diff --git a/0001-HID-multitouch-Properly-deal-with-Win8-PTP-reports-w.patch b/0001-HID-multitouch-Properly-deal-with-Win8-PTP-reports-w.patch index e15ec6bb1..56bcc7ec6 100644 --- a/0001-HID-multitouch-Properly-deal-with-Win8-PTP-reports-w.patch +++ b/0001-HID-multitouch-Properly-deal-with-Win8-PTP-reports-w.patch @@ -1,8 +1,8 @@ -From f5c1da991de077420fda17a236342de5a0068f5d Mon Sep 17 00:00:00 2001 +From 8c6b638bb620eef53cb83ffe88d7b528f666af10 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Wed, 22 Nov 2017 12:57:08 +0100 -Subject: [PATCH v2 1/3] HID: multitouch: Properly deal with Win8 PTP reports - with 0 touches +Subject: [PATCH] HID: multitouch: Properly deal with Win8 PTP reports with 0 + touches The Windows Precision Touchpad spec "Figure 4 Button Only Down and Up" and "Table 9 Report Sequence for Button Only Down and Up" indicate @@ -24,7 +24,7 @@ Signed-off-by: Jiri Kosina 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c -index 9ef24b518f12..d8b1cad74faf 100644 +index 397592959238..0a42e19d914a 100644 --- a/drivers/hid/hid-multitouch.c +++ b/drivers/hid/hid-multitouch.c @@ -119,6 +119,9 @@ struct mt_device { @@ -50,19 +50,20 @@ index 9ef24b518f12..d8b1cad74faf 100644 return 1; case HID_DG_CONTACTCOUNT: /* Ignore if indexes are out of bounds. */ -@@ -855,9 +864,10 @@ static void mt_process_mt_event(struct hid_device *hid, struct hid_field *field, +@@ -866,10 +875,11 @@ static void mt_process_mt_event(struct hid_device *hid, struct hid_field *field, static void mt_touch_report(struct hid_device *hid, struct hid_report *report) { struct mt_device *td = hid_get_drvdata(hid); + __s32 cls = td->mtclass.name; struct hid_field *field; + bool first_packet; unsigned count; - int r, n; + int r, n, scantime = 0; /* sticky fingers release in progress, abort */ if (test_and_set_bit(MT_IO_FLAGS_RUNNING, &td->mt_io_flags)) -@@ -867,12 +877,29 @@ static void mt_touch_report(struct hid_device *hid, struct hid_report *report) +@@ -879,12 +889,29 @@ static void mt_touch_report(struct hid_device *hid, struct hid_report *report) * Includes multi-packet support where subsequent * packets are sent with zero contactcount. */ @@ -91,9 +92,9 @@ index 9ef24b518f12..d8b1cad74faf 100644 } + td->prev_scantime = scantime; + first_packet = td->num_received == 0; for (r = 0; r < report->maxfield; r++) { - field = report->field[r]; -@@ -1329,6 +1356,7 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id) +@@ -1342,6 +1369,7 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id) td->maxcontact_report_id = -1; td->inputmode_value = MT_INPUTMODE_TOUCHSCREEN; td->cc_index = -1; diff --git a/0002-HID-multitouch-Only-look-at-non-touch-fields-in-firs.patch b/0002-HID-multitouch-Only-look-at-non-touch-fields-in-firs.patch deleted file mode 100644 index 3ea374ff5..000000000 --- a/0002-HID-multitouch-Only-look-at-non-touch-fields-in-firs.patch +++ /dev/null @@ -1,84 +0,0 @@ -From c25d877f4ee97deb92170129eee4777a5d5997d9 Mon Sep 17 00:00:00 2001 -From: Hans de Goede -Date: Wed, 22 Nov 2017 12:57:09 +0100 -Subject: [PATCH v2 2/3] HID: multitouch: Only look at non touch fields in - first packet of a frame - -Devices in "single finger hybrid mode" will send one report per finger, -on some devices only the first report of such a multi-packet frame will -contain a value for BTN_LEFT, in subsequent reports (if multiple fingers -are down) the value is always 0, causing hid-mt to report BTN_LEFT going -1 - 0 - 1 - 0 when pressing a clickpad and putting down a second finger. -This happens for example on USB 0603:0002 mt touchpads. - -This commit fixes this by only reporting non touch fields for the first -packet of a (possibly) multi-packet frame. - -Signed-off-by: Hans de Goede -Reviewed-by: Benjamin Tissoires -Signed-off-by: Jiri Kosina ---- - drivers/hid/hid-multitouch.c | 17 +++++++++++++++-- - 1 file changed, 15 insertions(+), 2 deletions(-) - -diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c -index d8b1cad74faf..760c4a042e6a 100644 ---- a/drivers/hid/hid-multitouch.c -+++ b/drivers/hid/hid-multitouch.c -@@ -787,9 +787,11 @@ static int mt_touch_event(struct hid_device *hid, struct hid_field *field, - } - - static void mt_process_mt_event(struct hid_device *hid, struct hid_field *field, -- struct hid_usage *usage, __s32 value) -+ struct hid_usage *usage, __s32 value, -+ bool first_packet) - { - struct mt_device *td = hid_get_drvdata(hid); -+ __s32 cls = td->mtclass.name; - __s32 quirks = td->mtclass.quirks; - struct input_dev *input = field->hidinput->input; - -@@ -846,6 +848,15 @@ static void mt_process_mt_event(struct hid_device *hid, struct hid_field *field, - break; - - default: -+ /* -+ * For Win8 PTP touchpads we should only look at -+ * non finger/touch events in the first_packet of -+ * a (possible) multi-packet frame. -+ */ -+ if ((cls == MT_CLS_WIN_8 || cls == MT_CLS_WIN_8_DUAL) && -+ !first_packet) -+ return; -+ - if (usage->type) - input_event(input, usage->type, usage->code, - value); -@@ -866,6 +877,7 @@ static void mt_touch_report(struct hid_device *hid, struct hid_report *report) - struct mt_device *td = hid_get_drvdata(hid); - __s32 cls = td->mtclass.name; - struct hid_field *field; -+ bool first_packet; - unsigned count; - int r, n, scantime = 0; - -@@ -901,6 +913,7 @@ static void mt_touch_report(struct hid_device *hid, struct hid_report *report) - } - td->prev_scantime = scantime; - -+ first_packet = td->num_received == 0; - for (r = 0; r < report->maxfield; r++) { - field = report->field[r]; - count = field->report_count; -@@ -910,7 +923,7 @@ static void mt_touch_report(struct hid_device *hid, struct hid_report *report) - - for (n = 0; n < count; n++) - mt_process_mt_event(hid, field, &field->usage[n], -- field->value[n]); -+ field->value[n], first_packet); - } - - if (td->num_received >= td->num_expected) --- -2.14.3 - diff --git a/kernel-aarch64-debug.config b/kernel-aarch64-debug.config index fd2f21ddf..620b86dfb 100644 --- a/kernel-aarch64-debug.config +++ b/kernel-aarch64-debug.config @@ -1163,6 +1163,7 @@ CONFIG_DEBUG_SECTION_MISMATCH=y CONFIG_DEBUG_SET_MODULE_RONX=y CONFIG_DEBUG_SG=y CONFIG_DEBUG_SHIRQ=y +CONFIG_DEBUG_SHOW_MEMALLOC_LINE=y CONFIG_DEBUG_SLAB=y CONFIG_DEBUG_SPINLOCK=y CONFIG_DEBUG_STACK_USAGE=y @@ -1284,6 +1285,7 @@ CONFIG_DRM_DW_HDMI_AHB_AUDIO=m CONFIG_DRM_DW_HDMI_CEC=m CONFIG_DRM_DW_HDMI_I2S_AUDIO=m CONFIG_DRM_DW_HDMI=m +CONFIG_DRM_ETNAVIV_THERMAL=y CONFIG_DRM_FBDEV_EMULATION=y CONFIG_DRM_FBDEV_OVERALLOC=100 CONFIG_DRM_HDLCD=m diff --git a/kernel-aarch64.config b/kernel-aarch64.config index b0535812b..47ddc5e73 100644 --- a/kernel-aarch64.config +++ b/kernel-aarch64.config @@ -1155,6 +1155,7 @@ CONFIG_DEBUG_SECTION_MISMATCH=y CONFIG_DEBUG_SET_MODULE_RONX=y # CONFIG_DEBUG_SG is not set CONFIG_DEBUG_SHIRQ=y +CONFIG_DEBUG_SHOW_MEMALLOC_LINE=y # CONFIG_DEBUG_SPINLOCK is not set # CONFIG_DEBUG_STACK_USAGE is not set # CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set @@ -1274,6 +1275,7 @@ CONFIG_DRM_DW_HDMI_AHB_AUDIO=m CONFIG_DRM_DW_HDMI_CEC=m CONFIG_DRM_DW_HDMI_I2S_AUDIO=m CONFIG_DRM_DW_HDMI=m +CONFIG_DRM_ETNAVIV_THERMAL=y CONFIG_DRM_FBDEV_EMULATION=y CONFIG_DRM_FBDEV_OVERALLOC=100 CONFIG_DRM_HDLCD=m diff --git a/kernel-armv7hl-debug.config b/kernel-armv7hl-debug.config index d5386fed3..5afc6c7c7 100644 --- a/kernel-armv7hl-debug.config +++ b/kernel-armv7hl-debug.config @@ -1218,6 +1218,7 @@ CONFIG_DEBUG_RT_MUTEXES=y CONFIG_DEBUG_SET_MODULE_RONX=y CONFIG_DEBUG_SG=y CONFIG_DEBUG_SHIRQ=y +CONFIG_DEBUG_SHOW_MEMALLOC_LINE=y CONFIG_DEBUG_SLAB=y CONFIG_DEBUG_SPINLOCK=y CONFIG_DEBUG_STACK_USAGE=y @@ -1349,6 +1350,7 @@ CONFIG_DRM_DW_HDMI_I2S_AUDIO=m CONFIG_DRM_DW_HDMI=m CONFIG_DRM_ETNAVIV=m # CONFIG_DRM_ETNAVIV_REGISTER_LOGGING is not set +CONFIG_DRM_ETNAVIV_THERMAL=y CONFIG_DRM_EXYNOS5433_DECON=y CONFIG_DRM_EXYNOS7_DECON=y CONFIG_DRM_EXYNOS_DPI=y diff --git a/kernel-armv7hl-lpae-debug.config b/kernel-armv7hl-lpae-debug.config index 4b22214d4..a65f8c90f 100644 --- a/kernel-armv7hl-lpae-debug.config +++ b/kernel-armv7hl-lpae-debug.config @@ -1164,6 +1164,7 @@ CONFIG_DEBUG_RT_MUTEXES=y CONFIG_DEBUG_SET_MODULE_RONX=y CONFIG_DEBUG_SG=y CONFIG_DEBUG_SHIRQ=y +CONFIG_DEBUG_SHOW_MEMALLOC_LINE=y CONFIG_DEBUG_SLAB=y CONFIG_DEBUG_SPINLOCK=y CONFIG_DEBUG_STACK_USAGE=y @@ -1292,6 +1293,7 @@ CONFIG_DRM_DW_HDMI_AHB_AUDIO=m CONFIG_DRM_DW_HDMI_CEC=m CONFIG_DRM_DW_HDMI_I2S_AUDIO=m CONFIG_DRM_DW_HDMI=m +CONFIG_DRM_ETNAVIV_THERMAL=y CONFIG_DRM_EXYNOS5433_DECON=y CONFIG_DRM_EXYNOS7_DECON=y CONFIG_DRM_EXYNOS_DPI=y diff --git a/kernel-armv7hl-lpae.config b/kernel-armv7hl-lpae.config index c38dac48f..da66d377c 100644 --- a/kernel-armv7hl-lpae.config +++ b/kernel-armv7hl-lpae.config @@ -1155,6 +1155,7 @@ CONFIG_DEBUG_RODATA_TEST=y CONFIG_DEBUG_SET_MODULE_RONX=y # CONFIG_DEBUG_SG is not set CONFIG_DEBUG_SHIRQ=y +CONFIG_DEBUG_SHOW_MEMALLOC_LINE=y # CONFIG_DEBUG_SPINLOCK is not set # CONFIG_DEBUG_STACK_USAGE is not set # CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set @@ -1282,6 +1283,7 @@ CONFIG_DRM_DW_HDMI_AHB_AUDIO=m CONFIG_DRM_DW_HDMI_CEC=m CONFIG_DRM_DW_HDMI_I2S_AUDIO=m CONFIG_DRM_DW_HDMI=m +CONFIG_DRM_ETNAVIV_THERMAL=y CONFIG_DRM_EXYNOS5433_DECON=y CONFIG_DRM_EXYNOS7_DECON=y CONFIG_DRM_EXYNOS_DPI=y diff --git a/kernel-armv7hl.config b/kernel-armv7hl.config index 1c328b88c..532e63c55 100644 --- a/kernel-armv7hl.config +++ b/kernel-armv7hl.config @@ -1209,6 +1209,7 @@ CONFIG_DEBUG_RODATA_TEST=y CONFIG_DEBUG_SET_MODULE_RONX=y # CONFIG_DEBUG_SG is not set CONFIG_DEBUG_SHIRQ=y +CONFIG_DEBUG_SHOW_MEMALLOC_LINE=y # CONFIG_DEBUG_SPINLOCK is not set # CONFIG_DEBUG_STACK_USAGE is not set # CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set @@ -1339,6 +1340,7 @@ CONFIG_DRM_DW_HDMI_I2S_AUDIO=m CONFIG_DRM_DW_HDMI=m CONFIG_DRM_ETNAVIV=m # CONFIG_DRM_ETNAVIV_REGISTER_LOGGING is not set +CONFIG_DRM_ETNAVIV_THERMAL=y CONFIG_DRM_EXYNOS5433_DECON=y CONFIG_DRM_EXYNOS7_DECON=y CONFIG_DRM_EXYNOS_DPI=y diff --git a/kernel-i686-PAE.config b/kernel-i686-PAE.config index cc636201a..e46097f24 100644 --- a/kernel-i686-PAE.config +++ b/kernel-i686-PAE.config @@ -1005,6 +1005,7 @@ CONFIG_DEBUG_RODATA_TEST=y CONFIG_DEBUG_SET_MODULE_RONX=y # CONFIG_DEBUG_SG is not set CONFIG_DEBUG_SHIRQ=y +CONFIG_DEBUG_SHOW_MEMALLOC_LINE=y # CONFIG_DEBUG_SPINLOCK is not set CONFIG_DEBUG_STACKOVERFLOW=y # CONFIG_DEBUG_STACK_USAGE is not set diff --git a/kernel-i686-PAEdebug.config b/kernel-i686-PAEdebug.config index dbdadfc5c..90322cb83 100644 --- a/kernel-i686-PAEdebug.config +++ b/kernel-i686-PAEdebug.config @@ -1014,6 +1014,7 @@ CONFIG_DEBUG_RT_MUTEXES=y CONFIG_DEBUG_SET_MODULE_RONX=y CONFIG_DEBUG_SG=y CONFIG_DEBUG_SHIRQ=y +CONFIG_DEBUG_SHOW_MEMALLOC_LINE=y CONFIG_DEBUG_SLAB=y CONFIG_DEBUG_SPINLOCK=y CONFIG_DEBUG_STACKOVERFLOW=y diff --git a/kernel-i686-debug.config b/kernel-i686-debug.config index 4ca9cc7dd..461835e85 100644 --- a/kernel-i686-debug.config +++ b/kernel-i686-debug.config @@ -1014,6 +1014,7 @@ CONFIG_DEBUG_RT_MUTEXES=y CONFIG_DEBUG_SET_MODULE_RONX=y CONFIG_DEBUG_SG=y CONFIG_DEBUG_SHIRQ=y +CONFIG_DEBUG_SHOW_MEMALLOC_LINE=y CONFIG_DEBUG_SLAB=y CONFIG_DEBUG_SPINLOCK=y CONFIG_DEBUG_STACKOVERFLOW=y diff --git a/kernel-i686.config b/kernel-i686.config index 317350b92..bfa169d72 100644 --- a/kernel-i686.config +++ b/kernel-i686.config @@ -1005,6 +1005,7 @@ CONFIG_DEBUG_RODATA_TEST=y CONFIG_DEBUG_SET_MODULE_RONX=y # CONFIG_DEBUG_SG is not set CONFIG_DEBUG_SHIRQ=y +CONFIG_DEBUG_SHOW_MEMALLOC_LINE=y # CONFIG_DEBUG_SPINLOCK is not set CONFIG_DEBUG_STACKOVERFLOW=y # CONFIG_DEBUG_STACK_USAGE is not set diff --git a/kernel-ppc64-debug.config b/kernel-ppc64-debug.config index 49bf507c8..6c1faccb4 100644 --- a/kernel-ppc64-debug.config +++ b/kernel-ppc64-debug.config @@ -994,6 +994,7 @@ CONFIG_DEBUG_RT_MUTEXES=y CONFIG_DEBUG_SET_MODULE_RONX=y CONFIG_DEBUG_SG=y CONFIG_DEBUG_SHIRQ=y +CONFIG_DEBUG_SHOW_MEMALLOC_LINE=y CONFIG_DEBUG_SLAB=y CONFIG_DEBUG_SPINLOCK=y CONFIG_DEBUG_STACKOVERFLOW=y diff --git a/kernel-ppc64.config b/kernel-ppc64.config index 8f2a16c0e..ccb025140 100644 --- a/kernel-ppc64.config +++ b/kernel-ppc64.config @@ -985,6 +985,7 @@ CONFIG_DEBUG_RODATA_TEST=y CONFIG_DEBUG_SET_MODULE_RONX=y # CONFIG_DEBUG_SG is not set CONFIG_DEBUG_SHIRQ=y +CONFIG_DEBUG_SHOW_MEMALLOC_LINE=y # CONFIG_DEBUG_SPINLOCK is not set CONFIG_DEBUG_STACKOVERFLOW=y # CONFIG_DEBUG_STACK_USAGE is not set diff --git a/kernel-ppc64le-debug.config b/kernel-ppc64le-debug.config index db2a5548a..231297726 100644 --- a/kernel-ppc64le-debug.config +++ b/kernel-ppc64le-debug.config @@ -948,6 +948,7 @@ CONFIG_DEBUG_RT_MUTEXES=y CONFIG_DEBUG_SET_MODULE_RONX=y CONFIG_DEBUG_SG=y CONFIG_DEBUG_SHIRQ=y +CONFIG_DEBUG_SHOW_MEMALLOC_LINE=y CONFIG_DEBUG_SLAB=y CONFIG_DEBUG_SPINLOCK=y CONFIG_DEBUG_STACKOVERFLOW=y diff --git a/kernel-ppc64le.config b/kernel-ppc64le.config index 097b776a7..01546d42e 100644 --- a/kernel-ppc64le.config +++ b/kernel-ppc64le.config @@ -939,6 +939,7 @@ CONFIG_DEBUG_RODATA_TEST=y CONFIG_DEBUG_SET_MODULE_RONX=y # CONFIG_DEBUG_SG is not set CONFIG_DEBUG_SHIRQ=y +CONFIG_DEBUG_SHOW_MEMALLOC_LINE=y # CONFIG_DEBUG_SPINLOCK is not set CONFIG_DEBUG_STACKOVERFLOW=y # CONFIG_DEBUG_STACK_USAGE is not set diff --git a/kernel-s390x-debug.config b/kernel-s390x-debug.config index 6c7b5028a..d0865a0d1 100644 --- a/kernel-s390x-debug.config +++ b/kernel-s390x-debug.config @@ -951,6 +951,7 @@ CONFIG_DEBUG_RT_MUTEXES=y CONFIG_DEBUG_SET_MODULE_RONX=y CONFIG_DEBUG_SG=y CONFIG_DEBUG_SHIRQ=y +CONFIG_DEBUG_SHOW_MEMALLOC_LINE=y CONFIG_DEBUG_SLAB=y CONFIG_DEBUG_SPINLOCK=y CONFIG_DEBUG_STACK_USAGE=y diff --git a/kernel-s390x.config b/kernel-s390x.config index a7361b8e5..17133babf 100644 --- a/kernel-s390x.config +++ b/kernel-s390x.config @@ -942,6 +942,7 @@ CONFIG_DEBUG_RODATA_TEST=y CONFIG_DEBUG_SET_MODULE_RONX=y # CONFIG_DEBUG_SG is not set CONFIG_DEBUG_SHIRQ=y +CONFIG_DEBUG_SHOW_MEMALLOC_LINE=y # CONFIG_DEBUG_SPINLOCK is not set # CONFIG_DEBUG_STACK_USAGE is not set # CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set diff --git a/kernel-x86_64-debug.config b/kernel-x86_64-debug.config index d1a8288f0..0cd585636 100644 --- a/kernel-x86_64-debug.config +++ b/kernel-x86_64-debug.config @@ -1054,6 +1054,7 @@ CONFIG_DEBUG_RT_MUTEXES=y CONFIG_DEBUG_SET_MODULE_RONX=y CONFIG_DEBUG_SG=y CONFIG_DEBUG_SHIRQ=y +CONFIG_DEBUG_SHOW_MEMALLOC_LINE=y CONFIG_DEBUG_SLAB=y CONFIG_DEBUG_SPINLOCK=y CONFIG_DEBUG_STACKOVERFLOW=y diff --git a/kernel-x86_64.config b/kernel-x86_64.config index 38c4ace44..fbc5fbfed 100644 --- a/kernel-x86_64.config +++ b/kernel-x86_64.config @@ -1045,6 +1045,7 @@ CONFIG_DEBUG_RODATA_TEST=y CONFIG_DEBUG_SET_MODULE_RONX=y # CONFIG_DEBUG_SG is not set CONFIG_DEBUG_SHIRQ=y +CONFIG_DEBUG_SHOW_MEMALLOC_LINE=y # CONFIG_DEBUG_SPINLOCK is not set CONFIG_DEBUG_STACKOVERFLOW=y # CONFIG_DEBUG_STACK_USAGE is not set diff --git a/kernel.spec b/kernel.spec index a2b8de263..3256ee14d 100644 --- a/kernel.spec +++ b/kernel.spec @@ -54,7 +54,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 10 +%define stable_update 11 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -613,7 +613,6 @@ Patch628: 0001-Bluetooth-btusb-Add-a-Kconfig-option-to-enable-USB-a.patch # Adding these suggested by Benjamin Tissoires # Queued in hid.git/for-4.16/hid-quirks-cleanup/multitouch for merging into 4.16 Patch630: 0001-HID-multitouch-Properly-deal-with-Win8-PTP-reports-w.patch -Patch631: 0002-HID-multitouch-Only-look-at-non-touch-fields-in-firs.patch Patch632: 0003-HID-multitouch-Combine-all-left-button-events-in-a-f.patch # Make SATA link powermanagement policy configurable for: @@ -648,6 +647,9 @@ Patch662: mm-khugepaged-Convert-VM_BUG_ON-to-collapse-fail.patch # CVE-2017-18232 rhbz 1558066 1558067 Patch663: 0001-scsi-libsas-direct-call-probe-and-destruct.patch +# rhbz 1547037 +Patch664: mmu-ALIGN_DOWN-correct-variable.patch + # END OF PATCH DEFINITIONS %endif @@ -1946,6 +1948,9 @@ fi # # %changelog +* Mon Mar 19 2018 Laura Abbott - 4.15.11-200 +- Linux v4.15.11 + * Mon Mar 19 2018 Justin M. Forbes - Fix CVE-2017-18232 (rhbz 1558066 1558067) diff --git a/mmu-ALIGN_DOWN-correct-variable.patch b/mmu-ALIGN_DOWN-correct-variable.patch new file mode 100644 index 000000000..5ea481a6b --- /dev/null +++ b/mmu-ALIGN_DOWN-correct-variable.patch @@ -0,0 +1,49 @@ +From 73422d1684caa09afe011cc404477836b537ac6b Mon Sep 17 00:00:00 2001 +From: Maris Nartiss +Date: Mon, 19 Mar 2018 09:55:07 -0700 +Subject: [PATCH] mmu: ALIGN_DOWN correct variable + +Commit 7110c89bb8852ff8b0f88ce05b332b3fe22bd11e ("mmu: swap out round +for ALIGN") replaced two calls to round/rounddown with ALIGN/ALIGN_DOWN, +but erroneously applied ALIGN_DOWN to a different variable (addr) and left +intended variable (tail) not rounded/ALIGNed. + +As a result screen corruption, X lockups are observable. An example of kernel +log of affected system with NV98 card where it was bisected: + +nouveau 0000:01:00.0: gr: TRAP_M2MF 00000002 [IN] +nouveau 0000:01:00.0: gr: TRAP_M2MF 00320951 400007c0 00000000 04000000 +nouveau 0000:01:00.0: gr: 00200000 [] ch 1 [000fbbe000 DRM] subc 4 class 5039 +mthd 0100 data 00000000 +nouveau 0000:01:00.0: fb: trapped read at 0040000000 on channel 1 +[0fbbe000 DRM] +engine 00 [PGRAPH] client 03 [DISPATCH] subclient 04 [M2M_IN] reason 00000006 +[NULL_DMAOBJ] + +Fixes bug 105173 ("[MCP79][Regression] Unhandled NULL pointer dereference in +nvkm_object_unmap since kernel 4.15") +https://bugs.freedesktop.org/show_bug.cgi?id=105173 + +Fixes: 7110c89bb885 ("mmu: swap out round for ALIGN ") +Tested-by: Pierre Moreau +Reviewed-by: Pierre Moreau +--- + drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c +index e35d3e17cd7c..c6e3d0dd1070 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmm.c +@@ -1354,7 +1354,7 @@ nvkm_vmm_get_locked(struct nvkm_vmm *vmm, bool getref, bool mapref, bool sparse, + + tail = this->addr + this->size; + if (vmm->func->page_block && next && next->page != p) +- tail = ALIGN_DOWN(addr, vmm->func->page_block); ++ tail = ALIGN_DOWN(tail, vmm->func->page_block); + + if (addr <= tail && tail - addr >= size) { + rb_erase(&this->tree, &vmm->free); +-- +2.14.3 + diff --git a/sources b/sources index 6e9a23d8d..212d05b86 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (linux-4.15.tar.xz) = c00d92659df815a53dcac7dde145b742b1f20867d380c07cb09ddb3295d6ff10f8931b21ef0b09d7156923a3957b39d74d87c883300173b2e20690d2b4ec35ea -SHA512 (patch-4.15.10.xz) = 275abec91344e9409d27dc3ce801f104717730819a9d90786b0ef104525cf706291e0954a3e8d16618179a1e9603d6d12cd9cfdac3efac8783b83a0decdab94a +SHA512 (patch-4.15.11.xz) = 6d809fdf66accfbd35db25aac230d11fb55ba5ac019a7314c67937eaf9b5a49b134bc3e36685eaf7b0605dab9a54a82da62eb1e08048c1c3a3c980fcc142dfe2