From: Greg Kroah-Hartman Date: Mon, 10 Dec 2018 10:16:15 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.19.9~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1d2915f451710359ec151da0d55b8b662aa47a0e;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: alsa-hda-add-support-for-amd-stoney-ridge.patch alsa-hda-realtek-add-support-for-acer-aspire-c24-860-headset-mic.patch alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4660g.patch alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4860g-z6860g.patch alsa-hda-realtek-fix-speaker-output-regression-on-thinkpad-t570.patch alsa-pcm-call-snd_pcm_unlink-conditionally-at-closing.patch alsa-pcm-fix-interval-evaluation-with-openmin-max.patch alsa-pcm-fix-starvation-on-down_write_nonblock.patch alsa-usb-audio-fix-uaf-decrement-if-card-has-no-live-interfaces-in-card.c.patch arc-remove-config_initramfs_source-from-defconfigs.patch usb-appledisplay-add-27-apple-cinema-display.patch usb-check-usb_get_extra_descriptor-for-proper-size.patch usb-quirk-add-no-lpm-quirk-on-sandisk-ultra-flair-device.patch --- diff --git a/queue-4.9/alsa-hda-add-support-for-amd-stoney-ridge.patch b/queue-4.9/alsa-hda-add-support-for-amd-stoney-ridge.patch new file mode 100644 index 00000000000..77b3eba80ca --- /dev/null +++ b/queue-4.9/alsa-hda-add-support-for-amd-stoney-ridge.patch @@ -0,0 +1,34 @@ +From 3deef52ce10514ccdebba8e8ab85f9cebd0eb3f7 Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Thu, 29 Nov 2018 08:57:37 +0000 +Subject: ALSA: hda: Add support for AMD Stoney Ridge + +From: Kai-Heng Feng + +commit 3deef52ce10514ccdebba8e8ab85f9cebd0eb3f7 upstream. + +It's similar to other AMD audio devices, it also supports D3, which can +save some power drain. + +Signed-off-by: Kai-Heng Feng +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2352,6 +2352,10 @@ static const struct pci_device_id azx_id + /* AMD Hudson */ + { PCI_DEVICE(0x1022, 0x780d), + .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB }, ++ /* AMD Stoney */ ++ { PCI_DEVICE(0x1022, 0x157a), ++ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB | ++ AZX_DCAPS_PM_RUNTIME }, + /* AMD Raven */ + { PCI_DEVICE(0x1022, 0x15e3), + .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB | diff --git a/queue-4.9/alsa-hda-realtek-add-support-for-acer-aspire-c24-860-headset-mic.patch b/queue-4.9/alsa-hda-realtek-add-support-for-acer-aspire-c24-860-headset-mic.patch new file mode 100644 index 00000000000..53c11841ce8 --- /dev/null +++ b/queue-4.9/alsa-hda-realtek-add-support-for-acer-aspire-c24-860-headset-mic.patch @@ -0,0 +1,34 @@ +From 705b65f107470499442240ff7afee5021a7002a6 Mon Sep 17 00:00:00 2001 +From: Chris Chiu +Date: Wed, 5 Dec 2018 14:48:54 +0800 +Subject: ALSA: hda/realtek - Add support for Acer Aspire C24-860 headset mic + +From: Chris Chiu + +commit 705b65f107470499442240ff7afee5021a7002a6 upstream. + +The Acer AIO Aspire C24-860 with ALC286 can't detect the headset +microphone. Just like another Acer AIO U27-880, it needs a different +pin value for 0x18 and the headset fixup to make headset mic work. + +Signed-off-by: Jian-Hong Pan +Signed-off-by: Daniel Drake +Signed-off-by: Chris Chiu +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5674,6 +5674,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1025, 0x0762, "Acer Aspire E1-472", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572), + SND_PCI_QUIRK(0x1025, 0x0775, "Acer Aspire E1-572", ALC271_FIXUP_HP_GATE_MIC_JACK_E1_572), + SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS), ++ SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK), + SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z), + SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS), diff --git a/queue-4.9/alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4660g.patch b/queue-4.9/alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4660g.patch new file mode 100644 index 00000000000..0d9346b26ce --- /dev/null +++ b/queue-4.9/alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4660g.patch @@ -0,0 +1,35 @@ +From 9f8aefed9623a91dec54eab8908f3810b7f8d73a Mon Sep 17 00:00:00 2001 +From: Chris Chiu +Date: Wed, 5 Dec 2018 14:48:55 +0800 +Subject: ALSA: hda/realtek: Fix mic issue on Acer AIO Veriton Z4660G + +From: Chris Chiu + +commit 9f8aefed9623a91dec54eab8908f3810b7f8d73a upstream. + +Acer AIO Veriton Z4660G with ALC286 codec has issue with the input +from external microphones connecting via 'Front Mic' jack. The fixup +ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE enables the jack sensing of +the headset and fix the audio input issue of external microphone. + +Signed-off-by: Jian-Hong Pan +Signed-off-by: Daniel Drake +Signed-off-by: Chris Chiu +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5676,6 +5676,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS), + SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK), ++ SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z), + SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS), + SND_PCI_QUIRK(0x1028, 0x05bd, "Dell Latitude E6440", ALC292_FIXUP_DELL_E7X), diff --git a/queue-4.9/alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4860g-z6860g.patch b/queue-4.9/alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4860g-z6860g.patch new file mode 100644 index 00000000000..13da145df0c --- /dev/null +++ b/queue-4.9/alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4860g-z6860g.patch @@ -0,0 +1,35 @@ +From b72f936f6b325f4fde06b02e4b6ab682f6f2e73f Mon Sep 17 00:00:00 2001 +From: Chris Chiu +Date: Wed, 5 Dec 2018 14:48:56 +0800 +Subject: ALSA: hda/realtek: Fix mic issue on Acer AIO Veriton Z4860G/Z6860G + +From: Chris Chiu + +commit b72f936f6b325f4fde06b02e4b6ab682f6f2e73f upstream. + +Acer AIO Veriton Z4860G/Z6860G with the same ALC286 codec has issues +with the input from external microphone. The issue can be fixed by +the fixup ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE for Veriton Z4660G. + +Signed-off-by: Jian-Hong Pan +Signed-off-by: Daniel Drake +Signed-off-by: Chris Chiu +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5676,6 +5676,8 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1025, 0x079b, "Acer Aspire V5-573G", ALC282_FIXUP_ASPIRE_V5_PINS), + SND_PCI_QUIRK(0x1025, 0x102b, "Acer Aspire C24-860", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x106d, "Acer Cloudbook 14", ALC283_FIXUP_CHROME_BOOK), ++ SND_PCI_QUIRK(0x1025, 0x128f, "Acer Veriton Z6860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x1025, 0x1290, "Acer Veriton Z4860G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1025, 0x1291, "Acer Veriton Z4660G", ALC286_FIXUP_ACER_AIO_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z), + SND_PCI_QUIRK(0x1028, 0x054b, "Dell XPS one 2710", ALC275_FIXUP_DELL_XPS), diff --git a/queue-4.9/alsa-hda-realtek-fix-speaker-output-regression-on-thinkpad-t570.patch b/queue-4.9/alsa-hda-realtek-fix-speaker-output-regression-on-thinkpad-t570.patch new file mode 100644 index 00000000000..be08af443aa --- /dev/null +++ b/queue-4.9/alsa-hda-realtek-fix-speaker-output-regression-on-thinkpad-t570.patch @@ -0,0 +1,58 @@ +From 54947cd64c1b8290f64bb2958e343c07270e3a58 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 3 Dec 2018 10:44:15 +0100 +Subject: ALSA: hda/realtek - Fix speaker output regression on Thinkpad T570 + +From: Takashi Iwai + +commit 54947cd64c1b8290f64bb2958e343c07270e3a58 upstream. + +We've got a regression report for some Thinkpad models (at least +T570s) which shows the too low speaker output volume. The bisection +leaded to the commit 61fcf8ece9b6 ("ALSA: hda/realtek - Enable Thinkpad +Dock device for ALC298 platform"), and it's basically adding the two +pin configurations for the dock, and looks harmless. + +The real culprit seems, though, that the DAC assignment for the +speaker pin is implicitly assumed on these devices, i.e. pin NID 0x14 +to be coupled with DAC NID 0x03. When more pins are configured by the +commit above, the auto-parser changes the DAC assignment, and this +resulted in the regression. + +As a workaround, just provide the fixed pin / DAC mapping table for +this Thinkpad fixup function. It's no generic solution, but the +problem itself is pretty much device-specific, so must be good +enough. + +Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1554304 +Fixes: 61fcf8ece9b6 ("ALSA: hda/realtek - Enable Thinkpad Dock device for ALC298 platform") +Cc: +Reported-and-tested-by: Jeremy Cline +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4489,9 +4489,18 @@ static void alc_fixup_tpt470_dock(struct + { 0x19, 0x21a11010 }, /* dock mic */ + { } + }; ++ /* Assure the speaker pin to be coupled with DAC NID 0x03; otherwise ++ * the speaker output becomes too low by some reason on Thinkpads with ++ * ALC298 codec ++ */ ++ static hda_nid_t preferred_pairs[] = { ++ 0x14, 0x03, 0x17, 0x02, 0x21, 0x02, ++ 0 ++ }; + struct alc_spec *spec = codec->spec; + + if (action == HDA_FIXUP_ACT_PRE_PROBE) { ++ spec->gen.preferred_dacs = preferred_pairs; + spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP; + snd_hda_apply_pincfgs(codec, pincfgs); + } else if (action == HDA_FIXUP_ACT_INIT) { diff --git a/queue-4.9/alsa-pcm-call-snd_pcm_unlink-conditionally-at-closing.patch b/queue-4.9/alsa-pcm-call-snd_pcm_unlink-conditionally-at-closing.patch new file mode 100644 index 00000000000..68b5c2ca943 --- /dev/null +++ b/queue-4.9/alsa-pcm-call-snd_pcm_unlink-conditionally-at-closing.patch @@ -0,0 +1,43 @@ +From b51abed8355e5556886623b2772fa6b7598d2282 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 29 Nov 2018 08:02:49 +0100 +Subject: ALSA: pcm: Call snd_pcm_unlink() conditionally at closing + +From: Takashi Iwai + +commit b51abed8355e5556886623b2772fa6b7598d2282 upstream. + +Currently the PCM core calls snd_pcm_unlink() always unconditionally +at closing a stream. However, since snd_pcm_unlink() invokes the +global rwsem down, the lock can be easily contended. More badly, when +a thread runs in a high priority RT-FIFO, it may stall at spinning. + +Basically the call of snd_pcm_unlink() is required only for the linked +streams that are already rare occasion. For normal use cases, this +code path is fairly superfluous. + +As an optimization (and also as a workaround for the RT problem +above in normal situations without linked streams), this patch adds a +check before calling snd_pcm_unlink() and calls it only when needed. + +Reported-by: Chanho Min +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/pcm_native.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -2225,7 +2225,8 @@ int snd_pcm_hw_constraints_complete(stru + + static void pcm_release_private(struct snd_pcm_substream *substream) + { +- snd_pcm_unlink(substream); ++ if (snd_pcm_stream_linked(substream)) ++ snd_pcm_unlink(substream); + } + + void snd_pcm_release_substream(struct snd_pcm_substream *substream) diff --git a/queue-4.9/alsa-pcm-fix-interval-evaluation-with-openmin-max.patch b/queue-4.9/alsa-pcm-fix-interval-evaluation-with-openmin-max.patch new file mode 100644 index 00000000000..83aeef42440 --- /dev/null +++ b/queue-4.9/alsa-pcm-fix-interval-evaluation-with-openmin-max.patch @@ -0,0 +1,40 @@ +From 5363857b916c1f48027e9b96ee8be8376bf20811 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 29 Nov 2018 12:05:19 +0100 +Subject: ALSA: pcm: Fix interval evaluation with openmin/max + +From: Takashi Iwai + +commit 5363857b916c1f48027e9b96ee8be8376bf20811 upstream. + +As addressed in alsa-lib (commit b420056604f0), we need to fix the +case where the evaluation of PCM interval "(x x+1]" leading to +-EINVAL. After applying rules, such an interval may be translated as +"(x x+1)". + +Fixes: ff2d6acdf6f1 ("ALSA: pcm: Fix snd_interval_refine first/last with open min/max") +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + include/sound/pcm_params.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/include/sound/pcm_params.h ++++ b/include/sound/pcm_params.h +@@ -247,11 +247,13 @@ static inline int snd_interval_empty(con + static inline int snd_interval_single(const struct snd_interval *i) + { + return (i->min == i->max || +- (i->min + 1 == i->max && i->openmax)); ++ (i->min + 1 == i->max && (i->openmin || i->openmax))); + } + + static inline int snd_interval_value(const struct snd_interval *i) + { ++ if (i->openmin && !i->openmax) ++ return i->max; + return i->min; + } + diff --git a/queue-4.9/alsa-pcm-fix-starvation-on-down_write_nonblock.patch b/queue-4.9/alsa-pcm-fix-starvation-on-down_write_nonblock.patch new file mode 100644 index 00000000000..4aa99fc7e76 --- /dev/null +++ b/queue-4.9/alsa-pcm-fix-starvation-on-down_write_nonblock.patch @@ -0,0 +1,91 @@ +From b888a5f713e4d17faaaff24316585a4eb07f35b7 Mon Sep 17 00:00:00 2001 +From: Chanho Min +Date: Mon, 26 Nov 2018 14:36:37 +0900 +Subject: ALSA: pcm: Fix starvation on down_write_nonblock() + +From: Chanho Min + +commit b888a5f713e4d17faaaff24316585a4eb07f35b7 upstream. + +Commit 67ec1072b053 ("ALSA: pcm: Fix rwsem deadlock for non-atomic PCM +stream") fixes deadlock for non-atomic PCM stream. But, This patch +causes antother stuck. +If writer is RT thread and reader is a normal thread, the reader +thread will be difficult to get scheduled. It may not give chance to +release readlocks and writer gets stuck for a long time if they are +pinned to single cpu. + +The deadlock described in the previous commit is because the linux +rwsem queues like a FIFO. So, we might need non-FIFO writelock, not +non-block one. + +My suggestion is that the writer gives reader a chance to be scheduled +by using the minimum msleep() instaed of spinning without blocking by +writer. Also, The *_nonblock may be changed to *_nonfifo appropriately +to this concept. +In terms of performance, when trylock is failed, this minimum periodic +msleep will have the same performance as the tick-based +schedule()/wake_up_q(). + +[ Although this has a fairly high performance penalty, the relevant + code path became already rare due to the previous commit ("ALSA: + pcm: Call snd_pcm_unlink() conditionally at closing"). That is, now + this unconditional msleep appears only when using linked streams, + and this must be a rare case. So we accept this as a quick + workaround until finding a more suitable one -- tiwai ] + +Fixes: 67ec1072b053 ("ALSA: pcm: Fix rwsem deadlock for non-atomic PCM stream") +Suggested-by: Wonmin Jung +Signed-off-by: Chanho Min +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/pcm_native.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + + /* + * Compatibility +@@ -78,12 +79,12 @@ static DECLARE_RWSEM(snd_pcm_link_rwsem) + * and this may lead to a deadlock when the code path takes read sem + * twice (e.g. one in snd_pcm_action_nonatomic() and another in + * snd_pcm_stream_lock()). As a (suboptimal) workaround, let writer to +- * spin until it gets the lock. ++ * sleep until all the readers are completed without blocking by writer. + */ +-static inline void down_write_nonblock(struct rw_semaphore *lock) ++static inline void down_write_nonfifo(struct rw_semaphore *lock) + { + while (!down_write_trylock(lock)) +- cond_resched(); ++ msleep(1); + } + + /** +@@ -1825,7 +1826,7 @@ static int snd_pcm_link(struct snd_pcm_s + res = -ENOMEM; + goto _nolock; + } +- down_write_nonblock(&snd_pcm_link_rwsem); ++ down_write_nonfifo(&snd_pcm_link_rwsem); + write_lock_irq(&snd_pcm_link_rwlock); + if (substream->runtime->status->state == SNDRV_PCM_STATE_OPEN || + substream->runtime->status->state != substream1->runtime->status->state || +@@ -1872,7 +1873,7 @@ static int snd_pcm_unlink(struct snd_pcm + struct snd_pcm_substream *s; + int res = 0; + +- down_write_nonblock(&snd_pcm_link_rwsem); ++ down_write_nonfifo(&snd_pcm_link_rwsem); + write_lock_irq(&snd_pcm_link_rwlock); + if (!snd_pcm_stream_linked(substream)) { + res = -EALREADY; diff --git a/queue-4.9/alsa-usb-audio-fix-uaf-decrement-if-card-has-no-live-interfaces-in-card.c.patch b/queue-4.9/alsa-usb-audio-fix-uaf-decrement-if-card-has-no-live-interfaces-in-card.c.patch new file mode 100644 index 00000000000..8640757c6f8 --- /dev/null +++ b/queue-4.9/alsa-usb-audio-fix-uaf-decrement-if-card-has-no-live-interfaces-in-card.c.patch @@ -0,0 +1,49 @@ +From 5f8cf712582617d523120df67d392059eaf2fc4b Mon Sep 17 00:00:00 2001 +From: Hui Peng +Date: Mon, 3 Dec 2018 16:09:34 +0100 +Subject: ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c + +From: Hui Peng + +commit 5f8cf712582617d523120df67d392059eaf2fc4b upstream. + +If a USB sound card reports 0 interfaces, an error condition is triggered +and the function usb_audio_probe errors out. In the error path, there was a +use-after-free vulnerability where the memory object of the card was first +freed, followed by a decrement of the number of active chips. Moving the +decrement above the atomic_dec fixes the UAF. + +[ The original problem was introduced in 3.1 kernel, while it was + developed in a different form. The Fixes tag below indicates the + original commit but it doesn't mean that the patch is applicable + cleanly. -- tiwai ] + +Fixes: 362e4e49abe5 ("ALSA: usb-audio - clear chip->probing on error exit") +Reported-by: Hui Peng +Reported-by: Mathias Payer +Signed-off-by: Hui Peng +Signed-off-by: Mathias Payer +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/usb/card.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -644,9 +644,12 @@ static int usb_audio_probe(struct usb_in + + __error: + if (chip) { ++ /* chip->active is inside the chip->card object, ++ * decrement before memory is possibly returned. ++ */ ++ atomic_dec(&chip->active); + if (!chip->num_interfaces) + snd_card_free(chip->card); +- atomic_dec(&chip->active); + } + mutex_unlock(®ister_mutex); + return err; diff --git a/queue-4.9/arc-remove-config_initramfs_source-from-defconfigs.patch b/queue-4.9/arc-remove-config_initramfs_source-from-defconfigs.patch new file mode 100644 index 00000000000..1161a1d413b --- /dev/null +++ b/queue-4.9/arc-remove-config_initramfs_source-from-defconfigs.patch @@ -0,0 +1,50 @@ +From alexey.brodkin@synopsys.com Mon Dec 10 10:51:40 2018 +From: Alexey Brodkin +Date: Mon, 10 Dec 2018 11:33:49 +0300 +Subject: ARC: [zebu] Remove CONFIG_INITRAMFS_SOURCE from defconfigs +To: stable@vger.kernel.org +Cc: linux-snps-arc@lists.infradead.org, linux-kernel@vger.kernel.org, Alexey Brodkin , Greg Kroah-Hartman , Kevin Hilman +Message-ID: <20181210083349.35728-1-abrodkin@synopsys.com> + +From: Alexey Brodkin + +Zebu boards were added in v4.9 and then renamed to "haps" in v4.10. + +Thus backporting +commit 64234961c145 (ARC: configs: Remove CONFIG_INITRAMFS_SOURCE from defconfigs) +we missed "zebu" defconfigs in v4.9. + +Note this is only applicable to "linux-4.9.y"! + +Spotted by KerneCI, see [1]. + +[1] https://storage.kernelci.org/stable/linux-4.9.y/v4.9.144/arc/zebu_hs_smp_defconfig/build.log + +Signed-off-by: Alexey Brodkin +Cc: Kevin Hilman +Signed-off-by: Greg Kroah-Hartman +--- + arch/arc/configs/zebu_hs_defconfig | 1 - + arch/arc/configs/zebu_hs_smp_defconfig | 1 - + 2 files changed, 2 deletions(-) + +--- a/arch/arc/configs/zebu_hs_defconfig ++++ b/arch/arc/configs/zebu_hs_defconfig +@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y + # CONFIG_UTS_NS is not set + # CONFIG_PID_NS is not set + CONFIG_BLK_DEV_INITRD=y +-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/" + CONFIG_EXPERT=y + CONFIG_PERF_EVENTS=y + # CONFIG_COMPAT_BRK is not set +--- a/arch/arc/configs/zebu_hs_smp_defconfig ++++ b/arch/arc/configs/zebu_hs_smp_defconfig +@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y + # CONFIG_UTS_NS is not set + # CONFIG_PID_NS is not set + CONFIG_BLK_DEV_INITRD=y +-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/" + CONFIG_EMBEDDED=y + CONFIG_PERF_EVENTS=y + # CONFIG_VM_EVENT_COUNTERS is not set diff --git a/queue-4.9/series b/queue-4.9/series index 17ee9064aa1..d9301c46f93 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -17,3 +17,16 @@ iommu-vt-d-use-memunmap-to-free-memremap.patch team-no-need-to-do-team_notify_peers-or-team_mcast_r.patch net-amd-add-missing-of_node_put.patch mm-don-t-warn-about-allocations-which-stall-for-too-.patch +arc-remove-config_initramfs_source-from-defconfigs.patch +usb-quirk-add-no-lpm-quirk-on-sandisk-ultra-flair-device.patch +usb-appledisplay-add-27-apple-cinema-display.patch +usb-check-usb_get_extra_descriptor-for-proper-size.patch +alsa-usb-audio-fix-uaf-decrement-if-card-has-no-live-interfaces-in-card.c.patch +alsa-hda-add-support-for-amd-stoney-ridge.patch +alsa-pcm-fix-starvation-on-down_write_nonblock.patch +alsa-pcm-call-snd_pcm_unlink-conditionally-at-closing.patch +alsa-pcm-fix-interval-evaluation-with-openmin-max.patch +alsa-hda-realtek-fix-speaker-output-regression-on-thinkpad-t570.patch +alsa-hda-realtek-add-support-for-acer-aspire-c24-860-headset-mic.patch +alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4660g.patch +alsa-hda-realtek-fix-mic-issue-on-acer-aio-veriton-z4860g-z6860g.patch diff --git a/queue-4.9/usb-appledisplay-add-27-apple-cinema-display.patch b/queue-4.9/usb-appledisplay-add-27-apple-cinema-display.patch new file mode 100644 index 00000000000..b1a87bfd524 --- /dev/null +++ b/queue-4.9/usb-appledisplay-add-27-apple-cinema-display.patch @@ -0,0 +1,29 @@ +From d7859905301880ad3e16272399d26900af3ac496 Mon Sep 17 00:00:00 2001 +From: Alexander Theissen +Date: Tue, 4 Dec 2018 23:43:35 +0100 +Subject: usb: appledisplay: Add 27" Apple Cinema Display + +From: Alexander Theissen + +commit d7859905301880ad3e16272399d26900af3ac496 upstream. + +Add another Apple Cinema Display to the list of supported displays. + +Signed-off-by: Alexander Theissen +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/appledisplay.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/misc/appledisplay.c ++++ b/drivers/usb/misc/appledisplay.c +@@ -64,6 +64,7 @@ static const struct usb_device_id appled + { APPLEDISPLAY_DEVICE(0x921c) }, + { APPLEDISPLAY_DEVICE(0x921d) }, + { APPLEDISPLAY_DEVICE(0x9222) }, ++ { APPLEDISPLAY_DEVICE(0x9226) }, + { APPLEDISPLAY_DEVICE(0x9236) }, + + /* Terminating entry */ diff --git a/queue-4.9/usb-check-usb_get_extra_descriptor-for-proper-size.patch b/queue-4.9/usb-check-usb_get_extra_descriptor-for-proper-size.patch new file mode 100644 index 00000000000..3838ab63671 --- /dev/null +++ b/queue-4.9/usb-check-usb_get_extra_descriptor-for-proper-size.patch @@ -0,0 +1,95 @@ +From 704620afc70cf47abb9d6a1a57f3825d2bca49cf Mon Sep 17 00:00:00 2001 +From: Mathias Payer +Date: Wed, 5 Dec 2018 21:19:59 +0100 +Subject: USB: check usb_get_extra_descriptor for proper size + +From: Mathias Payer + +commit 704620afc70cf47abb9d6a1a57f3825d2bca49cf upstream. + +When reading an extra descriptor, we need to properly check the minimum +and maximum size allowed, to prevent from invalid data being sent by a +device. + +Reported-by: Hui Peng +Reported-by: Mathias Payer +Co-developed-by: Linus Torvalds +Signed-off-by: Hui Peng +Signed-off-by: Mathias Payer +Signed-off-by: Linus Torvalds +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/hub.c | 2 +- + drivers/usb/core/usb.c | 6 +++--- + drivers/usb/host/hwa-hc.c | 2 +- + include/linux/usb.h | 4 ++-- + 4 files changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2225,7 +2225,7 @@ static int usb_enumerate_device_otg(stru + /* descriptor may appear anywhere in config */ + err = __usb_get_extra_descriptor(udev->rawdescriptors[0], + le16_to_cpu(udev->config[0].desc.wTotalLength), +- USB_DT_OTG, (void **) &desc); ++ USB_DT_OTG, (void **) &desc, sizeof(*desc)); + if (err || !(desc->bmAttributes & USB_OTG_HNP)) + return 0; + +--- a/drivers/usb/core/usb.c ++++ b/drivers/usb/core/usb.c +@@ -696,14 +696,14 @@ EXPORT_SYMBOL_GPL(usb_get_current_frame_ + */ + + int __usb_get_extra_descriptor(char *buffer, unsigned size, +- unsigned char type, void **ptr) ++ unsigned char type, void **ptr, size_t minsize) + { + struct usb_descriptor_header *header; + + while (size >= sizeof(struct usb_descriptor_header)) { + header = (struct usb_descriptor_header *)buffer; + +- if (header->bLength < 2) { ++ if (header->bLength < 2 || header->bLength > size) { + printk(KERN_ERR + "%s: bogus descriptor, type %d length %d\n", + usbcore_name, +@@ -712,7 +712,7 @@ int __usb_get_extra_descriptor(char *buf + return -1; + } + +- if (header->bDescriptorType == type) { ++ if (header->bDescriptorType == type && header->bLength >= minsize) { + *ptr = header; + return 0; + } +--- a/drivers/usb/host/hwa-hc.c ++++ b/drivers/usb/host/hwa-hc.c +@@ -654,7 +654,7 @@ static int hwahc_security_create(struct + top = itr + itr_size; + result = __usb_get_extra_descriptor(usb_dev->rawdescriptors[index], + le16_to_cpu(usb_dev->actconfig->desc.wTotalLength), +- USB_DT_SECURITY, (void **) &secd); ++ USB_DT_SECURITY, (void **) &secd, sizeof(*secd)); + if (result == -1) { + dev_warn(dev, "BUG? WUSB host has no security descriptors\n"); + return 0; +--- a/include/linux/usb.h ++++ b/include/linux/usb.h +@@ -336,11 +336,11 @@ struct usb_host_bos { + }; + + int __usb_get_extra_descriptor(char *buffer, unsigned size, +- unsigned char type, void **ptr); ++ unsigned char type, void **ptr, size_t min); + #define usb_get_extra_descriptor(ifpoint, type, ptr) \ + __usb_get_extra_descriptor((ifpoint)->extra, \ + (ifpoint)->extralen, \ +- type, (void **)ptr) ++ type, (void **)ptr, sizeof(**(ptr))) + + /* ----------------------------------------------------------------------- */ + diff --git a/queue-4.9/usb-quirk-add-no-lpm-quirk-on-sandisk-ultra-flair-device.patch b/queue-4.9/usb-quirk-add-no-lpm-quirk-on-sandisk-ultra-flair-device.patch new file mode 100644 index 00000000000..1c90a280a80 --- /dev/null +++ b/queue-4.9/usb-quirk-add-no-lpm-quirk-on-sandisk-ultra-flair-device.patch @@ -0,0 +1,66 @@ +From 2f2dde6ba89b1ef1fe23c1138131b315d9aa4019 Mon Sep 17 00:00:00 2001 +From: Harry Pan +Date: Thu, 29 Nov 2018 00:40:41 +0800 +Subject: usb: quirk: add no-LPM quirk on SanDisk Ultra Flair device + +From: Harry Pan + +commit 2f2dde6ba89b1ef1fe23c1138131b315d9aa4019 upstream. + +Some lower volume SanDisk Ultra Flair in 16GB, which the VID:PID is +in 0781:5591, will aggressively request LPM of U1/U2 during runtime, +when using this thumb drive as the OS installation key we found the +device will generate failure during U1 exit path making it dropped +from the USB bus, this causes a corrupted installation in system at +the end. + +i.e., +[ 166.918296] hub 2-0:1.0: state 7 ports 7 chg 0000 evt 0004 +[ 166.918327] usb usb2-port2: link state change +[ 166.918337] usb usb2-port2: do warm reset +[ 166.970039] usb usb2-port2: not warm reset yet, waiting 50ms +[ 167.022040] usb usb2-port2: not warm reset yet, waiting 200ms +[ 167.276043] usb usb2-port2: status 02c0, change 0041, 5.0 Gb/s +[ 167.276050] usb 2-2: USB disconnect, device number 2 +[ 167.276058] usb 2-2: unregistering device +[ 167.276060] usb 2-2: unregistering interface 2-2:1.0 +[ 167.276170] xhci_hcd 0000:00:15.0: shutdown urb ffffa3c7cc695cc0 ep1in-bulk +[ 167.284055] sd 0:0:0:0: [sda] tag#0 FAILED Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK +[ 167.284064] sd 0:0:0:0: [sda] tag#0 CDB: Read(10) 28 00 00 33 04 90 00 01 00 00 +... + +Analyzed the USB trace in the link layer we realized it is because +of the 6-ms timer of tRecoveryConfigurationTimeout which documented +on the USB 3.2 Revision 1.0, the section 7.5.10.4.2 of "Exit from +Recovery.Configuration"; device initiates U1 exit -> Recovery.Active +-> Recovery.Configuration, then the host timer timeout makes the link +transits to eSS.Inactive -> Rx.Detect follows by a Warm Reset. + +Interestingly, the other higher volume of SanDisk Ultra Flair sharing +the same VID:PID, such as 64GB, would not request LPM during runtime, +it sticks at U0 always, thus disabling LPM does not affect those thumb +drives at all. + +The same odd occures in SanDisk Ultra Fit 16GB, VID:PID in 0781:5583. + +Signed-off-by: Harry Pan +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -188,6 +188,10 @@ static const struct usb_device_id usb_qu + /* Midiman M-Audio Keystation 88es */ + { USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* SanDisk Ultra Fit and Ultra Flair */ ++ { USB_DEVICE(0x0781, 0x5583), .driver_info = USB_QUIRK_NO_LPM }, ++ { USB_DEVICE(0x0781, 0x5591), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* M-Systems Flash Disk Pioneers */ + { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME }, +