diff --git a/.kernel.metadata b/.kernel.metadata index 6230047..9c34010 100644 --- a/.kernel.metadata +++ b/.kernel.metadata @@ -1,2 +1,2 @@ 40f3e72192d59c0b7a4638cebd0ea55d35a782bb SOURCES/linux-4.19.tar.xz -6135a68aa82864f7f8127a1254f66ed0c0275d26 SOURCES/patch-4.19.32.xz +fb34003dd692474c184651618b963a1aeaa0a708 SOURCES/patch-4.19.34.xz diff --git a/SOURCES/9999-centos-r40-v40-dts-update.patch b/SOURCES/9999-centos-r40-v40-dts-update.patch new file mode 100644 index 0000000..a4a753c --- /dev/null +++ b/SOURCES/9999-centos-r40-v40-dts-update.patch @@ -0,0 +1,469 @@ +From c41ca64d075020e2d5daecb7f48da6af0ba5b512 Mon Sep 17 00:00:00 2001 +From: Tuomas Tynkkynen +Date: Wed, 8 Aug 2018 02:25:53 +0300 +Subject: ARM: dts: sunxi: Don't use cd-inverted in sun8i-r40-bananapi-m2-ultra + +Another user of cd-inverted seems to have crept in. Switch it away from +cd-inverted to be consistent with other sunxi boards. + +Signed-off-by: Tuomas Tynkkynen +Signed-off-by: Maxime Ripard +--- + arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts +index c39b9169ea64..a891a387e8f1 100644 +--- a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts ++++ b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts +@@ -159,8 +159,7 @@ + &mmc0 { + vmmc-supply = <®_dcdc1>; + bus-width = <4>; +- cd-gpios = <&pio 7 13 GPIO_ACTIVE_HIGH>; /* PH13 */ +- cd-inverted; ++ cd-gpios = <&pio 7 13 GPIO_ACTIVE_LOW>; /* PH13 */ + status = "okay"; + }; + +-- +cgit 1.2-0.3.lf.el7 + +From e5c6e693be831c1bba9b4f8f1da597fb5514deca Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Wed, 9 Jan 2019 23:02:55 +0800 +Subject: ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix WiFi regulator + definitions + +The design of the Bananapi M2 Ultra has both DLDO1 and DLDO2 regulators +provide power to the WiFi+BT module, which is based on the Broadcom +BCM43438 or BCM43430 chip. Each regulator output from the PMIC can supply +up to 200 mA. The datasheet of the chip suggests a maximum power draw of +up to 360 mA when transmitting, thus requiring two outputs from the PMIC +to handle the load. However the device tree only references one of them, +leaving the other unused and possibly turned off. + +This patch marks both as always-on, since we don't have a proper binding +to specify two regulators as "bound together". The name and constraints +of DLDO2 are also added. + +Fixes: da7ac948fa93 ("ARM: dts: sun8i: Add board dts file for Banana Pi M2 + Ultra") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +--- + arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts +index 438b7b44dab3..1a6794e63b90 100644 +--- a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts ++++ b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts +@@ -250,12 +250,27 @@ + regulator-name = "vcc-wifi-io"; + }; + ++/* ++ * Our WiFi chip needs both DLDO2 and DLDO3 to be powered at the same ++ * time, with the two being in sync, to be able to meet maximum power ++ * consumption during transmits. Since this is not really supported ++ * right now, just use the two as always on, and we will fix it later. ++ */ ++ + ®_dldo2 { ++ regulator-always-on; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + regulator-name = "vcc-wifi"; + }; + ++®_dldo3 { ++ regulator-always-on; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ regulator-name = "vcc-wifi-2"; ++}; ++ + ®_dldo4 { + regulator-min-microvolt = <2500000>; + regulator-max-microvolt = <2500000>; +-- +cgit 1.2-0.3.lf.el7 + +From 0729b4af5753b65aa031f58c435da53dbbf56d19 Mon Sep 17 00:00:00 2001 +From: Rob Herring +Date: Thu, 13 Sep 2018 13:12:32 -0500 +Subject: ARM: dts: sunxi: Fix I2C bus warnings + +dtc has new checks for I2C buses. Fix the warnings in unit-addresses. + +arch/arm/boot/dts/sun8i-a23-gt90h-v4.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: I2C bus unit address format error, expected "40" +arch/arm/boot/dts/sun8i-a23-inet86dz.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: I2C bus unit address format error, expected "40" +arch/arm/boot/dts/sun8i-a23-polaroid-mid2407pxe03.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: I2C bus unit address format error, expected "40" +arch/arm/boot/dts/sun8i-a23-polaroid-mid2809pxe04.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: I2C bus unit address format error, expected "40" +arch/arm/boot/dts/sun8i-a33-ga10h-v1.1.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: I2C bus unit address format error, expected "40" +arch/arm/boot/dts/sun8i-a33-inet-d978-rev2.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: missing or empty reg property +arch/arm/boot/dts/sun8i-a33-ippo-q8h-v1.2.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: missing or empty reg property +arch/arm/boot/dts/sun8i-a33-q8-tablet.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2ac00/touchscreen@0: missing or empty reg property +arch/arm/boot/dts/sun5i-a13-utoo-p66.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2b000/touchscreen: I2C bus unit address format error, expected "40" +arch/arm/boot/dts/sun5i-a13-difrnce-dit4350.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2b000/touchscreen: missing or empty reg property +arch/arm/boot/dts/sun5i-a13-empire-electronix-m712.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2b000/touchscreen: missing or empty reg property +arch/arm/boot/dts/sun5i-a13-inet-98v-rev2.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2b000/touchscreen: missing or empty reg property +arch/arm/boot/dts/sun5i-a13-q8-tablet.dtb: Warning (i2c_bus_reg): /soc@1c00000/i2c@1c2b000/touchscreen: missing or empty reg property + +Cc: Maxime Ripard +Cc: Chen-Yu Tsai +Signed-off-by: Rob Herring +Signed-off-by: Chen-Yu Tsai +--- + arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +(limited to 'arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts') + +diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts +index 35859d8f3267..bf97f6244c23 100644 +--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts ++++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts +@@ -95,7 +95,7 @@ + &i2c0 { + status = "okay"; + +- axp22x: pmic@68 { ++ axp22x: pmic@34 { + compatible = "x-powers,axp221"; + reg = <0x34>; + interrupt-parent = <&nmi_intc>; +-- +cgit 1.2-0.3.lf.el7 + +From 933ea7e9d143cee0c8c3bdc274afa69c91d91d61 Mon Sep 17 00:00:00 2001 +From: Pablo Greco +Date: Wed, 10 Apr 2019 18:59:25 -0300 +Subject: [PATCH v2 1/6] ARM: dts: sun8i: v40: bananapi-m2-berry: Sort device + node dereferences. + +The device node dereferences are out of order, sort them. + +Signed-off-by: Pablo Greco +--- + arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts | 36 +++++++++++------------ + 1 file changed, 18 insertions(+), 18 deletions(-) + +diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts +index bf97f62..f05cabd 100644 +--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts ++++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts +@@ -105,6 +105,24 @@ + + #include "axp22x.dtsi" + ++&mmc0 { ++ vmmc-supply = <®_dcdc1>; ++ bus-width = <4>; ++ cd-gpios = <&pio 7 13 GPIO_ACTIVE_LOW>; /* PH13 */ ++ status = "okay"; ++}; ++ ++&mmc1 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&mmc1_pg_pins>; ++ vmmc-supply = <®_dldo2>; ++ vqmmc-supply = <®_dldo1>; ++ mmc-pwrseq = <&wifi_pwrseq>; ++ bus-width = <4>; ++ non-removable; ++ status = "okay"; ++}; ++ + ®_aldo3 { + regulator-always-on; + regulator-min-microvolt = <2700000>; +@@ -152,24 +170,6 @@ + regulator-name = "vcc-wifi"; + }; + +-&mmc0 { +- vmmc-supply = <®_dcdc1>; +- bus-width = <4>; +- cd-gpios = <&pio 7 13 GPIO_ACTIVE_LOW>; /* PH13 */ +- status = "okay"; +-}; +- +-&mmc1 { +- pinctrl-names = "default"; +- pinctrl-0 = <&mmc1_pg_pins>; +- vmmc-supply = <®_dldo2>; +- vqmmc-supply = <®_dldo1>; +- mmc-pwrseq = <&wifi_pwrseq>; +- bus-width = <4>; +- non-removable; +- status = "okay"; +-}; +- + &uart0 { + pinctrl-names = "default"; + pinctrl-0 = <&uart0_pb_pins>; +-- +1.8.3.1 + +From 745c1a105e34553caf247215cdcefa30db95092a Mon Sep 17 00:00:00 2001 +From: Pablo Greco +Date: Thu, 11 Apr 2019 13:58:49 -0300 +Subject: [PATCH v2 2/6] ARM: dts: sun8i: v40: bananapi-m2-berry: Enable GMAC + ethernet controller + +Just like the Bananapi M2 Ultra, the Bananapi M2 Berry has a Realtek +RTL8211E RGMII PHY tied to the GMAC. +The PMIC's DC1SW output provides power for the PHY, while the ALDO2 +output provides I/O voltages on both sides. + +Signed-off-by: Pablo Greco +--- + arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts | 30 +++++++++++++++++++++++ + 1 file changed, 30 insertions(+) + +diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts +index f05cabd..0d79e91 100644 +--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts ++++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts +@@ -50,6 +50,7 @@ + compatible = "sinovoip,bpi-m2-berry", "allwinner,sun8i-r40"; + + aliases { ++ ethernet0 = &gmac; + serial0 = &uart0; + }; + +@@ -92,6 +93,22 @@ + status = "okay"; + }; + ++&gmac { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&gmac_rgmii_pins>; ++ phy-handle = <&phy1>; ++ phy-mode = "rgmii"; ++ phy-supply = <®_dc1sw>; ++ status = "okay"; ++}; ++ ++&gmac_mdio { ++ phy1: ethernet-phy@1 { ++ compatible = "ethernet-phy-ieee802.3-c22"; ++ reg = <1>; ++ }; ++}; ++ + &i2c0 { + status = "okay"; + +@@ -123,6 +140,13 @@ + status = "okay"; + }; + ++®_aldo2 { ++ regulator-always-on; ++ regulator-min-microvolt = <2500000>; ++ regulator-max-microvolt = <2500000>; ++ regulator-name = "vcc-pa"; ++}; ++ + ®_aldo3 { + regulator-always-on; + regulator-min-microvolt = <2700000>; +@@ -130,6 +154,12 @@ + regulator-name = "avcc"; + }; + ++®_dc1sw { ++ regulator-min-microvolt = <3000000>; ++ regulator-max-microvolt = <3000000>; ++ regulator-name = "vcc-gmac-phy"; ++}; ++ + ®_dcdc1 { + regulator-always-on; + regulator-min-microvolt = <3000000>; +-- +1.8.3.1 + +From 274ba1411bac61fcecdf021a13d645891e7b723c Mon Sep 17 00:00:00 2001 +From: Pablo Greco +Date: Thu, 11 Apr 2019 14:00:05 -0300 +Subject: [PATCH v2 3/6] ARM: dts: sun8i: v40: bananapi-m2-berry: Enable HDMI + output + +This patch adds the hdmi nodes to the Bananapi M2 Berry, the same way it +was done to the Bananapi M2 Ultra + +Signed-off-by: Pablo Greco +--- + arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts | 29 +++++++++++++++++++++++ + 1 file changed, 29 insertions(+) + +diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts +index 0d79e91..2a5b80b 100644 +--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts ++++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts +@@ -58,6 +58,17 @@ + stdout-path = "serial0:115200n8"; + }; + ++ connector { ++ compatible = "hdmi-connector"; ++ type = "a"; ++ ++ port { ++ hdmi_con_in: endpoint { ++ remote-endpoint = <&hdmi_out_con>; ++ }; ++ }; ++ }; ++ + leds { + compatible = "gpio-leds"; + +@@ -88,6 +99,10 @@ + }; + }; + ++&de { ++ status = "okay"; ++}; ++ + &ehci1 { + /* Terminus Tech FE 1.1s 4-port USB 2.0 hub here */ + status = "okay"; +@@ -109,6 +124,16 @@ + }; + }; + ++&hdmi { ++ status = "okay"; ++}; ++ ++&hdmi_out { ++ hdmi_out_con: endpoint { ++ remote-endpoint = <&hdmi_con_in>; ++ }; ++}; ++ + &i2c0 { + status = "okay"; + +@@ -200,6 +225,10 @@ + regulator-name = "vcc-wifi"; + }; + ++&tcon_tv0 { ++ status = "okay"; ++}; ++ + &uart0 { + pinctrl-names = "default"; + pinctrl-0 = <&uart0_pb_pins>; +-- +1.8.3.1 + +From e91ec82e21aaf29f1453053175050b8230c2b495 Mon Sep 17 00:00:00 2001 +From: Pablo Greco +Date: Thu, 11 Apr 2019 14:03:54 -0300 +Subject: [PATCH v2 4/6] ARM: dts: sun8i: v40: bananapi-m2-berry: Enable AHCI + +Just like the Bananapi M2 Ultra, enable the ahci controller and +the two regulators needed to activate it. + +Signed-off-by: Pablo Greco +--- + arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts +index 2a5b80b..c37c7ab 100644 +--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts ++++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts +@@ -99,6 +99,12 @@ + }; + }; + ++&ahci { ++ ahci-supply = <®_dldo4>; ++ phy-supply = <®_eldo3>; ++ status = "okay"; ++}; ++ + &de { + status = "okay"; + }; +@@ -225,6 +231,18 @@ + regulator-name = "vcc-wifi"; + }; + ++®_dldo4 { ++ regulator-min-microvolt = <2500000>; ++ regulator-max-microvolt = <2500000>; ++ regulator-name = "vdd2v5-sata"; ++}; ++ ++®_eldo3 { ++ regulator-min-microvolt = <1200000>; ++ regulator-max-microvolt = <1200000>; ++ regulator-name = "vdd1v2-sata"; ++}; ++ + &tcon_tv0 { + status = "okay"; + }; +-- +1.8.3.1 + +From df95d67e4385275586d3f91ee145f8d13885a560 Mon Sep 17 00:00:00 2001 +From: Pablo Greco +Date: Thu, 11 Apr 2019 14:04:35 -0300 +Subject: [PATCH v2 5/6] ARM: dts: sun8i: v40: bananapi-m2-berry: Fix WiFi + regulator definitions + +Just like was done for the bananapi-m2-ultra, add the second wifi/bt +regulator and mark both as always-on. + +Signed-off-by: Pablo Greco +--- + arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts +index c37c7ab..78f4a1a 100644 +--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts ++++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts +@@ -225,12 +225,27 @@ + regulator-name = "vcc-wifi-io"; + }; + ++/* ++ * Our WiFi chip needs both DLDO2 and DLDO3 to be powered at the same ++ * time, with the two being in sync, to be able to meet maximum power ++ * consumption during transmits. Since this is not really supported ++ * right now, just use the two as always on, and we will fix it later. ++ */ ++ + ®_dldo2 { ++ regulator-always-on; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + regulator-name = "vcc-wifi"; + }; + ++®_dldo3 { ++ regulator-always-on; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ regulator-name = "vcc-wifi-2"; ++}; ++ + ®_dldo4 { + regulator-min-microvolt = <2500000>; + regulator-max-microvolt = <2500000>; +-- +1.8.3.1 + diff --git a/SOURCES/9999-centos-r40sata.patch b/SOURCES/9999-centos-r40sata.patch index d47fc6b..09e1f11 100644 --- a/SOURCES/9999-centos-r40sata.patch +++ b/SOURCES/9999-centos-r40sata.patch @@ -1602,3 +1602,69 @@ index a891a387e8f1..438b7b44dab3 100644 &tcon_tv0 { status = "okay"; }; +From b9f6b80e04ad061ff4e12bdb72ea21af3518d79f Mon Sep 17 00:00:00 2001 +From: Maxime Ripard +Date: Mon, 25 Mar 2019 14:52:44 +0100 +Subject: ARM: dts: sun8i: r40: Fix AHCI reset-names property + +The AHCI node was introduced with a typo in the reset-names property that +got written resets-name instead. + +This was working because the reset is optional for that driver, and the +controller was put out of reset by the bootloader. + +Fixes: 41c64d3318aa ("ARM: dts: sun8i: r40: add sata node") +Acked-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +--- + arch/arm/boot/dts/sun8i-r40.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +(limited to 'arch/arm/boot/dts/sun8i-r40.dtsi') + +diff --git a/arch/arm/boot/dts/sun8i-r40.dtsi b/arch/arm/boot/dts/sun8i-r40.dtsi +index 1061d46efafd..9784c23346a8 100644 +--- a/arch/arm/boot/dts/sun8i-r40.dtsi ++++ b/arch/arm/boot/dts/sun8i-r40.dtsi +@@ -562,7 +562,7 @@ + interrupts = ; + clocks = <&ccu CLK_BUS_SATA>, <&ccu CLK_SATA>; + resets = <&ccu RST_BUS_SATA>; +- resets-name = "ahci"; ++ reset-names = "ahci"; + #address-cells = <1>; + #size-cells = <0>; + status = "disabled"; +-- +cgit 1.2-0.3.lf.el7 + +From 327384569871e7e3ed637d89726abacda3902098 Mon Sep 17 00:00:00 2001 +From: Maxime Ripard +Date: Mon, 25 Mar 2019 14:52:45 +0100 +Subject: ARM: dts: sun8i: r40: Remove useless AHCI properties + +The SATA controller never have any children nodes, so we don't need the +address and size cells properties. + +Acked-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +--- + arch/arm/boot/dts/sun8i-r40.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm/boot/dts/sun8i-r40.dtsi b/arch/arm/boot/dts/sun8i-r40.dtsi +index 9784c23346a8..56c6885b02d1 100644 +--- a/arch/arm/boot/dts/sun8i-r40.dtsi ++++ b/arch/arm/boot/dts/sun8i-r40.dtsi +@@ -563,8 +563,6 @@ + clocks = <&ccu CLK_BUS_SATA>, <&ccu CLK_SATA>; + resets = <&ccu RST_BUS_SATA>; + reset-names = "ahci"; +- #address-cells = <1>; +- #size-cells = <0>; + status = "disabled"; + + }; +-- +cgit 1.2-0.3.lf.el7 + diff --git a/SOURCES/CVE-2019-3459-and-CVE-2019-3460.patch b/SOURCES/CVE-2019-3459-and-CVE-2019-3460.patch deleted file mode 100644 index c7fa627..0000000 --- a/SOURCES/CVE-2019-3459-and-CVE-2019-3460.patch +++ /dev/null @@ -1,167 +0,0 @@ -From 20614b74e481f0c9f94032ae99f110d4647b65a6 Mon Sep 17 00:00:00 2001 -From: Greg Kroah-Hartman -Date: Thu, 10 Jan 2019 07:28:33 +0100 -Subject: [PATCH 1/2] Bluetooth: check message types in l2cap_get_conf_opt - -l2cap_get_conf_opt can handle a "default" message type, but it needs to -be verified that it really is the correct type (CONF_EFS or CONF_RFC) -before passing it back to the caller. To do this we need to check the -return value of this call now and handle the error correctly up the -stack. - -Based on a patch from Ran Menscher. - -Reported-by: Ran Menscher -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: Jeremy Cline ---- - net/bluetooth/l2cap_core.c | 25 +++++++++++++++++++------ - 1 file changed, 19 insertions(+), 6 deletions(-) - -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index d17a4736e47c..a0ce6e8e5ef7 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -2979,6 +2979,10 @@ static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, - break; - - default: -+ /* Only CONF_EFS and CONF_RFC are allowed here */ -+ if ((opt->type != L2CAP_CONF_EFS) && -+ (opt->type != L2CAP_CONF_RFC)) -+ return -EPROTO; - *val = (unsigned long) opt->val; - break; - } -@@ -3323,7 +3327,7 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data - void *endptr = data + data_size; - void *req = chan->conf_req; - int len = chan->conf_len; -- int type, hint, olen; -+ int type, hint, olen, err; - unsigned long val; - struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; - struct l2cap_conf_efs efs; -@@ -3335,7 +3339,10 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data - BT_DBG("chan %p", chan); - - while (len >= L2CAP_CONF_OPT_SIZE) { -- len -= l2cap_get_conf_opt(&req, &type, &olen, &val); -+ err = l2cap_get_conf_opt(&req, &type, &olen, &val); -+ if (err < 0) -+ return err; -+ len -= err; - - hint = type & L2CAP_CONF_HINT; - type &= L2CAP_CONF_MASK; -@@ -3538,7 +3545,7 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, - struct l2cap_conf_req *req = data; - void *ptr = req->data; - void *endptr = data + size; -- int type, olen; -+ int type, olen, err; - unsigned long val; - struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; - struct l2cap_conf_efs efs; -@@ -3546,7 +3553,10 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, - BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data); - - while (len >= L2CAP_CONF_OPT_SIZE) { -- len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); -+ err = l2cap_get_conf_opt(&rsp, &type, &olen, &val); -+ if (err < 0) -+ return err; -+ len -= err; - - switch (type) { - case L2CAP_CONF_MTU: -@@ -3706,7 +3716,7 @@ void __l2cap_connect_rsp_defer(struct l2cap_chan *chan) - - static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len) - { -- int type, olen; -+ int type, olen, err; - unsigned long val; - /* Use sane default values in case a misbehaving remote device - * did not send an RFC or extended window size option. -@@ -3726,7 +3736,10 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len) - return; - - while (len >= L2CAP_CONF_OPT_SIZE) { -- len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); -+ err = l2cap_get_conf_opt(&rsp, &type, &olen, &val); -+ if (err < 0) -+ return; -+ len -= err; - - switch (type) { - case L2CAP_CONF_RFC: --- -2.20.1 - -From 50cd5314f5ffa264906f4986f414750d648c4ece Mon Sep 17 00:00:00 2001 -From: Greg Kroah-Hartman -Date: Thu, 10 Jan 2019 07:29:17 +0100 -Subject: [PATCH 2/2] Bluetooth: check the buffer size for some messages before - parsing - -The L2CAP_CONF_EFS and L2CAP_CONF_RFC messages can be sent from -userspace so their structure sizes need to be checked before parsing -them. - -Based on a patch from Ran Menscher. - -Reported-by: Ran Menscher -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: Jeremy Cline ---- - net/bluetooth/l2cap_core.c | 12 ++++++++---- - 1 file changed, 8 insertions(+), 4 deletions(-) - -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index a0ce6e8e5ef7..d8d3cbdc0d29 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -3360,7 +3360,8 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data - break; - - case L2CAP_CONF_RFC: -- if (olen == sizeof(rfc)) -+ if ((olen == sizeof(rfc)) && -+ (endptr - ptr >= L2CAP_CONF_OPT_SIZE + sizeof(rfc))) - memcpy(&rfc, (void *) val, olen); - break; - -@@ -3370,7 +3371,8 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data - break; - - case L2CAP_CONF_EFS: -- if (olen == sizeof(efs)) { -+ if ((olen == sizeof(efs)) && -+ (endptr - ptr >= L2CAP_CONF_OPT_SIZE + sizeof(efs))) { - remote_efs = 1; - memcpy(&efs, (void *) val, olen); - } -@@ -3575,7 +3577,8 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, - break; - - case L2CAP_CONF_RFC: -- if (olen == sizeof(rfc)) -+ if ((olen == sizeof(rfc)) && -+ (endptr - ptr >= L2CAP_CONF_OPT_SIZE + sizeof(rfc))) - memcpy(&rfc, (void *)val, olen); - - if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) && -@@ -3595,7 +3598,8 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, - break; - - case L2CAP_CONF_EFS: -- if (olen == sizeof(efs)) { -+ if ((olen == sizeof(efs)) && -+ (endptr - ptr >= L2CAP_CONF_OPT_SIZE + sizeof(efs))) { - memcpy(&efs, (void *)val, olen); - - if (chan->local_stype != L2CAP_SERV_NOTRAFIC && --- -2.20.1 - diff --git a/SPECS/kernel.spec b/SPECS/kernel.spec index 65a3957..a4fb681 100644 --- a/SPECS/kernel.spec +++ b/SPECS/kernel.spec @@ -54,7 +54,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 32 +%define stable_update 34 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -652,12 +652,10 @@ Patch516: asus-fx503-keyb.patch # rhbz 1661961 patch merged upstream in 4.20 Patch517: 0001-Bluetooth-btsdio-Do-not-bind-to-non-removable-BCM434.patch -# CVE-2019-3459 and CVE-2019-3460 rbhz 1663176 1663179 1665925 -Patch519: CVE-2019-3459-and-CVE-2019-3460.patch - ##centos Patch10002: 9999-centos-a83t-hdmi.patch Patch11002: 9999-centos-r40sata.patch +Patch11003: 9999-centos-r40-v40-dts-update.patch ##end centos # END OF PATCH DEFINITIONS @@ -2216,6 +2214,12 @@ fi # # %changelog +* Sat Apr 13 2019 Pablo Greco - 4.19.34-300 +- Linux v4.19.34 +- Update device tree for BananaPi M2 Berry +- Update device tree for BananaPi M2 Ultra +- Remove upstreamed patches + * Fri Mar 29 2019 Pablo Greco - 4.19.32-300 - Linux v4.19.32