From 45c77d097d2793bcd7bae5b2688416fc89336297 Mon Sep 17 00:00:00 2001 From: Jeremy Cline Date: Thu, 13 Dec 2018 11:57:21 -0500 Subject: Linux v4.19.9 --- ...Fix-speaker-output-regression-on-Thinkpad.patch | 59 ---------------------- ...dio-fix-UAF-decrement-if-card-has-no-live.patch | 49 ------------------ kernel.spec | 11 ++-- sources | 2 +- 4 files changed, 5 insertions(+), 116 deletions(-) delete mode 100644 ALSA-hda-realtek-Fix-speaker-output-regression-on-Thinkpad.patch delete mode 100644 alsa-usb-audio-fix-UAF-decrement-if-card-has-no-live.patch diff --git a/ALSA-hda-realtek-Fix-speaker-output-regression-on-Thinkpad.patch b/ALSA-hda-realtek-Fix-speaker-output-regression-on-Thinkpad.patch deleted file mode 100644 index 6bf0997a1..000000000 --- a/ALSA-hda-realtek-Fix-speaker-output-regression-on-Thinkpad.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 54947cd64c1b8290f64bb2958e343c07270e3a58 Mon Sep 17 00:00:00 2001 -From: Takashi Iwai -Date: Mon, 3 Dec 2018 10:44:15 +0100 -Subject: [PATCH] ALSA: hda/realtek - Fix speaker output regression on Thinkpad - T570 - -We've got a regression report for some Thinkpad models (at least -T570s) which shows the too low speaker output volume. The bisection -leaded to the commit 61fcf8ece9b6 ("ALSA: hda/realtek - Enable Thinkpad -Dock device for ALC298 platform"), and it's basically adding the two -pin configurations for the dock, and looks harmless. - -The real culprit seems, though, that the DAC assignment for the -speaker pin is implicitly assumed on these devices, i.e. pin NID 0x14 -to be coupled with DAC NID 0x03. When more pins are configured by the -commit above, the auto-parser changes the DAC assignment, and this -resulted in the regression. - -As a workaround, just provide the fixed pin / DAC mapping table for -this Thinkpad fixup function. It's no generic solution, but the -problem itself is pretty much device-specific, so must be good -enough. - -Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1554304 -Fixes: 61fcf8ece9b6 ("ALSA: hda/realtek - Enable Thinkpad Dock device for ALC298 platform") -Cc: -Reported-and-tested-by: Jeremy Cline -Signed-off-by: Takashi Iwai -Signed-off-by: Jeremy Cline ---- - sound/pci/hda/patch_realtek.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 06f93032d0cc..802f1f1b3a19 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -4988,9 +4988,18 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec, - { 0x19, 0x21a11010 }, /* dock mic */ - { } - }; -+ /* Assure the speaker pin to be coupled with DAC NID 0x03; otherwise -+ * the speaker output becomes too low by some reason on Thinkpads with -+ * ALC298 codec -+ */ -+ static hda_nid_t preferred_pairs[] = { -+ 0x14, 0x03, 0x17, 0x02, 0x21, 0x02, -+ 0 -+ }; - struct alc_spec *spec = codec->spec; - - if (action == HDA_FIXUP_ACT_PRE_PROBE) { -+ spec->gen.preferred_dacs = preferred_pairs; - spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP; - snd_hda_apply_pincfgs(codec, pincfgs); - } else if (action == HDA_FIXUP_ACT_INIT) { --- -2.19.2 - diff --git a/alsa-usb-audio-fix-UAF-decrement-if-card-has-no-live.patch b/alsa-usb-audio-fix-UAF-decrement-if-card-has-no-live.patch deleted file mode 100644 index 6dc9fa5d0..000000000 --- a/alsa-usb-audio-fix-UAF-decrement-if-card-has-no-live.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 5f8cf712582617d523120df67d392059eaf2fc4b Mon Sep 17 00:00:00 2001 -From: Hui Peng -Date: Mon, 3 Dec 2018 16:09:34 +0100 -Subject: ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in - card.c - -If a USB sound card reports 0 interfaces, an error condition is triggered -and the function usb_audio_probe errors out. In the error path, there was a -use-after-free vulnerability where the memory object of the card was first -freed, followed by a decrement of the number of active chips. Moving the -decrement above the atomic_dec fixes the UAF. - -[ The original problem was introduced in 3.1 kernel, while it was - developed in a different form. The Fixes tag below indicates the - original commit but it doesn't mean that the patch is applicable - cleanly. -- tiwai ] - -Fixes: 362e4e49abe5 ("ALSA: usb-audio - clear chip->probing on error exit") -Reported-by: Hui Peng -Reported-by: Mathias Payer -Signed-off-by: Hui Peng -Signed-off-by: Mathias Payer -Cc: -Signed-off-by: Takashi Iwai ---- - sound/usb/card.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/sound/usb/card.c b/sound/usb/card.c -index 2bfe4e80a6b9..a105947eaf55 100644 ---- a/sound/usb/card.c -+++ b/sound/usb/card.c -@@ -682,9 +682,12 @@ static int usb_audio_probe(struct usb_interface *intf, - - __error: - if (chip) { -+ /* chip->active is inside the chip->card object, -+ * decrement before memory is possibly returned. -+ */ -+ atomic_dec(&chip->active); - if (!chip->num_interfaces) - snd_card_free(chip->card); -- atomic_dec(&chip->active); - } - mutex_unlock(®ister_mutex); - return err; --- -cgit 1.2-0.3.lf.el7 - diff --git a/kernel.spec b/kernel.spec index 416f333b5..0df8ca429 100644 --- a/kernel.spec +++ b/kernel.spec @@ -54,7 +54,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 8 +%define stable_update 9 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -627,12 +627,6 @@ Patch510: iio-accel-kxcjk1013-Add-more-hardware-ids.patch # rhbz 1645070 patch queued upstream for merging into 4.21 Patch516: asus-fx503-keyb.patch -# rbhz 1554304 patch in the sound tree and Cc'd for stable -Patch517: ALSA-hda-realtek-Fix-speaker-output-regression-on-Thinkpad.patch - -# CVE-2018-19824 rhbz 1655816 1655817 -Patch518: alsa-usb-audio-fix-UAF-decrement-if-card-has-no-live.patch - # END OF PATCH DEFINITIONS %endif @@ -1884,6 +1878,9 @@ fi # # %changelog +* Thu Dec 13 2018 Jeremy Cline - 4.19.9-200 +- Linux v4.19.9 + * Tue Dec 11 2018 Hans de Goede - Really fix non functional hotkeys on Asus FX503VD (#1645070) diff --git a/sources b/sources index 29c5ee70b..368230314 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (linux-4.19.tar.xz) = ab67cc746b375a8b135e8b23e35e1d6787930d19b3c26b2679787d62951cbdbc3bb66f8ededeb9b890e5008b2459397f9018f1a6772fdef67780b06a4cb9f6f4 -SHA512 (patch-4.19.8.xz) = c53092846a7f9a3d34eaf42085d2b404fd85e1acebe11b3f18c98123ce317012ec71d51fb5cb0f5db865f3a46a82f026db5ea02032f579c20cbea7dc15b5e145 +SHA512 (patch-4.19.9.xz) = d0eef9c50f754f4df8812b796ea25052edbf4815289c5a35cc14fe8b4e67fa9b9fcab5a4c6d695c2a0db8ef92f1fe51907fa96c775487c5e8a1482ca6d5b271f -- cgit