diff options
| -rw-r--r-- | 0001-drm-nouveau-kms-handle-mDP-connectors.patch | 54 | ||||
| -rw-r--r-- | 0001-mwifiex-Fix-possible-buffer-overflows-in-mwifiex_cmd.patch | 35 | ||||
| -rw-r--r-- | Bluetooth-hci_core-Fix-attempting-to-set-RPA-timeout-when-unsupported.patch | 56 | ||||
| -rw-r--r-- | kernel.spec | 11 | ||||
| -rw-r--r-- | sources | 2 |
5 files changed, 59 insertions, 99 deletions
diff --git a/0001-drm-nouveau-kms-handle-mDP-connectors.patch b/0001-drm-nouveau-kms-handle-mDP-connectors.patch new file mode 100644 index 000000000..44c150fd3 --- /dev/null +++ b/0001-drm-nouveau-kms-handle-mDP-connectors.patch @@ -0,0 +1,54 @@ +From 54a080fdc2e65b38aea4dd59dde357d6c340fa25 Mon Sep 17 00:00:00 2001 +From: Karol Herbst <kherbst@redhat.com> +Date: Thu, 26 Nov 2020 14:47:50 +0100 +Subject: [PATCH] drm/nouveau/kms: handle mDP connectors + +In some cases we have the handle those explicitly as the fallback +connector type detection fails and marks those as eDP connectors. + +Attempting to use such a connector with mutter leads to a crash of mutter +as it ends up with two eDP displays. + +Information is taken from the official DCB documentation. + +Upstream Nouveau commit: 95adf381b74e86a8a34b93c3fab73c15dd2f3f5c + +Cc: stable@vger.kernel.org +Cc: dri-devel@lists.freedesktop.org +Cc: Ben Skeggs <bskeggs@redhat.com> +Reported-by: Mark Pearson <markpearson@lenovo.com> +Tested-by: Mark Pearson <markpearson@lenovo.com> +Signed-off-by: Karol Herbst <kherbst@redhat.com> +Signed-off-by: Ben Skeggs <bskeggs@redhat.com> +--- + drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/conn.h | 1 + + drivers/gpu/drm/nouveau/nouveau_connector.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/conn.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/conn.h +index f5f59261ea81..d1beaad0c82b 100644 +--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/conn.h ++++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/conn.h +@@ -14,6 +14,7 @@ enum dcb_connector_type { + DCB_CONNECTOR_LVDS_SPWG = 0x41, + DCB_CONNECTOR_DP = 0x46, + DCB_CONNECTOR_eDP = 0x47, ++ DCB_CONNECTOR_mDP = 0x48, + DCB_CONNECTOR_HDMI_0 = 0x60, + DCB_CONNECTOR_HDMI_1 = 0x61, + DCB_CONNECTOR_HDMI_C = 0x63, +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c +index 8b4b3688c7ae..4c992fd5bd68 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -1210,6 +1210,7 @@ drm_conntype_from_dcb(enum dcb_connector_type dcb) + case DCB_CONNECTOR_DMS59_DP0: + case DCB_CONNECTOR_DMS59_DP1: + case DCB_CONNECTOR_DP : ++ case DCB_CONNECTOR_mDP : + case DCB_CONNECTOR_USB_C : return DRM_MODE_CONNECTOR_DisplayPort; + case DCB_CONNECTOR_eDP : return DRM_MODE_CONNECTOR_eDP; + case DCB_CONNECTOR_HDMI_0 : +-- +2.29.2 + diff --git a/0001-mwifiex-Fix-possible-buffer-overflows-in-mwifiex_cmd.patch b/0001-mwifiex-Fix-possible-buffer-overflows-in-mwifiex_cmd.patch deleted file mode 100644 index 48ef5911c..000000000 --- a/0001-mwifiex-Fix-possible-buffer-overflows-in-mwifiex_cmd.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 5c455c5ab332773464d02ba17015acdca198f03d Mon Sep 17 00:00:00 2001 -From: Zhang Xiaohui <ruc_zhangxiaohui@163.com> -Date: Sun, 6 Dec 2020 16:48:01 +0800 -Subject: [PATCH] mwifiex: Fix possible buffer overflows in - mwifiex_cmd_802_11_ad_hoc_start - -mwifiex_cmd_802_11_ad_hoc_start() calls memcpy() without checking -the destination size may trigger a buffer overflower, -which a local user could use to cause denial of service -or the execution of arbitrary code. -Fix it by putting the length check before calling memcpy(). - -Signed-off-by: Zhang Xiaohui <ruc_zhangxiaohui@163.com> -Signed-off-by: Kalle Valo <kvalo@codeaurora.org> -Link: https://lore.kernel.org/r/20201206084801.26479-1-ruc_zhangxiaohui@163.com ---- - drivers/net/wireless/marvell/mwifiex/join.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c -index 5934f7147547..173ccf79cbfc 100644 ---- a/drivers/net/wireless/marvell/mwifiex/join.c -+++ b/drivers/net/wireless/marvell/mwifiex/join.c -@@ -877,6 +877,8 @@ mwifiex_cmd_802_11_ad_hoc_start(struct mwifiex_private *priv, - - memset(adhoc_start->ssid, 0, IEEE80211_MAX_SSID_LEN); - -+ if (req_ssid->ssid_len > IEEE80211_MAX_SSID_LEN) -+ req_ssid->ssid_len = IEEE80211_MAX_SSID_LEN; - memcpy(adhoc_start->ssid, req_ssid->ssid, req_ssid->ssid_len); - - mwifiex_dbg(adapter, INFO, "info: ADHOC_S_CMD: SSID = %s\n", --- -2.29.2 - diff --git a/Bluetooth-hci_core-Fix-attempting-to-set-RPA-timeout-when-unsupported.patch b/Bluetooth-hci_core-Fix-attempting-to-set-RPA-timeout-when-unsupported.patch deleted file mode 100644 index f298a652e..000000000 --- a/Bluetooth-hci_core-Fix-attempting-to-set-RPA-timeout-when-unsupported.patch +++ /dev/null @@ -1,56 +0,0 @@ -From MAILER-DAEMON Thu Jan 7 13:40:23 2021 -From: Edward Vear <edwardvear@gmail.com> -To: linux-bluetooth@vger.kernel.org -Cc: edwardvear@gmail.com, marcel@holtmann.org, johan.hedberg@gmail.com, davem@davemloft.net, kuba@kernel.org -Subject: [PATCH] Bluetooth: hci_core: Fix attempting to set RPA timeout when unsupported -Date: Tue, 27 Oct 2020 00:02:03 -0700 -Message-Id: <20201027070203.13561-1-edwardvear@gmail.com> -List-ID: <linux-bluetooth.vger.kernel.org> -X-Mailing-List: linux-bluetooth@vger.kernel.org -MIME-Version: 1.0 -Content-Type: text/plain; charset="utf-8" -Content-Transfer-Encoding: 7bit - -During controller initialization, an LE Set RPA Timeout command is sent -to the controller if supported. However, the value checked to determine -if the command is supported is incorrect. Page 1921 of the Bluetooth -Core Spec v5.2 shows that bit 2 of octet 35 of the Supported_Commands -field corresponds to the LE Set RPA Timeout command, but currently -bit 6 of octet 35 is checked. This patch checks the correct value -instead. - -This issue led to the error seen in the following btmon output during -initialization of an adapter (rtl8761b) and prevented initialization -from completing. - -< HCI Command: LE Set Resolvable Private Address Timeout (0x08|0x002e) plen 2 - Timeout: 900 seconds -> HCI Event: Command Complete (0x0e) plen 4 - LE Set Resolvable Private Address Timeout (0x08|0x002e) ncmd 2 - Status: Unsupported Remote Feature / Unsupported LMP Feature (0x1a) -= Close Index: 00:E0:4C:6B:E5:03 - -The error did not appear when running with this patch. - -Signed-off-by: Edward Vear <edwardvear@gmail.com> ---- - net/bluetooth/hci_core.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c -index 502552d6e9af..c4aa2cbb9269 100644 ---- a/net/bluetooth/hci_core.c -+++ b/net/bluetooth/hci_core.c -@@ -763,7 +763,7 @@ static int hci_init3_req(struct hci_request *req, unsigned long opt) - hci_req_add(req, HCI_OP_LE_CLEAR_RESOLV_LIST, 0, NULL); - } - -- if (hdev->commands[35] & 0x40) { -+ if (hdev->commands[35] & 0x04) { - __le16 rpa_timeout = cpu_to_le16(hdev->rpa_timeout); - - /* Set RPA timeout */ --- -2.29.1 - - diff --git a/kernel.spec b/kernel.spec index c1c19dd3a..39fb2ae83 100644 --- a/kernel.spec +++ b/kernel.spec @@ -94,7 +94,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 5 +%define stable_update 6 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -847,14 +847,8 @@ Patch102: 0001-update-phy-on-pine64-a64-devices.patch # OMAP Pandaboard fix Patch103: arm-pandaboard-fix-add-bluetooth.patch -# Fix CVE-2020-36158 rhbz 1913348 1913349 -Patch104: 0001-mwifiex-Fix-possible-buffer-overflows-in-mwifiex_cmd.patch - Patch105: 0001-ALSA-hda-via-Fix-runtime-PM-for-Clevo-W35xSS.patch -# rhbz 1898495 -Patch106: Bluetooth-hci_core-Fix-attempting-to-set-RPA-timeout-when-unsupported.patch - # Nouveau mDP detection fix Patch107: 0001-drm-nouveau-kms-handle-mDP-connectors.patch @@ -2971,6 +2965,9 @@ fi # # %changelog +* Mon Jan 11 06:51:13 CST 2021 Justin M. Forbes <jforbes@fedoraproject.org> - 5.10.6-200 +- Linux v5.10.6 + * Thu Jan 7 2021 Justin M. Forbes <jforbes@fedoraproject.org> - Fix bluetooth controller initialization (rhbz 1898495) @@ -1,2 +1,2 @@ SHA512 (linux-5.10.tar.xz) = c28d52bc0c1e2c99017ceeca0bf2e622427f3416e0692090b01f65e3b3a5bce0e3e52ce3cee15d71e84fcb965bd48bdfcccb818c0105035d712ebd07afde9452 -SHA512 (patch-5.10.5.xz) = a6f240134f82b15a368a3348880764ee0289d8bf898a20e79298faad050a5426a87627233602f6cc7629f68070bf14e34bfe2ee72a9ff5c24e36ce18f3fc8e3a +SHA512 (patch-5.10.6.xz) = 54e74994a27b6a753717c778e5a550fd5db0f4acd24095f9b6e6d7cbb5c914be2f914d34865c9453d85a37873f0575fc5af54374ea1fe6e6d313d978e739d58f |