From 2a7f414faf59b4dd100415e156e009a6bbfdc2fb Mon Sep 17 00:00:00 2001 From: "Justin M. Forbes" Date: Thu, 13 Jun 2019 09:12:02 -0500 Subject: Fix CVE-2019-10126 (rhbz 1716992 1720122) --- kernel.spec | 6 + ...ap-overflow-in-mwifiex_uap_parse_tail_ies.patch | 173 +++++++++++++++++++++ 2 files changed, 179 insertions(+) create mode 100644 mwifiex-Fix-heap-overflow-in-mwifiex_uap_parse_tail_ies.patch diff --git a/kernel.spec b/kernel.spec index ea706d09e..bfa4af747 100644 --- a/kernel.spec +++ b/kernel.spec @@ -626,6 +626,9 @@ Patch539: usb-dwc2-Fix-DMA-cache-alignment-issues.patch # Mainlined, https://bugzilla.redhat.com/show_bug.cgi?id=1716289 Patch540: 0001-netfilter-nat-fix-udp-checksum-corruption.patch +# CVE-2019-10126 rhbz 1716992 1720122 +Patch541: mwifiex-Fix-heap-overflow-in-mwifiex_uap_parse_tail_ies.patch + # END OF PATCH DEFINITIONS %endif @@ -1864,6 +1867,9 @@ fi # # %changelog +* Thu Jun 13 2019 Justin M. Forbes +- Fix CVE-2019-10126 (rhbz 1716992 1720122) + * Tue Jun 11 2019 Jeremy Cline - 5.1.9-300 - Linux v5.1.9 - Fix UDP checkshums for SIP packets (rhbz 1716289) diff --git a/mwifiex-Fix-heap-overflow-in-mwifiex_uap_parse_tail_ies.patch b/mwifiex-Fix-heap-overflow-in-mwifiex_uap_parse_tail_ies.patch new file mode 100644 index 000000000..c9a0f13a7 --- /dev/null +++ b/mwifiex-Fix-heap-overflow-in-mwifiex_uap_parse_tail_ies.patch @@ -0,0 +1,173 @@ +From patchwork Fri May 31 13:18:41 2019 +Content-Type: text/plain; charset="utf-8" +MIME-Version: 1.0 +Content-Transfer-Encoding: 7bit +X-Patchwork-Submitter: Takashi Iwai +X-Patchwork-Id: 10970141 +X-Patchwork-Delegate: kvalo@adurom.com +Return-Path: +Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org + [172.30.200.125]) + by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id A2FA614C0 + for ; + Fri, 31 May 2019 13:19:19 +0000 (UTC) +Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) + by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 914E928CA2 + for ; + Fri, 31 May 2019 13:19:19 +0000 (UTC) +Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) + id 858EA28CA3; Fri, 31 May 2019 13:19:19 +0000 (UTC) +X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on + pdx-wl-mail.web.codeaurora.org +X-Spam-Level: +X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, + RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 +Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) + by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C4AB628CB5 + for ; + Fri, 31 May 2019 13:19:18 +0000 (UTC) +Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand + id S1726687AbfEaNTR (ORCPT + ); + Fri, 31 May 2019 09:19:17 -0400 +Received: from mx2.suse.de ([195.135.220.15]:46148 "EHLO mx1.suse.de" + rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP + id S1726330AbfEaNTR (ORCPT ); + Fri, 31 May 2019 09:19:17 -0400 +X-Virus-Scanned: by amavisd-new at test-mx.suse.de +Received: from relay2.suse.de (unknown [195.135.220.254]) + by mx1.suse.de (Postfix) with ESMTP id A72A4AE4D; + Fri, 31 May 2019 13:19:15 +0000 (UTC) +From: Takashi Iwai +To: Kalle Valo +Cc: Amitkumar Karwar , + Nishant Sarmukadam , + Ganapathi Bhat , + Xinming Hu , + huangwen , + Solar Designer , + Marcus Meissner , + linux-wireless@vger.kernel.org +Subject: [PATCH] mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies() +Date: Fri, 31 May 2019 15:18:41 +0200 +Message-Id: <20190531131841.7552-1-tiwai@suse.de> +X-Mailer: git-send-email 2.16.4 +Sender: linux-wireless-owner@vger.kernel.org +Precedence: bulk +List-ID: +X-Mailing-List: linux-wireless@vger.kernel.org +X-Virus-Scanned: ClamAV using ClamSMTP + +A few places in mwifiex_uap_parse_tail_ies() perform memcpy() +unconditionally, which may lead to either buffer overflow or read over +boundary. + +This patch addresses the issues by checking the read size and the +destination size at each place more properly. Along with the fixes, +the patch cleans up the code slightly by introducing a temporary +variable for the token size, and unifies the error path with the +standard goto statement. + +Reported-by: huangwen +Signed-off-by: Takashi Iwai +--- + drivers/net/wireless/marvell/mwifiex/ie.c | 47 ++++++++++++++++++++----------- + 1 file changed, 31 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/ie.c b/drivers/net/wireless/marvell/mwifiex/ie.c +index 6845eb57b39a..653d347a9a19 100644 +--- a/drivers/net/wireless/marvell/mwifiex/ie.c ++++ b/drivers/net/wireless/marvell/mwifiex/ie.c +@@ -329,6 +329,8 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv, + struct ieee80211_vendor_ie *vendorhdr; + u16 gen_idx = MWIFIEX_AUTO_IDX_MASK, ie_len = 0; + int left_len, parsed_len = 0; ++ unsigned int token_len; ++ int err = 0; + + if (!info->tail || !info->tail_len) + return 0; +@@ -344,6 +346,12 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv, + */ + while (left_len > sizeof(struct ieee_types_header)) { + hdr = (void *)(info->tail + parsed_len); ++ token_len = hdr->len + sizeof(struct ieee_types_header); ++ if (token_len > left_len) { ++ err = -EINVAL; ++ goto out; ++ } ++ + switch (hdr->element_id) { + case WLAN_EID_SSID: + case WLAN_EID_SUPP_RATES: +@@ -361,17 +369,20 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv, + if (cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT, + WLAN_OUI_TYPE_MICROSOFT_WMM, + (const u8 *)hdr, +- hdr->len + sizeof(struct ieee_types_header))) ++ token_len)) + break; + /* fall through */ + default: +- memcpy(gen_ie->ie_buffer + ie_len, hdr, +- hdr->len + sizeof(struct ieee_types_header)); +- ie_len += hdr->len + sizeof(struct ieee_types_header); ++ if (ie_len + token_len > IEEE_MAX_IE_SIZE) { ++ err = -EINVAL; ++ goto out; ++ } ++ memcpy(gen_ie->ie_buffer + ie_len, hdr, token_len); ++ ie_len += token_len; + break; + } +- left_len -= hdr->len + sizeof(struct ieee_types_header); +- parsed_len += hdr->len + sizeof(struct ieee_types_header); ++ left_len -= token_len; ++ parsed_len += token_len; + } + + /* parse only WPA vendor IE from tail, WMM IE is configured by +@@ -381,15 +392,17 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv, + WLAN_OUI_TYPE_MICROSOFT_WPA, + info->tail, info->tail_len); + if (vendorhdr) { +- memcpy(gen_ie->ie_buffer + ie_len, vendorhdr, +- vendorhdr->len + sizeof(struct ieee_types_header)); +- ie_len += vendorhdr->len + sizeof(struct ieee_types_header); ++ token_len = vendorhdr->len + sizeof(struct ieee_types_header); ++ if (ie_len + token_len > IEEE_MAX_IE_SIZE) { ++ err = -EINVAL; ++ goto out; ++ } ++ memcpy(gen_ie->ie_buffer + ie_len, vendorhdr, token_len); ++ ie_len += token_len; + } + +- if (!ie_len) { +- kfree(gen_ie); +- return 0; +- } ++ if (!ie_len) ++ goto out; + + gen_ie->ie_index = cpu_to_le16(gen_idx); + gen_ie->mgmt_subtype_mask = cpu_to_le16(MGMT_MASK_BEACON | +@@ -399,13 +412,15 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv, + + if (mwifiex_update_uap_custom_ie(priv, gen_ie, &gen_idx, NULL, NULL, + NULL, NULL)) { +- kfree(gen_ie); +- return -1; ++ err = -EINVAL; ++ goto out; + } + + priv->gen_idx = gen_idx; ++ ++ out: + kfree(gen_ie); +- return 0; ++ return err; + } + + /* This function parses different IEs-head & tail IEs, beacon IEs, -- cgit From 69fb81e57fac18f8a41693c9ac55f04aa2f448a3 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Fri, 14 Jun 2019 12:00:20 +0200 Subject: Fix the LCD panel an Asus EeePC 1025C not lighting up (rhbz#1697069) Fix the LCD panel on the GPD MicroPC not working --- ...i-Use-a-fuzzy-check-for-burst-mode-clock-.patch | 77 ++++++++++ ...6-asus-wmi-Only-Tell-EC-the-OS-will-handl.patch | 161 +++++++++++++++++++++ drm-panel-orientation-quirks.patch | 113 +++++++++++++++ efi-bgrt-acpi6.2-support.patch | 82 +++++++++++ kernel.spec | 12 ++ 5 files changed, 445 insertions(+) create mode 100644 0001-drm-i915-dsi-Use-a-fuzzy-check-for-burst-mode-clock-.patch create mode 100644 0001-platform-x86-asus-wmi-Only-Tell-EC-the-OS-will-handl.patch create mode 100644 drm-panel-orientation-quirks.patch create mode 100644 efi-bgrt-acpi6.2-support.patch diff --git a/0001-drm-i915-dsi-Use-a-fuzzy-check-for-burst-mode-clock-.patch b/0001-drm-i915-dsi-Use-a-fuzzy-check-for-burst-mode-clock-.patch new file mode 100644 index 000000000..51a5a3a85 --- /dev/null +++ b/0001-drm-i915-dsi-Use-a-fuzzy-check-for-burst-mode-clock-.patch @@ -0,0 +1,77 @@ +From f158b268ddbb3758dec49861bdf3ad8c9aae2e87 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 29 Nov 2018 12:40:05 +0100 +Subject: [PATCH] drm/i915/dsi: Use a fuzzy check for burst mode clock check + +Prior to this commit we fail to init the DSI panel on the GPD MicroPC: +https://www.indiegogo.com/projects/gpd-micropc-6-inch-handheld-industry-laptop#/ + +The problem is intel_dsi_vbt_init() failing with the following error: +*ERROR* Burst mode freq is less than computed + +The pclk in the VBT panel modeline is 70000, together with 24 bpp and +4 lines this results in a bitrate value of 70000 * 24 / 4 = 420000. +But the target_burst_mode_freq in the VBT is 418000. + +This commit works around this problem by adding an intel_fuzzy_clock_check +when target_burst_mode_freq < bitrate and setting target_burst_mode_freq to +bitrate when that checks succeeds, fixing the panel not working. + +Cc: stable@vger.kernel.org +Signed-off-by: Hans de Goede +--- + drivers/gpu/drm/i915/intel_display.c | 2 +- + drivers/gpu/drm/i915/intel_drv.h | 1 + + drivers/gpu/drm/i915/intel_dsi_vbt.c | 11 +++++++++++ + 3 files changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 5098228f1302..ceb78f44f087 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -11942,7 +11942,7 @@ intel_modeset_pipe_config(struct drm_crtc *crtc, + return 0; + } + +-static bool intel_fuzzy_clock_check(int clock1, int clock2) ++bool intel_fuzzy_clock_check(int clock1, int clock2) + { + int diff; + +diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h +index a38b9cff5cd0..e85cd377a652 100644 +--- a/drivers/gpu/drm/i915/intel_drv.h ++++ b/drivers/gpu/drm/i915/intel_drv.h +@@ -1742,6 +1742,7 @@ int vlv_force_pll_on(struct drm_i915_private *dev_priv, enum pipe pipe, + const struct dpll *dpll); + void vlv_force_pll_off(struct drm_i915_private *dev_priv, enum pipe pipe); + int lpt_get_iclkip(struct drm_i915_private *dev_priv); ++bool intel_fuzzy_clock_check(int clock1, int clock2); + + /* modesetting asserts */ + void assert_panel_unlocked(struct drm_i915_private *dev_priv, +diff --git a/drivers/gpu/drm/i915/intel_dsi_vbt.c b/drivers/gpu/drm/i915/intel_dsi_vbt.c +index 3074448446bc..4b8e48db1843 100644 +--- a/drivers/gpu/drm/i915/intel_dsi_vbt.c ++++ b/drivers/gpu/drm/i915/intel_dsi_vbt.c +@@ -853,6 +853,17 @@ bool intel_dsi_vbt_init(struct intel_dsi *intel_dsi, u16 panel_id) + if (mipi_config->target_burst_mode_freq) { + u32 bitrate = intel_dsi_bitrate(intel_dsi); + ++ /* ++ * Sometimes the VBT contains a slightly lower clock, ++ * then the bitrate we have calculated, in this case ++ * just replace it with the calculated bitrate. ++ */ ++ if (mipi_config->target_burst_mode_freq < bitrate && ++ intel_fuzzy_clock_check( ++ mipi_config->target_burst_mode_freq, ++ bitrate)) ++ mipi_config->target_burst_mode_freq = bitrate; ++ + if (mipi_config->target_burst_mode_freq < bitrate) { + DRM_ERROR("Burst mode freq is less than computed\n"); + return false; +-- +2.21.0 + diff --git a/0001-platform-x86-asus-wmi-Only-Tell-EC-the-OS-will-handl.patch b/0001-platform-x86-asus-wmi-Only-Tell-EC-the-OS-will-handl.patch new file mode 100644 index 000000000..84e529c1d --- /dev/null +++ b/0001-platform-x86-asus-wmi-Only-Tell-EC-the-OS-will-handl.patch @@ -0,0 +1,161 @@ +Delivered-To: hdegoede@gapps.redhat.com +Received: by 2002:ac9:6402:0:0:0:0:0 with SMTP id r2csp1159009ock; + Mon, 20 May 2019 23:28:40 -0700 (PDT) +X-Google-Smtp-Source: APXvYqzEtwqq6Q1hbrBqTEFvHJuczfsldfTxiiS018/hst2dmGipO/i52QcWyXJaIxAb/ecz61yL +X-Received: by 2002:a05:620a:1116:: with SMTP id o22mr60937067qkk.23.1558420120852; + Mon, 20 May 2019 23:28:40 -0700 (PDT) +ARC-Seal: i=1; a=rsa-sha256; t=1558420120; cv=none; + d=google.com; s=arc-20160816; + b=j/NtlSCAGn5q9DlinYEqsw+9oDJu7zz7hZdeHecj2hwygNbfIbK6CHEBtQws9lpBM2 + 2X/7zdY451jiHHtP8cXvYsVRkvlIyOgd7jagu+kIOpgVY+IoiEW0UzuWY/dUMwQTK6D+ + CD9FmPs0hMdTVx8++AHS3N+SNujtJcFpRngUYfPJ0YOmbQJGt4nKRKaW0kkZD1pBsK91 + +YhTSQqz4e2xZ02r0LbfWgYWyE1ppjjz53nTq6ezyvKhQ84JViMf5kFMoGUDKoLRVH5U + sH5xsZCzzGptH0dA6oJJzk8rjDc+puOwJWIW8D5fsCz93a0rRi/ia5rfsN54P/MpPMgQ + DsHg== +ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; + h=content-transfer-encoding:mime-version:message-id:date:subject:cc + :to:from:delivered-to; + bh=KdOwY7jBol7uA/PFFDO66V1bihnYwiif3YrjkSKRUiA=; + b=gSM2abji2zLjywkvGpQ72oLfbsLhc8/waOBxP9JVMgMzkd6YXKAMdqeDG78UgEUkZX + RS//NNHSAIA+CDPrZHd9IBuV/GA887Hoezn4lryvCIYVNjoWOcBuFlG5/ix32GqMUNs5 + gQDcToEn7rWl2LJpuhgMDLfvCcV8B77lRJThslE6zeeLR/M4lTklAl2epcopBQmZqXqS + QaIJg7rndM61R469mrv9TLpaBxun3CAA8OQ+W0+j059ZoiGUMIJ4ZsuMCpvTHp4gQ5fe + EmXXpAFxUE8a70UmSgRqIDbaqC6ik9ox9yCLhu1Aby5fvHeBW78nA83obbfix90uBmak + QVag== +ARC-Authentication-Results: i=1; mx.google.com; + spf=pass (google.com: domain gapps.redhat.com configured 209.132.183.28 as internal address) smtp.mailfrom=hdegoede@redhat.com +Return-Path: +Received: from mx1.redhat.com (mx1.redhat.com. [209.132.183.28]) + by mx.google.com with ESMTPS id a51si948515qta.226.2019.05.20.23.28.40 + for + (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); + Mon, 20 May 2019 23:28:40 -0700 (PDT) +Received-SPF: pass (google.com: domain gapps.redhat.com configured 209.132.183.28 as internal address) +Authentication-Results: mx.google.com; + spf=pass (google.com: domain gapps.redhat.com configured 209.132.183.28 as internal address) smtp.mailfrom=hdegoede@redhat.com +Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) + (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) + (No client certificate requested) + by mx1.redhat.com (Postfix) with ESMTPS id 1EB1285539 + for ; Tue, 21 May 2019 06:28:40 +0000 (UTC) +Received: by smtp.corp.redhat.com (Postfix) + id 18D0E19C67; Tue, 21 May 2019 06:28:40 +0000 (UTC) +Delivered-To: hdegoede@redhat.com +Received: from shalem.localdomain.com (ovpn-116-215.ams2.redhat.com [10.36.116.215]) + by smtp.corp.redhat.com (Postfix) with ESMTP id 8119F19C5B; + Tue, 21 May 2019 06:28:38 +0000 (UTC) +From: Hans de Goede +To: Darren Hart , + Andy Shevchenko , + Corentin Chary +Cc: Hans de Goede , + acpi4asus-user@lists.sourceforge.net, + platform-driver-x86@vger.kernel.org, + linux-kernel@vger.kernel.org, + =?UTF-8?q?Jo=C3=A3o=20Paulo=20Rechi=20Vita?= +Subject: [PATCH] platform/x86: asus-wmi: Only Tell EC the OS will handle display hotkeys from asus_nb_wmi +Date: Tue, 21 May 2019 08:28:37 +0200 +Message-Id: <20190521062837.3887-1-hdegoede@redhat.com> +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 +X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Tue, 21 May 2019 06:28:40 +0000 (UTC) + +Commit 78f3ac76d9e5 ("platform/x86: asus-wmi: Tell the EC the OS will +handle the display off hotkey") causes the backlight to be permanently off +on various EeePC laptop models using the eeepc-wmi driver (Asus EeePC +1015BX, Asus EeePC 1025C). + +The asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL) call added +by that commit is made conditional in this commit and only enabled in +the quirk_entry structs in the asus-nb-wmi driver fixing the broken +display / backlight on various EeePC laptop models. + +Cc: João Paulo Rechi Vita +Fixes: 78f3ac76d9e5 ("platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey") +Signed-off-by: Hans de Goede +--- + drivers/platform/x86/asus-nb-wmi.c | 8 ++++++++ + drivers/platform/x86/asus-wmi.c | 2 +- + drivers/platform/x86/asus-wmi.h | 1 + + 3 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index b6f2ff95c3ed..59f3a37a44d7 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -78,10 +78,12 @@ static bool asus_q500a_i8042_filter(unsigned char data, unsigned char str, + + static struct quirk_entry quirk_asus_unknown = { + .wapf = 0, ++ .wmi_backlight_set_devstate = true, + }; + + static struct quirk_entry quirk_asus_q500a = { + .i8042_filter = asus_q500a_i8042_filter, ++ .wmi_backlight_set_devstate = true, + }; + + /* +@@ -92,26 +94,32 @@ static struct quirk_entry quirk_asus_q500a = { + static struct quirk_entry quirk_asus_x55u = { + .wapf = 4, + .wmi_backlight_power = true, ++ .wmi_backlight_set_devstate = true, + .no_display_toggle = true, + }; + + static struct quirk_entry quirk_asus_wapf4 = { + .wapf = 4, ++ .wmi_backlight_set_devstate = true, + }; + + static struct quirk_entry quirk_asus_x200ca = { + .wapf = 2, ++ .wmi_backlight_set_devstate = true, + }; + + static struct quirk_entry quirk_asus_ux303ub = { + .wmi_backlight_native = true, ++ .wmi_backlight_set_devstate = true, + }; + + static struct quirk_entry quirk_asus_x550lb = { ++ .wmi_backlight_set_devstate = true, + .xusb2pr = 0x01D9, + }; + + static struct quirk_entry quirk_asus_forceals = { ++ .wmi_backlight_set_devstate = true, + .wmi_force_als_set = true, + }; + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index ee1fa93708ec..a66e99500c12 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -2131,7 +2131,7 @@ static int asus_wmi_add(struct platform_device *pdev) + err = asus_wmi_backlight_init(asus); + if (err && err != -ENODEV) + goto fail_backlight; +- } else ++ } else if (asus->driver->quirks->wmi_backlight_set_devstate) + err = asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL); + + status = wmi_install_notify_handler(asus->driver->event_guid, +diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h +index 6c1311f4b04d..57a79bddb286 100644 +--- a/drivers/platform/x86/asus-wmi.h ++++ b/drivers/platform/x86/asus-wmi.h +@@ -44,6 +44,7 @@ struct quirk_entry { + bool store_backlight_power; + bool wmi_backlight_power; + bool wmi_backlight_native; ++ bool wmi_backlight_set_devstate; + bool wmi_force_als_set; + int wapf; + /* +-- +2.21.0 + diff --git a/drm-panel-orientation-quirks.patch b/drm-panel-orientation-quirks.patch new file mode 100644 index 000000000..7504fab7b --- /dev/null +++ b/drm-panel-orientation-quirks.patch @@ -0,0 +1,113 @@ +From 0dfd69f0ef79517b722c36000b20c64a6263519d Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Tue, 21 May 2019 17:02:15 +0200 +Subject: [PATCH 1/2] drm: panel-orientation-quirks: Add quirk for GPD pocket2 + +GPD has done it again, make a nice device (good), use way too generic +DMI strings (bad) and use a portrait screen rotated 90 degrees (ugly). + +Because of the too generic DMI strings this entry is also doing bios-date +matching, so the gpd_pocket2 data struct may very well need to be updated +with some extra bios-dates in the future. + +Changes in v2: +-Add one more known BIOS date to the list of BIOS dates + +Cc: Jurgen Kramer +Reported-by: Jurgen Kramer +Signed-off-by: Hans de Goede +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 521aff99b08a..98679c831f66 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -50,6 +50,14 @@ static const struct drm_dmi_panel_orientation_data gpd_pocket = { + .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, + }; + ++static const struct drm_dmi_panel_orientation_data gpd_pocket2 = { ++ .width = 1200, ++ .height = 1920, ++ .bios_dates = (const char * const []){ "06/28/2018", "08/28/2018", ++ "12/07/2018", NULL }, ++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, ++}; ++ + static const struct drm_dmi_panel_orientation_data gpd_win = { + .width = 720, + .height = 1280, +@@ -112,6 +120,14 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"), + }, + .driver_data = (void *)&gpd_pocket, ++ }, { /* GPD Pocket 2 (generic strings, also match on bios date) */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"), ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"), ++ }, ++ .driver_data = (void *)&gpd_pocket2, + }, { /* GPD Win (same note on DMI match as GPD Pocket) */ + .matches = { + DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"), +-- +2.21.0 + +From de2393a0d476c441c7afb4e5df1c31e53aef2cbc Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Thu, 23 May 2019 12:09:29 +0200 +Subject: [PATCH 2/2] drm: panel-orientation-quirks: Add quirk for GPD MicroPC + +GPD has done it again, make a nice device (good), use way too generic +DMI strings (bad) and use a portrait screen rotated 90 degrees (ugly). + +Because of the too generic DMI strings this entry is also doing bios-date +matching, so the gpd_micropc data struct may very well need to be updated +with some extra bios-dates in the future. + +Signed-off-by: Hans de Goede +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 98679c831f66..d8a0bcd02f34 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -42,6 +42,14 @@ static const struct drm_dmi_panel_orientation_data asus_t100ha = { + .orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP, + }; + ++static const struct drm_dmi_panel_orientation_data gpd_micropc = { ++ .width = 720, ++ .height = 1280, ++ .bios_dates = (const char * const []){ "04/26/2019", ++ NULL }, ++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, ++}; ++ + static const struct drm_dmi_panel_orientation_data gpd_pocket = { + .width = 1200, + .height = 1920, +@@ -107,6 +115,14 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100HAN"), + }, + .driver_data = (void *)&asus_t100ha, ++ }, { /* GPD MicroPC (generic strings, also match on bios date) */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"), ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"), ++ }, ++ .driver_data = (void *)&gpd_micropc, + }, { /* + * GPD Pocket, note that the the DMI data is less generic then + * it seems, devices with a board-vendor of "AMI Corporation" +-- +2.21.0 + diff --git a/efi-bgrt-acpi6.2-support.patch b/efi-bgrt-acpi6.2-support.patch new file mode 100644 index 000000000..753c93577 --- /dev/null +++ b/efi-bgrt-acpi6.2-support.patch @@ -0,0 +1,82 @@ +From 240090cb2d72f5de98f8fc2e3aa27803cab378b2 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 29 May 2019 14:50:17 +0200 +Subject: [PATCH] efi/bgrt: Drop BGRT status field reserved bits check + +Starting with ACPI 6.2 bits 1 and 2 of the BGRT status field are no longer +reserved. These bits are now used to indicate if the image needs to be +rotated before being displayed. + +The first device using these bits has now shown up (the GPD MicroPC) and +the reserved bits check causes us to reject the valid BGRT table on this +device. + +Rather then changing the reserved bits check, allowing only the 2 new bits, +instead just completely remove it so that we do not end up with a similar +problem when more bits are added in the future. + +Signed-off-by: Hans de Goede +--- + drivers/firmware/efi/efi-bgrt.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/firmware/efi/efi-bgrt.c b/drivers/firmware/efi/efi-bgrt.c +index a2384184a7de..b07c17643210 100644 +--- a/drivers/firmware/efi/efi-bgrt.c ++++ b/drivers/firmware/efi/efi-bgrt.c +@@ -47,11 +47,6 @@ void __init efi_bgrt_init(struct acpi_table_header *table) + bgrt->version); + goto out; + } +- if (bgrt->status & 0xfe) { +- pr_notice("Ignoring BGRT: reserved status bits are non-zero %u\n", +- bgrt->status); +- goto out; +- } + if (bgrt->image_type != 0) { + pr_notice("Ignoring BGRT: invalid image type %u (expected 0)\n", + bgrt->image_type); +-- +2.21.0 + +From 8f8d779bd966ef8af2279906772dec322220e73a Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 29 May 2019 15:44:09 +0200 +Subject: [PATCH] efifb: BGRT: Add check for new BGRT status field rotation + bits + +Starting with ACPI 6.2 bits 1 and 2 of the BGRT status field are no longer +reserved. These bits are now used to indicate if the image needs to be +rotated before being displayed. + +The efifb code does not support rotating the image before copying it to +the screen. + +This commit adds a check for these new bits and if they are set leaves the +fb contents as is instead of trying to use the un-rotated BGRT image. + +Acked-by: Ard Biesheuvel +Signed-off-by: Hans de Goede +--- + drivers/video/fbdev/efifb.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c +index 9f39f0c360e0..dfa8dd47d19d 100644 +--- a/drivers/video/fbdev/efifb.c ++++ b/drivers/video/fbdev/efifb.c +@@ -169,6 +169,11 @@ static void efifb_show_boot_graphics(struct fb_info *info) + return; + } + ++ if (bgrt_tab.status & 0x06) { ++ pr_info("efifb: BGRT rotation bits set, not showing boot graphics\n"); ++ return; ++ } ++ + /* Avoid flashing the logo if we're going to print std probe messages */ + if (console_loglevel > CONSOLE_LOGLEVEL_QUIET) + return; +-- +2.21.0 + diff --git a/kernel.spec b/kernel.spec index bfa4af747..867426f07 100644 --- a/kernel.spec +++ b/kernel.spec @@ -629,6 +629,14 @@ Patch540: 0001-netfilter-nat-fix-udp-checksum-corruption.patch # CVE-2019-10126 rhbz 1716992 1720122 Patch541: mwifiex-Fix-heap-overflow-in-mwifiex_uap_parse_tail_ies.patch +# 1697069 LCD panel an Asus EeePC 1025C not lighting up, submitted upstream +Patch542: 0001-platform-x86-asus-wmi-Only-Tell-EC-the-OS-will-handl.patch + +# Fix the LCD panel on the GPD MicroPC not working, pending as fixes for 5.2 +Patch543: 0001-drm-i915-dsi-Use-a-fuzzy-check-for-burst-mode-clock-.patch +Patch544: drm-panel-orientation-quirks.patch +Patch545: efi-bgrt-acpi6.2-support.patch + # END OF PATCH DEFINITIONS %endif @@ -1867,6 +1875,10 @@ fi # # %changelog +* Fri Jun 14 2019 Hans de Goede +- Fix the LCD panel an Asus EeePC 1025C not lighting up (rhbz#1697069) +- Fix the LCD panel on the GPD MicroPC not working + * Thu Jun 13 2019 Justin M. Forbes - Fix CVE-2019-10126 (rhbz 1716992 1720122) -- cgit