From: Greg Kroah-Hartman Date: Mon, 10 Dec 2018 10:15:39 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v4.19.9~29 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1a286333b7df3c494dbf8b68c51e2ed11ec69fcd;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: alsa-hda-add-support-for-amd-stoney-ridge.patch alsa-hda-realtek-add-support-for-acer-aspire-c24-860-headset-mic.patch alsa-hda-realtek-alc286-mic-and-headset-mode-fixups-for-acer-aspire-u27-880.patch alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4660g.patch alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4860g-z6860g.patch alsa-hda-realtek-fix-speaker-output-regression-on-thinkpad-t570.patch alsa-pcm-call-snd_pcm_unlink-conditionally-at-closing.patch alsa-pcm-fix-interval-evaluation-with-openmin-max.patch alsa-pcm-fix-starvation-on-down_write_nonblock.patch alsa-usb-audio-add-smsl-d1-to-quirks-for-native-dsd-support.patch alsa-usb-audio-fix-uaf-decrement-if-card-has-no-live-interfaces-in-card.c.patch usb-appledisplay-add-27-apple-cinema-display.patch usb-check-usb_get_extra_descriptor-for-proper-size.patch usb-quirk-add-no-lpm-quirk-on-sandisk-ultra-flair-device.patch usb-serial-console-fix-reported-terminal-settings.patch --- diff --git a/queue-4.19/alsa-hda-add-support-for-amd-stoney-ridge.patch b/queue-4.19/alsa-hda-add-support-for-amd-stoney-ridge.patch new file mode 100644 index 00000000000..5af9aae2e46 --- /dev/null +++ b/queue-4.19/alsa-hda-add-support-for-amd-stoney-ridge.patch @@ -0,0 +1,34 @@ +From 3deef52ce10514ccdebba8e8ab85f9cebd0eb3f7 Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Thu, 29 Nov 2018 08:57:37 +0000 +Subject: ALSA: hda: Add support for AMD Stoney Ridge + +From: Kai-Heng Feng + +commit 3deef52ce10514ccdebba8e8ab85f9cebd0eb3f7 upstream. + +It's similar to other AMD audio devices, it also supports D3, which can +save some power drain. + +Signed-off-by: Kai-Heng Feng +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2585,6 +2585,10 @@ static const struct pci_device_id azx_id + /* AMD Hudson */ + { PCI_DEVICE(0x1022, 0x780d), + .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB }, ++ /* AMD Stoney */ ++ { PCI_DEVICE(0x1022, 0x157a), ++ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB | ++ AZX_DCAPS_PM_RUNTIME }, + /* AMD Raven */ + { PCI_DEVICE(0x1022, 0x15e3), + .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB | diff --git a/queue-4.19/alsa-hda-realtek-add-support-for-acer-aspire-c24-860-headset-mic.patch b/queue-4.19/alsa-hda-realtek-add-support-for-acer-aspire-c24-860-headset-mic.patch new file mode 100644 index 00000000000..26d86117a85 --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-add-support-for-acer-aspire-c24-860-headset-mic.patch @@ -0,0 +1,34 @@ +From 705b65f107470499442240ff7afee5021a7002a6 Mon Sep 17 00:00:00 2001 +From: Chris Chiu +Date: Wed, 5 Dec 2018 14:48:54 +0800 +Subject: ALSA: hda/realtek - Add support for Acer Aspire C24-860 headset mic + +From: Chris Chiu + +commit 705b65f107470499442240ff7afee5021a7002a6 upstream. + +The Acer AIO Aspire C24-860 with ALC286 can't detect the headset +microphone. Just like another Acer AIO U27-880, it needs a different +pin value for 0x18 and the headset fixup to make headset mic work. + +Signed-off-by: Jian-Hong Pan +Signed-off-by: Daniel Drake +Signed-off-by: Chris Chiu +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6420,6 +6420,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1025, 0x0762, "Acer Aspire E1-472", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572), + SND_PCI_QUIRK(0x1025, 0x0775, "Acer Aspire E1-572", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572), + SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS), ++ SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK), + SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z), + SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS), diff --git a/queue-4.19/alsa-hda-realtek-alc286-mic-and-headset-mode-fixups-for-acer-aspire-u27-880.patch b/queue-4.19/alsa-hda-realtek-alc286-mic-and-headset-mode-fixups-for-acer-aspire-u27-880.patch new file mode 100644 index 00000000000..805710ccd13 --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-alc286-mic-and-headset-mode-fixups-for-acer-aspire-u27-880.patch @@ -0,0 +1,64 @@ +From 33aaebd48ae2d2c78fef5063a0381e17db19b060 Mon Sep 17 00:00:00 2001 +From: Chris Chiu +Date: Wed, 5 Dec 2018 14:48:53 +0800 +Subject: ALSA: hda/realtek: ALC286 mic and headset-mode fixups for Acer Aspire U27-880 + +From: Chris Chiu + +commit 33aaebd48ae2d2c78fef5063a0381e17db19b060 upstream. + +Acer Aspire U27-880(AIO) with ALC286 codec can not detect headset mic +and internal mic not working either. It needs the similar quirk like +Sony laptops to fix headphone jack sensing and enables use of the +internal microphone. + +Unfortunately jack sensing for the headset mic is still not working. + +Signed-off-by: Jian-Hong Pan +Signed-off-by: Daniel Drake +Signed-off-by: Chris Chiu +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5519,6 +5519,7 @@ enum { + ALC221_FIXUP_HP_HEADSET_MIC, + ALC285_FIXUP_LENOVO_HEADPHONE_NOISE, + ALC295_FIXUP_HP_AUTO_MUTE, ++ ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -6396,6 +6397,15 @@ static const struct hda_fixup alc269_fix + .type = HDA_FIXUP_FUNC, + .v.func = alc_fixup_auto_mute_via_amp, + }, ++ [ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x18, 0x01a1913c }, /* use as headset mic, without its own jack detect */ ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_HEADSET_MIC ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -7074,6 +7084,10 @@ static const struct snd_hda_pin_quirk al + {0x14, 0x90170110}, + {0x19, 0x04a11040}, + {0x21, 0x04211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0286, 0x1025, "Acer", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE, ++ {0x12, 0x90a60130}, ++ {0x17, 0x90170110}, ++ {0x21, 0x02211020}), + SND_HDA_PIN_QUIRK(0x10ec0288, 0x1028, "Dell", ALC288_FIXUP_DELL1_MIC_NO_PRESENCE, + {0x12, 0x90a60120}, + {0x14, 0x90170110}, diff --git a/queue-4.19/alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4660g.patch b/queue-4.19/alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4660g.patch new file mode 100644 index 00000000000..700e50a0cfa --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4660g.patch @@ -0,0 +1,35 @@ +From 9f8aefed9623a91dec54eab8908f3810b7f8d73a Mon Sep 17 00:00:00 2001 +From: Chris Chiu +Date: Wed, 5 Dec 2018 14:48:55 +0800 +Subject: ALSA: hda/realtek: Fix mic issue on Acer AIO Veriton Z4660G + +From: Chris Chiu + +commit 9f8aefed9623a91dec54eab8908f3810b7f8d73a upstream. + +Acer AIO Veriton Z4660G with ALC286 codec has issue with the input +from external microphones connecting via 'Front Mic' jack. The fixup +ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE enables the jack sensing of +the headset and fix the audio input issue of external microphone. + +Signed-off-by: Jian-Hong Pan +Signed-off-by: Daniel Drake +Signed-off-by: Chris Chiu +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6422,6 +6422,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS), + SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK), ++ SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z), + SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS), + SND_PCI_QUIRK(0x1028, 0x05bd, "Dell Latitude E6440", ALC292_FIXUP_DELL_E7X), diff --git a/queue-4.19/alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4860g-z6860g.patch b/queue-4.19/alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4860g-z6860g.patch new file mode 100644 index 00000000000..2a3ef423ed5 --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4860g-z6860g.patch @@ -0,0 +1,35 @@ +From b72f936f6b325f4fde06b02e4b6ab682f6f2e73f Mon Sep 17 00:00:00 2001 +From: Chris Chiu +Date: Wed, 5 Dec 2018 14:48:56 +0800 +Subject: ALSA: hda/realtek: Fix mic issue on Acer AIO Veriton Z4860G/Z6860G + +From: Chris Chiu + +commit b72f936f6b325f4fde06b02e4b6ab682f6f2e73f upstream. + +Acer AIO Veriton Z4860G/Z6860G with the same ALC286 codec has issues +with the input from external microphone. The issue can be fixed by +the fixup ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE for Veriton Z4660G. + +Signed-off-by: Jian-Hong Pan +Signed-off-by: Daniel Drake +Signed-off-by: Chris Chiu +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6422,6 +6422,8 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS), + SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK), ++ SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z), + SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS), diff --git a/queue-4.19/alsa-hda-realtek-fix-speaker-output-regression-on-thinkpad-t570.patch b/queue-4.19/alsa-hda-realtek-fix-speaker-output-regression-on-thinkpad-t570.patch new file mode 100644 index 00000000000..e562cd4bdfb --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-fix-speaker-output-regression-on-thinkpad-t570.patch @@ -0,0 +1,58 @@ +From 54947cd64c1b8290f64bb2958e343c07270e3a58 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 3 Dec 2018 10:44:15 +0100 +Subject: ALSA: hda/realtek - Fix speaker output regression on Thinkpad T570 + +From: Takashi Iwai + +commit 54947cd64c1b8290f64bb2958e343c07270e3a58 upstream. + +We've got a regression report for some Thinkpad models (at least +T570s) which shows the too low speaker output volume. The bisection +leaded to the commit 61fcf8ece9b6 ("ALSA: hda/realtek - Enable Thinkpad +Dock device for ALC298 platform"), and it's basically adding the two +pin configurations for the dock, and looks harmless. + +The real culprit seems, though, that the DAC assignment for the +speaker pin is implicitly assumed on these devices, i.e. pin NID 0x14 +to be coupled with DAC NID 0x03. When more pins are configured by the +commit above, the auto-parser changes the DAC assignment, and this +resulted in the regression. + +As a workaround, just provide the fixed pin / DAC mapping table for +this Thinkpad fixup function. It's no generic solution, but the +problem itself is pretty much device-specific, so must be good +enough. + +Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1554304 +Fixes: 61fcf8ece9b6 ("ALSA: hda/realtek - Enable Thinkpad Dock device for ALC298 platform") +Cc: +Reported-and-tested-by: Jeremy Cline +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4988,9 +4988,18 @@ static void alc_fixup_tpt470_dock(struct + { 0x19, 0x21a11010 }, /* dock mic */ + { } + }; ++ /* Assure the speaker pin to be coupled with DAC NID 0x03; otherwise ++ * the speaker output becomes too low by some reason on Thinkpads with ++ * ALC298 codec ++ */ ++ static hda_nid_t preferred_pairs[] = { ++ 0x14, 0x03, 0x17, 0x02, 0x21, 0x02, ++ 0 ++ }; + struct alc_spec *spec = codec->spec; + + if (action == HDA_FIXUP_ACT_PRE_PROBE) { ++ spec->gen.preferred_dacs = preferred_pairs; + spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP; + snd_hda_apply_pincfgs(codec, pincfgs); + } else if (action == HDA_FIXUP_ACT_INIT) { diff --git a/queue-4.19/alsa-pcm-call-snd_pcm_unlink-conditionally-at-closing.patch b/queue-4.19/alsa-pcm-call-snd_pcm_unlink-conditionally-at-closing.patch new file mode 100644 index 00000000000..12545ead307 --- /dev/null +++ b/queue-4.19/alsa-pcm-call-snd_pcm_unlink-conditionally-at-closing.patch @@ -0,0 +1,43 @@ +From b51abed8355e5556886623b2772fa6b7598d2282 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 29 Nov 2018 08:02:49 +0100 +Subject: ALSA: pcm: Call snd_pcm_unlink() conditionally at closing + +From: Takashi Iwai + +commit b51abed8355e5556886623b2772fa6b7598d2282 upstream. + +Currently the PCM core calls snd_pcm_unlink() always unconditionally +at closing a stream. However, since snd_pcm_unlink() invokes the +global rwsem down, the lock can be easily contended. More badly, when +a thread runs in a high priority RT-FIFO, it may stall at spinning. + +Basically the call of snd_pcm_unlink() is required only for the linked +streams that are already rare occasion. For normal use cases, this +code path is fairly superfluous. + +As an optimization (and also as a workaround for the RT problem +above in normal situations without linked streams), this patch adds a +check before calling snd_pcm_unlink() and calls it only when needed. + +Reported-by: Chanho Min +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/pcm_native.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -2370,7 +2370,8 @@ int snd_pcm_hw_constraints_complete(stru + + static void pcm_release_private(struct snd_pcm_substream *substream) + { +- snd_pcm_unlink(substream); ++ if (snd_pcm_stream_linked(substream)) ++ snd_pcm_unlink(substream); + } + + void snd_pcm_release_substream(struct snd_pcm_substream *substream) diff --git a/queue-4.19/alsa-pcm-fix-interval-evaluation-with-openmin-max.patch b/queue-4.19/alsa-pcm-fix-interval-evaluation-with-openmin-max.patch new file mode 100644 index 00000000000..f689db22962 --- /dev/null +++ b/queue-4.19/alsa-pcm-fix-interval-evaluation-with-openmin-max.patch @@ -0,0 +1,40 @@ +From 5363857b916c1f48027e9b96ee8be8376bf20811 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 29 Nov 2018 12:05:19 +0100 +Subject: ALSA: pcm: Fix interval evaluation with openmin/max + +From: Takashi Iwai + +commit 5363857b916c1f48027e9b96ee8be8376bf20811 upstream. + +As addressed in alsa-lib (commit b420056604f0), we need to fix the +case where the evaluation of PCM interval "(x x+1]" leading to +-EINVAL. After applying rules, such an interval may be translated as +"(x x+1)". + +Fixes: ff2d6acdf6f1 ("ALSA: pcm: Fix snd_interval_refine first/last with open min/max") +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + include/sound/pcm_params.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/include/sound/pcm_params.h ++++ b/include/sound/pcm_params.h +@@ -254,11 +254,13 @@ static inline int snd_interval_empty(con + static inline int snd_interval_single(const struct snd_interval *i) + { + return (i->min == i->max || +- (i->min + 1 == i->max && i->openmax)); ++ (i->min + 1 == i->max && (i->openmin || i->openmax))); + } + + static inline int snd_interval_value(const struct snd_interval *i) + { ++ if (i->openmin && !i->openmax) ++ return i->max; + return i->min; + } + diff --git a/queue-4.19/alsa-pcm-fix-starvation-on-down_write_nonblock.patch b/queue-4.19/alsa-pcm-fix-starvation-on-down_write_nonblock.patch new file mode 100644 index 00000000000..94fd26bb3a8 --- /dev/null +++ b/queue-4.19/alsa-pcm-fix-starvation-on-down_write_nonblock.patch @@ -0,0 +1,91 @@ +From b888a5f713e4d17faaaff24316585a4eb07f35b7 Mon Sep 17 00:00:00 2001 +From: Chanho Min +Date: Mon, 26 Nov 2018 14:36:37 +0900 +Subject: ALSA: pcm: Fix starvation on down_write_nonblock() + +From: Chanho Min + +commit b888a5f713e4d17faaaff24316585a4eb07f35b7 upstream. + +Commit 67ec1072b053 ("ALSA: pcm: Fix rwsem deadlock for non-atomic PCM +stream") fixes deadlock for non-atomic PCM stream. But, This patch +causes antother stuck. +If writer is RT thread and reader is a normal thread, the reader +thread will be difficult to get scheduled. It may not give chance to +release readlocks and writer gets stuck for a long time if they are +pinned to single cpu. + +The deadlock described in the previous commit is because the linux +rwsem queues like a FIFO. So, we might need non-FIFO writelock, not +non-block one. + +My suggestion is that the writer gives reader a chance to be scheduled +by using the minimum msleep() instaed of spinning without blocking by +writer. Also, The *_nonblock may be changed to *_nonfifo appropriately +to this concept. +In terms of performance, when trylock is failed, this minimum periodic +msleep will have the same performance as the tick-based +schedule()/wake_up_q(). + +[ Although this has a fairly high performance penalty, the relevant + code path became already rare due to the previous commit ("ALSA: + pcm: Call snd_pcm_unlink() conditionally at closing"). That is, now + this unconditional msleep appears only when using linked streams, + and this must be a rare case. So we accept this as a quick + workaround until finding a more suitable one -- tiwai ] + +Fixes: 67ec1072b053 ("ALSA: pcm: Fix rwsem deadlock for non-atomic PCM stream") +Suggested-by: Wonmin Jung +Signed-off-by: Chanho Min +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/pcm_native.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -36,6 +36,7 @@ + #include + #include + #include ++#include + + #include "pcm_local.h" + +@@ -91,12 +92,12 @@ static DECLARE_RWSEM(snd_pcm_link_rwsem) + * and this may lead to a deadlock when the code path takes read sem + * twice (e.g. one in snd_pcm_action_nonatomic() and another in + * snd_pcm_stream_lock()). As a (suboptimal) workaround, let writer to +- * spin until it gets the lock. ++ * sleep until all the readers are completed without blocking by writer. + */ +-static inline void down_write_nonblock(struct rw_semaphore *lock) ++static inline void down_write_nonfifo(struct rw_semaphore *lock) + { + while (!down_write_trylock(lock)) +- cond_resched(); ++ msleep(1); + } + + #define PCM_LOCK_DEFAULT 0 +@@ -1967,7 +1968,7 @@ static int snd_pcm_link(struct snd_pcm_s + res = -ENOMEM; + goto _nolock; + } +- down_write_nonblock(&snd_pcm_link_rwsem); ++ down_write_nonfifo(&snd_pcm_link_rwsem); + write_lock_irq(&snd_pcm_link_rwlock); + if (substream->runtime->status->state == SNDRV_PCM_STATE_OPEN || + substream->runtime->status->state != substream1->runtime->status->state || +@@ -2014,7 +2015,7 @@ static int snd_pcm_unlink(struct snd_pcm + struct snd_pcm_substream *s; + int res = 0; + +- down_write_nonblock(&snd_pcm_link_rwsem); ++ down_write_nonfifo(&snd_pcm_link_rwsem); + write_lock_irq(&snd_pcm_link_rwlock); + if (!snd_pcm_stream_linked(substream)) { + res = -EALREADY; diff --git a/queue-4.19/alsa-usb-audio-add-smsl-d1-to-quirks-for-native-dsd-support.patch b/queue-4.19/alsa-usb-audio-add-smsl-d1-to-quirks-for-native-dsd-support.patch new file mode 100644 index 00000000000..5b378c8a924 --- /dev/null +++ b/queue-4.19/alsa-usb-audio-add-smsl-d1-to-quirks-for-native-dsd-support.patch @@ -0,0 +1,33 @@ +From 44ff57e685f96d0cb9540004cc9d1d880e7a4315 Mon Sep 17 00:00:00 2001 +From: Tony Das +Date: Wed, 28 Nov 2018 20:16:37 +0000 +Subject: ALSA: usb-audio: Add SMSL D1 to quirks for native DSD support + +From: Tony Das + +commit 44ff57e685f96d0cb9540004cc9d1d880e7a4315 upstream. + +This patch adds quirk VID/PID IDs for the SMSL D1 in order to enable +Native DSD support. + +[ Moved the added entry in numerical order -- tiwai ] + +Signed-off-by: Tony Das +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1373,6 +1373,7 @@ u64 snd_usb_interface_dsd_format_quirks( + return SNDRV_PCM_FMTBIT_DSD_U32_BE; + break; + ++ case USB_ID(0x152a, 0x85de): /* SMSL D1 DAC */ + case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */ + case USB_ID(0x0d8c, 0x0316): /* Hegel HD12 DSD */ + case USB_ID(0x16b0, 0x06b2): /* NuPrime DAC-10 */ diff --git a/queue-4.19/alsa-usb-audio-fix-uaf-decrement-if-card-has-no-live-interfaces-in-card.c.patch b/queue-4.19/alsa-usb-audio-fix-uaf-decrement-if-card-has-no-live-interfaces-in-card.c.patch new file mode 100644 index 00000000000..0395058bad7 --- /dev/null +++ b/queue-4.19/alsa-usb-audio-fix-uaf-decrement-if-card-has-no-live-interfaces-in-card.c.patch @@ -0,0 +1,49 @@ +From 5f8cf712582617d523120df67d392059eaf2fc4b Mon Sep 17 00:00:00 2001 +From: Hui Peng +Date: Mon, 3 Dec 2018 16:09:34 +0100 +Subject: ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c + +From: Hui Peng + +commit 5f8cf712582617d523120df67d392059eaf2fc4b upstream. + +If a USB sound card reports 0 interfaces, an error condition is triggered +and the function usb_audio_probe errors out. In the error path, there was a +use-after-free vulnerability where the memory object of the card was first +freed, followed by a decrement of the number of active chips. Moving the +decrement above the atomic_dec fixes the UAF. + +[ The original problem was introduced in 3.1 kernel, while it was + developed in a different form. The Fixes tag below indicates the + original commit but it doesn't mean that the patch is applicable + cleanly. -- tiwai ] + +Fixes: 362e4e49abe5 ("ALSA: usb-audio - clear chip->probing on error exit") +Reported-by: Hui Peng +Reported-by: Mathias Payer +Signed-off-by: Hui Peng +Signed-off-by: Mathias Payer +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/card.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -682,9 +682,12 @@ static int usb_audio_probe(struct usb_in + + __error: + if (chip) { ++ /* chip->active is inside the chip->card object, ++ * decrement before memory is possibly returned. ++ */ ++ atomic_dec(&chip->active); + if (!chip->num_interfaces) + snd_card_free(chip->card); +- atomic_dec(&chip->active); + } + mutex_unlock(®ister_mutex); + return err; diff --git a/queue-4.19/series b/queue-4.19/series index 860638073fa..979a5f5ddb8 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -54,3 +54,18 @@ ibmvnic-fix-rx-queue-buffer-cleanup.patch ibmvnic-update-driver-queues-after-change-in-ring-si.patch team-no-need-to-do-team_notify_peers-or-team_mcast_r.patch net-amd-add-missing-of_node_put.patch +usb-quirk-add-no-lpm-quirk-on-sandisk-ultra-flair-device.patch +usb-appledisplay-add-27-apple-cinema-display.patch +usb-check-usb_get_extra_descriptor-for-proper-size.patch +usb-serial-console-fix-reported-terminal-settings.patch +alsa-usb-audio-add-smsl-d1-to-quirks-for-native-dsd-support.patch +alsa-usb-audio-fix-uaf-decrement-if-card-has-no-live-interfaces-in-card.c.patch +alsa-hda-add-support-for-amd-stoney-ridge.patch +alsa-pcm-fix-starvation-on-down_write_nonblock.patch +alsa-pcm-call-snd_pcm_unlink-conditionally-at-closing.patch +alsa-pcm-fix-interval-evaluation-with-openmin-max.patch +alsa-hda-realtek-fix-speaker-output-regression-on-thinkpad-t570.patch +alsa-hda-realtek-alc286-mic-and-headset-mode-fixups-for-acer-aspire-u27-880.patch +alsa-hda-realtek-add-support-for-acer-aspire-c24-860-headset-mic.patch +alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4660g.patch +alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4860g-z6860g.patch diff --git a/queue-4.19/usb-appledisplay-add-27-apple-cinema-display.patch b/queue-4.19/usb-appledisplay-add-27-apple-cinema-display.patch new file mode 100644 index 00000000000..3a5fa217512 --- /dev/null +++ b/queue-4.19/usb-appledisplay-add-27-apple-cinema-display.patch @@ -0,0 +1,29 @@ +From d7859905301880ad3e16272399d26900af3ac496 Mon Sep 17 00:00:00 2001 +From: Alexander Theissen +Date: Tue, 4 Dec 2018 23:43:35 +0100 +Subject: usb: appledisplay: Add 27" Apple Cinema Display + +From: Alexander Theissen + +commit d7859905301880ad3e16272399d26900af3ac496 upstream. + +Add another Apple Cinema Display to the list of supported displays. + +Signed-off-by: Alexander Theissen +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/appledisplay.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/misc/appledisplay.c ++++ b/drivers/usb/misc/appledisplay.c +@@ -51,6 +51,7 @@ static const struct usb_device_id appled + { APPLEDISPLAY_DEVICE(0x921c) }, + { APPLEDISPLAY_DEVICE(0x921d) }, + { APPLEDISPLAY_DEVICE(0x9222) }, ++ { APPLEDISPLAY_DEVICE(0x9226) }, + { APPLEDISPLAY_DEVICE(0x9236) }, + + /* Terminating entry */ diff --git a/queue-4.19/usb-check-usb_get_extra_descriptor-for-proper-size.patch b/queue-4.19/usb-check-usb_get_extra_descriptor-for-proper-size.patch new file mode 100644 index 00000000000..bcc9a05be2b --- /dev/null +++ b/queue-4.19/usb-check-usb_get_extra_descriptor-for-proper-size.patch @@ -0,0 +1,95 @@ +From 704620afc70cf47abb9d6a1a57f3825d2bca49cf Mon Sep 17 00:00:00 2001 +From: Mathias Payer +Date: Wed, 5 Dec 2018 21:19:59 +0100 +Subject: USB: check usb_get_extra_descriptor for proper size + +From: Mathias Payer + +commit 704620afc70cf47abb9d6a1a57f3825d2bca49cf upstream. + +When reading an extra descriptor, we need to properly check the minimum +and maximum size allowed, to prevent from invalid data being sent by a +device. + +Reported-by: Hui Peng +Reported-by: Mathias Payer +Co-developed-by: Linus Torvalds +Signed-off-by: Hui Peng +Signed-off-by: Mathias Payer +Signed-off-by: Linus Torvalds +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 2 +- + drivers/usb/core/usb.c | 6 +++--- + drivers/usb/host/hwa-hc.c | 2 +- + include/linux/usb.h | 4 ++-- + 4 files changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2250,7 +2250,7 @@ static int usb_enumerate_device_otg(stru + /* descriptor may appear anywhere in config */ + err = __usb_get_extra_descriptor(udev->rawdescriptors[0], + le16_to_cpu(udev->config[0].desc.wTotalLength), +- USB_DT_OTG, (void **) &desc); ++ USB_DT_OTG, (void **) &desc, sizeof(*desc)); + if (err || !(desc->bmAttributes & USB_OTG_HNP)) + return 0; + +--- a/drivers/usb/core/usb.c ++++ b/drivers/usb/core/usb.c +@@ -832,14 +832,14 @@ EXPORT_SYMBOL_GPL(usb_get_current_frame_ + */ + + int __usb_get_extra_descriptor(char *buffer, unsigned size, +- unsigned char type, void **ptr) ++ unsigned char type, void **ptr, size_t minsize) + { + struct usb_descriptor_header *header; + + while (size >= sizeof(struct usb_descriptor_header)) { + header = (struct usb_descriptor_header *)buffer; + +- if (header->bLength < 2) { ++ if (header->bLength < 2 || header->bLength > size) { + printk(KERN_ERR + "%s: bogus descriptor, type %d length %d\n", + usbcore_name, +@@ -848,7 +848,7 @@ int __usb_get_extra_descriptor(char *buf + return -1; + } + +- if (header->bDescriptorType == type) { ++ if (header->bDescriptorType == type && header->bLength >= minsize) { + *ptr = header; + return 0; + } +--- a/drivers/usb/host/hwa-hc.c ++++ b/drivers/usb/host/hwa-hc.c +@@ -640,7 +640,7 @@ static int hwahc_security_create(struct + top = itr + itr_size; + result = __usb_get_extra_descriptor(usb_dev->rawdescriptors[index], + le16_to_cpu(usb_dev->actconfig->desc.wTotalLength), +- USB_DT_SECURITY, (void **) &secd); ++ USB_DT_SECURITY, (void **) &secd, sizeof(*secd)); + if (result == -1) { + dev_warn(dev, "BUG? WUSB host has no security descriptors\n"); + return 0; +--- a/include/linux/usb.h ++++ b/include/linux/usb.h +@@ -407,11 +407,11 @@ struct usb_host_bos { + }; + + int __usb_get_extra_descriptor(char *buffer, unsigned size, +- unsigned char type, void **ptr); ++ unsigned char type, void **ptr, size_t min); + #define usb_get_extra_descriptor(ifpoint, type, ptr) \ + __usb_get_extra_descriptor((ifpoint)->extra, \ + (ifpoint)->extralen, \ +- type, (void **)ptr) ++ type, (void **)ptr, sizeof(**(ptr))) + + /* ----------------------------------------------------------------------- */ + diff --git a/queue-4.19/usb-quirk-add-no-lpm-quirk-on-sandisk-ultra-flair-device.patch b/queue-4.19/usb-quirk-add-no-lpm-quirk-on-sandisk-ultra-flair-device.patch new file mode 100644 index 00000000000..8acbbd5a50a --- /dev/null +++ b/queue-4.19/usb-quirk-add-no-lpm-quirk-on-sandisk-ultra-flair-device.patch @@ -0,0 +1,66 @@ +From 2f2dde6ba89b1ef1fe23c1138131b315d9aa4019 Mon Sep 17 00:00:00 2001 +From: Harry Pan +Date: Thu, 29 Nov 2018 00:40:41 +0800 +Subject: usb: quirk: add no-LPM quirk on SanDisk Ultra Flair device + +From: Harry Pan + +commit 2f2dde6ba89b1ef1fe23c1138131b315d9aa4019 upstream. + +Some lower volume SanDisk Ultra Flair in 16GB, which the VID:PID is +in 0781:5591, will aggressively request LPM of U1/U2 during runtime, +when using this thumb drive as the OS installation key we found the +device will generate failure during U1 exit path making it dropped +from the USB bus, this causes a corrupted installation in system at +the end. + +i.e., +[ 166.918296] hub 2-0:1.0: state 7 ports 7 chg 0000 evt 0004 +[ 166.918327] usb usb2-port2: link state change +[ 166.918337] usb usb2-port2: do warm reset +[ 166.970039] usb usb2-port2: not warm reset yet, waiting 50ms +[ 167.022040] usb usb2-port2: not warm reset yet, waiting 200ms +[ 167.276043] usb usb2-port2: status 02c0, change 0041, 5.0 Gb/s +[ 167.276050] usb 2-2: USB disconnect, device number 2 +[ 167.276058] usb 2-2: unregistering device +[ 167.276060] usb 2-2: unregistering interface 2-2:1.0 +[ 167.276170] xhci_hcd 0000:00:15.0: shutdown urb ffffa3c7cc695cc0 ep1in-bulk +[ 167.284055] sd 0:0:0:0: [sda] tag#0 FAILED Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK +[ 167.284064] sd 0:0:0:0: [sda] tag#0 CDB: Read(10) 28 00 00 33 04 90 00 01 00 00 +... + +Analyzed the USB trace in the link layer we realized it is because +of the 6-ms timer of tRecoveryConfigurationTimeout which documented +on the USB 3.2 Revision 1.0, the section 7.5.10.4.2 of "Exit from +Recovery.Configuration"; device initiates U1 exit -> Recovery.Active +-> Recovery.Configuration, then the host timer timeout makes the link +transits to eSS.Inactive -> Rx.Detect follows by a Warm Reset. + +Interestingly, the other higher volume of SanDisk Ultra Flair sharing +the same VID:PID, such as 64GB, would not request LPM during runtime, +it sticks at U0 always, thus disabling LPM does not affect those thumb +drives at all. + +The same odd occures in SanDisk Ultra Fit 16GB, VID:PID in 0781:5583. + +Signed-off-by: Harry Pan +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -333,6 +333,10 @@ static const struct usb_device_id usb_qu + /* Midiman M-Audio Keystation 88es */ + { USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* SanDisk Ultra Fit and Ultra Flair */ ++ { USB_DEVICE(0x0781, 0x5583), .driver_info = USB_QUIRK_NO_LPM }, ++ { USB_DEVICE(0x0781, 0x5591), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* M-Systems Flash Disk Pioneers */ + { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME }, + diff --git a/queue-4.19/usb-serial-console-fix-reported-terminal-settings.patch b/queue-4.19/usb-serial-console-fix-reported-terminal-settings.patch new file mode 100644 index 00000000000..3e6f99f94e0 --- /dev/null +++ b/queue-4.19/usb-serial-console-fix-reported-terminal-settings.patch @@ -0,0 +1,110 @@ +From f51ccf46217c28758b1f3b5bc0ccfc00eca658b2 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 4 Dec 2018 17:00:36 +0100 +Subject: USB: serial: console: fix reported terminal settings + +From: Johan Hovold + +commit f51ccf46217c28758b1f3b5bc0ccfc00eca658b2 upstream. + +The USB-serial console implementation has never reported the actual +terminal settings used. Despite storing the corresponding cflags in its +struct console, these were never honoured on later tty open() where the +tty termios would be left initialised to the driver defaults. + +Unlike the serial console implementation, the USB-serial code calls +subdriver open() already at console setup. While calling set_termios() +and write() before open() looks like it could work for some USB-serial +drivers, others definitely do not expect this, so modelling this after +serial core is going to be intrusive, if at all possible. + +Instead, use a (renamed) tty helper to save the termios data used at +console setup so that the tty termios reflects the actual terminal +settings after a subsequent tty open(). + +Note that the calls to tty_init_termios() (tty_driver_install()) and +tty_save_termios() are serialised using the disconnect mutex. + +This specifically fixes a regression that was triggered by a recent +change adding software flow control to the pl2303 driver: a getty trying +to disable flow control while leaving the baud rate unchanged would now +also set the baud rate to the driver default (prior to the flow-control +change this had been a noop). + +Fixes: 7041d9c3f01b ("USB: serial: pl2303: add support for tx xon/xoff flow control") +Cc: stable # 4.18 +Cc: Florian Zumbiehl +Reported-by: Jarkko Nikula +Tested-by: Jarkko Nikula +Acked-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/tty_io.c | 11 +++++++++-- + drivers/usb/serial/console.c | 2 +- + include/linux/tty.h | 1 + + 3 files changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -1372,7 +1372,13 @@ err_release_lock: + return ERR_PTR(retval); + } + +-static void tty_free_termios(struct tty_struct *tty) ++/** ++ * tty_save_termios() - save tty termios data in driver table ++ * @tty: tty whose termios data to save ++ * ++ * Locking: Caller guarantees serialisation with tty_init_termios(). ++ */ ++void tty_save_termios(struct tty_struct *tty) + { + struct ktermios *tp; + int idx = tty->index; +@@ -1391,6 +1397,7 @@ static void tty_free_termios(struct tty_ + } + *tp = tty->termios; + } ++EXPORT_SYMBOL_GPL(tty_save_termios); + + /** + * tty_flush_works - flush all works of a tty/pty pair +@@ -1490,7 +1497,7 @@ static void release_tty(struct tty_struc + WARN_ON(!mutex_is_locked(&tty_mutex)); + if (tty->ops->shutdown) + tty->ops->shutdown(tty); +- tty_free_termios(tty); ++ tty_save_termios(tty); + tty_driver_remove_tty(tty->driver, tty); + tty->port->itty = NULL; + if (tty->link) +--- a/drivers/usb/serial/console.c ++++ b/drivers/usb/serial/console.c +@@ -101,7 +101,6 @@ static int usb_console_setup(struct cons + cflag |= PARENB; + break; + } +- co->cflag = cflag; + + /* + * no need to check the index here: if the index is wrong, console +@@ -164,6 +163,7 @@ static int usb_console_setup(struct cons + serial->type->set_termios(tty, port, &dummy); + + tty_port_tty_set(&port->port, NULL); ++ tty_save_termios(tty); + tty_kref_put(tty); + } + tty_port_set_initialized(&port->port, 1); +--- a/include/linux/tty.h ++++ b/include/linux/tty.h +@@ -556,6 +556,7 @@ extern struct tty_struct *tty_init_dev(s + extern void tty_release_struct(struct tty_struct *tty, int idx); + extern int tty_release(struct inode *inode, struct file *filp); + extern void tty_init_termios(struct tty_struct *tty); ++extern void tty_save_termios(struct tty_struct *tty); + extern int tty_standard_install(struct tty_driver *driver, + struct tty_struct *tty); +