From 814681799f857df9c5aa7797fd01105edb604ccf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philip=20M=C3=BCller?= <philm@manjaro.org>
Date: Wed, 8 Apr 2020 22:45:24 +0200
Subject: [PATCH] [pkg-upd] 5.6.3-2
---
...ential-access-overflow-in-beep-helpe.patch | 42 +++++++++++++++++++
...-invalid-access-for-enumerated-ctl-i.patch | 42 +++++++++++++++++++
PKGBUILD | 12 +++++-
3 files changed, 94 insertions(+), 2 deletions(-)
create mode 100644 0001-ALSA-hda-Fix-potential-access-overflow-in-beep-helpe.patch
create mode 100644 0002-ALSA-ice1724-Fix-invalid-access-for-enumerated-ctl-i.patch
diff --git a/0001-ALSA-hda-Fix-potential-access-overflow-in-beep-helpe.patch b/0001-ALSA-hda-Fix-potential-access-overflow-in-beep-helpe.patch
new file mode 100644
index 0000000..484fac7
--- /dev/null
+++ b/0001-ALSA-hda-Fix-potential-access-overflow-in-beep-helpe.patch
@@ -0,0 +1,42 @@
+From 59b4a3ed754311917646a1032da4a42cdc2cfde6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 7 Apr 2020 10:36:22 +0200
+Subject: [PATCH] ALSA: hda: Fix potential access overflow in beep helper
+
+The beep control helper function blindly stores the values in two
+stereo channels no matter whether the actual control is mono or
+stereo. This is practically harmless, but it annoys the recently
+introduced sanity check, resulting in an error when the checker is
+enabled.
+
+This patch corrects the behavior to store only on the defined array
+member.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207139
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+---
+ sound/pci/hda/hda_beep.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/hda_beep.c b/sound/pci/hda/hda_beep.c
+index f5fd62ed4df5..841523f6b88d 100644
+--- a/sound/pci/hda/hda_beep.c
++++ b/sound/pci/hda/hda_beep.c
+@@ -290,8 +290,12 @@ int snd_hda_mixer_amp_switch_get_beep(struct snd_kcontrol *kcontrol,
+ {
+ struct hda_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct hda_beep *beep = codec->beep;
++ int chs = get_amp_channels(kcontrol);
++
+ if (beep && (!beep->enabled || !ctl_has_mute(kcontrol))) {
+- ucontrol->value.integer.value[0] =
++ if (chs & 1)
++ ucontrol->value.integer.value[0] = beep->enabled;
++ if (chs & 2)
+ ucontrol->value.integer.value[1] = beep->enabled;
+ return 0;
+ }
+--
+2.25.0
+
diff --git a/0002-ALSA-ice1724-Fix-invalid-access-for-enumerated-ctl-i.patch b/0002-ALSA-ice1724-Fix-invalid-access-for-enumerated-ctl-i.patch
new file mode 100644
index 0000000..dcaf424
--- /dev/null
+++ b/0002-ALSA-ice1724-Fix-invalid-access-for-enumerated-ctl-i.patch
@@ -0,0 +1,42 @@
+From 8cd18c2bdaf1ddb117654fd1ba4befbf770bf2b5 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 7 Apr 2020 10:31:44 +0200
+Subject: [PATCH] ALSA: ice1724: Fix invalid access for enumerated ctl items
+
+The access to Analog Capture Source control value implemented in
+prodigy_hifi.c is wrong, as caught by the recently introduced sanity
+check; it should be accessing value.enumerated.item[] instead of
+value.integer.value[]. This patch corrects the wrong access pattern.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207139
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+---
+ sound/pci/ice1712/prodigy_hifi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/ice1712/prodigy_hifi.c b/sound/pci/ice1712/prodigy_hifi.c
+index 91f83cef0e56..9aa12a67d370 100644
+--- a/sound/pci/ice1712/prodigy_hifi.c
++++ b/sound/pci/ice1712/prodigy_hifi.c
+@@ -536,7 +536,7 @@ static int wm_adc_mux_enum_get(struct snd_kcontrol *kcontrol,
+ struct snd_ice1712 *ice = snd_kcontrol_chip(kcontrol);
+
+ mutex_lock(&ice->gpio_mutex);
+- ucontrol->value.integer.value[0] = wm_get(ice, WM_ADC_MUX) & 0x1f;
++ ucontrol->value.enumerated.item[0] = wm_get(ice, WM_ADC_MUX) & 0x1f;
+ mutex_unlock(&ice->gpio_mutex);
+ return 0;
+ }
+@@ -550,7 +550,7 @@ static int wm_adc_mux_enum_put(struct snd_kcontrol *kcontrol,
+
+ mutex_lock(&ice->gpio_mutex);
+ oval = wm_get(ice, WM_ADC_MUX);
+- nval = (oval & 0xe0) | ucontrol->value.integer.value[0];
++ nval = (oval & 0xe0) | ucontrol->value.enumerated.item[0];
+ if (nval != oval) {
+ wm_put(ice, WM_ADC_MUX, nval);
+ change = 1;
+--
+2.25.0
+
diff --git a/PKGBUILD b/PKGBUILD
index b945466..a0707ed 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -13,7 +13,7 @@ _basekernel=5.6
_basever=56
_aufs=20200302
pkgver=5.6.3
-pkgrel=1
+pkgrel=2
arch=('i686' 'x86_64')
url="http://www.kernel.org/"
license=('GPL2')
@@ -35,6 +35,8 @@ source=("https://www.kernel.org/pub/linux/kernel/v5.x/linux-${_basekernel}.tar.x
# ARCH Patches
'0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-CLONE_NEWUSER.patch'
# MANJARO Patches
+ '0001-ALSA-hda-Fix-potential-access-overflow-in-beep-helpe.patch'
+ '0002-ALSA-ice1724-Fix-invalid-access-for-enumerated-ctl-i.patch'
'0001-apparmor-patch-to-provide-compatibility-with-v2-net-rules.patch'
'0002-apparmor-af_unix-mediation.patch'
'0003-apparmor-fix-use-after-free-in-sk_peer_label.patch'
@@ -55,7 +57,7 @@ source=("https://www.kernel.org/pub/linux/kernel/v5.x/linux-${_basekernel}.tar.x
'0013-bootsplash.patch')
sha256sums=('e342b04a2aa63808ea0ef1baab28fc520bd031ef8cf93d9ee4a31d4058fcb622'
'a677aa98df0fc907314130b511feef3108717d98c405c98a51dde4e06d1c492c'
- '560c296946217372ea4357a4eea1a062e9cb8e21acb40fe842259baa18aa8da9'
+ 'c4c1e6dc98efba3d0af1a70a28fdeaf84ce1bfc61713c2d7159403bbab59b233'
'bfe52746bfc04114627b6f1e0dd94bc05dd94abe8f6dbee770f78d6116e315e8'
'b44d81446d8b53d5637287c30ae3eb64cae0078c3fbc45fcf1081dd6699818b5'
'ef60c4afbae6270748bca1661d054815ea83f84ac3962fa316cd1b6abea506a4'
@@ -67,6 +69,8 @@ sha256sums=('e342b04a2aa63808ea0ef1baab28fc520bd031ef8cf93d9ee4a31d4058fcb622'
'1c69ed79eeef0c0dcf68ce3086a0e372260d2fed94c93c7711e0682b2bcaae39'
'29adcb9fac02b77f93ec36c2003ae930cc0a6ee1884d002c280480b5e8f22261'
'7685d526bbdbfa795986591a70071c960ff572f56d3501774861728a9df8664c'
+ 'd9032bb428c42e093f2686ae2830133c3600496f93574b3b41dc0ec69af6d5ad'
+ 'bc53f7ec92126955e221698e634d2185909e83bc526f7ff9c7ad86da3fd8c8f4'
'98202b8ad70d02d86603294bae967874fa7b18704b5c7b867568b0fd33a08921'
'5cbbf3db9ea3205e9b89fe3049bea6dd626181db0cb0dc461e4cf5a400c68dd6'
'c7dbec875d0c1d6782c037a1dcefff2e5bdb5fc9dffac1beea07dd8c1bdef1d7'
@@ -99,6 +103,10 @@ prepare() {
patch -Np1 -i ../0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-CLONE_NEWUSER.patch
# other fixes by Arch
+ # https://bugzilla.kernel.org/show_bug.cgi?id=207139
+ patch -Np1 -i "${srcdir}/0001-ALSA-hda-Fix-potential-access-overflow-in-beep-helpe.patch
+ patch -Np1 -i "${srcdir}/0002-ALSA-ice1724-Fix-invalid-access-for-enumerated-ctl-i.patch
+
# add patches for snapd
# https://gitlab.com/apparmor/apparmor-kernel/tree/5.2-outoftree
patch -Np1 -i "${srcdir}/0001-apparmor-patch-to-provide-compatibility-with-v2-net-rules.patch"
--
GitLab