Linux 5.10.6

Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>

5 files changed, 59 insertions, 99 deletions

diff --git a/0001-drm-nouveau-kms-handle-mDP-connectors.patch b/0001-drm-nouveau-kms-handle-mDP-connectors.patch
new file mode 100644
index 000000000..44c150fd3
--- /dev/null
+++ b/0001-drm-nouveau-kms-handle-mDP-connectors.patch
@@ -0,0 +1,54 @@
+From 54a080fdc2e65b38aea4dd59dde357d6c340fa25 Mon Sep 17 00:00:00 2001
+From: Karol Herbst <kherbst@redhat.com>
+Date: Thu, 26 Nov 2020 14:47:50 +0100
+Subject: [PATCH] drm/nouveau/kms: handle mDP connectors
+
+In some cases we have the handle those explicitly as the fallback
+connector type detection fails and marks those as eDP connectors.
+
+Attempting to use such a connector with mutter leads to a crash of mutter
+as it ends up with two eDP displays.
+
+Information is taken from the official DCB documentation.
+
+Upstream Nouveau commit: 95adf381b74e86a8a34b93c3fab73c15dd2f3f5c
+
+Cc: stable@vger.kernel.org
+Cc: dri-devel@lists.freedesktop.org
+Cc: Ben Skeggs <bskeggs@redhat.com>
+Reported-by: Mark Pearson <markpearson@lenovo.com>
+Tested-by: Mark Pearson <markpearson@lenovo.com>
+Signed-off-by: Karol Herbst <kherbst@redhat.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+---
+ drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/conn.h | 1 +
+ drivers/gpu/drm/nouveau/nouveau_connector.c             | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/conn.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/conn.h
+index f5f59261ea81..d1beaad0c82b 100644
+--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/conn.h
++++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/conn.h
+@@ -14,6 +14,7 @@ enum dcb_connector_type {
+ 	DCB_CONNECTOR_LVDS_SPWG = 0x41,
+ 	DCB_CONNECTOR_DP = 0x46,
+ 	DCB_CONNECTOR_eDP = 0x47,
++	DCB_CONNECTOR_mDP = 0x48,
+ 	DCB_CONNECTOR_HDMI_0 = 0x60,
+ 	DCB_CONNECTOR_HDMI_1 = 0x61,
+ 	DCB_CONNECTOR_HDMI_C = 0x63,
+diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
+index 8b4b3688c7ae..4c992fd5bd68 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
+@@ -1210,6 +1210,7 @@ drm_conntype_from_dcb(enum dcb_connector_type dcb)
+ 	case DCB_CONNECTOR_DMS59_DP0:
+ 	case DCB_CONNECTOR_DMS59_DP1:
+ 	case DCB_CONNECTOR_DP       :
++	case DCB_CONNECTOR_mDP      :
+ 	case DCB_CONNECTOR_USB_C    : return DRM_MODE_CONNECTOR_DisplayPort;
+ 	case DCB_CONNECTOR_eDP      : return DRM_MODE_CONNECTOR_eDP;
+ 	case DCB_CONNECTOR_HDMI_0   :
+-- 
+2.29.2
+
diff --git a/0001-mwifiex-Fix-possible-buffer-overflows-in-mwifiex_cmd.patch b/0001-mwifiex-Fix-possible-buffer-overflows-in-mwifiex_cmd.patch
deleted file mode 100644
index 48ef5911c..000000000
--- a/0001-mwifiex-Fix-possible-buffer-overflows-in-mwifiex_cmd.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From 5c455c5ab332773464d02ba17015acdca198f03d Mon Sep 17 00:00:00 2001
-From: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
-Date: Sun, 6 Dec 2020 16:48:01 +0800
-Subject: [PATCH] mwifiex: Fix possible buffer overflows in
- mwifiex_cmd_802_11_ad_hoc_start
-
-mwifiex_cmd_802_11_ad_hoc_start() calls memcpy() without checking
-the destination size may trigger a buffer overflower,
-which a local user could use to cause denial of service
-or the execution of arbitrary code.
-Fix it by putting the length check before calling memcpy().
-
-Signed-off-by: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-Link: https://lore.kernel.org/r/20201206084801.26479-1-ruc_zhangxiaohui@163.com
----
- drivers/net/wireless/marvell/mwifiex/join.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
-index 5934f7147547..173ccf79cbfc 100644
---- a/drivers/net/wireless/marvell/mwifiex/join.c
-+++ b/drivers/net/wireless/marvell/mwifiex/join.c
-@@ -877,6 +877,8 @@ mwifiex_cmd_802_11_ad_hoc_start(struct mwifiex_private *priv,
-
- 	memset(adhoc_start->ssid, 0, IEEE80211_MAX_SSID_LEN);
-
-+	if (req_ssid->ssid_len > IEEE80211_MAX_SSID_LEN)
-+		req_ssid->ssid_len = IEEE80211_MAX_SSID_LEN;
- 	memcpy(adhoc_start->ssid, req_ssid->ssid, req_ssid->ssid_len);
-
- 	mwifiex_dbg(adapter, INFO, "info: ADHOC_S_CMD: SSID = %s\n",
--- 
-2.29.2
-
diff --git a/Bluetooth-hci_core-Fix-attempting-to-set-RPA-timeout-when-unsupported.patch b/Bluetooth-hci_core-Fix-attempting-to-set-RPA-timeout-when-unsupported.patch
deleted file mode 100644
index f298a652e..000000000
--- a/Bluetooth-hci_core-Fix-attempting-to-set-RPA-timeout-when-unsupported.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From MAILER-DAEMON Thu Jan  7 13:40:23 2021
-From: Edward Vear <edwardvear@gmail.com>
-To: linux-bluetooth@vger.kernel.org
-Cc: edwardvear@gmail.com, marcel@holtmann.org, johan.hedberg@gmail.com, davem@davemloft.net, kuba@kernel.org
-Subject: [PATCH] Bluetooth: hci_core: Fix attempting to set RPA timeout when unsupported
-Date: Tue, 27 Oct 2020 00:02:03 -0700
-Message-Id: <20201027070203.13561-1-edwardvear@gmail.com>
-List-ID: <linux-bluetooth.vger.kernel.org>
-X-Mailing-List: linux-bluetooth@vger.kernel.org
-MIME-Version: 1.0
-Content-Type: text/plain; charset="utf-8"
-Content-Transfer-Encoding: 7bit
-
-During controller initialization, an LE Set RPA Timeout command is sent
-to the controller if supported. However, the value checked to determine
-if the command is supported is incorrect. Page 1921 of the Bluetooth
-Core Spec v5.2 shows that bit 2 of octet 35 of the Supported_Commands
-field corresponds to the LE Set RPA Timeout command, but currently
-bit 6 of octet 35 is checked. This patch checks the correct value
-instead.
-
-This issue led to the error seen in the following btmon output during
-initialization of an adapter (rtl8761b) and prevented initialization
-from completing.
-
-< HCI Command: LE Set Resolvable Private Address Timeout (0x08|0x002e) plen 2
-        Timeout: 900 seconds
-> HCI Event: Command Complete (0x0e) plen 4
-      LE Set Resolvable Private Address Timeout (0x08|0x002e) ncmd 2
-        Status: Unsupported Remote Feature / Unsupported LMP Feature (0x1a)
-= Close Index: 00:E0:4C:6B:E5:03
-
-The error did not appear when running with this patch.
-
-Signed-off-by: Edward Vear <edwardvear@gmail.com>
----
- net/bluetooth/hci_core.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
-index 502552d6e9af..c4aa2cbb9269 100644
---- a/net/bluetooth/hci_core.c
-+++ b/net/bluetooth/hci_core.c
-@@ -763,7 +763,7 @@ static int hci_init3_req(struct hci_request *req, unsigned long opt)
- 			hci_req_add(req, HCI_OP_LE_CLEAR_RESOLV_LIST, 0, NULL);
- 		}
- 
--		if (hdev->commands[35] & 0x40) {
-+		if (hdev->commands[35] & 0x04) {
- 			__le16 rpa_timeout = cpu_to_le16(hdev->rpa_timeout);
- 
- 			/* Set RPA timeout */
--- 
-2.29.1
-
-
diff --git a/kernel.spec b/kernel.spec
index c1c19dd3a..39fb2ae83 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -94,7 +94,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 5
+%define stable_update 6
 # Set rpm version accordingly
 %if 0%{?stable_update}
 %define stablerev %{stable_update}
@@ -847,14 +847,8 @@ Patch102: 0001-update-phy-on-pine64-a64-devices.patch
 # OMAP Pandaboard fix
 Patch103: arm-pandaboard-fix-add-bluetooth.patch
 
-# Fix CVE-2020-36158 rhbz 1913348 1913349
-Patch104: 0001-mwifiex-Fix-possible-buffer-overflows-in-mwifiex_cmd.patch
-
 Patch105: 0001-ALSA-hda-via-Fix-runtime-PM-for-Clevo-W35xSS.patch
 
-# rhbz 1898495
-Patch106: Bluetooth-hci_core-Fix-attempting-to-set-RPA-timeout-when-unsupported.patch
-
 # Nouveau mDP detection fix
 Patch107: 0001-drm-nouveau-kms-handle-mDP-connectors.patch
 
@@ -2971,6 +2965,9 @@ fi
 #
 #
 %changelog
+* Mon Jan 11 06:51:13 CST 2021 Justin M. Forbes <jforbes@fedoraproject.org> - 5.10.6-200
+- Linux v5.10.6
+
 * Thu Jan  7 2021 Justin M. Forbes <jforbes@fedoraproject.org>
 - Fix bluetooth controller initialization (rhbz 1898495)
 
diff --git a/sources b/sources
index 74ac8eb0b..28e68ed6b 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 SHA512 (linux-5.10.tar.xz) = c28d52bc0c1e2c99017ceeca0bf2e622427f3416e0692090b01f65e3b3a5bce0e3e52ce3cee15d71e84fcb965bd48bdfcccb818c0105035d712ebd07afde9452
-SHA512 (patch-5.10.5.xz) = a6f240134f82b15a368a3348880764ee0289d8bf898a20e79298faad050a5426a87627233602f6cc7629f68070bf14e34bfe2ee72a9ff5c24e36ce18f3fc8e3a
+SHA512 (patch-5.10.6.xz) = 54e74994a27b6a753717c778e5a550fd5db0f4acd24095f9b6e6d7cbb5c914be2f914d34865c9453d85a37873f0575fc5af54374ea1fe6e6d313d978e739d58f