From 666f5bdad6bc5c3fa0bb03d34014779a7cfbffb4 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 3 Nov 2019 18:51:46 +0100 Subject: [PATCH] 5.3-stable patches added patches: alsa-bebob-fix-prototype-of-helper-function-to-return-negative-value.patch alsa-hda-realtek-add-support-for-alc623.patch alsa-hda-realtek-fix-2-front-mics-of-codec-0x623.patch alsa-timer-fix-mutex-deadlock-at-releasing-card.patch ath10k-fix-latency-issue-for-qca988x.patch fuse-flush-dirty-data-metadata-before-non-truncate-setattr.patch fuse-truncate-pending-writes-on-o_trunc.patch nl80211-fix-validation-of-mesh-path-nexthop.patch uas-revert-commit-3ae62a42090f-uas-fix-alignment-of-scatter-gather-segments.patch --- ...er-function-to-return-negative-value.patch | 37 +++++ ...a-hda-realtek-add-support-for-alc623.patch | 67 +++++++++ ...ltek-fix-2-front-mics-of-codec-0x623.patch | 38 ++++++ ...fix-mutex-deadlock-at-releasing-card.patch | 129 ++++++++++++++++++ ...ath10k-fix-latency-issue-for-qca988x.patch | 54 ++++++++ ...metadata-before-non-truncate-setattr.patch | 57 ++++++++ ...e-truncate-pending-writes-on-o_trunc.patch | 55 ++++++++ ...-fix-validation-of-mesh-path-nexthop.patch | 34 +++++ queue-5.3/series | 9 ++ ...alignment-of-scatter-gather-segments.patch | 92 +++++++++++++ 10 files changed, 572 insertions(+) create mode 100644 queue-5.3/alsa-bebob-fix-prototype-of-helper-function-to-return-negative-value.patch create mode 100644 queue-5.3/alsa-hda-realtek-add-support-for-alc623.patch create mode 100644 queue-5.3/alsa-hda-realtek-fix-2-front-mics-of-codec-0x623.patch create mode 100644 queue-5.3/alsa-timer-fix-mutex-deadlock-at-releasing-card.patch create mode 100644 queue-5.3/ath10k-fix-latency-issue-for-qca988x.patch create mode 100644 queue-5.3/fuse-flush-dirty-data-metadata-before-non-truncate-setattr.patch create mode 100644 queue-5.3/fuse-truncate-pending-writes-on-o_trunc.patch create mode 100644 queue-5.3/nl80211-fix-validation-of-mesh-path-nexthop.patch create mode 100644 queue-5.3/uas-revert-commit-3ae62a42090f-uas-fix-alignment-of-scatter-gather-segments.patch diff --git a/queue-5.3/alsa-bebob-fix-prototype-of-helper-function-to-return-negative-value.patch b/queue-5.3/alsa-bebob-fix-prototype-of-helper-function-to-return-negative-value.patch new file mode 100644 index 00000000000..56447b8b070 --- /dev/null +++ b/queue-5.3/alsa-bebob-fix-prototype-of-helper-function-to-return-negative-value.patch @@ -0,0 +1,37 @@ +From f2bbdbcb075f3977a53da3bdcb7cd460bc8ae5f2 Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Sat, 26 Oct 2019 12:06:20 +0900 +Subject: ALSA: bebob: Fix prototype of helper function to return negative value + +From: Takashi Sakamoto + +commit f2bbdbcb075f3977a53da3bdcb7cd460bc8ae5f2 upstream. + +A helper function of ALSA bebob driver returns negative value in a +function which has a prototype to return unsigned value. + +This commit fixes it by changing the prototype. + +Fixes: eb7b3a056cd8 ("ALSA: bebob: Add commands and connections/streams management") +Cc: # v3.16+ +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20191026030620.12077-1-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/firewire/bebob/bebob_stream.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/sound/firewire/bebob/bebob_stream.c ++++ b/sound/firewire/bebob/bebob_stream.c +@@ -252,8 +252,7 @@ end: + return err; + } + +-static unsigned int +-map_data_channels(struct snd_bebob *bebob, struct amdtp_stream *s) ++static int map_data_channels(struct snd_bebob *bebob, struct amdtp_stream *s) + { + unsigned int sec, sections, ch, channels; + unsigned int pcm, midi, location; diff --git a/queue-5.3/alsa-hda-realtek-add-support-for-alc623.patch b/queue-5.3/alsa-hda-realtek-add-support-for-alc623.patch new file mode 100644 index 00000000000..f55b815b981 --- /dev/null +++ b/queue-5.3/alsa-hda-realtek-add-support-for-alc623.patch @@ -0,0 +1,67 @@ +From f0778871a13889b86a65d4ad34bef8340af9d082 Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Thu, 24 Oct 2019 15:13:32 +0800 +Subject: ALSA: hda/realtek - Add support for ALC623 + +From: Kailang Yang + +commit f0778871a13889b86a65d4ad34bef8340af9d082 upstream. + +Support new codec ALC623. + +Signed-off-by: Kailang Yang +Cc: +Link: https://lore.kernel.org/r/ed97b6a8bd9445ecb48bc763d9aaba7a@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -409,6 +409,9 @@ static void alc_fill_eapd_coef(struct hd + case 0x10ec0672: + alc_update_coef_idx(codec, 0xd, 0, 1<<14); /* EAPD Ctrl */ + break; ++ case 0x10ec0623: ++ alc_update_coef_idx(codec, 0x19, 1<<13, 0); ++ break; + case 0x10ec0668: + alc_update_coef_idx(codec, 0x7, 3<<13, 0); + break; +@@ -2919,6 +2922,7 @@ enum { + ALC269_TYPE_ALC225, + ALC269_TYPE_ALC294, + ALC269_TYPE_ALC300, ++ ALC269_TYPE_ALC623, + ALC269_TYPE_ALC700, + }; + +@@ -2954,6 +2958,7 @@ static int alc269_parse_auto_config(stru + case ALC269_TYPE_ALC225: + case ALC269_TYPE_ALC294: + case ALC269_TYPE_ALC300: ++ case ALC269_TYPE_ALC623: + case ALC269_TYPE_ALC700: + ssids = alc269_ssids; + break; +@@ -7976,6 +7981,9 @@ static int patch_alc269(struct hda_codec + spec->codec_variant = ALC269_TYPE_ALC300; + spec->gen.mixer_nid = 0; /* no loopback on ALC300 */ + break; ++ case 0x10ec0623: ++ spec->codec_variant = ALC269_TYPE_ALC623; ++ break; + case 0x10ec0700: + case 0x10ec0701: + case 0x10ec0703: +@@ -9103,6 +9111,7 @@ static const struct hda_device_id snd_hd + HDA_CODEC_ENTRY(0x10ec0298, "ALC298", patch_alc269), + HDA_CODEC_ENTRY(0x10ec0299, "ALC299", patch_alc269), + HDA_CODEC_ENTRY(0x10ec0300, "ALC300", patch_alc269), ++ HDA_CODEC_ENTRY(0x10ec0623, "ALC623", patch_alc269), + HDA_CODEC_REV_ENTRY(0x10ec0861, 0x100340, "ALC660", patch_alc861), + HDA_CODEC_ENTRY(0x10ec0660, "ALC660-VD", patch_alc861vd), + HDA_CODEC_ENTRY(0x10ec0861, "ALC861", patch_alc861), diff --git a/queue-5.3/alsa-hda-realtek-fix-2-front-mics-of-codec-0x623.patch b/queue-5.3/alsa-hda-realtek-fix-2-front-mics-of-codec-0x623.patch new file mode 100644 index 00000000000..87a299c2b6d --- /dev/null +++ b/queue-5.3/alsa-hda-realtek-fix-2-front-mics-of-codec-0x623.patch @@ -0,0 +1,38 @@ +From 8a6c55d0f883e9a7e7c91841434f3b6bbf932bb2 Mon Sep 17 00:00:00 2001 +From: Aaron Ma +Date: Thu, 24 Oct 2019 19:44:39 +0800 +Subject: ALSA: hda/realtek - Fix 2 front mics of codec 0x623 + +From: Aaron Ma + +commit 8a6c55d0f883e9a7e7c91841434f3b6bbf932bb2 upstream. + +These 2 ThinkCentres installed a new realtek codec ID 0x623, +it has 2 front mics with the same location on pin 0x18 and 0x19. + +Apply fixup ALC283_FIXUP_HEADSET_MIC to change 1 front mic +location to right, then pulseaudio can handle them. +One "Front Mic" and one "Mic" will be shown, and audio output works +fine. + +Signed-off-by: Aaron Ma +Cc: +Link: https://lore.kernel.org/r/20191024114439.31522-1-aaron.ma@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7187,6 +7187,8 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x3151, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC), ++ SND_PCI_QUIRK(0x17aa, 0x3176, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC), ++ SND_PCI_QUIRK(0x17aa, 0x3178, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), + SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), + SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI), diff --git a/queue-5.3/alsa-timer-fix-mutex-deadlock-at-releasing-card.patch b/queue-5.3/alsa-timer-fix-mutex-deadlock-at-releasing-card.patch new file mode 100644 index 00000000000..1c1712c8535 --- /dev/null +++ b/queue-5.3/alsa-timer-fix-mutex-deadlock-at-releasing-card.patch @@ -0,0 +1,129 @@ +From a39331867335d4a94b6165e306265c9e24aca073 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 30 Oct 2019 22:42:57 +0100 +Subject: ALSA: timer: Fix mutex deadlock at releasing card + +From: Takashi Iwai + +commit a39331867335d4a94b6165e306265c9e24aca073 upstream. + +When a card is disconnected while in use, the system waits until all +opened files are closed then releases the card. This is done via +put_device() of the card device in each device release code. + +The recently reported mutex deadlock bug happens in this code path; +snd_timer_close() for the timer device deals with the global +register_mutex and it calls put_device() there. When this timer +device is the last one, the card gets freed and it eventually calls +snd_timer_free(), which has again the protection with the global +register_mutex -- boom. + +Basically put_device() call itself is race-free, so a relative simple +workaround is to move this put_device() call out of the mutex. For +achieving that, in this patch, snd_timer_close_locked() got a new +argument to store the card device pointer in return, and each caller +invokes put_device() with the returned object after the mutex unlock. + +Reported-and-tested-by: Kirill A. Shutemov +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/timer.c | 24 +++++++++++++++++------- + 1 file changed, 17 insertions(+), 7 deletions(-) + +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -226,7 +226,8 @@ static int snd_timer_check_master(struct + return 0; + } + +-static int snd_timer_close_locked(struct snd_timer_instance *timeri); ++static int snd_timer_close_locked(struct snd_timer_instance *timeri, ++ struct device **card_devp_to_put); + + /* + * open a timer instance +@@ -238,6 +239,7 @@ int snd_timer_open(struct snd_timer_inst + { + struct snd_timer *timer; + struct snd_timer_instance *timeri = NULL; ++ struct device *card_dev_to_put = NULL; + int err; + + mutex_lock(®ister_mutex); +@@ -261,7 +263,7 @@ int snd_timer_open(struct snd_timer_inst + list_add_tail(&timeri->open_list, &snd_timer_slave_list); + err = snd_timer_check_slave(timeri); + if (err < 0) { +- snd_timer_close_locked(timeri); ++ snd_timer_close_locked(timeri, &card_dev_to_put); + timeri = NULL; + } + goto unlock; +@@ -313,7 +315,7 @@ int snd_timer_open(struct snd_timer_inst + timeri = NULL; + + if (timer->card) +- put_device(&timer->card->card_dev); ++ card_dev_to_put = &timer->card->card_dev; + module_put(timer->module); + goto unlock; + } +@@ -323,12 +325,15 @@ int snd_timer_open(struct snd_timer_inst + timer->num_instances++; + err = snd_timer_check_master(timeri); + if (err < 0) { +- snd_timer_close_locked(timeri); ++ snd_timer_close_locked(timeri, &card_dev_to_put); + timeri = NULL; + } + + unlock: + mutex_unlock(®ister_mutex); ++ /* put_device() is called after unlock for avoiding deadlock */ ++ if (card_dev_to_put) ++ put_device(card_dev_to_put); + *ti = timeri; + return err; + } +@@ -338,7 +343,8 @@ EXPORT_SYMBOL(snd_timer_open); + * close a timer instance + * call this with register_mutex down. + */ +-static int snd_timer_close_locked(struct snd_timer_instance *timeri) ++static int snd_timer_close_locked(struct snd_timer_instance *timeri, ++ struct device **card_devp_to_put) + { + struct snd_timer *timer = timeri->timer; + struct snd_timer_instance *slave, *tmp; +@@ -395,7 +401,7 @@ static int snd_timer_close_locked(struct + timer->hw.close(timer); + /* release a card refcount for safe disconnection */ + if (timer->card) +- put_device(&timer->card->card_dev); ++ *card_devp_to_put = &timer->card->card_dev; + module_put(timer->module); + } + +@@ -407,14 +413,18 @@ static int snd_timer_close_locked(struct + */ + int snd_timer_close(struct snd_timer_instance *timeri) + { ++ struct device *card_dev_to_put = NULL; + int err; + + if (snd_BUG_ON(!timeri)) + return -ENXIO; + + mutex_lock(®ister_mutex); +- err = snd_timer_close_locked(timeri); ++ err = snd_timer_close_locked(timeri, &card_dev_to_put); + mutex_unlock(®ister_mutex); ++ /* put_device() is called after unlock for avoiding deadlock */ ++ if (card_dev_to_put) ++ put_device(card_dev_to_put); + return err; + } + EXPORT_SYMBOL(snd_timer_close); diff --git a/queue-5.3/ath10k-fix-latency-issue-for-qca988x.patch b/queue-5.3/ath10k-fix-latency-issue-for-qca988x.patch new file mode 100644 index 00000000000..8bb45fb7e65 --- /dev/null +++ b/queue-5.3/ath10k-fix-latency-issue-for-qca988x.patch @@ -0,0 +1,54 @@ +From d79749f7716d9dc32fa2d5075f6ec29aac63c76d Mon Sep 17 00:00:00 2001 +From: Miaoqing Pan +Date: Thu, 29 Aug 2019 10:45:12 +0800 +Subject: ath10k: fix latency issue for QCA988x + +From: Miaoqing Pan + +commit d79749f7716d9dc32fa2d5075f6ec29aac63c76d upstream. + +(kvalo: cherry picked from commit 1340cc631bd00431e2f174525c971f119df9efa1 in +wireless-drivers-next to wireless-drivers as this a frequently reported +regression) + +Bad latency is found on QCA988x, the issue was introduced by +commit 4504f0e5b571 ("ath10k: sdio: workaround firmware UART +pin configuration bug"). If uart_pin_workaround is false, this +change will set uart pin even if uart_print is false. + +Tested HW: QCA9880 +Tested FW: 10.2.4-1.0-00037 + +Fixes: 4504f0e5b571 ("ath10k: sdio: workaround firmware UART pin configuration bug") +Signed-off-by: Miaoqing Pan +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath10k/core.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/ath/ath10k/core.c ++++ b/drivers/net/wireless/ath/ath10k/core.c +@@ -2118,12 +2118,15 @@ static int ath10k_init_uart(struct ath10 + return ret; + } + +- if (!uart_print && ar->hw_params.uart_pin_workaround) { +- ret = ath10k_bmi_write32(ar, hi_dbg_uart_txpin, +- ar->hw_params.uart_pin); +- if (ret) { +- ath10k_warn(ar, "failed to set UART TX pin: %d", ret); +- return ret; ++ if (!uart_print) { ++ if (ar->hw_params.uart_pin_workaround) { ++ ret = ath10k_bmi_write32(ar, hi_dbg_uart_txpin, ++ ar->hw_params.uart_pin); ++ if (ret) { ++ ath10k_warn(ar, "failed to set UART TX pin: %d", ++ ret); ++ return ret; ++ } + } + + return 0; diff --git a/queue-5.3/fuse-flush-dirty-data-metadata-before-non-truncate-setattr.patch b/queue-5.3/fuse-flush-dirty-data-metadata-before-non-truncate-setattr.patch new file mode 100644 index 00000000000..930f50a0688 --- /dev/null +++ b/queue-5.3/fuse-flush-dirty-data-metadata-before-non-truncate-setattr.patch @@ -0,0 +1,57 @@ +From b24e7598db62386a95a3c8b9c75630c5d56fe077 Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Wed, 23 Oct 2019 14:26:37 +0200 +Subject: fuse: flush dirty data/metadata before non-truncate setattr + +From: Miklos Szeredi + +commit b24e7598db62386a95a3c8b9c75630c5d56fe077 upstream. + +If writeback cache is enabled, then writes might get reordered with +chmod/chown/utimes. The problem with this is that performing the write in +the fuse daemon might itself change some of these attributes. In such case +the following sequence of operations will result in file ending up with the +wrong mode, for example: + + int fd = open ("suid", O_WRONLY|O_CREAT|O_EXCL); + write (fd, "1", 1); + fchown (fd, 0, 0); + fchmod (fd, 04755); + close (fd); + +This patch fixes this by flushing pending writes before performing +chown/chmod/utimes. + +Reported-by: Giuseppe Scrivano +Tested-by: Giuseppe Scrivano +Fixes: 4d99ff8f12eb ("fuse: Turn writeback cache on") +Cc: # v3.15+ +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/dir.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -1476,6 +1476,19 @@ int fuse_do_setattr(struct dentry *dentr + is_truncate = true; + } + ++ /* Flush dirty data/metadata before non-truncate SETATTR */ ++ if (is_wb && S_ISREG(inode->i_mode) && ++ attr->ia_valid & ++ (ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_MTIME_SET | ++ ATTR_TIMES_SET)) { ++ err = write_inode_now(inode, true); ++ if (err) ++ return err; ++ ++ fuse_set_nowrite(inode); ++ fuse_release_nowrite(inode); ++ } ++ + if (is_truncate) { + fuse_set_nowrite(inode); + set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state); diff --git a/queue-5.3/fuse-truncate-pending-writes-on-o_trunc.patch b/queue-5.3/fuse-truncate-pending-writes-on-o_trunc.patch new file mode 100644 index 00000000000..0e3d4bfc678 --- /dev/null +++ b/queue-5.3/fuse-truncate-pending-writes-on-o_trunc.patch @@ -0,0 +1,55 @@ +From e4648309b85a78f8c787457832269a8712a8673e Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Wed, 23 Oct 2019 14:26:37 +0200 +Subject: fuse: truncate pending writes on O_TRUNC + +From: Miklos Szeredi + +commit e4648309b85a78f8c787457832269a8712a8673e upstream. + +Make sure cached writes are not reordered around open(..., O_TRUNC), with +the obvious wrong results. + +Fixes: 4d99ff8f12eb ("fuse: Turn writeback cache on") +Cc: # v3.15+ +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/file.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -201,7 +201,7 @@ int fuse_open_common(struct inode *inode + { + struct fuse_conn *fc = get_fuse_conn(inode); + int err; +- bool lock_inode = (file->f_flags & O_TRUNC) && ++ bool is_wb_truncate = (file->f_flags & O_TRUNC) && + fc->atomic_o_trunc && + fc->writeback_cache; + +@@ -209,16 +209,20 @@ int fuse_open_common(struct inode *inode + if (err) + return err; + +- if (lock_inode) ++ if (is_wb_truncate) { + inode_lock(inode); ++ fuse_set_nowrite(inode); ++ } + + err = fuse_do_open(fc, get_node_id(inode), file, isdir); + + if (!err) + fuse_finish_open(inode, file); + +- if (lock_inode) ++ if (is_wb_truncate) { ++ fuse_release_nowrite(inode); + inode_unlock(inode); ++ } + + return err; + } diff --git a/queue-5.3/nl80211-fix-validation-of-mesh-path-nexthop.patch b/queue-5.3/nl80211-fix-validation-of-mesh-path-nexthop.patch new file mode 100644 index 00000000000..92b41ca48eb --- /dev/null +++ b/queue-5.3/nl80211-fix-validation-of-mesh-path-nexthop.patch @@ -0,0 +1,34 @@ +From 1fab1b89e2e8f01204a9c05a39fd0b6411a48593 Mon Sep 17 00:00:00 2001 +From: Markus Theil +Date: Tue, 29 Oct 2019 10:30:03 +0100 +Subject: nl80211: fix validation of mesh path nexthop + +From: Markus Theil + +commit 1fab1b89e2e8f01204a9c05a39fd0b6411a48593 upstream. + +Mesh path nexthop should be a ethernet address, but current validation +checks against 4 byte integers. + +Cc: stable@vger.kernel.org +Fixes: 2ec600d672e74 ("nl80211/cfg80211: support for mesh, sta dumping") +Signed-off-by: Markus Theil +Link: https://lore.kernel.org/r/20191029093003.10355-1-markus.theil@tu-ilmenau.de +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/wireless/nl80211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -377,7 +377,7 @@ const struct nla_policy nl80211_policy[N + [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ }, + [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY, + .len = IEEE80211_MAX_MESH_ID_LEN }, +- [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 }, ++ [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT, + + [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 }, + [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED }, diff --git a/queue-5.3/series b/queue-5.3/series index 10a02cafd6e..d82bad0bff1 100644 --- a/queue-5.3/series +++ b/queue-5.3/series @@ -92,3 +92,12 @@ s390-pci-fix-msi-message-data.patch thunderbolt-correct-path-indices-for-pcie-tunnel.patch thunderbolt-use-32-bit-writes-when-writing-ring-prod.patch ath6kl-fix-a-null-ptr-deref-bug-in-ath6kl_usb_alloc_.patch +fuse-flush-dirty-data-metadata-before-non-truncate-setattr.patch +fuse-truncate-pending-writes-on-o_trunc.patch +alsa-bebob-fix-prototype-of-helper-function-to-return-negative-value.patch +alsa-timer-fix-mutex-deadlock-at-releasing-card.patch +alsa-hda-realtek-fix-2-front-mics-of-codec-0x623.patch +alsa-hda-realtek-add-support-for-alc623.patch +ath10k-fix-latency-issue-for-qca988x.patch +uas-revert-commit-3ae62a42090f-uas-fix-alignment-of-scatter-gather-segments.patch +nl80211-fix-validation-of-mesh-path-nexthop.patch diff --git a/queue-5.3/uas-revert-commit-3ae62a42090f-uas-fix-alignment-of-scatter-gather-segments.patch b/queue-5.3/uas-revert-commit-3ae62a42090f-uas-fix-alignment-of-scatter-gather-segments.patch new file mode 100644 index 00000000000..7c2b6e24107 --- /dev/null +++ b/queue-5.3/uas-revert-commit-3ae62a42090f-uas-fix-alignment-of-scatter-gather-segments.patch @@ -0,0 +1,92 @@ +From 1186f86a71130a7635a20843e355bb880c7349b2 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 23 Oct 2019 11:34:33 -0400 +Subject: UAS: Revert commit 3ae62a42090f ("UAS: fix alignment of scatter/gather segments") + +From: Alan Stern + +commit 1186f86a71130a7635a20843e355bb880c7349b2 upstream. + +Commit 3ae62a42090f ("UAS: fix alignment of scatter/gather segments"), +copying a similar commit for usb-storage, attempted to solve a problem +involving scatter-gather I/O and USB/IP by setting the +virt_boundary_mask for mass-storage devices. + +However, it now turns out that the analogous change in usb-storage +interacted badly with commit 09324d32d2a0 ("block: force an unlimited +segment size on queues with a virt boundary"), which was added later. +A typical error message is: + + ehci-pci 0000:00:13.2: swiotlb buffer is full (sz: 327680 bytes), + total 32768 (slots), used 97 (slots) + +There is no longer any reason to keep the virt_boundary_mask setting +in the uas driver. It was needed in the first place only for +handling devices with a block size smaller than the maxpacket size and +where the host controller was not capable of fully general +scatter-gather operation (that is, able to merge two SG segments into +a single USB packet). But: + + High-speed or slower connections never use a bulk maxpacket + value larger than 512; + + The SCSI layer does not handle block devices with a block size + smaller than 512 bytes; + + All the host controllers capable of SuperSpeed operation can + handle fully general SG; + + Since commit ea44d190764b ("usbip: Implement SG support to + vhci-hcd and stub driver") was merged, the USB/IP driver can + also handle SG. + +Therefore all supported device/controller combinations should be okay +with no need for any special virt_boundary_mask. So in order to head +off potential problems similar to those affecting usb-storage, this +patch reverts commit 3ae62a42090f. + +Signed-off-by: Alan Stern +CC: Oliver Neukum +CC: +Acked-by: Christoph Hellwig +Fixes: 3ae62a42090f ("UAS: fix alignment of scatter/gather segments") +Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.1910231132470.1878-100000@iolanthe.rowland.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/uas.c | 20 -------------------- + 1 file changed, 20 deletions(-) + +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -789,30 +789,10 @@ static int uas_slave_alloc(struct scsi_d + { + struct uas_dev_info *devinfo = + (struct uas_dev_info *)sdev->host->hostdata; +- int maxp; + + sdev->hostdata = devinfo; + + /* +- * We have two requirements here. We must satisfy the requirements +- * of the physical HC and the demands of the protocol, as we +- * definitely want no additional memory allocation in this path +- * ruling out using bounce buffers. +- * +- * For a transmission on USB to continue we must never send +- * a package that is smaller than maxpacket. Hence the length of each +- * scatterlist element except the last must be divisible by the +- * Bulk maxpacket value. +- * If the HC does not ensure that through SG, +- * the upper layer must do that. We must assume nothing +- * about the capabilities off the HC, so we use the most +- * pessimistic requirement. +- */ +- +- maxp = usb_maxpacket(devinfo->udev, devinfo->data_in_pipe, 0); +- blk_queue_virt_boundary(sdev->request_queue, maxp - 1); +- +- /* + * The protocol has no requirements on alignment in the strict sense. + * Controllers may or may not have alignment restrictions. + * As this is not exported, we use an extremely conservative guess. -- 2.39.5