--- /dev/null
+From 4b4e0e32e4b09274dbc9d173016c1a026f44608c Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Tue, 16 Jul 2019 15:21:34 +0800
+Subject: ALSA: hda/realtek: apply ALC891 headset fixup to one Dell machine
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit 4b4e0e32e4b09274dbc9d173016c1a026f44608c upstream.
+
+Without this patch, the headset-mic and headphone-mic don't work.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8149,6 +8149,11 @@ static const struct snd_hda_pin_quirk al
+ {0x18, 0x01a19030},
+ {0x1a, 0x01813040},
+ {0x21, 0x01014020}),
++ SND_HDA_PIN_QUIRK(0x10ec0867, 0x1028, "Dell", ALC891_FIXUP_DELL_MIC_NO_PRESENCE,
++ {0x16, 0x01813030},
++ {0x17, 0x02211010},
++ {0x18, 0x01a19040},
++ {0x21, 0x01014020}),
+ SND_HDA_PIN_QUIRK(0x10ec0662, 0x1028, "Dell", ALC662_FIXUP_DELL_MIC_NO_PRESENCE,
+ {0x14, 0x01014010},
+ {0x18, 0x01a19020},
--- /dev/null
+From ede34f397ddb063b145b9e7d79c6026f819ded13 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 15 Jul 2019 22:50:27 +0200
+Subject: ALSA: seq: Break too long mutex context in the write loop
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit ede34f397ddb063b145b9e7d79c6026f819ded13 upstream.
+
+The fix for the racy writes and ioctls to sequencer widened the
+application of client->ioctl_mutex to the whole write loop. Although
+it does unlock/relock for the lengthy operation like the event dup,
+the loop keeps the ioctl_mutex for the whole time in other
+situations. This may take quite long time if the user-space would
+give a huge buffer, and this is a likely cause of some weird behavior
+spotted by syzcaller fuzzer.
+
+This patch puts a simple workaround, just adding a mutex break in the
+loop when a large number of events have been processed. This
+shouldn't hit any performance drop because the threshold is set high
+enough for usual operations.
+
+Fixes: 7bd800915677 ("ALSA: seq: More protection for concurrent write and ioctl races")
+Reported-by: syzbot+97aae04ce27e39cbfca9@syzkaller.appspotmail.com
+Reported-by: syzbot+4c595632b98bb8ffcc66@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/core/seq/seq_clientmgr.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -1001,7 +1001,7 @@ static ssize_t snd_seq_write(struct file
+ {
+ struct snd_seq_client *client = file->private_data;
+ int written = 0, len;
+- int err;
++ int err, handled;
+ struct snd_seq_event event;
+
+ if (!(snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT))
+@@ -1014,6 +1014,8 @@ static ssize_t snd_seq_write(struct file
+ if (!client->accept_output || client->pool == NULL)
+ return -ENXIO;
+
++ repeat:
++ handled = 0;
+ /* allocate the pool now if the pool is not allocated yet */
+ mutex_lock(&client->ioctl_mutex);
+ if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) {
+@@ -1073,12 +1075,19 @@ static ssize_t snd_seq_write(struct file
+ 0, 0, &client->ioctl_mutex);
+ if (err < 0)
+ break;
++ handled++;
+
+ __skip_event:
+ /* Update pointers and counts */
+ count -= len;
+ buf += len;
+ written += len;
++
++ /* let's have a coffee break if too many events are queued */
++ if (++handled >= 200) {
++ mutex_unlock(&client->ioctl_mutex);
++ goto repeat;
++ }
+ }
+
+ out:
--- /dev/null
+From ceaea851b9ea75f9ea2bbefb53ff0d4b27cd5a6e Mon Sep 17 00:00:00 2001
+From: Mark Brown <broonie@kernel.org>
+Date: Fri, 21 Jun 2019 12:33:57 +0100
+Subject: ASoC: dapm: Adapt for debugfs API change
+
+From: Mark Brown <broonie@kernel.org>
+
+commit ceaea851b9ea75f9ea2bbefb53ff0d4b27cd5a6e upstream.
+
+Back in ff9fb72bc07705c (debugfs: return error values, not NULL) the
+debugfs APIs were changed to return error pointers rather than NULL
+pointers on error, breaking the error checking in ASoC. Update the
+code to use IS_ERR() and log the codes that are returned as part of
+the error messages.
+
+Fixes: ff9fb72bc07705c (debugfs: return error values, not NULL)
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-dapm.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -2120,23 +2120,25 @@ void snd_soc_dapm_debugfs_init(struct sn
+ {
+ struct dentry *d;
+
+- if (!parent)
++ if (!parent || IS_ERR(parent))
+ return;
+
+ dapm->debugfs_dapm = debugfs_create_dir("dapm", parent);
+
+- if (!dapm->debugfs_dapm) {
++ if (IS_ERR(dapm->debugfs_dapm)) {
+ dev_warn(dapm->dev,
+- "ASoC: Failed to create DAPM debugfs directory\n");
++ "ASoC: Failed to create DAPM debugfs directory %ld\n",
++ PTR_ERR(dapm->debugfs_dapm));
+ return;
+ }
+
+ d = debugfs_create_file("bias_level", 0444,
+ dapm->debugfs_dapm, dapm,
+ &dapm_bias_fops);
+- if (!d)
++ if (IS_ERR(d))
+ dev_warn(dapm->dev,
+- "ASoC: Failed to create bias level debugfs file\n");
++ "ASoC: Failed to create bias level debugfs file: %ld\n",
++ PTR_ERR(d));
+ }
+
+ static void dapm_debugfs_add_widget(struct snd_soc_dapm_widget *w)
+@@ -2150,10 +2152,10 @@ static void dapm_debugfs_add_widget(stru
+ d = debugfs_create_file(w->name, 0444,
+ dapm->debugfs_dapm, w,
+ &dapm_widget_power_fops);
+- if (!d)
++ if (IS_ERR(d))
+ dev_warn(w->dapm->dev,
+- "ASoC: Failed to create %s debugfs file\n",
+- w->name);
++ "ASoC: Failed to create %s debugfs file: %ld\n",
++ w->name, PTR_ERR(d));
+ }
+
+ static void dapm_debugfs_cleanup(struct snd_soc_dapm_context *dapm)
+++ /dev/null
-From aa081859b10c5d8b19f5c525c78883a59d73c2b8 Mon Sep 17 00:00:00 2001
-From: Ronnie Sahlberg <lsahlber@redhat.com>
-Date: Fri, 19 Jul 2019 08:12:11 +1000
-Subject: cifs: flush before set-info if we have writeable handles
-
-From: Ronnie Sahlberg <lsahlber@redhat.com>
-
-commit aa081859b10c5d8b19f5c525c78883a59d73c2b8 upstream.
-
-Servers can defer destaging any data and updating the mtime until close().
-This means that if we do a setinfo to modify the mtime while other handles
-are open for write the server may overwrite our setinfo timestamps when
-if flushes the file on close() of the writeable handle.
-
-To solve this we add an explicit flush when the mtime is about to
-be updated.
-
-This fixes "cp -p" to preserve mtime when copying a file onto an SMB2 share.
-
-CC: Stable <stable@vger.kernel.org>
-Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
-Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
-Signed-off-by: Steve French <stfrench@microsoft.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- fs/cifs/inode.c | 16 ++++++++++++++++
- 1 file changed, 16 insertions(+)
-
---- a/fs/cifs/inode.c
-+++ b/fs/cifs/inode.c
-@@ -2357,6 +2357,8 @@ cifs_setattr_nounix(struct dentry *diren
- struct inode *inode = d_inode(direntry);
- struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
- struct cifsInodeInfo *cifsInode = CIFS_I(inode);
-+ struct cifsFileInfo *wfile;
-+ struct cifs_tcon *tcon;
- char *full_path = NULL;
- int rc = -EACCES;
- __u32 dosattr = 0;
-@@ -2398,6 +2400,20 @@ cifs_setattr_nounix(struct dentry *diren
- mapping_set_error(inode->i_mapping, rc);
- rc = 0;
-
-+ if (attrs->ia_valid & ATTR_MTIME) {
-+ rc = cifs_get_writable_file(cifsInode, false, &wfile);
-+ if (!rc) {
-+ tcon = tlink_tcon(wfile->tlink);
-+ rc = tcon->ses->server->ops->flush(xid, tcon, &wfile->fid);
-+ cifsFileInfo_put(wfile);
-+ if (rc)
-+ return rc;
-+ } else if (rc != -EBADF)
-+ return rc;
-+ else
-+ rc = 0;
-+ }
-+
- if (attrs->ia_valid & ATTR_SIZE) {
- rc = cifs_set_file_size(inode, attrs, xid, full_path);
- if (rc != 0)
--- /dev/null
+From aeb87246537a83c2aff482f3f34a2e0991e02cbc Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Mon, 24 Jun 2019 07:20:14 +0000
+Subject: lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGE_SIZE
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+commit aeb87246537a83c2aff482f3f34a2e0991e02cbc upstream.
+
+All mapping iterator logic is based on the assumption that sg->offset
+is always lower than PAGE_SIZE.
+
+But there are situations where sg->offset is such that the SG item
+is on the second page. In that case sg_copy_to_buffer() fails
+properly copying the data into the buffer. One of the reason is
+that the data will be outside the kmapped area used to access that
+data.
+
+This patch fixes the issue by adjusting the mapping iterator
+offset and pgoffset fields such that offset is always lower than
+PAGE_SIZE.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Fixes: 4225fc8555a9 ("lib/scatterlist: use page iterator in the mapping iterator")
+Cc: stable@vger.kernel.org
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/scatterlist.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/lib/scatterlist.c
++++ b/lib/scatterlist.c
+@@ -496,17 +496,18 @@ static bool sg_miter_get_next_page(struc
+ {
+ if (!miter->__remaining) {
+ struct scatterlist *sg;
+- unsigned long pgoffset;
+
+ if (!__sg_page_iter_next(&miter->piter))
+ return false;
+
+ sg = miter->piter.sg;
+- pgoffset = miter->piter.sg_pgoffset;
+
+- miter->__offset = pgoffset ? 0 : sg->offset;
++ miter->__offset = miter->piter.sg_pgoffset ? 0 : sg->offset;
++ miter->piter.sg_pgoffset += miter->__offset >> PAGE_SHIFT;
++ miter->__offset &= PAGE_SIZE - 1;
+ miter->__remaining = sg->offset + sg->length -
+- (pgoffset << PAGE_SHIFT) - miter->__offset;
++ (miter->piter.sg_pgoffset << PAGE_SHIFT) -
++ miter->__offset;
+ miter->__remaining = min_t(unsigned long, miter->__remaining,
+ PAGE_SIZE - miter->__offset);
+ }
--- /dev/null
+From 766b9b168f6c75c350dd87c3e0bc6a9b322f0013 Mon Sep 17 00:00:00 2001
+From: Ezequiel Garcia <ezequiel@collabora.com>
+Date: Thu, 2 May 2019 18:00:43 -0400
+Subject: media: coda: Remove unbalanced and unneeded mutex unlock
+
+From: Ezequiel Garcia <ezequiel@collabora.com>
+
+commit 766b9b168f6c75c350dd87c3e0bc6a9b322f0013 upstream.
+
+The mutex unlock in the threaded interrupt handler is not paired
+with any mutex lock. Remove it.
+
+This bug has been here for a really long time, so it applies
+to any stable repo.
+
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Ezequiel Garcia <ezequiel@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Cc: stable@vger.kernel.org
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/coda/coda-bit.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/media/platform/coda/coda-bit.c
++++ b/drivers/media/platform/coda/coda-bit.c
+@@ -2257,7 +2257,6 @@ irqreturn_t coda_irq_handler(int irq, vo
+ if (ctx == NULL) {
+ v4l2_err(&dev->v4l2_dev,
+ "Instance released before the end of transaction\n");
+- mutex_unlock(&dev->coda_mutex);
+ return IRQ_HANDLED;
+ }
+
--- /dev/null
+From 07d89227a983df957a6a7c56f7c040cde9ac571f Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@collabora.com>
+Date: Wed, 19 Jun 2019 05:21:33 -0400
+Subject: media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom()
+
+From: Boris Brezillon <boris.brezillon@collabora.com>
+
+commit 07d89227a983df957a6a7c56f7c040cde9ac571f upstream.
+
+cfg->type can be overridden by v4l2_ctrl_fill() and the new value is
+stored in the local type var. Fix the tests to use this local var.
+
+Fixes: 0996517cf8ea ("V4L/DVB: v4l2: Add new control handling framework")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
+[hverkuil-cisco@xs4all.nl: change to !qmenu and !qmenu_int (checkpatch)]
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/v4l2-core/v4l2-ctrls.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/v4l2-core/v4l2-ctrls.c
++++ b/drivers/media/v4l2-core/v4l2-ctrls.c
+@@ -2113,16 +2113,15 @@ struct v4l2_ctrl *v4l2_ctrl_new_custom(s
+ v4l2_ctrl_fill(cfg->id, &name, &type, &min, &max, &step,
+ &def, &flags);
+
+- is_menu = (cfg->type == V4L2_CTRL_TYPE_MENU ||
+- cfg->type == V4L2_CTRL_TYPE_INTEGER_MENU);
++ is_menu = (type == V4L2_CTRL_TYPE_MENU ||
++ type == V4L2_CTRL_TYPE_INTEGER_MENU);
+ if (is_menu)
+ WARN_ON(step);
+ else
+ WARN_ON(cfg->menu_skip_mask);
+- if (cfg->type == V4L2_CTRL_TYPE_MENU && qmenu == NULL)
++ if (type == V4L2_CTRL_TYPE_MENU && !qmenu) {
+ qmenu = v4l2_ctrl_get_menu(cfg->id);
+- else if (cfg->type == V4L2_CTRL_TYPE_INTEGER_MENU &&
+- qmenu_int == NULL) {
++ } else if (type == V4L2_CTRL_TYPE_INTEGER_MENU && !qmenu_int) {
+ handler_set_err(hdl, -EINVAL);
+ return NULL;
+ }
--- /dev/null
+From 44942b4e457beda00981f616402a1a791e8c616e Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Thu, 27 Jun 2019 06:41:45 -0400
+Subject: NFSv4: Handle the special Linux file open access mode
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+commit 44942b4e457beda00981f616402a1a791e8c616e upstream.
+
+According to the open() manpage, Linux reserves the access mode 3
+to mean "check for read and write permission on the file and return
+a file descriptor that can't be used for reading or writing."
+
+Currently, the NFSv4 code will ask the server to open the file,
+and will use an incorrect share access mode of 0. Since it has
+an incorrect share access mode, the client later forgets to send
+a corresponding close, meaning it can leak stateids on the server.
+
+Fixes: ce4ef7c0a8a05 ("NFS: Split out NFS v4 file operations")
+Cc: stable@vger.kernel.org # 3.6+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/inode.c | 1 +
+ fs/nfs/nfs4file.c | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -1034,6 +1034,7 @@ int nfs_open(struct inode *inode, struct
+ nfs_fscache_open_file(inode, filp);
+ return 0;
+ }
++EXPORT_SYMBOL_GPL(nfs_open);
+
+ /*
+ * This function is called whenever some part of NFS notices that
+--- a/fs/nfs/nfs4file.c
++++ b/fs/nfs/nfs4file.c
+@@ -50,7 +50,7 @@ nfs4_file_open(struct inode *inode, stru
+ return err;
+
+ if ((openflags & O_ACCMODE) == 3)
+- openflags--;
++ return nfs_open(inode, filp);
+
+ /* We can't create new files here */
+ openflags &= ~(O_CREAT|O_EXCL);
--- /dev/null
+From 8e04fdfadda75a849c649f7e50fe7d97772e1fcb Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Wed, 17 Jul 2019 13:57:44 -0400
+Subject: pnfs/flexfiles: Fix PTR_ERR() dereferences in ff_layout_track_ds_error
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+commit 8e04fdfadda75a849c649f7e50fe7d97772e1fcb upstream.
+
+mirror->mirror_ds can be NULL if uninitialised, but can contain
+a PTR_ERR() if call to GETDEVICEINFO failed.
+
+Fixes: 65990d1afbd2 ("pNFS/flexfiles: Fix a deadlock on LAYOUTGET")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Cc: stable@vger.kernel.org # 4.10+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/flexfilelayout/flexfilelayoutdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
++++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+@@ -306,7 +306,7 @@ int ff_layout_track_ds_error(struct nfs4
+ if (status == 0)
+ return 0;
+
+- if (mirror->mirror_ds == NULL)
++ if (IS_ERR_OR_NULL(mirror->mirror_ds))
+ return -EINVAL;
+
+ dserr = kmalloc(sizeof(*dserr), gfp_flags);
crypto-ccp-memset-structure-fields-to-zero-before-reuse.patch
crypto-ccp-gcm-use-const-time-tag-comparison.patch
crypto-crypto4xx-fix-a-potential-double-free-in-ppc4xx_trng_probe.patch
-cifs-flush-before-set-info-if-we-have-writeable-handles.patch
input-gtco-bounds-check-collection-indent-level.patch
input-alps-don-t-handle-alps-cs19-trackpoint-only-device.patch
input-synaptics-whitelist-lenovo-t580-smbus-intertouch.patch
arm64-tegra-update-jetson-tx1-gpu-regulator-timings.patch
iwlwifi-pcie-don-t-service-an-interrupt-that-was-masked.patch
iwlwifi-pcie-fix-alive-interrupt-handling-for-gen2-devices-w-o-msi-x.patch
+nfsv4-handle-the-special-linux-file-open-access-mode.patch
+pnfs-flexfiles-fix-ptr_err-dereferences-in-ff_layout_track_ds_error.patch
+lib-scatterlist-fix-mapping-iterator-when-sg-offset-is-greater-than-page_size.patch
+asoc-dapm-adapt-for-debugfs-api-change.patch
+alsa-seq-break-too-long-mutex-context-in-the-write-loop.patch
+alsa-hda-realtek-apply-alc891-headset-fixup-to-one-dell-machine.patch
+media-v4l2-test-type-instead-of-cfg-type-in-v4l2_ctrl_new_custom.patch
+media-coda-remove-unbalanced-and-unneeded-mutex-unlock.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
