From: Sasha Levin Date: Wed, 30 Oct 2019 11:28:34 +0000 (-0400) Subject: fixes for 4.19 X-Git-Tag: v4.4.199~47 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a541d07b1172b9d7ef9bc8193c0909fd13976b41;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/alsa-hda-realtek-reduce-the-headphone-static-noise-o.patch b/queue-4.19/alsa-hda-realtek-reduce-the-headphone-static-noise-o.patch new file mode 100644 index 00000000000..de949108dc8 --- /dev/null +++ b/queue-4.19/alsa-hda-realtek-reduce-the-headphone-static-noise-o.patch @@ -0,0 +1,100 @@ +From ffad7bfc533ba03f107180fce8419f818324d729 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Oct 2019 12:39:19 +0800 +Subject: ALSA: hda/realtek: Reduce the Headphone static noise on XPS 9350/9360 + +From: Kai-Heng Feng + +[ Upstream commit 1099f48457d06b816359fb43ac32a4a07e33219b ] + +Headphone on XPS 9350/9360 produces a background white noise. The The +noise level somehow correlates with "Headphone Mic Boost", when it sets +to 1 the noise disappears. However, doing this has a side effect, which +also decreases the overall headphone volume so I didn't send the patch +upstream. + +The noise was bearable back then, but after commit 717f43d81afc ("ALSA: +hda/realtek - Update headset mode for ALC256") the noise exacerbates to +a point it starts hurting ears. + +So let's use the workaround to set "Headphone Mic Boost" to 1 and lock +it so it's not touchable by userspace. + +Fixes: 717f43d81afc ("ALSA: hda/realtek - Update headset mode for ALC256") +BugLink: https://bugs.launchpad.net/bugs/1654448 +BugLink: https://bugs.launchpad.net/bugs/1845810 +Signed-off-by: Kai-Heng Feng +Link: https://lore.kernel.org/r/20191003043919.10960-1-kai.heng.feng@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 24 +++++++++++++++++++++--- + 1 file changed, 21 insertions(+), 3 deletions(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 7480218f32ba7..45eebfea1d883 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5253,6 +5253,17 @@ static void alc271_hp_gate_mic_jack(struct hda_codec *codec, + } + } + ++static void alc256_fixup_dell_xps_13_headphone_noise2(struct hda_codec *codec, ++ const struct hda_fixup *fix, ++ int action) ++{ ++ if (action != HDA_FIXUP_ACT_PRE_PROBE) ++ return; ++ ++ snd_hda_codec_amp_stereo(codec, 0x1a, HDA_INPUT, 0, HDA_AMP_VOLMASK, 1); ++ snd_hda_override_wcaps(codec, 0x1a, get_wcaps(codec, 0x1a) & ~AC_WCAP_IN_AMP); ++} ++ + static void alc269_fixup_limit_int_mic_boost(struct hda_codec *codec, + const struct hda_fixup *fix, + int action) +@@ -5635,6 +5646,7 @@ enum { + ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE, + ALC275_FIXUP_DELL_XPS, + ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE, ++ ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2, + ALC293_FIXUP_LENOVO_SPK_NOISE, + ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, + ALC255_FIXUP_DELL_SPK_NOISE, +@@ -6352,6 +6364,12 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE + }, ++ [ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc256_fixup_dell_xps_13_headphone_noise2, ++ .chained = true, ++ .chain_id = ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE ++ }, + [ALC293_FIXUP_LENOVO_SPK_NOISE] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc_fixup_disable_aamix, +@@ -6794,17 +6812,17 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x06de, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK), + SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK), + SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK), +- SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), ++ SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2), + SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), + SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), + SND_PCI_QUIRK(0x1028, 0x0738, "Dell Precision 5820", ALC269_FIXUP_NO_SHUTUP), +- SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), ++ SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2), + SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME), + SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), + SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3), + SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), + SND_PCI_QUIRK(0x1028, 0x080c, "Dell WYSE", ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE), +- SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), ++ SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE2), + SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), + SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), + SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), +-- +2.20.1 + diff --git a/queue-4.19/arm-8914-1-nommu-fix-exc_ret-for-xip.patch b/queue-4.19/arm-8914-1-nommu-fix-exc_ret-for-xip.patch new file mode 100644 index 00000000000..3d3a2475e88 --- /dev/null +++ b/queue-4.19/arm-8914-1-nommu-fix-exc_ret-for-xip.patch @@ -0,0 +1,84 @@ +From 51bd786756761391dbb11422758abc4efcfa3ce1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Oct 2019 10:12:20 +0100 +Subject: ARM: 8914/1: NOMMU: Fix exc_ret for XIP + +From: Vladimir Murzin + +[ Upstream commit 4c0742f65b4ee466546fd24b71b56516cacd4613 ] + +It was reported that 72cd4064fcca "NOMMU: Toggle only bits in +EXC_RETURN we are really care of" breaks NOMMU+XIP combination. +It happens because saved EXC_RETURN gets overwritten when data +section is relocated. + +The fix is to propagate EXC_RETURN via register and let relocation +code to commit that value into memory. + +Fixes: 72cd4064fcca ("ARM: 8830/1: NOMMU: Toggle only bits in EXC_RETURN we are really care of") +Reported-by: afzal mohammed +Tested-by: afzal mohammed +Signed-off-by: Vladimir Murzin +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/kernel/head-common.S | 5 +++-- + arch/arm/kernel/head-nommu.S | 2 ++ + arch/arm/mm/proc-v7m.S | 5 ++--- + 3 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/kernel/head-common.S b/arch/arm/kernel/head-common.S +index 997b02302c314..9328f2010bc19 100644 +--- a/arch/arm/kernel/head-common.S ++++ b/arch/arm/kernel/head-common.S +@@ -72,7 +72,7 @@ ENDPROC(__vet_atags) + * The following fragment of code is executed with the MMU on in MMU mode, + * and uses absolute addresses; this is not position independent. + * +- * r0 = cp#15 control register ++ * r0 = cp#15 control register (exc_ret for M-class) + * r1 = machine ID + * r2 = atags/dtb pointer + * r9 = processor ID +@@ -141,7 +141,8 @@ __mmap_switched_data: + #ifdef CONFIG_CPU_CP15 + .long cr_alignment @ r3 + #else +- .long 0 @ r3 ++M_CLASS(.long exc_ret) @ r3 ++AR_CLASS(.long 0) @ r3 + #endif + .size __mmap_switched_data, . - __mmap_switched_data + +diff --git a/arch/arm/kernel/head-nommu.S b/arch/arm/kernel/head-nommu.S +index cab89479d15ef..326a97aa3ea0c 100644 +--- a/arch/arm/kernel/head-nommu.S ++++ b/arch/arm/kernel/head-nommu.S +@@ -205,6 +205,8 @@ M_CLASS(streq r3, [r12, #PMSAv8_MAIR1]) + bic r0, r0, #V7M_SCB_CCR_IC + #endif + str r0, [r12, V7M_SCB_CCR] ++ /* Pass exc_ret to __mmap_switched */ ++ mov r0, r10 + #endif /* CONFIG_CPU_CP15 elif CONFIG_CPU_V7M */ + ret lr + ENDPROC(__after_proc_init) +diff --git a/arch/arm/mm/proc-v7m.S b/arch/arm/mm/proc-v7m.S +index 92e84181933ad..59d82864c134b 100644 +--- a/arch/arm/mm/proc-v7m.S ++++ b/arch/arm/mm/proc-v7m.S +@@ -139,9 +139,8 @@ __v7m_setup_cont: + cpsie i + svc #0 + 1: cpsid i +- ldr r0, =exc_ret +- orr lr, lr, #EXC_RET_THREADMODE_PROCESSSTACK +- str lr, [r0] ++ /* Calculate exc_ret */ ++ orr r10, lr, #EXC_RET_THREADMODE_PROCESSSTACK + ldmia sp, {r0-r3, r12} + str r5, [r12, #11 * 4] @ restore the original SVC vector entry + mov lr, r6 @ restore LR +-- +2.20.1 + diff --git a/queue-4.19/iwlwifi-exclude-geo-sar-support-for-3168.patch b/queue-4.19/iwlwifi-exclude-geo-sar-support-for-3168.patch new file mode 100644 index 00000000000..fb7d27364c5 --- /dev/null +++ b/queue-4.19/iwlwifi-exclude-geo-sar-support-for-3168.patch @@ -0,0 +1,53 @@ +From f7fe0a49856b27db0ad9ca7949cdcbf8d4dcd761 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2019 13:10:53 +0300 +Subject: iwlwifi: exclude GEO SAR support for 3168 + +From: Luca Coelho + +[ Upstream commit 12e36d98d3e5acf5fc57774e0a15906d55f30cb9 ] + +We currently support two NICs in FW version 29, namely 7265D and 3168. +Out of these, only 7265D supports GEO SAR, so adjust the function that +checks for it accordingly. + +Signed-off-by: Luca Coelho +Fixes: f5a47fae6aa3 ("iwlwifi: mvm: fix version check for GEO_TX_POWER_LIMIT support") +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +index 9cb9f0544c9b1..2eba6d6f367f8 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +@@ -843,15 +843,17 @@ static bool iwl_mvm_sar_geo_support(struct iwl_mvm *mvm) + * firmware versions. Unfortunately, we don't have a TLV API + * flag to rely on, so rely on the major version which is in + * the first byte of ucode_ver. This was implemented +- * initially on version 38 and then backported to29 and 17. +- * The intention was to have it in 36 as well, but not all +- * 8000 family got this feature enabled. The 8000 family is +- * the only one using version 36, so skip this version +- * entirely. ++ * initially on version 38 and then backported to 17. It was ++ * also backported to 29, but only for 7265D devices. The ++ * intention was to have it in 36 as well, but not all 8000 ++ * family got this feature enabled. The 8000 family is the ++ * only one using version 36, so skip this version entirely. + */ + return IWL_UCODE_SERIAL(mvm->fw->ucode_ver) >= 38 || +- IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 29 || +- IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 17; ++ IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 17 || ++ (IWL_UCODE_SERIAL(mvm->fw->ucode_ver) == 29 && ++ ((mvm->trans->hw_rev & CSR_HW_REV_TYPE_MSK) == ++ CSR_HW_REV_TYPE_7265D)); + } + + int iwl_mvm_get_sar_geo_profile(struct iwl_mvm *mvm) +-- +2.20.1 + diff --git a/queue-4.19/nbd-verify-socket-is-supported-during-setup.patch b/queue-4.19/nbd-verify-socket-is-supported-during-setup.patch new file mode 100644 index 00000000000..8c7090618b3 --- /dev/null +++ b/queue-4.19/nbd-verify-socket-is-supported-during-setup.patch @@ -0,0 +1,78 @@ +From 85f33bdbb6d20c9239fd15e6f613f77b7ce3c287 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2019 16:27:34 -0500 +Subject: nbd: verify socket is supported during setup + +From: Mike Christie + +[ Upstream commit cf1b2326b734896734c6e167e41766f9cee7686a ] + +nbd requires socket families to support the shutdown method so the nbd +recv workqueue can be woken up from its sock_recvmsg call. If the socket +does not support the callout we will leave recv works running or get hangs +later when the device or module is removed. + +This adds a check during socket connection/reconnection to make sure the +socket being passed in supports the needed callout. + +Reported-by: syzbot+24c12fa8d218ed26011a@syzkaller.appspotmail.com +Fixes: e9e006f5fcf2 ("nbd: fix max number of supported devs") +Tested-by: Richard W.M. Jones +Signed-off-by: Mike Christie +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/nbd.c | 23 +++++++++++++++++++++-- + 1 file changed, 21 insertions(+), 2 deletions(-) + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index d445195945618..bd9aafe86c2fc 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -924,6 +924,25 @@ static blk_status_t nbd_queue_rq(struct blk_mq_hw_ctx *hctx, + return ret; + } + ++static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd, ++ int *err) ++{ ++ struct socket *sock; ++ ++ *err = 0; ++ sock = sockfd_lookup(fd, err); ++ if (!sock) ++ return NULL; ++ ++ if (sock->ops->shutdown == sock_no_shutdown) { ++ dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n"); ++ *err = -EINVAL; ++ return NULL; ++ } ++ ++ return sock; ++} ++ + static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, + bool netlink) + { +@@ -933,7 +952,7 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, + struct nbd_sock *nsock; + int err; + +- sock = sockfd_lookup(arg, &err); ++ sock = nbd_get_socket(nbd, arg, &err); + if (!sock) + return err; + +@@ -985,7 +1004,7 @@ static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg) + int i; + int err; + +- sock = sockfd_lookup(arg, &err); ++ sock = nbd_get_socket(nbd, arg, &err); + if (!sock) + return err; + +-- +2.20.1 + diff --git a/queue-4.19/series b/queue-4.19/series index ddbfe15bb4d..66dd4eb84d9 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -98,3 +98,8 @@ nbd-fix-possible-sysfs-duplicate-warning.patch nfsv4-fix-leak-of-clp-cl_acceptor-string.patch s390-uaccess-avoid-false-positive-compiler-warnings.patch tracing-initialize-iter-seq-after-zeroing-in-tracing.patch +arm-8914-1-nommu-fix-exc_ret-for-xip.patch +alsa-hda-realtek-reduce-the-headphone-static-noise-o.patch +iwlwifi-exclude-geo-sar-support-for-3168.patch +nbd-verify-socket-is-supported-during-setup.patch +usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch diff --git a/queue-4.19/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch b/queue-4.19/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch new file mode 100644 index 00000000000..d6e424184e2 --- /dev/null +++ b/queue-4.19/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch @@ -0,0 +1,39 @@ +From f2681b0cd4db49e5ca29ef4e80082bab740e07f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Oct 2019 17:11:15 +0300 +Subject: USB: legousbtower: fix a signedness bug in tower_probe() + +From: Dan Carpenter + +[ Upstream commit fd47a417e75e2506eb3672ae569b1c87e3774155 ] + +The problem is that sizeof() is unsigned long so negative error codes +are type promoted to high positive values and the condition becomes +false. + +Fixes: 1d427be4a39d ("USB: legousbtower: fix slab info leak at probe") +Signed-off-by: Dan Carpenter +Acked-by: Johan Hovold +Link: https://lore.kernel.org/r/20191011141115.GA4521@mwanda +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/misc/legousbtower.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c +index 62dab2441ec4f..23061f1526b4e 100644 +--- a/drivers/usb/misc/legousbtower.c ++++ b/drivers/usb/misc/legousbtower.c +@@ -878,7 +878,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device + get_version_reply, + sizeof(*get_version_reply), + 1000); +- if (result < sizeof(*get_version_reply)) { ++ if (result != sizeof(*get_version_reply)) { + if (result >= 0) + result = -EIO; + dev_err(idev, "get version request failed: %d\n", result); +-- +2.20.1 +