--- /dev/null
+From 74d6a5d5662975aed7f25952f62efbb6f6dadd29 Mon Sep 17 00:00:00 2001
+From: Wang Hai <wanghai38@huawei.com>
+Date: Fri, 12 Jun 2020 17:08:33 +0800
+Subject: 9p/trans_fd: Fix concurrency del of req_list in p9_fd_cancelled/p9_read_work
+
+From: Wang Hai <wanghai38@huawei.com>
+
+commit 74d6a5d5662975aed7f25952f62efbb6f6dadd29 upstream.
+
+p9_read_work and p9_fd_cancelled may be called concurrently.
+In some cases, req->req_list may be deleted by both p9_read_work
+and p9_fd_cancelled.
+
+We can fix it by ignoring replies associated with a cancelled
+request and ignoring cancelled request if message has been received
+before lock.
+
+Link: http://lkml.kernel.org/r/20200612090833.36149-1-wanghai38@huawei.com
+Fixes: 60ff779c4abb ("9p: client: remove unused code and any reference to "cancelled" function")
+Cc: <stable@vger.kernel.org> # v3.12+
+Reported-by: syzbot+77a25acfa0382e06ab23@syzkaller.appspotmail.com
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/9p/trans_fd.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -362,6 +362,10 @@ static void p9_read_work(struct work_str
+ if (m->rreq->status == REQ_STATUS_SENT) {
+ list_del(&m->rreq->req_list);
+ p9_client_cb(m->client, m->rreq, REQ_STATUS_RCVD);
++ } else if (m->rreq->status == REQ_STATUS_FLSHD) {
++ /* Ignore replies associated with a cancelled request. */
++ p9_debug(P9_DEBUG_TRANS,
++ "Ignore replies associated with a cancelled request\n");
+ } else {
+ spin_unlock(&m->client->lock);
+ p9_debug(P9_DEBUG_ERROR,
+@@ -703,11 +707,20 @@ static int p9_fd_cancelled(struct p9_cli
+ {
+ p9_debug(P9_DEBUG_TRANS, "client %p req %p\n", client, req);
+
++ spin_lock(&client->lock);
++ /* Ignore cancelled request if message has been received
++ * before lock.
++ */
++ if (req->status == REQ_STATUS_RCVD) {
++ spin_unlock(&client->lock);
++ return 0;
++ }
++
+ /* we haven't received a response for oldreq,
+ * remove it from the list.
+ */
+- spin_lock(&client->lock);
+ list_del(&req->req_list);
++ req->status = REQ_STATUS_FLSHD;
+ spin_unlock(&client->lock);
+ p9_req_put(req);
+
--- /dev/null
+From c2c3657f0aedb8736a0fb7b2b1985adfb86e7802 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 28 Jul 2020 10:20:33 +0200
+Subject: ALSA: hda/hdmi: Fix keep_power assignment for non-component devices
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit c2c3657f0aedb8736a0fb7b2b1985adfb86e7802 upstream.
+
+It's been reported that, when neither nouveau nor Nvidia graphics
+driver is used, the screen starts flickering. And, after comparing
+between the working case (stable 4.4.x) and the broken case, it turned
+out that the problem comes from the audio component binding. The
+Nvidia and AMD audio binding code clears the bus->keep_power flag
+whenever snd_hdac_acomp_init() succeeds. But this doesn't mean that
+the component is actually bound, but it merely indicates that it's
+ready for binding. So, when both nouveau and Nvidia are blacklisted
+or not ready, the driver keeps running without the audio component but
+also with bus->keep_power = false. This made the driver runtime PM
+kicked in and powering down when unused, which results in flickering
+in the graphics side, as it seems.
+
+For fixing the bug, this patch moves the bus->keep_power flag change
+into generic_acomp_notifier_set() that is the function called from the
+master_bind callback of component ops; i.e. it's guaranteed that the
+binding succeeded.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208609
+Fixes: 5a858e79c911 ("ALSA: hda - Disable audio component for legacy Nvidia HDMI codecs")
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200728082033.23933-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_hdmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2439,6 +2439,7 @@ static void generic_acomp_notifier_set(s
+ mutex_lock(&spec->bind_lock);
+ spec->use_acomp_notifier = use_acomp;
+ spec->codec->relaxed_resume = use_acomp;
++ spec->codec->bus->keep_power = 0;
+ /* reprogram each jack detection logic depending on the notifier */
+ for (i = 0; i < spec->num_pins; i++)
+ reprogram_jack_detect(spec->codec,
+@@ -2533,7 +2534,6 @@ static void generic_acomp_init(struct hd
+ if (!snd_hdac_acomp_init(&codec->bus->core, &spec->drm_audio_ops,
+ match_bound_vga, 0)) {
+ spec->acomp_registered = true;
+- codec->bus->keep_power = 0;
+ }
+ }
+
--- /dev/null
+From 4b43d05a1978a93a19374c6e6b817c9c1ff4ba4b Mon Sep 17 00:00:00 2001
+From: Armas Spann <zappel@retarded.farm>
+Date: Fri, 24 Jul 2020 16:06:16 +0200
+Subject: ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502) series with ALC289
+
+From: Armas Spann <zappel@retarded.farm>
+
+commit 4b43d05a1978a93a19374c6e6b817c9c1ff4ba4b upstream.
+
+This patch adds support for headset mic to the ASUS ROG Zephyrus
+G15(GA502) notebook series by adding the corresponding
+vendor/pci_device id, as well as adding a new fixup for the used
+realtek ALC289. The fixup stets the correct pin to get the headset mic
+correctly recognized on audio-jack.
+
+Signed-off-by: Armas Spann <zappel@retarded.farm>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200724140616.298892-1-zappel@retarded.farm
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6118,6 +6118,7 @@ enum {
+ ALC269VC_FIXUP_ACER_HEADSET_MIC,
+ ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE,
+ ALC289_FIXUP_ASUS_G401,
++ ALC289_FIXUP_ASUS_GA502,
+ ALC256_FIXUP_ACER_MIC_NO_PRESENCE,
+ };
+
+@@ -7335,6 +7336,13 @@ static const struct hda_fixup alc269_fix
+ { }
+ },
+ },
++ [ALC289_FIXUP_ASUS_GA502] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x03a11020 }, /* headset mic with jack detect */
++ { }
++ },
++ },
+ [ALC256_FIXUP_ACER_MIC_NO_PRESENCE] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+@@ -7526,6 +7534,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1043, 0x1bbd, "ASUS Z550MA", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
++ SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),
+ SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_G401),
+ SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
+ SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
--- /dev/null
+From 6fa38ef1534e7e9320aa15e329eb1404ab2f70ac Mon Sep 17 00:00:00 2001
+From: PeiSen Hou <pshou@realtek.com>
+Date: Mon, 27 Jul 2020 13:56:47 +0200
+Subject: ALSA: hda/realtek: Fix add a "ultra_low_power" function for intel reference board (alc256)
+
+From: PeiSen Hou <pshou@realtek.com>
+
+commit 6fa38ef1534e7e9320aa15e329eb1404ab2f70ac upstream.
+
+Intel requires to enable power saving mode for intel reference board (alc256)
+
+Signed-off-by: PeiSen Hou <pshou@realtek.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200727115647.10967-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7555,7 +7555,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC),
+ SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
+ SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE),
+- SND_PCI_QUIRK(0x10ec, 0x1230, "Intel Reference board", ALC225_FIXUP_HEADSET_JACK),
++ SND_PCI_QUIRK(0x10ec, 0x1230, "Intel Reference board", ALC295_FIXUP_CHROME_BOOK),
+ SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_HEADSET_MODE),
+ SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
+ SND_PCI_QUIRK(0x144d, 0xc169, "Samsung Notebook 9 Pen (NP930SBE-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
--- /dev/null
+From 5649625344fe1f4695eace7c37d011e317bf66d5 Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Wed, 29 Jul 2020 15:09:27 +0800
+Subject: ALSA: hda/realtek - Fixed HP right speaker no sound
+
+From: Kailang Yang <kailang@realtek.com>
+
+commit 5649625344fe1f4695eace7c37d011e317bf66d5 upstream.
+
+HP NB right speaker had no sound output.
+This platform was connected to I2S Amp for speaker out.(None Realtek I2S Amp IC)
+EC need to check codec GPIO1 pin to initial I2S Amp.
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/01285f623ac7447187482fb4a8ecaa7c@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5940,6 +5940,16 @@ static void alc_fixup_disable_mic_vref(s
+ snd_hda_codec_set_pin_target(codec, 0x19, PIN_VREFHIZ);
+ }
+
++static void alc285_fixup_hp_gpio_amp_init(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action != HDA_FIXUP_ACT_INIT)
++ return;
++
++ msleep(100);
++ alc_write_coef_idx(codec, 0x65, 0x0);
++}
++
+ /* for hda_fixup_thinkpad_acpi() */
+ #include "thinkpad_helper.c"
+
+@@ -6120,6 +6130,7 @@ enum {
+ ALC289_FIXUP_ASUS_GA401,
+ ALC289_FIXUP_ASUS_GA502,
+ ALC256_FIXUP_ACER_MIC_NO_PRESENCE,
++ ALC285_FIXUP_HP_GPIO_AMP_INIT,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -7352,6 +7363,12 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC256_FIXUP_ASUS_HEADSET_MODE
+ },
++ [ALC285_FIXUP_HP_GPIO_AMP_INIT] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc285_fixup_hp_gpio_amp_init,
++ .chained = true,
++ .chain_id = ALC285_FIXUP_HP_GPIO_LED
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -7502,7 +7519,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
+ SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x8729, "HP", ALC285_FIXUP_HP_GPIO_LED),
+- SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8736, "HP", ALC285_FIXUP_HP_GPIO_AMP_INIT),
+ SND_PCI_QUIRK(0x103c, 0x877a, "HP", ALC285_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x103c, 0x877d, "HP", ALC236_FIXUP_HP_MUTE_LED),
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
--- /dev/null
+From 293a92c1d9913248b9987b68f3a5d6d2f0aae62b Mon Sep 17 00:00:00 2001
+From: Armas Spann <zappel@retarded.farm>
+Date: Fri, 24 Jul 2020 16:08:37 +0200
+Subject: ALSA: hda/realtek: typo_fix: enable headset mic of ASUS ROG Zephyrus G14(GA401) series with ALC289
+
+From: Armas Spann <zappel@retarded.farm>
+
+commit 293a92c1d9913248b9987b68f3a5d6d2f0aae62b upstream.
+
+This patch fixes a small typo I accidently submitted with the initial patch. The board should be named GA401 not G401.
+
+Fixes: ff53664daff2 ("ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G14(G401) series with ALC289")
+Signed-off-by: Armas Spann <zappel@retarded.farm>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200724140837.302763-1-zappel@retarded.farm
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6117,7 +6117,7 @@ enum {
+ ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS,
+ ALC269VC_FIXUP_ACER_HEADSET_MIC,
+ ALC269VC_FIXUP_ACER_MIC_NO_PRESENCE,
+- ALC289_FIXUP_ASUS_G401,
++ ALC289_FIXUP_ASUS_GA401,
+ ALC289_FIXUP_ASUS_GA502,
+ ALC256_FIXUP_ACER_MIC_NO_PRESENCE,
+ };
+@@ -7329,7 +7329,7 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MIC
+ },
+- [ALC289_FIXUP_ASUS_G401] = {
++ [ALC289_FIXUP_ASUS_GA401] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+ { 0x19, 0x03a11020 }, /* headset mic with jack detect */
+@@ -7535,7 +7535,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1043, 0x1c23, "Asus X55U", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x1043, 0x1ccd, "ASUS X555UB", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1e11, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA502),
+- SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_G401),
++ SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401),
+ SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2),
+ SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x1043, 0x834a, "ASUS S101", ALC269_FIXUP_STEREO_DMIC),
--- /dev/null
+From a6630529aecb5a3e84370c376ed658e892e6261e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 27 Jul 2020 18:44:43 +0200
+Subject: ALSA: hda: Workaround for spurious wakeups on some Intel platforms
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit a6630529aecb5a3e84370c376ed658e892e6261e upstream.
+
+We've received a regression report on Intel HD-audio controller that
+wakes up immediately after S3 suspend. The bisection leads to the
+commit c4c8dd6ef807 ("ALSA: hda: Skip controller resume if not
+needed"). This commit replaces the system-suspend to use
+pm_runtime_force_suspend() instead of the direct call of
+__azx_runtime_suspend(). However, by some really mysterious reason,
+pm_runtime_force_suspend() causes a spurious wakeup (although it calls
+the same __azx_runtime_suspend() internally).
+
+As an ugly workaround for now, revert the behavior to call
+__azx_runtime_suspend() and __azx_runtime_resume() for those old Intel
+platforms that may exhibit such a problem, while keeping the new
+standard pm_runtime_force_suspend() and pm_runtime_force_resume()
+pair for the remaining chips.
+
+Fixes: c4c8dd6ef807 ("ALSA: hda: Skip controller resume if not needed")
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208649
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200727164443.4233-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_controller.h | 2 +-
+ sound/pci/hda/hda_intel.c | 17 ++++++++++++++---
+ 2 files changed, 15 insertions(+), 4 deletions(-)
+
+--- a/sound/pci/hda/hda_controller.h
++++ b/sound/pci/hda/hda_controller.h
+@@ -41,7 +41,7 @@
+ /* 24 unused */
+ #define AZX_DCAPS_COUNT_LPIB_DELAY (1 << 25) /* Take LPIB as delay */
+ #define AZX_DCAPS_PM_RUNTIME (1 << 26) /* runtime PM support */
+-/* 27 unused */
++#define AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP (1 << 27) /* Workaround for spurious wakeups after suspend */
+ #define AZX_DCAPS_CORBRP_SELF_CLEAR (1 << 28) /* CORBRP clears itself after reset */
+ #define AZX_DCAPS_NO_MSI64 (1 << 29) /* Stick to 32-bit MSIs */
+ #define AZX_DCAPS_SEPARATE_STREAM_TAG (1 << 30) /* capture and playback use separate stream tag */
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -298,7 +298,8 @@ enum {
+ /* PCH for HSW/BDW; with runtime PM */
+ /* no i915 binding for this as HSW/BDW has another controller for HDMI */
+ #define AZX_DCAPS_INTEL_PCH \
+- (AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_PM_RUNTIME)
++ (AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_PM_RUNTIME |\
++ AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP)
+
+ /* HSW HDMI */
+ #define AZX_DCAPS_INTEL_HASWELL \
+@@ -1028,7 +1029,14 @@ static int azx_suspend(struct device *de
+ chip = card->private_data;
+ bus = azx_bus(chip);
+ snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
+- pm_runtime_force_suspend(dev);
++ /* An ugly workaround: direct call of __azx_runtime_suspend() and
++ * __azx_runtime_resume() for old Intel platforms that suffer from
++ * spurious wakeups after S3 suspend
++ */
++ if (chip->driver_caps & AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP)
++ __azx_runtime_suspend(chip);
++ else
++ pm_runtime_force_suspend(dev);
+ if (bus->irq >= 0) {
+ free_irq(bus->irq, chip);
+ bus->irq = -1;
+@@ -1057,7 +1065,10 @@ static int azx_resume(struct device *dev
+ if (azx_acquire_irq(chip, 1) < 0)
+ return -EIO;
+
+- pm_runtime_force_resume(dev);
++ if (chip->driver_caps & AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP)
++ __azx_runtime_resume(chip, false);
++ else
++ pm_runtime_force_resume(dev);
+ snd_power_change_state(card, SNDRV_CTL_POWER_D0);
+
+ trace_azx_resume(chip);
--- /dev/null
+From 3da87ec67a491b9633a82045896c076b794bf938 Mon Sep 17 00:00:00 2001
+From: Laurence Tratt <laurie@tratt.net>
+Date: Sun, 21 Jun 2020 08:50:05 +0100
+Subject: ALSA: usb-audio: Add implicit feedback quirk for SSL2
+
+From: Laurence Tratt <laurie@tratt.net>
+
+commit 3da87ec67a491b9633a82045896c076b794bf938 upstream.
+
+As expected, this requires the same quirk as the SSL2+ in order for the
+clock to sync. This was suggested by, and tested on an SSL2, by Dmitry.
+
+Suggested-by: Dmitry <dpavlushko@gmail.com>
+Signed-off-by: Laurence Tratt <laurie@tratt.net>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200621075005.52mjjfc6dtdjnr3h@overdrive.tratt.net
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/pcm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -367,6 +367,7 @@ static int set_sync_ep_implicit_fb_quirk
+ ifnum = 0;
+ goto add_sync_ep_from_ifnum;
+ case USB_ID(0x07fd, 0x0008): /* MOTU M Series */
++ case USB_ID(0x31e9, 0x0001): /* Solid State Logic SSL2 */
+ case USB_ID(0x31e9, 0x0002): /* Solid State Logic SSL2+ */
+ case USB_ID(0x0d9a, 0x00df): /* RTX6001 */
+ ep = 0x81;
--- /dev/null
+From 54a485e9ec084da1a4b32dcf7749c7d760ed8aa5 Mon Sep 17 00:00:00 2001
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Date: Tue, 28 Jul 2020 14:38:48 -0400
+Subject: IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE
+
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+
+commit 54a485e9ec084da1a4b32dcf7749c7d760ed8aa5 upstream.
+
+The lookaside count is improperly initialized to the size of the
+Receive Queue with the additional +1. In the traces below, the
+RQ size is 384, so the count was set to 385.
+
+The lookaside count is then rarely refreshed. Note the high and
+incorrect count in the trace below:
+
+rvt_get_rwqe: [hfi1_0] wqe ffffc900078e9008 wr_id 55c7206d75a0 qpn c
+ qpt 2 pid 3018 num_sge 1 head 1 tail 0, count 385
+rvt_get_rwqe: (hfi1_rc_rcv+0x4eb/0x1480 [hfi1] <- rvt_get_rwqe) ret=0x1
+
+The head,tail indicate there is only one RWQE posted although the count
+says 385 and we correctly return the element 0.
+
+The next call to rvt_get_rwqe with the decremented count:
+
+rvt_get_rwqe: [hfi1_0] wqe ffffc900078e9058 wr_id 0 qpn c
+ qpt 2 pid 3018 num_sge 0 head 1 tail 1, count 384
+rvt_get_rwqe: (hfi1_rc_rcv+0x4eb/0x1480 [hfi1] <- rvt_get_rwqe) ret=0x1
+
+Note that the RQ is empty (head == tail) yet we return the RWQE at tail 1,
+which is not valid because of the bogus high count.
+
+Best case, the RWQE has never been posted and the rc logic sees an RWQE
+that is too small (all zeros) and puts the QP into an error state.
+
+In the worst case, a server slow at posting receive buffers might fool
+rvt_get_rwqe() into fetching an old RWQE and corrupt memory.
+
+Fix by deleting the faulty initialization code and creating an
+inline to fetch the posted count and convert all callers to use
+new inline.
+
+Fixes: f592ae3c999f ("IB/rdmavt: Fracture single lock used for posting and processing RWQEs")
+Link: https://lore.kernel.org/r/20200728183848.22226.29132.stgit@awfm-01.aw.intel.com
+Reported-by: Zhaojuan Guo <zguo@redhat.com>
+Cc: <stable@vger.kernel.org> # 5.4.x
+Reviewed-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Tested-by: Honggang Li <honli@redhat.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/sw/rdmavt/qp.c | 33 ++++-----------------------------
+ drivers/infiniband/sw/rdmavt/rc.c | 4 +---
+ include/rdma/rdmavt_qp.h | 19 +++++++++++++++++++
+ 3 files changed, 24 insertions(+), 32 deletions(-)
+
+--- a/drivers/infiniband/sw/rdmavt/qp.c
++++ b/drivers/infiniband/sw/rdmavt/qp.c
+@@ -898,8 +898,6 @@ static void rvt_init_qp(struct rvt_dev_i
+ qp->s_tail_ack_queue = 0;
+ qp->s_acked_ack_queue = 0;
+ qp->s_num_rd_atomic = 0;
+- if (qp->r_rq.kwq)
+- qp->r_rq.kwq->count = qp->r_rq.size;
+ qp->r_sge.num_sge = 0;
+ atomic_set(&qp->s_reserved_used, 0);
+ }
+@@ -2353,31 +2351,6 @@ bad_lkey:
+ }
+
+ /**
+- * get_count - count numbers of request work queue entries
+- * in circular buffer
+- * @rq: data structure for request queue entry
+- * @tail: tail indices of the circular buffer
+- * @head: head indices of the circular buffer
+- *
+- * Return - total number of entries in the circular buffer
+- */
+-static u32 get_count(struct rvt_rq *rq, u32 tail, u32 head)
+-{
+- u32 count;
+-
+- count = head;
+-
+- if (count >= rq->size)
+- count = 0;
+- if (count < tail)
+- count += rq->size - tail;
+- else
+- count -= tail;
+-
+- return count;
+-}
+-
+-/**
+ * get_rvt_head - get head indices of the circular buffer
+ * @rq: data structure for request queue entry
+ * @ip: the QP
+@@ -2451,7 +2424,7 @@ int rvt_get_rwqe(struct rvt_qp *qp, bool
+
+ if (kwq->count < RVT_RWQ_COUNT_THRESHOLD) {
+ head = get_rvt_head(rq, ip);
+- kwq->count = get_count(rq, tail, head);
++ kwq->count = rvt_get_rq_count(rq, head, tail);
+ }
+ if (unlikely(kwq->count == 0)) {
+ ret = 0;
+@@ -2486,7 +2459,9 @@ int rvt_get_rwqe(struct rvt_qp *qp, bool
+ * the number of remaining WQEs.
+ */
+ if (kwq->count < srq->limit) {
+- kwq->count = get_count(rq, tail, get_rvt_head(rq, ip));
++ kwq->count =
++ rvt_get_rq_count(rq,
++ get_rvt_head(rq, ip), tail);
+ if (kwq->count < srq->limit) {
+ struct ib_event ev;
+
+--- a/drivers/infiniband/sw/rdmavt/rc.c
++++ b/drivers/infiniband/sw/rdmavt/rc.c
+@@ -127,9 +127,7 @@ __be32 rvt_compute_aeth(struct rvt_qp *q
+ * not atomic, which is OK, since the fuzziness is
+ * resolved as further ACKs go out.
+ */
+- credits = head - tail;
+- if ((int)credits < 0)
+- credits += qp->r_rq.size;
++ credits = rvt_get_rq_count(&qp->r_rq, head, tail);
+ }
+ /*
+ * Binary search the credit table to find the code to
+--- a/include/rdma/rdmavt_qp.h
++++ b/include/rdma/rdmavt_qp.h
+@@ -278,6 +278,25 @@ struct rvt_rq {
+ spinlock_t lock ____cacheline_aligned_in_smp;
+ };
+
++/**
++ * rvt_get_rq_count - count numbers of request work queue entries
++ * in circular buffer
++ * @rq: data structure for request queue entry
++ * @head: head indices of the circular buffer
++ * @tail: tail indices of the circular buffer
++ *
++ * Return - total number of entries in the Receive Queue
++ */
++
++static inline u32 rvt_get_rq_count(struct rvt_rq *rq, u32 head, u32 tail)
++{
++ u32 count = head - tail;
++
++ if ((s32)count < 0)
++ count += rq->size;
++ return count;
++}
++
+ /*
+ * This structure holds the information that the send tasklet needs
+ * to send a RDMA read response or atomic operation.
--- /dev/null
+From 5351a56b1a4ceafd7a17ebfdf3cda430cdfd365d Mon Sep 17 00:00:00 2001
+From: Jason Gunthorpe <jgg@nvidia.com>
+Date: Mon, 27 Jul 2020 12:57:12 +0300
+Subject: RDMA/mlx5: Fix prefetch memory leak if get_prefetchable_mr fails
+
+From: Jason Gunthorpe <jgg@nvidia.com>
+
+commit 5351a56b1a4ceafd7a17ebfdf3cda430cdfd365d upstream.
+
+destroy_prefetch_work() must always be called if the work is not going
+to be queued. The num_sge also should have been set to i, not i-1
+which avoids the condition where it shouldn't have been called in the
+first place.
+
+Cc: stable@vger.kernel.org
+Fixes: fb985e278a30 ("RDMA/mlx5: Use SRCU properly in ODP prefetch")
+Link: https://lore.kernel.org/r/20200727095712.495652-1-leon@kernel.org
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/odp.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/odp.c
++++ b/drivers/infiniband/hw/mlx5/odp.c
+@@ -1798,9 +1798,7 @@ static bool init_prefetch_work(struct ib
+ work->frags[i].mr =
+ get_prefetchable_mr(pd, advice, sg_list[i].lkey);
+ if (!work->frags[i].mr) {
+- work->num_sge = i - 1;
+- if (i)
+- destroy_prefetch_work(work);
++ work->num_sge = i;
+ return false;
+ }
+
+@@ -1866,6 +1864,7 @@ int mlx5_ib_advise_mr_prefetch(struct ib
+ srcu_key = srcu_read_lock(&dev->odp_srcu);
+ if (!init_prefetch_work(pd, advice, pf_flags, work, sg_list, num_sge)) {
+ srcu_read_unlock(&dev->odp_srcu, srcu_key);
++ destroy_prefetch_work(work);
+ return -EINVAL;
+ }
+ queue_work(system_unbound_wq, &work->work);
--- /dev/null
+From 8ac68dc455d9d18241d44b96800d73229029ed34 Mon Sep 17 00:00:00 2001
+From: Paul Moore <paul@paul-moore.com>
+Date: Tue, 28 Jul 2020 15:33:21 -0400
+Subject: revert: 1320a4052ea1 ("audit: trigger accompanying records when no rules present")
+
+From: Paul Moore <paul@paul-moore.com>
+
+commit 8ac68dc455d9d18241d44b96800d73229029ed34 upstream.
+
+Unfortunately the commit listed in the subject line above failed
+to ensure that the task's audit_context was properly initialized/set
+before enabling the "accompanying records". Depending on the
+situation, the resulting audit_context could have invalid values in
+some of it's fields which could cause a kernel panic/oops when the
+task/syscall exists and the audit records are generated.
+
+We will revisit the original patch, with the necessary fixes, in a
+future kernel but right now we just want to fix the kernel panic
+with the least amount of added risk.
+
+Cc: stable@vger.kernel.org
+Fixes: 1320a4052ea1 ("audit: trigger accompanying records when no rules present")
+Reported-by: j2468h@googlemail.com
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/audit.c | 1 -
+ kernel/audit.h | 8 --------
+ kernel/auditsc.c | 3 +++
+ 3 files changed, 3 insertions(+), 9 deletions(-)
+
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -1811,7 +1811,6 @@ struct audit_buffer *audit_log_start(str
+ }
+
+ audit_get_stamp(ab->ctx, &t, &serial);
+- audit_clear_dummy(ab->ctx);
+ audit_log_format(ab, "audit(%llu.%03lu:%u): ",
+ (unsigned long long)t.tv_sec, t.tv_nsec/1000000, serial);
+
+--- a/kernel/audit.h
++++ b/kernel/audit.h
+@@ -290,13 +290,6 @@ extern int audit_signal_info_syscall(str
+ extern void audit_filter_inodes(struct task_struct *tsk,
+ struct audit_context *ctx);
+ extern struct list_head *audit_killed_trees(void);
+-
+-static inline void audit_clear_dummy(struct audit_context *ctx)
+-{
+- if (ctx)
+- ctx->dummy = 0;
+-}
+-
+ #else /* CONFIG_AUDITSYSCALL */
+ #define auditsc_get_stamp(c, t, s) 0
+ #define audit_put_watch(w) {}
+@@ -330,7 +323,6 @@ static inline int audit_signal_info_sysc
+ }
+
+ #define audit_filter_inodes(t, c) AUDIT_DISABLED
+-#define audit_clear_dummy(c) {}
+ #endif /* CONFIG_AUDITSYSCALL */
+
+ extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len);
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -1406,6 +1406,9 @@ static void audit_log_proctitle(void)
+ struct audit_context *context = audit_context();
+ struct audit_buffer *ab;
+
++ if (!context || context->dummy)
++ return;
++
+ ab = audit_log_start(context, GFP_KERNEL, AUDIT_PROCTITLE);
+ if (!ab)
+ return; /* audit_panic or being filtered */
sunrpc-check-that-domain-table-is-empty-at-module-un.patch
pci-aspm-disable-aspm-on-asmedia-asm1083-1085-pcie-to-pci-bridge.patch
+alsa-usb-audio-add-implicit-feedback-quirk-for-ssl2.patch
+alsa-hda-realtek-enable-headset-mic-of-asus-rog-zephyrus-g15-ga502-series-with-alc289.patch
+alsa-hda-realtek-typo_fix-enable-headset-mic-of-asus-rog-zephyrus-g14-ga401-series-with-alc289.patch
+alsa-hda-realtek-fix-add-a-ultra_low_power-function-for-intel-reference-board-alc256.patch
+alsa-hda-realtek-fixed-hp-right-speaker-no-sound.patch
+alsa-hda-workaround-for-spurious-wakeups-on-some-intel-platforms.patch
+alsa-hda-hdmi-fix-keep_power-assignment-for-non-component-devices.patch
+rdma-mlx5-fix-prefetch-memory-leak-if-get_prefetchable_mr-fails.patch
+ib-rdmavt-fix-rq-counting-issues-causing-use-of-an-invalid-rwqe.patch
+vhost-scsi-fix-up-req-type-endian-ness.patch
+9p-trans_fd-fix-concurrency-del-of-req_list-in-p9_fd_cancelled-p9_read_work.patch
+revert-1320a4052ea1-audit-trigger-accompanying-records-when-no-rules-present.patch
--- /dev/null
+From 295c1b9852d000580786375304a9800bd9634d15 Mon Sep 17 00:00:00 2001
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Fri, 10 Jul 2020 06:36:16 -0400
+Subject: vhost/scsi: fix up req type endian-ness
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+commit 295c1b9852d000580786375304a9800bd9634d15 upstream.
+
+vhost/scsi doesn't handle type conversion correctly
+for request type when using virtio 1.0 and up for BE,
+or cross-endian platforms.
+
+Fix it up using vhost_32_to_cpu.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/vhost/scsi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -1215,7 +1215,7 @@ vhost_scsi_ctl_handle_vq(struct vhost_sc
+ continue;
+ }
+
+- switch (v_req.type) {
++ switch (vhost32_to_cpu(vq, v_req.type)) {
+ case VIRTIO_SCSI_T_TMF:
+ vc.req = &v_req.tmf;
+ vc.req_size = sizeof(struct virtio_scsi_ctrl_tmf_req);
projects / thirdparty / kernel / stable-queue.git / commitdiff
