--- /dev/null
+From f2bbdbcb075f3977a53da3bdcb7cd460bc8ae5f2 Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Sat, 26 Oct 2019 12:06:20 +0900
+Subject: ALSA: bebob: Fix prototype of helper function to return negative value
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+commit f2bbdbcb075f3977a53da3bdcb7cd460bc8ae5f2 upstream.
+
+A helper function of ALSA bebob driver returns negative value in a
+function which has a prototype to return unsigned value.
+
+This commit fixes it by changing the prototype.
+
+Fixes: eb7b3a056cd8 ("ALSA: bebob: Add commands and connections/streams management")
+Cc: <stable@vger.kernel.org> # v3.16+
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Link: https://lore.kernel.org/r/20191026030620.12077-1-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/firewire/bebob/bebob_stream.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/sound/firewire/bebob/bebob_stream.c
++++ b/sound/firewire/bebob/bebob_stream.c
+@@ -253,8 +253,7 @@ end:
+ return err;
+ }
+
+-static unsigned int
+-map_data_channels(struct snd_bebob *bebob, struct amdtp_stream *s)
++static int map_data_channels(struct snd_bebob *bebob, struct amdtp_stream *s)
+ {
+ unsigned int sec, sections, ch, channels;
+ unsigned int pcm, midi, location;
--- /dev/null
+From f0778871a13889b86a65d4ad34bef8340af9d082 Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Thu, 24 Oct 2019 15:13:32 +0800
+Subject: ALSA: hda/realtek - Add support for ALC623
+
+From: Kailang Yang <kailang@realtek.com>
+
+commit f0778871a13889b86a65d4ad34bef8340af9d082 upstream.
+
+Support new codec ALC623.
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/ed97b6a8bd9445ecb48bc763d9aaba7a@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -375,6 +375,9 @@ static void alc_fill_eapd_coef(struct hd
+ case 0x10ec0672:
+ alc_update_coef_idx(codec, 0xd, 0, 1<<14); /* EAPD Ctrl */
+ break;
++ case 0x10ec0623:
++ alc_update_coef_idx(codec, 0x19, 1<<13, 0);
++ break;
+ case 0x10ec0668:
+ alc_update_coef_idx(codec, 0x7, 3<<13, 0);
+ break;
+@@ -2757,6 +2760,7 @@ enum {
+ ALC269_TYPE_ALC225,
+ ALC269_TYPE_ALC294,
+ ALC269_TYPE_ALC300,
++ ALC269_TYPE_ALC623,
+ ALC269_TYPE_ALC700,
+ };
+
+@@ -2792,6 +2796,7 @@ static int alc269_parse_auto_config(stru
+ case ALC269_TYPE_ALC225:
+ case ALC269_TYPE_ALC294:
+ case ALC269_TYPE_ALC300:
++ case ALC269_TYPE_ALC623:
+ case ALC269_TYPE_ALC700:
+ ssids = alc269_ssids;
+ break;
+@@ -7274,6 +7279,9 @@ static int patch_alc269(struct hda_codec
+ spec->codec_variant = ALC269_TYPE_ALC300;
+ spec->gen.mixer_nid = 0; /* no loopback on ALC300 */
+ break;
++ case 0x10ec0623:
++ spec->codec_variant = ALC269_TYPE_ALC623;
++ break;
+ case 0x10ec0700:
+ case 0x10ec0701:
+ case 0x10ec0703:
+@@ -8354,6 +8362,7 @@ static const struct hda_device_id snd_hd
+ HDA_CODEC_ENTRY(0x10ec0298, "ALC298", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0299, "ALC299", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0300, "ALC300", patch_alc269),
++ HDA_CODEC_ENTRY(0x10ec0623, "ALC623", patch_alc269),
+ HDA_CODEC_REV_ENTRY(0x10ec0861, 0x100340, "ALC660", patch_alc861),
+ HDA_CODEC_ENTRY(0x10ec0660, "ALC660-VD", patch_alc861vd),
+ HDA_CODEC_ENTRY(0x10ec0861, "ALC861", patch_alc861),
--- /dev/null
+From 8a6c55d0f883e9a7e7c91841434f3b6bbf932bb2 Mon Sep 17 00:00:00 2001
+From: Aaron Ma <aaron.ma@canonical.com>
+Date: Thu, 24 Oct 2019 19:44:39 +0800
+Subject: ALSA: hda/realtek - Fix 2 front mics of codec 0x623
+
+From: Aaron Ma <aaron.ma@canonical.com>
+
+commit 8a6c55d0f883e9a7e7c91841434f3b6bbf932bb2 upstream.
+
+These 2 ThinkCentres installed a new realtek codec ID 0x623,
+it has 2 front mics with the same location on pin 0x18 and 0x19.
+
+Apply fixup ALC283_FIXUP_HEADSET_MIC to change 1 front mic
+location to right, then pulseaudio can handle them.
+One "Front Mic" and one "Mic" will be shown, and audio output works
+fine.
+
+Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20191024114439.31522-1-aaron.ma@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6614,6 +6614,8 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x17aa, 0x3151, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x17aa, 0x3176, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x17aa, 0x3178, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
--- /dev/null
+From b24e7598db62386a95a3c8b9c75630c5d56fe077 Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@redhat.com>
+Date: Wed, 23 Oct 2019 14:26:37 +0200
+Subject: fuse: flush dirty data/metadata before non-truncate setattr
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+commit b24e7598db62386a95a3c8b9c75630c5d56fe077 upstream.
+
+If writeback cache is enabled, then writes might get reordered with
+chmod/chown/utimes. The problem with this is that performing the write in
+the fuse daemon might itself change some of these attributes. In such case
+the following sequence of operations will result in file ending up with the
+wrong mode, for example:
+
+ int fd = open ("suid", O_WRONLY|O_CREAT|O_EXCL);
+ write (fd, "1", 1);
+ fchown (fd, 0, 0);
+ fchmod (fd, 04755);
+ close (fd);
+
+This patch fixes this by flushing pending writes before performing
+chown/chmod/utimes.
+
+Reported-by: Giuseppe Scrivano <gscrivan@redhat.com>
+Tested-by: Giuseppe Scrivano <gscrivan@redhat.com>
+Fixes: 4d99ff8f12eb ("fuse: Turn writeback cache on")
+Cc: <stable@vger.kernel.org> # v3.15+
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fuse/dir.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/fs/fuse/dir.c
++++ b/fs/fuse/dir.c
+@@ -1650,6 +1650,19 @@ int fuse_do_setattr(struct dentry *dentr
+ if (attr->ia_valid & ATTR_SIZE)
+ is_truncate = true;
+
++ /* Flush dirty data/metadata before non-truncate SETATTR */
++ if (is_wb && S_ISREG(inode->i_mode) &&
++ attr->ia_valid &
++ (ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_MTIME_SET |
++ ATTR_TIMES_SET)) {
++ err = write_inode_now(inode, true);
++ if (err)
++ return err;
++
++ fuse_set_nowrite(inode);
++ fuse_release_nowrite(inode);
++ }
++
+ if (is_truncate) {
+ fuse_set_nowrite(inode);
+ set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
--- /dev/null
+From e4648309b85a78f8c787457832269a8712a8673e Mon Sep 17 00:00:00 2001
+From: Miklos Szeredi <mszeredi@redhat.com>
+Date: Wed, 23 Oct 2019 14:26:37 +0200
+Subject: fuse: truncate pending writes on O_TRUNC
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+commit e4648309b85a78f8c787457832269a8712a8673e upstream.
+
+Make sure cached writes are not reordered around open(..., O_TRUNC), with
+the obvious wrong results.
+
+Fixes: 4d99ff8f12eb ("fuse: Turn writeback cache on")
+Cc: <stable@vger.kernel.org> # v3.15+
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fuse/file.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -201,7 +201,7 @@ int fuse_open_common(struct inode *inode
+ {
+ struct fuse_conn *fc = get_fuse_conn(inode);
+ int err;
+- bool lock_inode = (file->f_flags & O_TRUNC) &&
++ bool is_wb_truncate = (file->f_flags & O_TRUNC) &&
+ fc->atomic_o_trunc &&
+ fc->writeback_cache;
+
+@@ -209,16 +209,20 @@ int fuse_open_common(struct inode *inode
+ if (err)
+ return err;
+
+- if (lock_inode)
++ if (is_wb_truncate) {
+ inode_lock(inode);
++ fuse_set_nowrite(inode);
++ }
+
+ err = fuse_do_open(fc, get_node_id(inode), file, isdir);
+
+ if (!err)
+ fuse_finish_open(inode, file);
+
+- if (lock_inode)
++ if (is_wb_truncate) {
++ fuse_release_nowrite(inode);
+ inode_unlock(inode);
++ }
+
+ return err;
+ }
net_sched-check-cops-tcf_block-in-tc_bind_tclass.patch
thunderbolt-use-32-bit-writes-when-writing-ring-prod.patch
ath6kl-fix-a-null-ptr-deref-bug-in-ath6kl_usb_alloc_.patch
+fuse-flush-dirty-data-metadata-before-non-truncate-setattr.patch
+fuse-truncate-pending-writes-on-o_trunc.patch
+alsa-bebob-fix-prototype-of-helper-function-to-return-negative-value.patch
+alsa-hda-realtek-fix-2-front-mics-of-codec-0x623.patch
+alsa-hda-realtek-add-support-for-alc623.patch
+uas-revert-commit-3ae62a42090f-uas-fix-alignment-of-scatter-gather-segments.patch
--- /dev/null
+From 1186f86a71130a7635a20843e355bb880c7349b2 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 23 Oct 2019 11:34:33 -0400
+Subject: UAS: Revert commit 3ae62a42090f ("UAS: fix alignment of scatter/gather segments")
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 1186f86a71130a7635a20843e355bb880c7349b2 upstream.
+
+Commit 3ae62a42090f ("UAS: fix alignment of scatter/gather segments"),
+copying a similar commit for usb-storage, attempted to solve a problem
+involving scatter-gather I/O and USB/IP by setting the
+virt_boundary_mask for mass-storage devices.
+
+However, it now turns out that the analogous change in usb-storage
+interacted badly with commit 09324d32d2a0 ("block: force an unlimited
+segment size on queues with a virt boundary"), which was added later.
+A typical error message is:
+
+ ehci-pci 0000:00:13.2: swiotlb buffer is full (sz: 327680 bytes),
+ total 32768 (slots), used 97 (slots)
+
+There is no longer any reason to keep the virt_boundary_mask setting
+in the uas driver. It was needed in the first place only for
+handling devices with a block size smaller than the maxpacket size and
+where the host controller was not capable of fully general
+scatter-gather operation (that is, able to merge two SG segments into
+a single USB packet). But:
+
+ High-speed or slower connections never use a bulk maxpacket
+ value larger than 512;
+
+ The SCSI layer does not handle block devices with a block size
+ smaller than 512 bytes;
+
+ All the host controllers capable of SuperSpeed operation can
+ handle fully general SG;
+
+ Since commit ea44d190764b ("usbip: Implement SG support to
+ vhci-hcd and stub driver") was merged, the USB/IP driver can
+ also handle SG.
+
+Therefore all supported device/controller combinations should be okay
+with no need for any special virt_boundary_mask. So in order to head
+off potential problems similar to those affecting usb-storage, this
+patch reverts commit 3ae62a42090f.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+CC: Oliver Neukum <oneukum@suse.com>
+CC: <stable@vger.kernel.org>
+Acked-by: Christoph Hellwig <hch@lst.de>
+Fixes: 3ae62a42090f ("UAS: fix alignment of scatter/gather segments")
+Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.1910231132470.1878-100000@iolanthe.rowland.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/storage/uas.c | 20 --------------------
+ 1 file changed, 20 deletions(-)
+
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -796,30 +796,10 @@ static int uas_slave_alloc(struct scsi_d
+ {
+ struct uas_dev_info *devinfo =
+ (struct uas_dev_info *)sdev->host->hostdata;
+- int maxp;
+
+ sdev->hostdata = devinfo;
+
+ /*
+- * We have two requirements here. We must satisfy the requirements
+- * of the physical HC and the demands of the protocol, as we
+- * definitely want no additional memory allocation in this path
+- * ruling out using bounce buffers.
+- *
+- * For a transmission on USB to continue we must never send
+- * a package that is smaller than maxpacket. Hence the length of each
+- * scatterlist element except the last must be divisible by the
+- * Bulk maxpacket value.
+- * If the HC does not ensure that through SG,
+- * the upper layer must do that. We must assume nothing
+- * about the capabilities off the HC, so we use the most
+- * pessimistic requirement.
+- */
+-
+- maxp = usb_maxpacket(devinfo->udev, devinfo->data_in_pipe, 0);
+- blk_queue_virt_boundary(sdev->request_queue, maxp - 1);
+-
+- /*
+ * The protocol has no requirements on alignment in the strict sense.
+ * Controllers may or may not have alignment restrictions.
+ * As this is not exported, we use an extremely conservative guess.