Merge remote-tracking branch 'origin/f31' into f31-user-thl-vanilla-fedora

3 files changed, 311 insertions, 214 deletions

diff --git a/CVE-2020-16119-DCCP-CCID-structure-use-after-free.patch b/CVE-2020-16119-DCCP-CCID-structure-use-after-free.patch
new file mode 100644
index 000000000..7eb981e45
--- /dev/null
+++ b/CVE-2020-16119-DCCP-CCID-structure-use-after-free.patch
@@ -0,0 +1,305 @@
+From MAILER-DAEMON Wed Oct 14 16:34:37 2020
+From: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
+To: netdev@vger.kernel.org
+Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>, "David S. Miller" <davem@davemloft.net>, Jakub Kicinski <kuba@kernel.org>, Thadeu Lima de Souza Cascardo <cascardo@canonical.com>, "Gustavo A. R. Silva" <gustavoars@kernel.org>, "Alexander A. Klimov" <grandmaster@al2klimov.de>, Kees Cook <keescook@chromium.org>, Eric Dumazet <edumazet@google.com>, Alexey Kodanev <alexey.kodanev@oracle.com>, dccp@vger.kernel.org, linux-kernel@vger.kernel.org
+Subject: [PATCH 1/2] dccp: ccid: move timers to struct dccp_sock
+Date: Tue, 13 Oct 2020 19:18:48 +0200
+Message-Id: <20201013171849.236025-2-kleber.souza@canonical.com>
+In-Reply-To: <20201013171849.236025-1-kleber.souza@canonical.com>
+References: <20201013171849.236025-1-kleber.souza@canonical.com>
+List-ID: <linux-kernel.vger.kernel.org>
+X-Mailing-List: linux-kernel@vger.kernel.org
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 7bit
+
+From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
+
+When dccps_hc_tx_ccid is freed, ccid timers may still trigger. The reason
+del_timer_sync can't be used is because this relies on keeping a reference
+to struct sock. But as we keep a pointer to dccps_hc_tx_ccid and free that
+during disconnect, the timer should really belong to struct dccp_sock.
+
+This addresses CVE-2020-16119.
+
+Fixes: 839a6094140a (net: dccp: Convert timers to use timer_setup())
+Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
+Acked-bd: Richard Sailer <richard_siegfried@systemli.org>
+---
+ include/linux/dccp.h   |  2 ++
+ net/dccp/ccids/ccid2.c | 32 +++++++++++++++++++-------------
+ net/dccp/ccids/ccid3.c | 30 ++++++++++++++++++++----------
+ 3 files changed, 41 insertions(+), 23 deletions(-)
+
+diff --git a/include/linux/dccp.h b/include/linux/dccp.h
+index 07e547c02fd8..504afa1a4be6 100644
+--- a/include/linux/dccp.h
++++ b/include/linux/dccp.h
+@@ -259,6 +259,7 @@ struct dccp_ackvec;
+  * @dccps_sync_scheduled - flag which signals "send out-of-band message soon"
+  * @dccps_xmitlet - tasklet scheduled by the TX CCID to dequeue data packets
+  * @dccps_xmit_timer - used by the TX CCID to delay sending (rate-based pacing)
++ * @dccps_ccid_timer - used by the CCIDs
+  * @dccps_syn_rtt - RTT sample from Request/Response exchange (in usecs)
+  */
+ struct dccp_sock {
+@@ -303,6 +304,7 @@ struct dccp_sock {
+ 	__u8				dccps_sync_scheduled:1;
+ 	struct tasklet_struct		dccps_xmitlet;
+ 	struct timer_list		dccps_xmit_timer;
++	struct timer_list		dccps_ccid_timer;
+ };
+ 
+ static inline struct dccp_sock *dccp_sk(const struct sock *sk)
+diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
+index 3da1f77bd039..dbca1f1e2449 100644
+--- a/net/dccp/ccids/ccid2.c
++++ b/net/dccp/ccids/ccid2.c
+@@ -126,21 +126,26 @@ static void dccp_tasklet_schedule(struct sock *sk)
+ 
+ static void ccid2_hc_tx_rto_expire(struct timer_list *t)
+ {
+-	struct ccid2_hc_tx_sock *hc = from_timer(hc, t, tx_rtotimer);
+-	struct sock *sk = hc->sk;
+-	const bool sender_was_blocked = ccid2_cwnd_network_limited(hc);
++	struct dccp_sock *dp = from_timer(dp, t, dccps_ccid_timer);
++	struct sock *sk = (struct sock *)dp;
++	struct ccid2_hc_tx_sock *hc;
++	bool sender_was_blocked;
+ 
+ 	bh_lock_sock(sk);
++
++	if (inet_sk_state_load(sk) == DCCP_CLOSED)
++		goto out;
++
++	hc = ccid_priv(dp->dccps_hc_tx_ccid);
++	sender_was_blocked = ccid2_cwnd_network_limited(hc);
++
+ 	if (sock_owned_by_user(sk)) {
+-		sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + HZ / 5);
++		sk_reset_timer(sk, &dp->dccps_ccid_timer, jiffies + HZ / 5);
+ 		goto out;
+ 	}
+ 
+ 	ccid2_pr_debug("RTO_EXPIRE\n");
+ 
+-	if (sk->sk_state == DCCP_CLOSED)
+-		goto out;
+-
+ 	/* back-off timer */
+ 	hc->tx_rto <<= 1;
+ 	if (hc->tx_rto > DCCP_RTO_MAX)
+@@ -166,7 +171,7 @@ static void ccid2_hc_tx_rto_expire(struct timer_list *t)
+ 	if (sender_was_blocked)
+ 		dccp_tasklet_schedule(sk);
+ 	/* restart backed-off timer */
+-	sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto);
++	sk_reset_timer(sk, &dp->dccps_ccid_timer, jiffies + hc->tx_rto);
+ out:
+ 	bh_unlock_sock(sk);
+ 	sock_put(sk);
+@@ -330,7 +335,7 @@ static void ccid2_hc_tx_packet_sent(struct sock *sk, unsigned int len)
+ 	}
+ #endif
+ 
+-	sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto);
++	sk_reset_timer(sk, &dp->dccps_ccid_timer, jiffies + hc->tx_rto);
+ 
+ #ifdef CONFIG_IP_DCCP_CCID2_DEBUG
+ 	do {
+@@ -700,9 +705,9 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
+ 
+ 	/* restart RTO timer if not all outstanding data has been acked */
+ 	if (hc->tx_pipe == 0)
+-		sk_stop_timer(sk, &hc->tx_rtotimer);
++		sk_stop_timer(sk, &dp->dccps_ccid_timer);
+ 	else
+-		sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto);
++		sk_reset_timer(sk, &dp->dccps_ccid_timer, jiffies + hc->tx_rto);
+ done:
+ 	/* check if incoming Acks allow pending packets to be sent */
+ 	if (sender_was_blocked && !ccid2_cwnd_network_limited(hc))
+@@ -737,17 +742,18 @@ static int ccid2_hc_tx_init(struct ccid *ccid, struct sock *sk)
+ 	hc->tx_last_cong = hc->tx_lsndtime = hc->tx_cwnd_stamp = ccid2_jiffies32;
+ 	hc->tx_cwnd_used = 0;
+ 	hc->sk		 = sk;
+-	timer_setup(&hc->tx_rtotimer, ccid2_hc_tx_rto_expire, 0);
++	timer_setup(&dp->dccps_ccid_timer, ccid2_hc_tx_rto_expire, 0);
+ 	INIT_LIST_HEAD(&hc->tx_av_chunks);
+ 	return 0;
+ }
+ 
+ static void ccid2_hc_tx_exit(struct sock *sk)
+ {
++	struct dccp_sock *dp = dccp_sk(sk);
+ 	struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk);
+ 	int i;
+ 
+-	sk_stop_timer(sk, &hc->tx_rtotimer);
++	sk_stop_timer(sk, &dp->dccps_ccid_timer);
+ 
+ 	for (i = 0; i < hc->tx_seqbufc; i++)
+ 		kfree(hc->tx_seqbuf[i]);
+diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
+index b9ee1a4a8955..685f4d046c0d 100644
+--- a/net/dccp/ccids/ccid3.c
++++ b/net/dccp/ccids/ccid3.c
+@@ -184,17 +184,24 @@ static inline void ccid3_hc_tx_update_win_count(struct ccid3_hc_tx_sock *hc,
+ 
+ static void ccid3_hc_tx_no_feedback_timer(struct timer_list *t)
+ {
+-	struct ccid3_hc_tx_sock *hc = from_timer(hc, t, tx_no_feedback_timer);
+-	struct sock *sk = hc->sk;
++	struct dccp_sock *dp = from_timer(dp, t, dccps_ccid_timer);
++	struct ccid3_hc_tx_sock *hc;
++	struct sock *sk = (struct sock *)dp;
+ 	unsigned long t_nfb = USEC_PER_SEC / 5;
+ 
+ 	bh_lock_sock(sk);
++
++	if (inet_sk_state_load(sk) == DCCP_CLOSED)
++		goto out;
++
+ 	if (sock_owned_by_user(sk)) {
+ 		/* Try again later. */
+ 		/* XXX: set some sensible MIB */
+ 		goto restart_timer;
+ 	}
+ 
++	hc = ccid_priv(dp->dccps_hc_tx_ccid);
++
+ 	ccid3_pr_debug("%s(%p, state=%s) - entry\n", dccp_role(sk), sk,
+ 		       ccid3_tx_state_name(hc->tx_state));
+ 
+@@ -250,8 +257,8 @@ static void ccid3_hc_tx_no_feedback_timer(struct timer_list *t)
+ 		t_nfb = max(hc->tx_t_rto, 2 * hc->tx_t_ipi);
+ 
+ restart_timer:
+-	sk_reset_timer(sk, &hc->tx_no_feedback_timer,
+-			   jiffies + usecs_to_jiffies(t_nfb));
++	sk_reset_timer(sk, &dp->dccps_ccid_timer,
++		       jiffies + usecs_to_jiffies(t_nfb));
+ out:
+ 	bh_unlock_sock(sk);
+ 	sock_put(sk);
+@@ -280,7 +287,7 @@ static int ccid3_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
+ 		return -EBADMSG;
+ 
+ 	if (hc->tx_state == TFRC_SSTATE_NO_SENT) {
+-		sk_reset_timer(sk, &hc->tx_no_feedback_timer, (jiffies +
++		sk_reset_timer(sk, &dp->dccps_ccid_timer, (jiffies +
+ 			       usecs_to_jiffies(TFRC_INITIAL_TIMEOUT)));
+ 		hc->tx_last_win_count	= 0;
+ 		hc->tx_t_last_win_count = now;
+@@ -354,6 +361,7 @@ static void ccid3_hc_tx_packet_sent(struct sock *sk, unsigned int len)
+ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
+ {
+ 	struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
++	struct dccp_sock *dp = dccp_sk(sk);
+ 	struct tfrc_tx_hist_entry *acked;
+ 	ktime_t now;
+ 	unsigned long t_nfb;
+@@ -420,7 +428,7 @@ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
+ 			       (unsigned int)(hc->tx_x >> 6));
+ 
+ 	/* unschedule no feedback timer */
+-	sk_stop_timer(sk, &hc->tx_no_feedback_timer);
++	sk_stop_timer(sk, &dp->dccps_ccid_timer);
+ 
+ 	/*
+ 	 * As we have calculated new ipi, delta, t_nom it is possible
+@@ -445,8 +453,8 @@ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
+ 		       "expire in %lu jiffies (%luus)\n",
+ 		       dccp_role(sk), sk, usecs_to_jiffies(t_nfb), t_nfb);
+ 
+-	sk_reset_timer(sk, &hc->tx_no_feedback_timer,
+-			   jiffies + usecs_to_jiffies(t_nfb));
++	sk_reset_timer(sk, &dp->dccps_ccid_timer,
++		       jiffies + usecs_to_jiffies(t_nfb));
+ }
+ 
+ static int ccid3_hc_tx_parse_options(struct sock *sk, u8 packet_type,
+@@ -488,21 +496,23 @@ static int ccid3_hc_tx_parse_options(struct sock *sk, u8 packet_type,
+ 
+ static int ccid3_hc_tx_init(struct ccid *ccid, struct sock *sk)
+ {
++	struct dccp_sock *dp = dccp_sk(sk);
+ 	struct ccid3_hc_tx_sock *hc = ccid_priv(ccid);
+ 
+ 	hc->tx_state = TFRC_SSTATE_NO_SENT;
+ 	hc->tx_hist  = NULL;
+ 	hc->sk	     = sk;
+-	timer_setup(&hc->tx_no_feedback_timer,
++	timer_setup(&dp->dccps_ccid_timer,
+ 		    ccid3_hc_tx_no_feedback_timer, 0);
+ 	return 0;
+ }
+ 
+ static void ccid3_hc_tx_exit(struct sock *sk)
+ {
++	struct dccp_sock *dp = dccp_sk(sk);
+ 	struct ccid3_hc_tx_sock *hc = ccid3_hc_tx_sk(sk);
+ 
+-	sk_stop_timer(sk, &hc->tx_no_feedback_timer);
++	sk_stop_timer(sk, &dp->dccps_ccid_timer);
+ 	tfrc_tx_hist_purge(&hc->tx_hist);
+ }
+ 
+-- 
+2.25.1
+
+
+From MAILER-DAEMON Wed Oct 14 16:34:37 2020
+From: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
+To: netdev@vger.kernel.org
+Cc: Gerrit Renker <gerrit@erg.abdn.ac.uk>, "David S. Miller" <davem@davemloft.net>, Jakub Kicinski <kuba@kernel.org>, Thadeu Lima de Souza Cascardo <cascardo@canonical.com>, "Gustavo A. R. Silva" <gustavoars@kernel.org>, "Alexander A. Klimov" <grandmaster@al2klimov.de>, Kees Cook <keescook@chromium.org>, Eric Dumazet <edumazet@google.com>, Alexey Kodanev <alexey.kodanev@oracle.com>, dccp@vger.kernel.org, linux-kernel@vger.kernel.org
+Subject: [PATCH 2/2] Revert "dccp: don't free ccid2_hc_tx_sock struct in dccp_disconnect()"
+Date: Tue, 13 Oct 2020 19:18:49 +0200
+Message-Id: <20201013171849.236025-3-kleber.souza@canonical.com>
+In-Reply-To: <20201013171849.236025-1-kleber.souza@canonical.com>
+References: <20201013171849.236025-1-kleber.souza@canonical.com>
+List-ID: <linux-kernel.vger.kernel.org>
+X-Mailing-List: linux-kernel@vger.kernel.org
+MIME-Version: 1.0
+Content-Type: text/plain; charset="utf-8"
+Content-Transfer-Encoding: 7bit
+
+From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
+
+This reverts commit 2677d20677314101293e6da0094ede7b5526d2b1.
+
+This fixes an issue that after disconnect, dccps_hc_tx_ccid will still be
+kept, allowing the socket to be reused as a listener socket, and the cloned
+socket will free its dccps_hc_tx_ccid, leading to a later use after free,
+when the listener socket is closed.
+
+This addresses CVE-2020-16119.
+
+Fixes: 2677d2067731 (dccp: don't free ccid2_hc_tx_sock struct in dccp_disconnect())
+Reported-by: Hadar Manor
+Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
+Acked-by: Richard Sailer <richard_siegfried@systemli.org>
+---
+ net/dccp/proto.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/dccp/proto.c b/net/dccp/proto.c
+index 6d705d90c614..359e848dba6c 100644
+--- a/net/dccp/proto.c
++++ b/net/dccp/proto.c
+@@ -279,7 +279,9 @@ int dccp_disconnect(struct sock *sk, int flags)
+ 
+ 	dccp_clear_xmit_timers(sk);
+ 	ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
++	ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
+ 	dp->dccps_hc_rx_ccid = NULL;
++	dp->dccps_hc_tx_ccid = NULL;
+ 
+ 	__skb_queue_purge(&sk->sk_receive_queue);
+ 	__skb_queue_purge(&sk->sk_write_queue);
+-- 
+2.25.1
+
+
diff --git a/kernel.spec b/kernel.spec
index 0b2b04b91..7cc707257 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -888,8 +888,8 @@ Patch107: 0001-drivers-perf-xgene_pmu-Fix-uninitialized-resource-st.patch
 
 Patch110: memory-tegra-Remove-GPU-from-DRM-IOMMU-group.patch
 
-# rhbz 1875339 1875828 1876997
-Patch113: pdx86-SW_TABLET_MODE-fixes.patch
+# CVE-2020-16119 rhbz 1886374 1888083
+Patch119: CVE-2020-16119-DCCP-CCID-structure-use-after-free.patch
 
 # END OF PATCH DEFINITIONS
 
@@ -3007,6 +3007,10 @@ fi
 #
 #
 %changelog
+* Wed Oct 14 11:29:48 CDT 2020 Justin M. Forbes <jforbes@fedoraproject.org> - 5.8.15-100
+- Linux v5.8.15
+- Fix CVE-2020-16119 (rhbz 1886374 1888083)
+
 * Wed Oct  7 07:21:35 CDT 2020 Justin M. Forbes <jforbes@fedoraproject.org> - 5.8.14-100
 - Linux v5.8.14
 
diff --git a/pdx86-SW_TABLET_MODE-fixes.patch b/pdx86-SW_TABLET_MODE-fixes.patch
deleted file mode 100644
index 3fa9f843c..000000000
--- a/pdx86-SW_TABLET_MODE-fixes.patch
+++ /dev/null
@@ -1,212 +0,0 @@
-From 9126d28cf4e537ef5e77006c51b1a24ad8e8170b Mon Sep 17 00:00:00 2001

-From: Hans de Goede <hdegoede@redhat.com>

-Date: Fri, 11 Sep 2020 13:34:42 +0200

-Subject: [PATCH 1/2] platform/x86: intel-vbtn: Fix SW_TABLET_MODE always

- reporting 1 on the HP Pavilion 11 x360

-

-Commit cfae58ed681c ("platform/x86: intel-vbtn: Only blacklist

-SW_TABLET_MODE on the 9 / "Laptop" chasis-type") restored SW_TABLET_MODE

-reporting on the HP stream x360 11 series on which it was previously broken

-by commit de9647efeaa9 ("platform/x86: intel-vbtn: Only activate tablet

-mode switch on 2-in-1's").

-

-It turns out that enabling SW_TABLET_MODE reporting on devices with a

-chassis-type of 10 ("Notebook") causes SW_TABLET_MODE to always report 1

-at boot on the HP Pavilion 11 x360, which causes libinput to disable the

-kbd and touchpad.

-

-The HP Pavilion 11 x360's ACPI VGBS method sets bit 4 instead of bit 6 when

-NOT in tablet mode at boot. Inspecting all the DSDTs in my DSDT collection

-shows only one other model, the Medion E1239T ever setting bit 4 and it

-always sets this together with bit 6.

-

-So lets treat bit 4 as a second bit which when set indicates the device not

-being in tablet-mode, as we already do for bit 6.

-

-While at it also prefix all VGBS constant defines with "VGBS_".

-

-Fixes: cfae58ed681c ("platform/x86: intel-vbtn: Only blacklist SW_TABLET_MODE on the 9 / "Laptop" chasis-type")

-Signed-off-by: Hans de Goede <hdegoede@redhat.com>

----

- drivers/platform/x86/intel-vbtn.c | 12 ++++++++----

- 1 file changed, 8 insertions(+), 4 deletions(-)

-

-diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c

-index e85d8e58320c..f443619e1e7e 100644

---- a/drivers/platform/x86/intel-vbtn.c

-+++ b/drivers/platform/x86/intel-vbtn.c

-@@ -15,9 +15,13 @@

- #include <linux/platform_device.h>

- #include <linux/suspend.h>

- 

-+/* Returned when NOT in tablet mode on some HP Stream x360 11 models */

-+#define VGBS_TABLET_MODE_FLAG_ALT	0x10

- /* When NOT in tablet mode, VGBS returns with the flag 0x40 */

--#define TABLET_MODE_FLAG 0x40

--#define DOCK_MODE_FLAG   0x80

-+#define VGBS_TABLET_MODE_FLAG		0x40

-+#define VGBS_DOCK_MODE_FLAG		0x80

-+

-+#define VGBS_TABLET_MODE_FLAGS (VGBS_TABLET_MODE_FLAG | VGBS_TABLET_MODE_FLAG_ALT)

- 

- MODULE_LICENSE("GPL");

- MODULE_AUTHOR("AceLan Kao");

-@@ -72,9 +76,9 @@ static void detect_tablet_mode(struct platform_device *device)

- 	if (ACPI_FAILURE(status))

- 		return;

- 

--	m = !(vgbs & TABLET_MODE_FLAG);

-+	m = !(vgbs & VGBS_TABLET_MODE_FLAGS);

- 	input_report_switch(priv->input_dev, SW_TABLET_MODE, m);

--	m = (vgbs & DOCK_MODE_FLAG) ? 1 : 0;

-+	m = (vgbs & VGBS_DOCK_MODE_FLAG) ? 1 : 0;

- 	input_report_switch(priv->input_dev, SW_DOCK, m);

- }

- 

--- 

-2.28.0

-

-From d26d82852e926fee13b5fa71cc004da391aaa5e3 Mon Sep 17 00:00:00 2001

-From: Hans de Goede <hdegoede@redhat.com>

-Date: Wed, 16 Sep 2020 16:14:39 +0200

-Subject: [PATCH 2/2] platform/x86: asus-wmi: Fix SW_TABLET_MODE always

- reporting 1 on many different models

-MIME-Version: 1.0

-Content-Type: text/plain; charset=UTF-8

-Content-Transfer-Encoding: 8bit

-

-Commit b0dbd97de1f1 ("platform/x86: asus-wmi: Add support for

-SW_TABLET_MODE") added support for reporting SW_TABLET_MODE using the

-Asus 0x00120063 WMI-device-id to see if various transformer models were

-docked into their keyboard-dock (SW_TABLET_MODE=0) or if they were

-being used as a tablet.

-

-The new SW_TABLET_MODE support (naively?) assumed that non Transformer

-devices would either not support the 0x00120063 WMI-device-id at all,

-or would NOT set ASUS_WMI_DSTS_PRESENCE_BIT in their reply when querying

-the device-id.

-

-Unfortunately this is not true and we have received many bug reports about

-this change causing the asus-wmi driver to always report SW_TABLET_MODE=1

-on non Transformer devices. This causes libinput to think that these are

-360 degree hinges style 2-in-1s folded into tablet-mode. Making libinput

-suppress keyboard and touchpad events from the builtin keyboard and

-touchpad. So effectively this causes the keyboard and touchpad to not work

-on many non Transformer Asus models.

-

-This commit fixes this by using the existing DMI based quirk mechanism in

-asus-nb-wmi.c to allow using the 0x00120063 device-id for reporting

-SW_TABLET_MODE on Transformer models and ignoring it on all other models.

-

-Fixes: b0dbd97de1f1 ("platform/x86: asus-wmi: Add support for SW_TABLET_MODE")

-BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=209011

-BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1875339

-BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1875828

-BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1876997

-Reported-by: Samuel Čavoj <samuel@cavoj.net>

-Signed-off-by: Hans de Goede <hdegoede@redhat.com>

----

- drivers/platform/x86/asus-nb-wmi.c | 32 ++++++++++++++++++++++++++++++

- drivers/platform/x86/asus-wmi.c    | 16 ++++++++-------

- drivers/platform/x86/asus-wmi.h    |  1 +

- 3 files changed, 42 insertions(+), 7 deletions(-)

-

-diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c

-index 680c3640e013..1d9fbabd02fb 100644

---- a/drivers/platform/x86/asus-nb-wmi.c

-+++ b/drivers/platform/x86/asus-nb-wmi.c

-@@ -115,6 +115,10 @@ static struct quirk_entry quirk_asus_vendor_backlight = {

- 	.wmi_backlight_set_devstate = true,

- };

- 

-+static struct quirk_entry quirk_asus_use_kbd_dock_devid = {

-+	.use_kbd_dock_devid = true,

-+};

-+

- static int dmi_matched(const struct dmi_system_id *dmi)

- {

- 	pr_info("Identified laptop model '%s'\n", dmi->ident);

-@@ -488,6 +492,34 @@ static const struct dmi_system_id asus_quirks[] = {

- 		},

- 		.driver_data = &quirk_asus_ga502i,

- 	},

-+	{

-+		.callback = dmi_matched,

-+		.ident = "Asus Transformer T100TA / T100HA / T100CHI",

-+		.matches = {

-+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),

-+			/* Match *T100* */

-+			DMI_MATCH(DMI_PRODUCT_NAME, "T100"),

-+		},

-+		.driver_data = &quirk_asus_use_kbd_dock_devid,

-+	},

-+	{

-+		.callback = dmi_matched,

-+		.ident = "Asus Transformer T101HA",

-+		.matches = {

-+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),

-+			DMI_MATCH(DMI_PRODUCT_NAME, "T101HA"),

-+		},

-+		.driver_data = &quirk_asus_use_kbd_dock_devid,

-+	},

-+	{

-+		.callback = dmi_matched,

-+		.ident = "Asus Transformer T200TA",

-+		.matches = {

-+			DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),

-+			DMI_MATCH(DMI_PRODUCT_NAME, "T200TA"),

-+		},

-+		.driver_data = &quirk_asus_use_kbd_dock_devid,

-+	},

- 	{},

- };

- 

-diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c

-index 8f4acdc06b13..ae6289d37faf 100644

---- a/drivers/platform/x86/asus-wmi.c

-+++ b/drivers/platform/x86/asus-wmi.c

-@@ -365,12 +365,14 @@ static int asus_wmi_input_init(struct asus_wmi *asus)

- 	if (err)

- 		goto err_free_dev;

- 

--	result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_KBD_DOCK);

--	if (result >= 0) {

--		input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE);

--		input_report_switch(asus->inputdev, SW_TABLET_MODE, !result);

--	} else if (result != -ENODEV) {

--		pr_err("Error checking for keyboard-dock: %d\n", result);

-+	if (asus->driver->quirks->use_kbd_dock_devid) {

-+		result = asus_wmi_get_devstate_simple(asus, ASUS_WMI_DEVID_KBD_DOCK);

-+		if (result >= 0) {

-+			input_set_capability(asus->inputdev, EV_SW, SW_TABLET_MODE);

-+			input_report_switch(asus->inputdev, SW_TABLET_MODE, !result);

-+		} else if (result != -ENODEV) {

-+			pr_err("Error checking for keyboard-dock: %d\n", result);

-+		}

- 	}

- 

- 	err = input_register_device(asus->inputdev);

-@@ -2114,7 +2116,7 @@ static void asus_wmi_handle_event_code(int code, struct asus_wmi *asus)

- 		return;

- 	}

- 

--	if (code == NOTIFY_KBD_DOCK_CHANGE) {

-+	if (asus->driver->quirks->use_kbd_dock_devid && code == NOTIFY_KBD_DOCK_CHANGE) {

- 		result = asus_wmi_get_devstate_simple(asus,

- 						      ASUS_WMI_DEVID_KBD_DOCK);

- 		if (result >= 0) {

-diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h

-index 4f31b68642a0..1a95c172f94b 100644

---- a/drivers/platform/x86/asus-wmi.h

-+++ b/drivers/platform/x86/asus-wmi.h

-@@ -33,6 +33,7 @@ struct quirk_entry {

- 	bool wmi_backlight_native;

- 	bool wmi_backlight_set_devstate;

- 	bool wmi_force_als_set;

-+	bool use_kbd_dock_devid;

- 	int wapf;

- 	/*

- 	 * For machines with AMD graphic chips, it will send out WMI event

--- 

-2.28.0

-