--- /dev/null
+From 3deef52ce10514ccdebba8e8ab85f9cebd0eb3f7 Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Thu, 29 Nov 2018 08:57:37 +0000
+Subject: ALSA: hda: Add support for AMD Stoney Ridge
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit 3deef52ce10514ccdebba8e8ab85f9cebd0eb3f7 upstream.
+
+It's similar to other AMD audio devices, it also supports D3, which can
+save some power drain.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_intel.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2363,6 +2363,10 @@ static const struct pci_device_id azx_id
+ /* AMD Hudson */
+ { PCI_DEVICE(0x1022, 0x780d),
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
++ /* AMD Stoney */
++ { PCI_DEVICE(0x1022, 0x157a),
++ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
++ AZX_DCAPS_PM_RUNTIME },
+ /* AMD Raven */
+ { PCI_DEVICE(0x1022, 0x15e3),
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
--- /dev/null
+From 705b65f107470499442240ff7afee5021a7002a6 Mon Sep 17 00:00:00 2001
+From: Chris Chiu <chiu@endlessm.com>
+Date: Wed, 5 Dec 2018 14:48:54 +0800
+Subject: ALSA: hda/realtek - Add support for Acer Aspire C24-860 headset mic
+
+From: Chris Chiu <chiu@endlessm.com>
+
+commit 705b65f107470499442240ff7afee5021a7002a6 upstream.
+
+The Acer AIO Aspire C24-860 with ALC286 can't detect the headset
+microphone. Just like another Acer AIO U27-880, it needs a different
+pin value for 0x18 and the headset fixup to make headset mic work.
+
+Signed-off-by: Jian-Hong Pan <jian-hong@endlessm.com>
+Signed-off-by: Daniel Drake <drake@endlessm.com>
+Signed-off-by: Chris Chiu <chiu@endlessm.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5609,6 +5609,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1025, 0x0762, "Acer Aspire E1-472", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
+ SND_PCI_QUIRK(0x1025, 0x0775, "Acer Aspire E1-572", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572),
+ SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS),
++ SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK),
+ SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
+ SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
--- /dev/null
+From 9f8aefed9623a91dec54eab8908f3810b7f8d73a Mon Sep 17 00:00:00 2001
+From: Chris Chiu <chiu@endlessm.com>
+Date: Wed, 5 Dec 2018 14:48:55 +0800
+Subject: ALSA: hda/realtek: Fix mic issue on Acer AIO Veriton Z4660G
+
+From: Chris Chiu <chiu@endlessm.com>
+
+commit 9f8aefed9623a91dec54eab8908f3810b7f8d73a upstream.
+
+Acer AIO Veriton Z4660G with ALC286 codec has issue with the input
+from external microphones connecting via 'Front Mic' jack. The fixup
+ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE enables the jack sensing of
+the headset and fix the audio input issue of external microphone.
+
+Signed-off-by: Jian-Hong Pan <jian-hong@endlessm.com>
+Signed-off-by: Daniel Drake <drake@endlessm.com>
+Signed-off-by: Chris Chiu <chiu@endlessm.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5611,6 +5611,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS),
+ SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK),
++ SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
+ SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
+ SND_PCI_QUIRK(0x1028, 0x05bd, "Dell Latitude E6440", ALC292_FIXUP_DELL_E7X),
--- /dev/null
+From b72f936f6b325f4fde06b02e4b6ab682f6f2e73f Mon Sep 17 00:00:00 2001
+From: Chris Chiu <chiu@endlessm.com>
+Date: Wed, 5 Dec 2018 14:48:56 +0800
+Subject: ALSA: hda/realtek: Fix mic issue on Acer AIO Veriton Z4860G/Z6860G
+
+From: Chris Chiu <chiu@endlessm.com>
+
+commit b72f936f6b325f4fde06b02e4b6ab682f6f2e73f upstream.
+
+Acer AIO Veriton Z4860G/Z6860G with the same ALC286 codec has issues
+with the input from external microphone. The issue can be fixed by
+the fixup ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE for Veriton Z4660G.
+
+Signed-off-by: Jian-Hong Pan <jian-hong@endlessm.com>
+Signed-off-by: Daniel Drake <drake@endlessm.com>
+Signed-off-by: Chris Chiu <chiu@endlessm.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5611,6 +5611,8 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS),
+ SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK),
++ SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
+ SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS),
--- /dev/null
+From b51abed8355e5556886623b2772fa6b7598d2282 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 29 Nov 2018 08:02:49 +0100
+Subject: ALSA: pcm: Call snd_pcm_unlink() conditionally at closing
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit b51abed8355e5556886623b2772fa6b7598d2282 upstream.
+
+Currently the PCM core calls snd_pcm_unlink() always unconditionally
+at closing a stream. However, since snd_pcm_unlink() invokes the
+global rwsem down, the lock can be easily contended. More badly, when
+a thread runs in a high priority RT-FIFO, it may stall at spinning.
+
+Basically the call of snd_pcm_unlink() is required only for the linked
+streams that are already rare occasion. For normal use cases, this
+code path is fairly superfluous.
+
+As an optimization (and also as a workaround for the RT problem
+above in normal situations without linked streams), this patch adds a
+check before calling snd_pcm_unlink() and calls it only when needed.
+
+Reported-by: Chanho Min <chanho.min@lge.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/pcm_native.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -2225,7 +2225,8 @@ int snd_pcm_hw_constraints_complete(stru
+
+ static void pcm_release_private(struct snd_pcm_substream *substream)
+ {
+- snd_pcm_unlink(substream);
++ if (snd_pcm_stream_linked(substream))
++ snd_pcm_unlink(substream);
+ }
+
+ void snd_pcm_release_substream(struct snd_pcm_substream *substream)
--- /dev/null
+From 5363857b916c1f48027e9b96ee8be8376bf20811 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 29 Nov 2018 12:05:19 +0100
+Subject: ALSA: pcm: Fix interval evaluation with openmin/max
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 5363857b916c1f48027e9b96ee8be8376bf20811 upstream.
+
+As addressed in alsa-lib (commit b420056604f0), we need to fix the
+case where the evaluation of PCM interval "(x x+1]" leading to
+-EINVAL. After applying rules, such an interval may be translated as
+"(x x+1)".
+
+Fixes: ff2d6acdf6f1 ("ALSA: pcm: Fix snd_interval_refine first/last with open min/max")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/sound/pcm_params.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/include/sound/pcm_params.h
++++ b/include/sound/pcm_params.h
+@@ -247,11 +247,13 @@ static inline int snd_interval_empty(con
+ static inline int snd_interval_single(const struct snd_interval *i)
+ {
+ return (i->min == i->max ||
+- (i->min + 1 == i->max && i->openmax));
++ (i->min + 1 == i->max && (i->openmin || i->openmax)));
+ }
+
+ static inline int snd_interval_value(const struct snd_interval *i)
+ {
++ if (i->openmin && !i->openmax)
++ return i->max;
+ return i->min;
+ }
+
--- /dev/null
+From b888a5f713e4d17faaaff24316585a4eb07f35b7 Mon Sep 17 00:00:00 2001
+From: Chanho Min <chanho.min@lge.com>
+Date: Mon, 26 Nov 2018 14:36:37 +0900
+Subject: ALSA: pcm: Fix starvation on down_write_nonblock()
+
+From: Chanho Min <chanho.min@lge.com>
+
+commit b888a5f713e4d17faaaff24316585a4eb07f35b7 upstream.
+
+Commit 67ec1072b053 ("ALSA: pcm: Fix rwsem deadlock for non-atomic PCM
+stream") fixes deadlock for non-atomic PCM stream. But, This patch
+causes antother stuck.
+If writer is RT thread and reader is a normal thread, the reader
+thread will be difficult to get scheduled. It may not give chance to
+release readlocks and writer gets stuck for a long time if they are
+pinned to single cpu.
+
+The deadlock described in the previous commit is because the linux
+rwsem queues like a FIFO. So, we might need non-FIFO writelock, not
+non-block one.
+
+My suggestion is that the writer gives reader a chance to be scheduled
+by using the minimum msleep() instaed of spinning without blocking by
+writer. Also, The *_nonblock may be changed to *_nonfifo appropriately
+to this concept.
+In terms of performance, when trylock is failed, this minimum periodic
+msleep will have the same performance as the tick-based
+schedule()/wake_up_q().
+
+[ Although this has a fairly high performance penalty, the relevant
+ code path became already rare due to the previous commit ("ALSA:
+ pcm: Call snd_pcm_unlink() conditionally at closing"). That is, now
+ this unconditional msleep appears only when using linked streams,
+ and this must be a rare case. So we accept this as a quick
+ workaround until finding a more suitable one -- tiwai ]
+
+Fixes: 67ec1072b053 ("ALSA: pcm: Fix rwsem deadlock for non-atomic PCM stream")
+Suggested-by: Wonmin Jung <wonmin.jung@lge.com>
+Signed-off-by: Chanho Min <chanho.min@lge.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/pcm_native.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -35,6 +35,7 @@
+ #include <sound/timer.h>
+ #include <sound/minors.h>
+ #include <linux/uio.h>
++#include <linux/delay.h>
+
+ /*
+ * Compatibility
+@@ -78,12 +79,12 @@ static DECLARE_RWSEM(snd_pcm_link_rwsem)
+ * and this may lead to a deadlock when the code path takes read sem
+ * twice (e.g. one in snd_pcm_action_nonatomic() and another in
+ * snd_pcm_stream_lock()). As a (suboptimal) workaround, let writer to
+- * spin until it gets the lock.
++ * sleep until all the readers are completed without blocking by writer.
+ */
+-static inline void down_write_nonblock(struct rw_semaphore *lock)
++static inline void down_write_nonfifo(struct rw_semaphore *lock)
+ {
+ while (!down_write_trylock(lock))
+- cond_resched();
++ msleep(1);
+ }
+
+ /**
+@@ -1825,7 +1826,7 @@ static int snd_pcm_link(struct snd_pcm_s
+ res = -ENOMEM;
+ goto _nolock;
+ }
+- down_write_nonblock(&snd_pcm_link_rwsem);
++ down_write_nonfifo(&snd_pcm_link_rwsem);
+ write_lock_irq(&snd_pcm_link_rwlock);
+ if (substream->runtime->status->state == SNDRV_PCM_STATE_OPEN ||
+ substream->runtime->status->state != substream1->runtime->status->state ||
+@@ -1872,7 +1873,7 @@ static int snd_pcm_unlink(struct snd_pcm
+ struct snd_pcm_substream *s;
+ int res = 0;
+
+- down_write_nonblock(&snd_pcm_link_rwsem);
++ down_write_nonfifo(&snd_pcm_link_rwsem);
+ write_lock_irq(&snd_pcm_link_rwlock);
+ if (!snd_pcm_stream_linked(substream)) {
+ res = -EALREADY;
--- /dev/null
+From 5f8cf712582617d523120df67d392059eaf2fc4b Mon Sep 17 00:00:00 2001
+From: Hui Peng <benquike@gmail.com>
+Date: Mon, 3 Dec 2018 16:09:34 +0100
+Subject: ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c
+
+From: Hui Peng <benquike@gmail.com>
+
+commit 5f8cf712582617d523120df67d392059eaf2fc4b upstream.
+
+If a USB sound card reports 0 interfaces, an error condition is triggered
+and the function usb_audio_probe errors out. In the error path, there was a
+use-after-free vulnerability where the memory object of the card was first
+freed, followed by a decrement of the number of active chips. Moving the
+decrement above the atomic_dec fixes the UAF.
+
+[ The original problem was introduced in 3.1 kernel, while it was
+ developed in a different form. The Fixes tag below indicates the
+ original commit but it doesn't mean that the patch is applicable
+ cleanly. -- tiwai ]
+
+Fixes: 362e4e49abe5 ("ALSA: usb-audio - clear chip->probing on error exit")
+Reported-by: Hui Peng <benquike@gmail.com>
+Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
+Signed-off-by: Hui Peng <benquike@gmail.com>
+Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/card.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -589,9 +589,12 @@ static int usb_audio_probe(struct usb_in
+
+ __error:
+ if (chip) {
++ /* chip->active is inside the chip->card object,
++ * decrement before memory is possibly returned.
++ */
++ atomic_dec(&chip->active);
+ if (!chip->num_interfaces)
+ snd_card_free(chip->card);
+- atomic_dec(&chip->active);
+ }
+ mutex_unlock(®ister_mutex);
+ return err;
net-faraday-ftmac100-remove-netif_running-netdev-che.patch
iommu-vt-d-use-memunmap-to-free-memremap.patch
net-amd-add-missing-of_node_put.patch
+usb-quirk-add-no-lpm-quirk-on-sandisk-ultra-flair-device.patch
+usb-appledisplay-add-27-apple-cinema-display.patch
+usb-check-usb_get_extra_descriptor-for-proper-size.patch
+alsa-usb-audio-fix-uaf-decrement-if-card-has-no-live-interfaces-in-card.c.patch
+alsa-hda-add-support-for-amd-stoney-ridge.patch
+alsa-pcm-fix-starvation-on-down_write_nonblock.patch
+alsa-pcm-call-snd_pcm_unlink-conditionally-at-closing.patch
+alsa-pcm-fix-interval-evaluation-with-openmin-max.patch
+alsa-hda-realtek-add-support-for-acer-aspire-c24-860-headset-mic.patch
+alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4660g.patch
+alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4860g-z6860g.patch
--- /dev/null
+From d7859905301880ad3e16272399d26900af3ac496 Mon Sep 17 00:00:00 2001
+From: Alexander Theissen <alex.theissen@me.com>
+Date: Tue, 4 Dec 2018 23:43:35 +0100
+Subject: usb: appledisplay: Add 27" Apple Cinema Display
+
+From: Alexander Theissen <alex.theissen@me.com>
+
+commit d7859905301880ad3e16272399d26900af3ac496 upstream.
+
+Add another Apple Cinema Display to the list of supported displays.
+
+Signed-off-by: Alexander Theissen <alex.theissen@me.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/misc/appledisplay.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/misc/appledisplay.c
++++ b/drivers/usb/misc/appledisplay.c
+@@ -64,6 +64,7 @@ static const struct usb_device_id appled
+ { APPLEDISPLAY_DEVICE(0x921c) },
+ { APPLEDISPLAY_DEVICE(0x921d) },
+ { APPLEDISPLAY_DEVICE(0x9222) },
++ { APPLEDISPLAY_DEVICE(0x9226) },
+ { APPLEDISPLAY_DEVICE(0x9236) },
+
+ /* Terminating entry */
--- /dev/null
+From 704620afc70cf47abb9d6a1a57f3825d2bca49cf Mon Sep 17 00:00:00 2001
+From: Mathias Payer <mathias.payer@nebelwelt.net>
+Date: Wed, 5 Dec 2018 21:19:59 +0100
+Subject: USB: check usb_get_extra_descriptor for proper size
+
+From: Mathias Payer <mathias.payer@nebelwelt.net>
+
+commit 704620afc70cf47abb9d6a1a57f3825d2bca49cf upstream.
+
+When reading an extra descriptor, we need to properly check the minimum
+and maximum size allowed, to prevent from invalid data being sent by a
+device.
+
+Reported-by: Hui Peng <benquike@gmail.com>
+Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
+Co-developed-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Hui Peng <benquike@gmail.com>
+Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: stable <stable@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hub.c | 2 +-
+ drivers/usb/core/usb.c | 6 +++---
+ drivers/usb/host/hwa-hc.c | 2 +-
+ include/linux/usb.h | 4 ++--
+ 4 files changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2211,7 +2211,7 @@ static int usb_enumerate_device_otg(stru
+ /* descriptor may appear anywhere in config */
+ err = __usb_get_extra_descriptor(udev->rawdescriptors[0],
+ le16_to_cpu(udev->config[0].desc.wTotalLength),
+- USB_DT_OTG, (void **) &desc);
++ USB_DT_OTG, (void **) &desc, sizeof(*desc));
+ if (err || !(desc->bmAttributes & USB_OTG_HNP))
+ return 0;
+
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -678,14 +678,14 @@ EXPORT_SYMBOL_GPL(usb_get_current_frame_
+ */
+
+ int __usb_get_extra_descriptor(char *buffer, unsigned size,
+- unsigned char type, void **ptr)
++ unsigned char type, void **ptr, size_t minsize)
+ {
+ struct usb_descriptor_header *header;
+
+ while (size >= sizeof(struct usb_descriptor_header)) {
+ header = (struct usb_descriptor_header *)buffer;
+
+- if (header->bLength < 2) {
++ if (header->bLength < 2 || header->bLength > size) {
+ printk(KERN_ERR
+ "%s: bogus descriptor, type %d length %d\n",
+ usbcore_name,
+@@ -694,7 +694,7 @@ int __usb_get_extra_descriptor(char *buf
+ return -1;
+ }
+
+- if (header->bDescriptorType == type) {
++ if (header->bDescriptorType == type && header->bLength >= minsize) {
+ *ptr = header;
+ return 0;
+ }
+--- a/drivers/usb/host/hwa-hc.c
++++ b/drivers/usb/host/hwa-hc.c
+@@ -654,7 +654,7 @@ static int hwahc_security_create(struct
+ top = itr + itr_size;
+ result = __usb_get_extra_descriptor(usb_dev->rawdescriptors[index],
+ le16_to_cpu(usb_dev->actconfig->desc.wTotalLength),
+- USB_DT_SECURITY, (void **) &secd);
++ USB_DT_SECURITY, (void **) &secd, sizeof(*secd));
+ if (result == -1) {
+ dev_warn(dev, "BUG? WUSB host has no security descriptors\n");
+ return 0;
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -334,11 +334,11 @@ struct usb_host_bos {
+ };
+
+ int __usb_get_extra_descriptor(char *buffer, unsigned size,
+- unsigned char type, void **ptr);
++ unsigned char type, void **ptr, size_t min);
+ #define usb_get_extra_descriptor(ifpoint, type, ptr) \
+ __usb_get_extra_descriptor((ifpoint)->extra, \
+ (ifpoint)->extralen, \
+- type, (void **)ptr)
++ type, (void **)ptr, sizeof(**(ptr)))
+
+ /* ----------------------------------------------------------------------- */
+
--- /dev/null
+From 2f2dde6ba89b1ef1fe23c1138131b315d9aa4019 Mon Sep 17 00:00:00 2001
+From: Harry Pan <harry.pan@intel.com>
+Date: Thu, 29 Nov 2018 00:40:41 +0800
+Subject: usb: quirk: add no-LPM quirk on SanDisk Ultra Flair device
+
+From: Harry Pan <harry.pan@intel.com>
+
+commit 2f2dde6ba89b1ef1fe23c1138131b315d9aa4019 upstream.
+
+Some lower volume SanDisk Ultra Flair in 16GB, which the VID:PID is
+in 0781:5591, will aggressively request LPM of U1/U2 during runtime,
+when using this thumb drive as the OS installation key we found the
+device will generate failure during U1 exit path making it dropped
+from the USB bus, this causes a corrupted installation in system at
+the end.
+
+i.e.,
+[ 166.918296] hub 2-0:1.0: state 7 ports 7 chg 0000 evt 0004
+[ 166.918327] usb usb2-port2: link state change
+[ 166.918337] usb usb2-port2: do warm reset
+[ 166.970039] usb usb2-port2: not warm reset yet, waiting 50ms
+[ 167.022040] usb usb2-port2: not warm reset yet, waiting 200ms
+[ 167.276043] usb usb2-port2: status 02c0, change 0041, 5.0 Gb/s
+[ 167.276050] usb 2-2: USB disconnect, device number 2
+[ 167.276058] usb 2-2: unregistering device
+[ 167.276060] usb 2-2: unregistering interface 2-2:1.0
+[ 167.276170] xhci_hcd 0000:00:15.0: shutdown urb ffffa3c7cc695cc0 ep1in-bulk
+[ 167.284055] sd 0:0:0:0: [sda] tag#0 FAILED Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK
+[ 167.284064] sd 0:0:0:0: [sda] tag#0 CDB: Read(10) 28 00 00 33 04 90 00 01 00 00
+...
+
+Analyzed the USB trace in the link layer we realized it is because
+of the 6-ms timer of tRecoveryConfigurationTimeout which documented
+on the USB 3.2 Revision 1.0, the section 7.5.10.4.2 of "Exit from
+Recovery.Configuration"; device initiates U1 exit -> Recovery.Active
+-> Recovery.Configuration, then the host timer timeout makes the link
+transits to eSS.Inactive -> Rx.Detect follows by a Warm Reset.
+
+Interestingly, the other higher volume of SanDisk Ultra Flair sharing
+the same VID:PID, such as 64GB, would not request LPM during runtime,
+it sticks at U0 always, thus disabling LPM does not affect those thumb
+drives at all.
+
+The same odd occures in SanDisk Ultra Fit 16GB, VID:PID in 0781:5583.
+
+Signed-off-by: Harry Pan <harry.pan@intel.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -188,6 +188,10 @@ static const struct usb_device_id usb_qu
+ /* Midiman M-Audio Keystation 88es */
+ { USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* SanDisk Ultra Fit and Ultra Flair */
++ { USB_DEVICE(0x0781, 0x5583), .driver_info = USB_QUIRK_NO_LPM },
++ { USB_DEVICE(0x0781, 0x5591), .driver_info = USB_QUIRK_NO_LPM },
++
+ /* M-Systems Flash Disk Pioneers */
+ { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
