TASK_UNINTERRUPTIBLE
Jens Axboe <axboe(a)kernel.dk>
io_uring: if we see flush on exit, cancel related tasks
Jens Axboe <axboe(a)kernel.dk>
io_uring: account io_uring internal files as REQ_F_INFLIGHT
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: fix files cancellation
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: always batch cancel in *cancel_files()
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: pass files into kill timeouts/poll
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: don't iterate io_uring_cancel_files()
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: add a {task,files} pair matching helper
Pavel Begunkov <asml.silence(a)gmail.com>
io_uring: simplify io_task_match()
-------------
Diffstat:
Makefile | 4 +-
arch/powerpc/kernel/vdso.c | 2 +-
arch/powerpc/kernel/vdso64/sigtramp.S | 11 +-
arch/powerpc/kernel/vdso64/vdso64.lds.S | 1 +
block/blk-cgroup.c | 18 +-
drivers/gpio/gpiolib-cdev.c | 2 +
drivers/gpu/drm/i915/display/intel_ddi.c | 13 +-
drivers/gpu/drm/nouveau/include/nvif/push.h | 216 ++++++-------
drivers/i2c/busses/i2c-mt65xx.c | 19 +-
.../chelsio/inline_crypto/chtls/chtls_cm.c | 7 +-
drivers/net/wireless/intel/iwlwifi/cfg/22000.c | 25 ++
drivers/net/wireless/intel/iwlwifi/iwl-config.h | 3 +
.../net/wireless/intel/iwlwifi/mvm/debugfs-vif.c | 3 +
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 3 +
drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 7 +-
drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 6 +
.../wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c | 11 +-
drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 10 +
drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 5 +
drivers/net/wireless/intel/iwlwifi/queue/tx.c | 6 +-
drivers/regulator/core.c | 44 ++-
fs/io-wq.c | 10 -
fs/io-wq.h | 1 -
fs/io_uring.c | 360 ++++++++-------------
fs/nfs/pnfs.c | 30 +-
fs/nilfs2/file.c | 1 +
fs/squashfs/block.c | 8 +-
fs/squashfs/export.c | 41 ++-
fs/squashfs/id.c | 40 ++-
fs/squashfs/squashfs_fs_sb.h | 1 +
fs/squashfs/super.c | 6 +-
fs/squashfs/xattr.h | 10 +-
fs/squashfs/xattr_id.c | 66 +++-
include/linux/sunrpc/xdr.h | 3 +-
kernel/bpf/verifier.c | 38 +--
mm/memcontrol.c | 5 +-
net/key/af_key.c | 6 +-
net/mac80211/spectmgmt.c | 10 +-
net/sunrpc/auth_gss/auth_gss.c | 30 +-
net/sunrpc/auth_gss/auth_gss_internal.h | 45 +++
net/sunrpc/auth_gss/gss_krb5_mech.c | 31 +-
sound/hda/intel-dsp-config.c | 4 +
sound/soc/codecs/ak4458.c | 22 +-
sound/soc/codecs/wm_adsp.c | 3 +
sound/soc/intel/boards/sof_sdw.c | 10 +
sound/soc/intel/skylake/skl-topology.c | 2 +-
46 files changed, 683 insertions(+), 516 deletions(-)
[View Less]