--- /dev/null
+From d278a9de5e1837edbe57b2f1f95a104ff6c84846 Mon Sep 17 00:00:00 2001
+From: Jaroslav Kysela <perex@perex.cz>
+Date: Wed, 2 Oct 2024 21:46:49 +0200
+Subject: ALSA: core: add isascii() check to card ID generator
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jaroslav Kysela <perex@perex.cz>
+
+commit d278a9de5e1837edbe57b2f1f95a104ff6c84846 upstream.
+
+The card identifier should contain only safe ASCII characters. The isalnum()
+returns true also for characters for non-ASCII characters.
+
+Link: https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/4135
+Link: https://lore.kernel.org/linux-sound/yk3WTvKkwheOon_LzZlJ43PPInz6byYfBzpKkbasww1yzuiMRqn7n6Y8vZcXB-xwFCu_vb8hoNjv7DTNwH5TWjpEuiVsyn9HPCEXqwF4120=@protonmail.com/
+Cc: stable@vger.kernel.org
+Reported-by: Barnabás Pőcze <pobrn@protonmail.com>
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Link: https://patch.msgid.link/20241002194649.1944696-1-perex@perex.cz
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/init.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/sound/core/init.c
++++ b/sound/core/init.c
+@@ -654,13 +654,19 @@ void snd_card_free(struct snd_card *card
+ }
+ EXPORT_SYMBOL(snd_card_free);
+
++/* check, if the character is in the valid ASCII range */
++static inline bool safe_ascii_char(char c)
++{
++ return isascii(c) && isalnum(c);
++}
++
+ /* retrieve the last word of shortname or longname */
+ static const char *retrieve_id_from_card_name(const char *name)
+ {
+ const char *spos = name;
+
+ while (*name) {
+- if (isspace(*name) && isalnum(name[1]))
++ if (isspace(*name) && safe_ascii_char(name[1]))
+ spos = name + 1;
+ name++;
+ }
+@@ -687,12 +693,12 @@ static void copy_valid_id_string(struct
+ {
+ char *id = card->id;
+
+- while (*nid && !isalnum(*nid))
++ while (*nid && !safe_ascii_char(*nid))
+ nid++;
+ if (isdigit(*nid))
+ *id++ = isalpha(*src) ? *src : 'D';
+ while (*nid && (size_t)(id - card->id) < sizeof(card->id) - 1) {
+- if (isalnum(*nid))
++ if (safe_ascii_char(*nid))
+ *id++ = *nid;
+ nid++;
+ }
+@@ -787,7 +793,7 @@ static ssize_t id_store(struct device *d
+
+ for (idx = 0; idx < copy; idx++) {
+ c = buf[idx];
+- if (!isalnum(c) && c != '_' && c != '-')
++ if (!safe_ascii_char(c) && c != '_' && c != '-')
+ return -EINVAL;
+ }
+ memcpy(buf1, buf, copy);
--- /dev/null
+From d75dba49744478c32f6ce1c16b5f391c2d5cef5f Mon Sep 17 00:00:00 2001
+From: Abhishek Tamboli <abhishektamboli9@gmail.com>
+Date: Mon, 30 Sep 2024 20:23:00 +0530
+Subject: ALSA: hda/realtek: Add a quirk for HP Pavilion 15z-ec200
+
+From: Abhishek Tamboli <abhishektamboli9@gmail.com>
+
+commit d75dba49744478c32f6ce1c16b5f391c2d5cef5f upstream.
+
+Add the quirk for HP Pavilion Gaming laptop 15z-ec200 for
+enabling the mute led. The fix apply the ALC285_FIXUP_HP_MUTE_LED
+quirk for this model.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=219303
+Signed-off-by: Abhishek Tamboli <abhishektamboli9@gmail.com>
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20240930145300.4604-1-abhishektamboli9@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10162,6 +10162,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x8896, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x88dd, "HP Pavilion 15z-ec200", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x8902, "HP OMEN 16", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x890e, "HP 255 G8 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
+ SND_PCI_QUIRK(0x103c, 0x8919, "HP Pavilion Aero Laptop 13-be0xxx", ALC287_FIXUP_HP_GPIO_LED),
--- /dev/null
+From dee476950cbd83125655a3f49e00d63b79f6114e Mon Sep 17 00:00:00 2001
+From: Ai Chao <aichao@kylinos.cn>
+Date: Thu, 26 Sep 2024 14:02:52 +0800
+Subject: ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9
+
+From: Ai Chao <aichao@kylinos.cn>
+
+commit dee476950cbd83125655a3f49e00d63b79f6114e upstream.
+
+The headset mic requires a fixup to be properly detected/used.
+
+Signed-off-by: Ai Chao <aichao@kylinos.cn>
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20240926060252.25630-1-aichao@kylinos.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10687,6 +10687,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1854, 0x0441, "LG CQ6 AIO", ALC256_FIXUP_HEADPHONE_AMP_VOL),
+ SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS),
+ SND_PCI_QUIRK(0x19e5, 0x320f, "Huawei WRT-WX9 ", ALC256_FIXUP_ASUS_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x19e5, 0x3212, "Huawei KLV-WX9 ", ALC256_FIXUP_ACER_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1b35, 0x1235, "CZC B20", ALC269_FIXUP_CZC_B20),
+ SND_PCI_QUIRK(0x1b35, 0x1236, "CZC TMI", ALC269_FIXUP_CZC_TMI),
+ SND_PCI_QUIRK(0x1b35, 0x1237, "CZC L101", ALC269_FIXUP_CZC_L101),
--- /dev/null
+From cb2deca056d579fe008c8d0a4ceb04d2b368fe42 Mon Sep 17 00:00:00 2001
+From: Nikolai Afanasenkov <nikolai.afanasenkov@hp.com>
+Date: Mon, 16 Sep 2024 13:50:42 -0600
+Subject: ALSA: hda/realtek: fix mute/micmute LED for HP mt645 G8
+
+From: Nikolai Afanasenkov <nikolai.afanasenkov@hp.com>
+
+commit cb2deca056d579fe008c8d0a4ceb04d2b368fe42 upstream.
+
+The HP Elite mt645 G8 Mobile Thin Client uses an ALC236 codec
+and needs the ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF quirk
+to enable the mute and micmute LED functionality.
+
+This patch adds the system ID of the HP Elite mt645 G8
+to the `alc269_fixup_tbl` in `patch_realtek.c`
+to enable the required quirk.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Nikolai Afanasenkov <nikolai.afanasenkov@hp.com>
+Link: https://patch.msgid.link/20240916195042.4050-1-nikolai.afanasenkov@hp.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10303,6 +10303,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x8ca2, "HP ZBook Power", ALC236_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8ca4, "HP ZBook Fury", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8ca7, "HP ZBook Fury", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8caf, "HP Elite mt645 G8 Mobile Thin Client", ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF),
+ SND_PCI_QUIRK(0x103c, 0x8cbd, "HP Pavilion Aero Laptop 13-bg0xxx", ALC245_FIXUP_HP_X360_MUTE_LEDS),
+ SND_PCI_QUIRK(0x103c, 0x8cdd, "HP Spectre", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x103c, 0x8cde, "HP Spectre", ALC287_FIXUP_CS35L41_I2C_2),
--- /dev/null
+From 49f5ee951f11f4d6a124f00f71b2590507811a55 Mon Sep 17 00:00:00 2001
+From: Baojun Xu <baojun.xu@ti.com>
+Date: Thu, 19 Sep 2024 15:57:43 +0800
+Subject: ALSA: hda/tas2781: Add new quirk for Lenovo Y990 Laptop
+
+From: Baojun Xu <baojun.xu@ti.com>
+
+commit 49f5ee951f11f4d6a124f00f71b2590507811a55 upstream.
+
+Add new vendor_id and subsystem_id in quirk for Lenovo Y990 Laptop.
+
+Signed-off-by: Baojun Xu <baojun.xu@ti.com>
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20240919075743.259-1-baojun.xu@ti.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10651,6 +10651,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x38cd, "Y790 VECO DUAL", ALC287_FIXUP_TAS2781_I2C),
+ SND_PCI_QUIRK(0x17aa, 0x38d2, "Lenovo Yoga 9 14IMH9", ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN),
+ SND_PCI_QUIRK(0x17aa, 0x38d7, "Lenovo Yoga 9 14IMH9", ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN),
++ SND_PCI_QUIRK(0x17aa, 0x38df, "Y990 YG DUAL", ALC287_FIXUP_TAS2781_I2C),
+ SND_PCI_QUIRK(0x17aa, 0x38f9, "Thinkbook 16P Gen5", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x17aa, 0x38fa, "Thinkbook 16P Gen5", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
--- /dev/null
+From 703235a244e533652346844cfa42623afb36eed1 Mon Sep 17 00:00:00 2001
+From: "Hans P. Moller" <hmoller@uc.cl>
+Date: Thu, 3 Oct 2024 20:28:28 -0300
+Subject: ALSA: line6: add hw monitor volume control to POD HD500X
+
+From: Hans P. Moller <hmoller@uc.cl>
+
+commit 703235a244e533652346844cfa42623afb36eed1 upstream.
+
+Add hw monitor volume control for POD HD500X. This is done adding
+LINE6_CAP_HWMON_CTL to the capabilities
+
+Signed-off-by: Hans P. Moller <hmoller@uc.cl>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/20241003232828.5819-1-hmoller@uc.cl
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/line6/podhd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/line6/podhd.c
++++ b/sound/usb/line6/podhd.c
+@@ -507,7 +507,7 @@ static const struct line6_properties pod
+ [LINE6_PODHD500X] = {
+ .id = "PODHD500X",
+ .name = "POD HD500X",
+- .capabilities = LINE6_CAP_CONTROL
++ .capabilities = LINE6_CAP_CONTROL | LINE6_CAP_HWMON_CTL
+ | LINE6_CAP_PCM | LINE6_CAP_HWMON,
+ .altsetting = 1,
+ .ep_ctrl_r = 0x81,
--- /dev/null
+From 73385f3e0d8088b715ae8f3f66d533c482a376ab Mon Sep 17 00:00:00 2001
+From: Lianqin Hu <hulianqin@vivo.com>
+Date: Wed, 25 Sep 2024 03:16:29 +0000
+Subject: ALSA: usb-audio: Add delay quirk for VIVO USB-C HEADSET
+
+From: Lianqin Hu <hulianqin@vivo.com>
+
+commit 73385f3e0d8088b715ae8f3f66d533c482a376ab upstream.
+
+Audio control requests that sets sampling frequency sometimes fail on
+this card. Adding delay between control messages eliminates that problem.
+
+Signed-off-by: Lianqin Hu <hulianqin@vivo.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: https://patch.msgid.link/TYUPR06MB62177E629E9DEF2401333BF7D2692@TYUPR06MB6217.apcprd06.prod.outlook.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/quirks.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -2279,6 +2279,8 @@ static const struct usb_audio_quirk_flag
+ QUIRK_FLAG_GENERIC_IMPLICIT_FB),
+ DEVICE_FLG(0x2b53, 0x0031, /* Fiero SC-01 (firmware v1.1.0) */
+ QUIRK_FLAG_GENERIC_IMPLICIT_FB),
++ DEVICE_FLG(0x2d95, 0x8011, /* VIVO USB-C HEADSET */
++ QUIRK_FLAG_CTL_MSG_DELAY_1M),
+ DEVICE_FLG(0x2d95, 0x8021, /* VIVO USB-C-XE710 HEADSET */
+ QUIRK_FLAG_CTL_MSG_DELAY_1M),
+ DEVICE_FLG(0x30be, 0x0101, /* Schiit Hel */
--- /dev/null
+From 6b0bde5d8d4078ca5feec72fd2d828f0e5cf115d Mon Sep 17 00:00:00 2001
+From: Jan Lalinsky <lalinsky@c4.cz>
+Date: Thu, 3 Oct 2024 05:08:11 +0200
+Subject: ALSA: usb-audio: Add native DSD support for Luxman D-08u
+
+From: Jan Lalinsky <lalinsky@c4.cz>
+
+commit 6b0bde5d8d4078ca5feec72fd2d828f0e5cf115d upstream.
+
+Add native DSD support for Luxman D-08u DAC, by adding the PID/VID 1852:5062.
+This makes DSD playback work, and also sound quality when playing PCM files
+is improved, crackling sounds are gone.
+
+Signed-off-by: Jan Lalinsky <lalinsky@c4.cz>
+Cc: <stable@vger.kernel.org>
+Link: https://patch.msgid.link/20241003030811.2655735-1-lalinsky@c4.cz
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/usb/quirks.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -2221,6 +2221,8 @@ static const struct usb_audio_quirk_flag
+ QUIRK_FLAG_DISABLE_AUTOSUSPEND),
+ DEVICE_FLG(0x17aa, 0x104d, /* Lenovo ThinkStation P620 Internal Speaker + Front Headset */
+ QUIRK_FLAG_DISABLE_AUTOSUSPEND),
++ DEVICE_FLG(0x1852, 0x5062, /* Luxman D-08u */
++ QUIRK_FLAG_ITF_USB_DSD_DAC | QUIRK_FLAG_CTL_MSG_DELAY),
+ DEVICE_FLG(0x1852, 0x5065, /* Luxman DA-06 */
+ QUIRK_FLAG_ITF_USB_DSD_DAC | QUIRK_FLAG_CTL_MSG_DELAY),
+ DEVICE_FLG(0x1901, 0x0191, /* GE B850V3 CP2114 audio interface */
--- /dev/null
+From 8b0d2f61545545ab5eef923ed6e59fc3be2385e0 Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Mon, 23 Sep 2024 09:58:14 +0200
+Subject: drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit 8b0d2f61545545ab5eef923ed6e59fc3be2385e0 upstream.
+
+FB_DAMAGE_CLIPS is a plane property for damage handling. Its UAPI
+should only use UAPI types. Hence replace struct drm_rect with
+struct drm_mode_rect in drm_atomic_plane_set_property(). Both types
+are identical in practice, so there's no change in behavior.
+
+Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Closes: https://lore.kernel.org/dri-devel/Zu1Ke1TuThbtz15E@intel.com/
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Fixes: d3b21767821e ("drm: Add a new plane property to send damage during plane update")
+Cc: Lukasz Spintzyk <lukasz.spintzyk@displaylink.com>
+Cc: Deepak Rawat <drawat@vmware.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Thomas Hellstrom <thellstrom@vmware.com>
+Cc: David Airlie <airlied@gmail.com>
+Cc: Simona Vetter <simona@ffwll.ch>
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Maxime Ripard <mripard@kernel.org>
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: dri-devel@lists.freedesktop.org
+Cc: <stable@vger.kernel.org> # v5.0+
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240923075841.16231-1-tzimmermann@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_atomic_uapi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_atomic_uapi.c
++++ b/drivers/gpu/drm/drm_atomic_uapi.c
+@@ -543,7 +543,7 @@ static int drm_atomic_plane_set_property
+ &state->fb_damage_clips,
+ val,
+ -1,
+- sizeof(struct drm_rect),
++ sizeof(struct drm_mode_rect),
+ &replaced);
+ return ret;
+ } else if (property == plane->scaling_filter_property) {
--- /dev/null
+From 5beb6fba25db235b52eab34bde8112f07bb31d75 Mon Sep 17 00:00:00 2001
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Date: Mon, 24 Jun 2024 18:43:47 +0200
+Subject: drm/mediatek: ovl_adaptor: Add missing of_node_put()
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+commit 5beb6fba25db235b52eab34bde8112f07bb31d75 upstream.
+
+Error paths that exit for_each_child_of_node() need to call
+of_node_put() to decerement the child refcount and avoid memory leaks.
+
+Add the missing of_node_put().
+
+Cc: stable@vger.kernel.org
+Fixes: 453c3364632a ("drm/mediatek: Add ovl_adaptor support for MT8195")
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20240624-mtk_disp_ovl_adaptor_scoped-v1-2-9fa1e074d881@gmail.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c
++++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c
+@@ -523,8 +523,10 @@ static int ovl_adaptor_comp_init(struct
+ }
+
+ comp_pdev = of_find_device_by_node(node);
+- if (!comp_pdev)
++ if (!comp_pdev) {
++ of_node_put(node);
+ return -EPROBE_DEFER;
++ }
+
+ priv->ovl_adaptor_comp[id] = &comp_pdev->dev;
+
--- /dev/null
+From f32b5128d2c440368b5bf3a7a356823e235caabb Mon Sep 17 00:00:00 2001
+From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Date: Thu, 11 Jul 2024 14:53:30 +0100
+Subject: drm/v3d: Prevent out of bounds access in performance query extensions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+
+commit f32b5128d2c440368b5bf3a7a356823e235caabb upstream.
+
+Check that the number of perfmons userspace is passing in the copy and
+reset extensions is not greater than the internal kernel storage where
+the ids will be copied into.
+
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
+Fixes: bae7cb5d6800 ("drm/v3d: Create a CPU job extension for the reset performance query job")
+Cc: Maíra Canal <mcanal@igalia.com>
+Cc: Iago Toral Quiroga <itoral@igalia.com>
+Cc: stable@vger.kernel.org # v6.8+
+Reviewed-by: Iago Toral Quiroga <itoral@igalia.com>
+Reviewed-by: Maíra Canal <mcanal@igalia.com>
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240711135340.84617-2-tursulin@igalia.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/v3d/v3d_submit.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/v3d/v3d_submit.c
++++ b/drivers/gpu/drm/v3d/v3d_submit.c
+@@ -671,6 +671,9 @@ v3d_get_cpu_reset_performance_params(str
+ if (reset.nperfmons > V3D_MAX_PERFMONS)
+ return -EINVAL;
+
++ if (reset.nperfmons > V3D_MAX_PERFMONS)
++ return -EINVAL;
++
+ job->job_type = V3D_CPU_JOB_TYPE_RESET_PERFORMANCE_QUERY;
+
+ job->performance_query.queries = kvmalloc_array(reset.count,
+@@ -753,6 +756,9 @@ v3d_get_cpu_copy_performance_query_param
+ return -EINVAL;
+
+ if (copy.nperfmons > V3D_MAX_PERFMONS)
++ return -EINVAL;
++
++ if (copy.nperfmons > V3D_MAX_PERFMONS)
+ return -EINVAL;
+
+ job->job_type = V3D_CPU_JOB_TYPE_COPY_PERFORMANCE_QUERY;
--- /dev/null
+From 59090e479ac78ae18facd4c58eb332562a23020e Mon Sep 17 00:00:00 2001
+From: Peng Fan <peng.fan@nxp.com>
+Date: Thu, 29 Aug 2024 11:29:11 +0800
+Subject: mm, slub: avoid zeroing kmalloc redzone
+
+From: Peng Fan <peng.fan@nxp.com>
+
+commit 59090e479ac78ae18facd4c58eb332562a23020e upstream.
+
+Since commit 946fa0dbf2d8 ("mm/slub: extend redzone check to extra
+allocated kmalloc space than requested"), setting orig_size treats
+the wasted space (object_size - orig_size) as a redzone. However with
+init_on_free=1 we clear the full object->size, including the redzone.
+
+Additionally we clear the object metadata, including the stored orig_size,
+making it zero, which makes check_object() treat the whole object as a
+redzone.
+
+These issues lead to the following BUG report with "slub_debug=FUZ
+init_on_free=1":
+
+[ 0.000000] =============================================================================
+[ 0.000000] BUG kmalloc-8 (Not tainted): kmalloc Redzone overwritten
+[ 0.000000] -----------------------------------------------------------------------------
+[ 0.000000]
+[ 0.000000] 0xffff000010032858-0xffff00001003285f @offset=2136. First byte 0x0 instead of 0xcc
+[ 0.000000] FIX kmalloc-8: Restoring kmalloc Redzone 0xffff000010032858-0xffff00001003285f=0xcc
+[ 0.000000] Slab 0xfffffdffc0400c80 objects=36 used=23 fp=0xffff000010032a18 flags=0x3fffe0000000200(workingset|node=0|zone=0|lastcpupid=0x1ffff)
+[ 0.000000] Object 0xffff000010032858 @offset=2136 fp=0xffff0000100328c8
+[ 0.000000]
+[ 0.000000] Redzone ffff000010032850: cc cc cc cc cc cc cc cc ........
+[ 0.000000] Object ffff000010032858: cc cc cc cc cc cc cc cc ........
+[ 0.000000] Redzone ffff000010032860: cc cc cc cc cc cc cc cc ........
+[ 0.000000] Padding ffff0000100328b4: 00 00 00 00 00 00 00 00 00 00 00 00 ............
+[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.11.0-rc3-next-20240814-00004-g61844c55c3f4 #144
+[ 0.000000] Hardware name: NXP i.MX95 19X19 board (DT)
+[ 0.000000] Call trace:
+[ 0.000000] dump_backtrace+0x90/0xe8
+[ 0.000000] show_stack+0x18/0x24
+[ 0.000000] dump_stack_lvl+0x74/0x8c
+[ 0.000000] dump_stack+0x18/0x24
+[ 0.000000] print_trailer+0x150/0x218
+[ 0.000000] check_object+0xe4/0x454
+[ 0.000000] free_to_partial_list+0x2f8/0x5ec
+
+To address the issue, use orig_size to clear the used area. And restore
+the value of orig_size after clear the remaining area.
+
+When CONFIG_SLUB_DEBUG not defined, (get_orig_size()' directly returns
+s->object_size. So when using memset to init the area, the size can simply
+be orig_size, as orig_size returns object_size when CONFIG_SLUB_DEBUG not
+enabled. And orig_size can never be bigger than object_size.
+
+Fixes: 946fa0dbf2d8 ("mm/slub: extend redzone check to extra allocated kmalloc space than requested")
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Feng Tang <feng.tang@intel.com>
+Acked-by: David Rientjes <rientjes@google.com>
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/slub.c | 100 ++++++++++++++++++++++++++++++++------------------------------
+ 1 file changed, 53 insertions(+), 47 deletions(-)
+
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -756,6 +756,50 @@ static inline bool slab_update_freelist(
+ return false;
+ }
+
++/*
++ * kmalloc caches has fixed sizes (mostly power of 2), and kmalloc() API
++ * family will round up the real request size to these fixed ones, so
++ * there could be an extra area than what is requested. Save the original
++ * request size in the meta data area, for better debug and sanity check.
++ */
++static inline void set_orig_size(struct kmem_cache *s,
++ void *object, unsigned int orig_size)
++{
++ void *p = kasan_reset_tag(object);
++ unsigned int kasan_meta_size;
++
++ if (!slub_debug_orig_size(s))
++ return;
++
++ /*
++ * KASAN can save its free meta data inside of the object at offset 0.
++ * If this meta data size is larger than 'orig_size', it will overlap
++ * the data redzone in [orig_size+1, object_size]. Thus, we adjust
++ * 'orig_size' to be as at least as big as KASAN's meta data.
++ */
++ kasan_meta_size = kasan_metadata_size(s, true);
++ if (kasan_meta_size > orig_size)
++ orig_size = kasan_meta_size;
++
++ p += get_info_end(s);
++ p += sizeof(struct track) * 2;
++
++ *(unsigned int *)p = orig_size;
++}
++
++static inline unsigned int get_orig_size(struct kmem_cache *s, void *object)
++{
++ void *p = kasan_reset_tag(object);
++
++ if (!slub_debug_orig_size(s))
++ return s->object_size;
++
++ p += get_info_end(s);
++ p += sizeof(struct track) * 2;
++
++ return *(unsigned int *)p;
++}
++
+ #ifdef CONFIG_SLUB_DEBUG
+ static unsigned long object_map[BITS_TO_LONGS(MAX_OBJS_PER_PAGE)];
+ static DEFINE_SPINLOCK(object_map_lock);
+@@ -969,50 +1013,6 @@ static void print_slab_info(const struct
+ folio_flags(folio, 0));
+ }
+
+-/*
+- * kmalloc caches has fixed sizes (mostly power of 2), and kmalloc() API
+- * family will round up the real request size to these fixed ones, so
+- * there could be an extra area than what is requested. Save the original
+- * request size in the meta data area, for better debug and sanity check.
+- */
+-static inline void set_orig_size(struct kmem_cache *s,
+- void *object, unsigned int orig_size)
+-{
+- void *p = kasan_reset_tag(object);
+- unsigned int kasan_meta_size;
+-
+- if (!slub_debug_orig_size(s))
+- return;
+-
+- /*
+- * KASAN can save its free meta data inside of the object at offset 0.
+- * If this meta data size is larger than 'orig_size', it will overlap
+- * the data redzone in [orig_size+1, object_size]. Thus, we adjust
+- * 'orig_size' to be as at least as big as KASAN's meta data.
+- */
+- kasan_meta_size = kasan_metadata_size(s, true);
+- if (kasan_meta_size > orig_size)
+- orig_size = kasan_meta_size;
+-
+- p += get_info_end(s);
+- p += sizeof(struct track) * 2;
+-
+- *(unsigned int *)p = orig_size;
+-}
+-
+-static inline unsigned int get_orig_size(struct kmem_cache *s, void *object)
+-{
+- void *p = kasan_reset_tag(object);
+-
+- if (!slub_debug_orig_size(s))
+- return s->object_size;
+-
+- p += get_info_end(s);
+- p += sizeof(struct track) * 2;
+-
+- return *(unsigned int *)p;
+-}
+-
+ void skip_orig_size_check(struct kmem_cache *s, const void *object)
+ {
+ set_orig_size(s, (void *)object, s->object_size);
+@@ -1859,7 +1859,6 @@ static inline void inc_slabs_node(struct
+ int objects) {}
+ static inline void dec_slabs_node(struct kmem_cache *s, int node,
+ int objects) {}
+-
+ #ifndef CONFIG_SLUB_TINY
+ static bool freelist_corrupted(struct kmem_cache *s, struct slab *slab,
+ void **freelist, void *nextfree)
+@@ -2187,14 +2186,21 @@ bool slab_free_hook(struct kmem_cache *s
+ */
+ if (unlikely(init)) {
+ int rsize;
+- unsigned int inuse;
++ unsigned int inuse, orig_size;
+
+ inuse = get_info_end(s);
++ orig_size = get_orig_size(s, x);
+ if (!kasan_has_integrated_init())
+- memset(kasan_reset_tag(x), 0, s->object_size);
++ memset(kasan_reset_tag(x), 0, orig_size);
+ rsize = (s->flags & SLAB_RED_ZONE) ? s->red_left_pad : 0;
+ memset((char *)kasan_reset_tag(x) + inuse, 0,
+ s->size - inuse - rsize);
++ /*
++ * Restore orig_size, otherwize kmalloc redzone overwritten
++ * would be reported
++ */
++ set_orig_size(s, x, orig_size);
++
+ }
+ /* KASAN might put x into memory quarantine, delaying its reuse. */
+ return !kasan_slab_free(s, x, init);
--- /dev/null
+From 9542130937e9dc707dd7c6b7af73326437da2d50 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Tue, 10 Sep 2024 18:32:24 +0200
+Subject: parisc: Fix itlb miss handler for 64-bit programs
+
+From: Helge Deller <deller@gmx.de>
+
+commit 9542130937e9dc707dd7c6b7af73326437da2d50 upstream.
+
+For an itlb miss when executing code above 4 Gb on ILP64 adjust the
+iasq/iaoq in the same way isr/ior was adjusted. This fixes signal
+delivery for the 64-bit static test program from
+http://ftp.parisc-linux.org/src/64bit.tar.gz. Note that signals are
+handled by the signal trampoline code in the 64-bit VDSO which is mapped
+into high userspace memory region above 4GB for 64-bit processes.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: stable@vger.kernel.org # v4.19+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/parisc/kernel/entry.S | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -1051,8 +1051,7 @@ ENTRY_CFI(intr_save) /* for os_hpmc */
+ STREG %r16, PT_ISR(%r29)
+ STREG %r17, PT_IOR(%r29)
+
+-#if 0 && defined(CONFIG_64BIT)
+- /* Revisit when we have 64-bit code above 4Gb */
++#if defined(CONFIG_64BIT)
+ b,n intr_save2
+
+ skip_save_ior:
+@@ -1060,8 +1059,7 @@ skip_save_ior:
+ * need to adjust iasq/iaoq here in the same way we adjusted isr/ior
+ * above.
+ */
+- extrd,u,* %r8,PSW_W_BIT,1,%r1
+- cmpib,COND(=),n 1,%r1,intr_save2
++ bb,COND(>=),n %r8,PSW_W_BIT,intr_save2
+ LDREG PT_IASQ0(%r29), %r16
+ LDREG PT_IAOQ0(%r29), %r17
+ /* adjust iasq/iaoq */
--- /dev/null
+From 62c0b1061593d7012292f781f11145b2d46f43ab Mon Sep 17 00:00:00 2001
+From: Luo Gengkun <luogengkun@huaweicloud.com>
+Date: Sat, 31 Aug 2024 07:43:15 +0000
+Subject: perf/core: Fix small negative period being ignored
+
+From: Luo Gengkun <luogengkun@huaweicloud.com>
+
+commit 62c0b1061593d7012292f781f11145b2d46f43ab upstream.
+
+In perf_adjust_period, we will first calculate period, and then use
+this period to calculate delta. However, when delta is less than 0,
+there will be a deviation compared to when delta is greater than or
+equal to 0. For example, when delta is in the range of [-14,-1], the
+range of delta = delta + 7 is between [-7,6], so the final value of
+delta/8 is 0. Therefore, the impact of -1 and -2 will be ignored.
+This is unacceptable when the target period is very short, because
+we will lose a lot of samples.
+
+Here are some tests and analyzes:
+before:
+ # perf record -e cs -F 1000 ./a.out
+ [ perf record: Woken up 1 times to write data ]
+ [ perf record: Captured and wrote 0.022 MB perf.data (518 samples) ]
+
+ # perf script
+ ...
+ a.out 396 257.956048: 23 cs: ffffffff81f4eeec schedul>
+ a.out 396 257.957891: 23 cs: ffffffff81f4eeec schedul>
+ a.out 396 257.959730: 23 cs: ffffffff81f4eeec schedul>
+ a.out 396 257.961545: 23 cs: ffffffff81f4eeec schedul>
+ a.out 396 257.963355: 23 cs: ffffffff81f4eeec schedul>
+ a.out 396 257.965163: 23 cs: ffffffff81f4eeec schedul>
+ a.out 396 257.966973: 23 cs: ffffffff81f4eeec schedul>
+ a.out 396 257.968785: 23 cs: ffffffff81f4eeec schedul>
+ a.out 396 257.970593: 23 cs: ffffffff81f4eeec schedul>
+ ...
+
+after:
+ # perf record -e cs -F 1000 ./a.out
+ [ perf record: Woken up 1 times to write data ]
+ [ perf record: Captured and wrote 0.058 MB perf.data (1466 samples) ]
+
+ # perf script
+ ...
+ a.out 395 59.338813: 11 cs: ffffffff81f4eeec schedul>
+ a.out 395 59.339707: 12 cs: ffffffff81f4eeec schedul>
+ a.out 395 59.340682: 13 cs: ffffffff81f4eeec schedul>
+ a.out 395 59.341751: 13 cs: ffffffff81f4eeec schedul>
+ a.out 395 59.342799: 12 cs: ffffffff81f4eeec schedul>
+ a.out 395 59.343765: 11 cs: ffffffff81f4eeec schedul>
+ a.out 395 59.344651: 11 cs: ffffffff81f4eeec schedul>
+ a.out 395 59.345539: 12 cs: ffffffff81f4eeec schedul>
+ a.out 395 59.346502: 13 cs: ffffffff81f4eeec schedul>
+ ...
+
+test.c
+
+int main() {
+ for (int i = 0; i < 20000; i++)
+ usleep(10);
+
+ return 0;
+}
+
+ # time ./a.out
+ real 0m1.583s
+ user 0m0.040s
+ sys 0m0.298s
+
+The above results were tested on x86-64 qemu with KVM enabled using
+test.c as test program. Ideally, we should have around 1500 samples,
+but the previous algorithm had only about 500, whereas the modified
+algorithm now has about 1400. Further more, the new version shows 1
+sample per 0.001s, while the previous one is 1 sample per 0.002s.This
+indicates that the new algorithm is more sensitive to small negative
+values compared to old algorithm.
+
+Fixes: bd2b5b12849a ("perf_counter: More aggressive frequency adjustment")
+Signed-off-by: Luo Gengkun <luogengkun@huaweicloud.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
+Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20240831074316.2106159-2-luogengkun@huaweicloud.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/events/core.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -4107,7 +4107,11 @@ static void perf_adjust_period(struct pe
+ period = perf_calculate_period(event, nsec, count);
+
+ delta = (s64)(period - hwc->sample_period);
+- delta = (delta + 7) / 8; /* low pass filter */
++ if (delta >= 0)
++ delta += 7;
++ else
++ delta -= 7;
++ delta /= 8; /* low pass filter */
+
+ sample_period = hwc->sample_period + delta;
+
spi-bcm63xx-fix-module-autoloading.patch
spi-bcm63xx-fix-missing-pm_runtime_disable.patch
power-supply-hwmon-fix-missing-temp1_max_alarm-attribute.patch
+mm-slub-avoid-zeroing-kmalloc-redzone.patch
+perf-core-fix-small-negative-period-being-ignored.patch
+drm-v3d-prevent-out-of-bounds-access-in-performance-query-extensions.patch
+parisc-fix-itlb-miss-handler-for-64-bit-programs.patch
+drm-mediatek-ovl_adaptor-add-missing-of_node_put.patch
+drm-consistently-use-struct-drm_mode_rect-for-fb_damage_clips.patch
+alsa-hda-tas2781-add-new-quirk-for-lenovo-y990-laptop.patch
+alsa-core-add-isascii-check-to-card-id-generator.patch
+alsa-usb-audio-add-delay-quirk-for-vivo-usb-c-headset.patch
+alsa-usb-audio-add-native-dsd-support-for-luxman-d-08u.patch
+alsa-line6-add-hw-monitor-volume-control-to-pod-hd500x.patch
+alsa-hda-realtek-fix-mute-micmute-led-for-hp-mt645-g8.patch
+alsa-hda-realtek-add-quirk-for-huawei-matebook-13-klv-wx9.patch
+alsa-hda-realtek-add-a-quirk-for-hp-pavilion-15z-ec200.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
