--- /dev/null
+From c3cdf189276c2a63da62ee250615bd55e3fb680d Mon Sep 17 00:00:00 2001
+From: Luke D Jones <luke@ljones.dev>
+Date: Mon, 7 Sep 2020 20:19:59 +1200
+Subject: ALSA: hda: fixup headset for ASUS GX502 laptop
+
+From: Luke D Jones <luke@ljones.dev>
+
+commit c3cdf189276c2a63da62ee250615bd55e3fb680d upstream.
+
+The GX502 requires a few steps to enable the headset i/o: pincfg,
+verbs to enable and unmute the amp used for headpone out, and
+a jacksense callback to toggle output via internal or jack using
+a verb.
+
+Signed-off-by: Luke D Jones <luke@ljones.dev>
+Cc: <stable@vger.kernel.org>
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208005
+Link: https://lore.kernel.org/r/20200907081959.56186-1-luke@ljones.dev
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 65 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 65 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5974,6 +5974,40 @@ static void alc_fixup_disable_mic_vref(s
+ snd_hda_codec_set_pin_target(codec, 0x19, PIN_VREFHIZ);
+ }
+
++
++static void alc294_gx502_toggle_output(struct hda_codec *codec,
++ struct hda_jack_callback *cb)
++{
++ /* The Windows driver sets the codec up in a very different way where
++ * it appears to leave 0x10 = 0x8a20 set. For Linux we need to toggle it
++ */
++ if (snd_hda_jack_detect_state(codec, 0x21) == HDA_JACK_PRESENT)
++ alc_write_coef_idx(codec, 0x10, 0x8a20);
++ else
++ alc_write_coef_idx(codec, 0x10, 0x0a20);
++}
++
++static void alc294_fixup_gx502_hp(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ /* Pin 0x21: headphones/headset mic */
++ if (!is_jack_detectable(codec, 0x21))
++ return;
++
++ switch (action) {
++ case HDA_FIXUP_ACT_PRE_PROBE:
++ snd_hda_jack_detect_enable_callback(codec, 0x21,
++ alc294_gx502_toggle_output);
++ break;
++ case HDA_FIXUP_ACT_INIT:
++ /* Make sure to start in a correct state, i.e. if
++ * headphones have been plugged in before powering up the system
++ */
++ alc294_gx502_toggle_output(codec, NULL);
++ break;
++ }
++}
++
+ static void alc285_fixup_hp_gpio_amp_init(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+@@ -6154,6 +6188,9 @@ enum {
+ ALC285_FIXUP_THINKPAD_HEADSET_JACK,
+ ALC294_FIXUP_ASUS_HPE,
+ ALC294_FIXUP_ASUS_COEF_1B,
++ ALC294_FIXUP_ASUS_GX502_HP,
++ ALC294_FIXUP_ASUS_GX502_PINS,
++ ALC294_FIXUP_ASUS_GX502_VERBS,
+ ALC285_FIXUP_HP_GPIO_LED,
+ ALC285_FIXUP_HP_MUTE_LED,
+ ALC236_FIXUP_HP_MUTE_LED,
+@@ -7319,6 +7356,33 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC
+ },
++ [ALC294_FIXUP_ASUS_GX502_PINS] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x03a11050 }, /* front HP mic */
++ { 0x1a, 0x01a11830 }, /* rear external mic */
++ { 0x21, 0x03211020 }, /* front HP out */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC294_FIXUP_ASUS_GX502_VERBS
++ },
++ [ALC294_FIXUP_ASUS_GX502_VERBS] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ /* set 0x15 to HP-OUT ctrl */
++ { 0x15, AC_VERB_SET_PIN_WIDGET_CONTROL, 0xc0 },
++ /* unmute the 0x15 amp */
++ { 0x15, AC_VERB_SET_AMP_GAIN_MUTE, 0xb000 },
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC294_FIXUP_ASUS_GX502_HP
++ },
++ [ALC294_FIXUP_ASUS_GX502_HP] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc294_fixup_gx502_hp,
++ },
+ [ALC294_FIXUP_ASUS_COEF_1B] = {
+ .type = HDA_FIXUP_VERBS,
+ .v.verbs = (const struct hda_verb[]) {
+@@ -7692,6 +7756,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),
+ SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401),
++ SND_PCI_QUIRK(0x1043, 0x1881, "ASUS Zephyrus S/M", ALC294_FIXUP_ASUS_GX502_PINS),
+ SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
+ SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x1043, 0x834a, "ASUS S101", ALC269_FIXUP_STEREO_DMIC),
--- /dev/null
+From fc19d559b0d31b5b831fd468b10d7dadafc0d0ec Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Wed, 9 Sep 2020 10:00:41 +0800
+Subject: ALSA: hda/realtek - The Mic on a RedmiBook doesn't work
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit fc19d559b0d31b5b831fd468b10d7dadafc0d0ec upstream.
+
+The Mic connects to the Nid 0x19, but the configuration of Nid 0x19
+is not defined to Mic, and also need to set the coeff to enable the
+auto detection on the Nid 0x19. After this change, the Mic plugging
+in or plugging out could be detected and could record the sound from
+the Mic.
+
+And the coeff value is suggested by Kailang of Realtek.
+
+Cc: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Link: https://lore.kernel.org/r/20200909020041.8967-1-hui.wang@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6209,6 +6209,7 @@ enum {
+ ALC269_FIXUP_LEMOTE_A1802,
+ ALC269_FIXUP_LEMOTE_A190X,
+ ALC256_FIXUP_INTEL_NUC8_RUGGED,
++ ALC255_FIXUP_XIAOMI_HEADSET_MIC,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -7572,6 +7573,16 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MODE
+ },
++ [ALC255_FIXUP_XIAOMI_HEADSET_MIC] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x45 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x5089 },
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC289_FIXUP_ASUS_GA401
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -7869,6 +7880,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1b35, 0x1236, "CZC TMI", ALC269_FIXUP_CZC_TMI),
+ SND_PCI_QUIRK(0x1b35, 0x1237, "CZC L101", ALC269_FIXUP_CZC_L101),
+ SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */
++ SND_PCI_QUIRK(0x1d72, 0x1602, "RedmiBook", ALC255_FIXUP_XIAOMI_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC),
+ SND_PCI_QUIRK(0x10ec, 0x118c, "Medion EE4254 MD62100", ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1c06, 0x2013, "Lemote A1802", ALC269_FIXUP_LEMOTE_A1802),
+@@ -8046,6 +8058,7 @@ static const struct hda_model_fixup alc2
+ {.id = ALC298_FIXUP_HUAWEI_MBX_STEREO, .name = "huawei-mbx-stereo"},
+ {.id = ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, .name = "alc256-medion-headset"},
+ {.id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc298-samsung-headphone"},
++ {.id = ALC255_FIXUP_XIAOMI_HEADSET_MIC, .name = "alc255-xiaomi-headset"},
+ {}
+ };
+ #define ALC225_STANDARD_PINS \
--- /dev/null
+From 20612303a0b45de748d31331407e84300c38e497 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Tue, 28 Jul 2020 16:21:44 +0100
+Subject: drm/i915: Filter wake_flags passed to default_wake_function
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 20612303a0b45de748d31331407e84300c38e497 upstream.
+
+(NOTE: This is the minimal backportable fix, a full fix is being
+developed at https://patchwork.freedesktop.org/patch/388048/)
+
+The flags passed to the wait_entry.func are passed onwards to
+try_to_wake_up(), which has a very particular interpretation for its
+wake_flags. In particular, beyond the published WF_SYNC, it has a few
+internal flags as well. Since we passed the fence->error down the chain
+via the flags argument, these ended up in the default_wake_function
+confusing the kernel/sched.
+
+Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2110
+Fixes: ef4688497512 ("drm/i915: Propagate fence errors")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Matthew Auld <matthew.auld@intel.com>
+Cc: <stable@vger.kernel.org> # v5.4+
+Reviewed-by: Matthew Auld <matthew.auld@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200728152144.1100-1-chris@chris-wilson.co.uk
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+[Joonas: Rebased and reordered into drm-intel-gt-next branch]
+[Joonas: Added a note and link about more complete fix]
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+(cherry picked from commit f4b3c395540aa3d4f5a6275c5bdd83ab89034806)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_sw_fence.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_sw_fence.c
++++ b/drivers/gpu/drm/i915/i915_sw_fence.c
+@@ -158,9 +158,13 @@ static void __i915_sw_fence_wake_up_all(
+
+ do {
+ list_for_each_entry_safe(pos, next, &x->head, entry) {
+- pos->func(pos,
+- TASK_NORMAL, fence->error,
+- &extra);
++ int wake_flags;
++
++ wake_flags = fence->error;
++ if (pos->func == autoremove_wake_function)
++ wake_flags = 0;
++
++ pos->func(pos, TASK_NORMAL, wake_flags, &extra);
+ }
+
+ if (list_empty(&extra))
--- /dev/null
+From 66d402e2e9455cf0213c42b97f22a0493372d7cc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Volker=20R=C3=BCmelin?= <vr_qemu@t-online.de>
+Date: Tue, 1 Sep 2020 15:22:21 +0200
+Subject: i2c: i801: Fix resume bug
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Volker Rümelin <vr_qemu@t-online.de>
+
+commit 66d402e2e9455cf0213c42b97f22a0493372d7cc upstream.
+
+On suspend the original host configuration gets restored. The
+resume routine has to undo this, otherwise the SMBus master
+may be left in disabled state or in i2c mode.
+
+[JD: Rebased on v5.8, moved the write into i801_setup_hstcfg.]
+
+Signed-off-by: Volker Rümelin <vr_qemu@t-online.de>
+Signed-off-by: Jean Delvare <jdelvare@suse.de>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-i801.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -1688,6 +1688,16 @@ static inline int i801_acpi_probe(struct
+ static inline void i801_acpi_remove(struct i801_priv *priv) { }
+ #endif
+
++static unsigned char i801_setup_hstcfg(struct i801_priv *priv)
++{
++ unsigned char hstcfg = priv->original_hstcfg;
++
++ hstcfg &= ~SMBHSTCFG_I2C_EN; /* SMBus timing */
++ hstcfg |= SMBHSTCFG_HST_EN;
++ pci_write_config_byte(priv->pci_dev, SMBHSTCFG, hstcfg);
++ return hstcfg;
++}
++
+ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ {
+ unsigned char temp;
+@@ -1804,14 +1814,10 @@ static int i801_probe(struct pci_dev *de
+ return err;
+ }
+
+- pci_read_config_byte(priv->pci_dev, SMBHSTCFG, &temp);
+- priv->original_hstcfg = temp;
+- temp &= ~SMBHSTCFG_I2C_EN; /* SMBus timing */
+- if (!(temp & SMBHSTCFG_HST_EN)) {
++ pci_read_config_byte(priv->pci_dev, SMBHSTCFG, &priv->original_hstcfg);
++ temp = i801_setup_hstcfg(priv);
++ if (!(priv->original_hstcfg & SMBHSTCFG_HST_EN))
+ dev_info(&dev->dev, "Enabling SMBus device\n");
+- temp |= SMBHSTCFG_HST_EN;
+- }
+- pci_write_config_byte(priv->pci_dev, SMBHSTCFG, temp);
+
+ if (temp & SMBHSTCFG_SMB_SMI_EN) {
+ dev_dbg(&dev->dev, "SMBus using interrupt SMI#\n");
+@@ -1937,6 +1943,7 @@ static int i801_resume(struct device *de
+ {
+ struct i801_priv *priv = dev_get_drvdata(dev);
+
++ i801_setup_hstcfg(priv);
+ i801_enable_host_notify(&priv->adapter);
+
+ return 0;
--- /dev/null
+From 0342d2342b24547ff8ec3e12f9148a9fd681481f Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Mon, 21 Sep 2020 13:55:28 +0200
+Subject: Revert "ALSA: hda - Fix silent audio output and corrupted input on MSI X570-A PRO"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+This reverts commit 982505615063873a896efce767c996792c3db00c which is
+commit 15cbff3fbbc631952c346744f862fb294504b5e2 upstream.
+
+It causes know regressions and will be reverted in Linus's tree soon.
+
+Reported-by: Hans de Goede <hdegoede@redhat.com>
+Cc: Dan Crawford <dnlcrwfrd@gmail.com>
+Cc: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/7efd2fe5-bf38-7f85-891a-eee3845d1493@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2466,7 +2466,6 @@ static const struct snd_pci_quirk alc882
+ SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1293, "MSI-GP65", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
+- SND_PCI_QUIRK(0x1462, 0x9c37, "MSI X570-A PRO", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0xda57, "MSI Z270-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
+ SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
iommu-amd-fix-potential-entry-null-deref.patch
i2c-mxs-use-mxs_dma_ctrl_wait4end-instead-of-dma_ctr.patch
riscv-add-sfence.vma-after-early-page-table-changes.patch
+drm-i915-filter-wake_flags-passed-to-default_wake_function.patch
+usb-quirks-add-usb_quirk_ignore_remote_wakeup-quirk-for-byd-zhaoxin-notebook.patch
+usb-uas-fix-disconnect-by-unplugging-a-hub.patch
+usblp-fix-race-between-disconnect-and-read.patch
+usb-typec-ucsi-prevent-mode-overrun.patch
+i2c-i801-fix-resume-bug.patch
+revert-alsa-hda-fix-silent-audio-output-and-corrupted.patch
+alsa-hda-fixup-headset-for-asus-gx502-laptop.patch
+alsa-hda-realtek-the-mic-on-a-redmibook-doesn-t-work.patch
--- /dev/null
+From bcea6dafeeef7d1a6a8320a249aabf981d63b881 Mon Sep 17 00:00:00 2001
+From: Penghao <penghao@uniontech.com>
+Date: Mon, 7 Sep 2020 10:30:26 +0800
+Subject: USB: quirks: Add USB_QUIRK_IGNORE_REMOTE_WAKEUP quirk for BYD zhaoxin notebook
+
+From: Penghao <penghao@uniontech.com>
+
+commit bcea6dafeeef7d1a6a8320a249aabf981d63b881 upstream.
+
+Add a USB_QUIRK_IGNORE_REMOTE_WAKEUP quirk for the BYD zhaoxin notebook.
+This notebook come with usb touchpad. And we would like to disable
+touchpad wakeup on this notebook by default.
+
+Signed-off-by: Penghao <penghao@uniontech.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200907023026.28189-1-penghao@uniontech.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -397,6 +397,10 @@ static const struct usb_device_id usb_qu
+ /* Generic RTL8153 based ethernet adapters */
+ { USB_DEVICE(0x0bda, 0x8153), .driver_info = USB_QUIRK_NO_LPM },
+
++ /* SONiX USB DEVICE Touchpad */
++ { USB_DEVICE(0x0c45, 0x7056), .driver_info =
++ USB_QUIRK_IGNORE_REMOTE_WAKEUP },
++
+ /* Action Semiconductor flash disk */
+ { USB_DEVICE(0x10d6, 0x2200), .driver_info =
+ USB_QUIRK_STRING_FETCH_255 },
--- /dev/null
+From 386e15a650447f53de3d2d8819ce9393f31650a4 Mon Sep 17 00:00:00 2001
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Date: Wed, 16 Sep 2020 12:00:34 +0300
+Subject: usb: typec: ucsi: Prevent mode overrun
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+commit 386e15a650447f53de3d2d8819ce9393f31650a4 upstream.
+
+Sometimes the embedded controller firmware does not
+terminate the list of alternate modes that the partner
+supports in its response to the GET_ALTERNATE_MODES command.
+Instead the firmware returns the supported alternate modes
+over and over again until the driver stops requesting them.
+
+If that happens, the number of modes for each alternate mode
+will exceed the maximum 6 that is defined in the USB Power
+Delivery specification. Making sure that can't happen by
+adding a check for it.
+
+This fixes NULL pointer dereference that is caused by the
+overrun.
+
+Fixes: ad74b8649beaf ("usb: typec: ucsi: Preliminary support for alternate modes")
+Cc: stable@vger.kernel.org
+Reported-by: Zwane Mwaikambo <zwanem@gmail.com>
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20200916090034.25119-3-heikki.krogerus@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/ucsi/ucsi.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/typec/ucsi/ucsi.c
++++ b/drivers/usb/typec/ucsi/ucsi.c
+@@ -246,14 +246,18 @@ void ucsi_altmode_update_active(struct u
+ con->partner_altmode[i] == altmode);
+ }
+
+-static u8 ucsi_altmode_next_mode(struct typec_altmode **alt, u16 svid)
++static int ucsi_altmode_next_mode(struct typec_altmode **alt, u16 svid)
+ {
+ u8 mode = 1;
+ int i;
+
+- for (i = 0; alt[i]; i++)
++ for (i = 0; alt[i]; i++) {
++ if (i > MODE_DISCOVERY_MAX)
++ return -ERANGE;
++
+ if (alt[i]->svid == svid)
+ mode++;
++ }
+
+ return mode;
+ }
+@@ -288,8 +292,11 @@ static int ucsi_register_altmode(struct
+ goto err;
+ }
+
+- desc->mode = ucsi_altmode_next_mode(con->port_altmode,
+- desc->svid);
++ ret = ucsi_altmode_next_mode(con->port_altmode, desc->svid);
++ if (ret < 0)
++ return ret;
++
++ desc->mode = ret;
+
+ switch (desc->svid) {
+ case USB_TYPEC_DP_SID:
+@@ -315,8 +322,11 @@ static int ucsi_register_altmode(struct
+ goto err;
+ }
+
+- desc->mode = ucsi_altmode_next_mode(con->partner_altmode,
+- desc->svid);
++ ret = ucsi_altmode_next_mode(con->partner_altmode, desc->svid);
++ if (ret < 0)
++ return ret;
++
++ desc->mode = ret;
+
+ alt = typec_partner_register_altmode(con->partner, desc);
+ if (IS_ERR(alt)) {
--- /dev/null
+From 325b008723b2dd31de020e85ab9d2e9aa4637d35 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Wed, 16 Sep 2020 11:40:25 +0200
+Subject: USB: UAS: fix disconnect by unplugging a hub
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit 325b008723b2dd31de020e85ab9d2e9aa4637d35 upstream.
+
+The SCSI layer can go into an ugly loop if you ignore that a device is
+gone. You need to report an error in the command rather than in the
+return value of the queue method.
+
+We need to specifically check for ENODEV. The issue goes back to the
+introduction of the driver.
+
+Fixes: 115bb1ffa54c3 ("USB: Add UAS driver")
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200916094026.30085-2-oneukum@suse.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/uas.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -662,8 +662,7 @@ static int uas_queuecommand_lck(struct s
+ if (devinfo->resetting) {
+ cmnd->result = DID_ERROR << 16;
+ cmnd->scsi_done(cmnd);
+- spin_unlock_irqrestore(&devinfo->lock, flags);
+- return 0;
++ goto zombie;
+ }
+
+ /* Find a free uas-tag */
+@@ -699,6 +698,16 @@ static int uas_queuecommand_lck(struct s
+ cmdinfo->state &= ~(SUBMIT_DATA_IN_URB | SUBMIT_DATA_OUT_URB);
+
+ err = uas_submit_urbs(cmnd, devinfo);
++ /*
++ * in case of fatal errors the SCSI layer is peculiar
++ * a command that has finished is a success for the purpose
++ * of queueing, no matter how fatal the error
++ */
++ if (err == -ENODEV) {
++ cmnd->result = DID_ERROR << 16;
++ cmnd->scsi_done(cmnd);
++ goto zombie;
++ }
+ if (err) {
+ /* If we did nothing, give up now */
+ if (cmdinfo->state & SUBMIT_STATUS_URB) {
+@@ -709,6 +718,7 @@ static int uas_queuecommand_lck(struct s
+ }
+
+ devinfo->cmnd[idx] = cmnd;
++zombie:
+ spin_unlock_irqrestore(&devinfo->lock, flags);
+ return 0;
+ }
--- /dev/null
+From 9cdabcb3ef8c24ca3a456e4db7b012befb688e73 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Thu, 17 Sep 2020 12:34:27 +0200
+Subject: usblp: fix race between disconnect() and read()
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit 9cdabcb3ef8c24ca3a456e4db7b012befb688e73 upstream.
+
+read() needs to check whether the device has been
+disconnected before it tries to talk to the device.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Reported-by: syzbot+be5b5f86a162a6c281e6@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/r/20200917103427.15740-1-oneukum@suse.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/usblp.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/usb/class/usblp.c
++++ b/drivers/usb/class/usblp.c
+@@ -827,6 +827,11 @@ static ssize_t usblp_read(struct file *f
+ if (rv < 0)
+ return rv;
+
++ if (!usblp->present) {
++ count = -ENODEV;
++ goto done;
++ }
++
+ if ((avail = usblp->rstatus) < 0) {
+ printk(KERN_ERR "usblp%d: error %d reading from printer\n",
+ usblp->minor, (int)avail);
projects / thirdparty / kernel / stable-queue.git / commitdiff
