--- /dev/null
+From 5307ab7726c882dbd79ebd31f5d92f9ef7a1e450 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2024 10:25:58 +0200
+Subject: ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit b3ebb007060f89d5a45c9b99f06a55e36a1945b5 ]
+
+We received a regression report for System76 Pangolin (pang14) due to
+the recent fix for Tuxedo Sirius devices to support the top speaker.
+The reason was the conflicting PCI SSID, as often seen.
+
+As a workaround, now the codec SSID is checked and the quirk is
+applied conditionally only to Sirius devices.
+
+Fixes: 4178d78cd7a8 ("ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices")
+Reported-by: Christian Heusel <christian@heusel.eu>
+Reported-by: Jerry <jerryluo225@gmail.com>
+Closes: https://lore.kernel.org/c930b6a6-64e5-498f-b65a-1cd5e0a1d733@heusel.eu
+Link: https://patch.msgid.link/20241004082602.29016-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_conexant.c | 24 +++++++++++++++++++-----
+ 1 file changed, 19 insertions(+), 5 deletions(-)
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 83d976e3442c4..5b296cacb3896 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -820,6 +820,23 @@ static const struct hda_pintbl cxt_pincfg_sws_js201d[] = {
+ {}
+ };
+
++/* pincfg quirk for Tuxedo Sirius;
++ * unfortunately the (PCI) SSID conflicts with System76 Pangolin pang14,
++ * which has incompatible pin setup, so we check the codec SSID (luckily
++ * different one!) and conditionally apply the quirk here
++ */
++static void cxt_fixup_sirius_top_speaker(struct hda_codec *codec,
++ const struct hda_fixup *fix,
++ int action)
++{
++ /* ignore for incorrectly picked-up pang14 */
++ if (codec->core.subsystem_id == 0x278212b3)
++ return;
++ /* set up the top speaker pin */
++ if (action == HDA_FIXUP_ACT_PRE_PROBE)
++ snd_hda_codec_set_pincfg(codec, 0x1d, 0x82170111);
++}
++
+ static const struct hda_fixup cxt_fixups[] = {
+ [CXT_PINCFG_LENOVO_X200] = {
+ .type = HDA_FIXUP_PINS,
+@@ -980,11 +997,8 @@ static const struct hda_fixup cxt_fixups[] = {
+ .v.pins = cxt_pincfg_sws_js201d,
+ },
+ [CXT_PINCFG_TOP_SPEAKER] = {
+- .type = HDA_FIXUP_PINS,
+- .v.pins = (const struct hda_pintbl[]) {
+- { 0x1d, 0x82170111 },
+- { }
+- },
++ .type = HDA_FIXUP_FUNC,
++ .v.func = cxt_fixup_sirius_top_speaker,
+ },
+ };
+
+--
+2.43.0
+
--- /dev/null
+From cac3463a60f4311ebe58810f012b4ffeded1aa0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2024 14:14:36 +0200
+Subject: ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 1c801e7f77445bc56e5e1fec6191fd4503534787 ]
+
+Some time ago, we introduced the obey_preferred_dacs flag for choosing
+the DAC/pin pairs specified by the driver instead of parsing the
+paths. This works as expected, per se, but there have been a few
+cases where we forgot to set this flag while preferred_dacs table is
+already set up. It ended up with incorrect wiring and made us
+wondering why it doesn't work.
+
+Basically, when the preferred_dacs table is provided, it means that
+the driver really wants to wire up to follow that. That is, the
+presence of the preferred_dacs table itself is already a "do-it"
+flag.
+
+In this patch, we simply replace the evaluation of obey_preferred_dacs
+flag with the presence of preferred_dacs table for fixing the
+misbehavior. Another patch to drop of the obsoleted flag will
+follow.
+
+Fixes: 242d990c158d ("ALSA: hda/generic: Add option to enforce preferred_dacs pairs")
+Link: https://bugzilla.suse.com/show_bug.cgi?id=1219803
+Link: https://patch.msgid.link/20241001121439.26060-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_generic.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index 992cf82da1024..2551fb9c6ed0d 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -1379,7 +1379,7 @@ static int try_assign_dacs(struct hda_codec *codec, int num_outs,
+ struct nid_path *path;
+ hda_nid_t pin = pins[i];
+
+- if (!spec->obey_preferred_dacs) {
++ if (!spec->preferred_dacs) {
+ path = snd_hda_get_path_from_idx(codec, path_idx[i]);
+ if (path) {
+ badness += assign_out_path_ctls(codec, path);
+@@ -1391,7 +1391,7 @@ static int try_assign_dacs(struct hda_codec *codec, int num_outs,
+ if (dacs[i]) {
+ if (is_dac_already_used(codec, dacs[i]))
+ badness += bad->shared_primary;
+- } else if (spec->obey_preferred_dacs) {
++ } else if (spec->preferred_dacs) {
+ badness += BAD_NO_PRIMARY_DAC;
+ }
+
+--
+2.43.0
+
--- /dev/null
+From 24902b8cfbdcfbeae271ac616ab266d0d3448950 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2024 18:50:39 +0800
+Subject: ALSA: hda/realtek: Fix the push button function for the ALC257
+
+From: Oder Chiou <oder_chiou@realtek.com>
+
+[ Upstream commit 05df9732a0894846c46d0062d4af535c5002799d ]
+
+The headset push button cannot work properly in case of the ALC257.
+This patch reverted the previous commit to correct the side effect.
+
+Fixes: ef9718b3d54e ("ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7")
+Signed-off-by: Oder Chiou <oder_chiou@realtek.com>
+Link: https://patch.msgid.link/20240930105039.3473266-1-oder_chiou@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 7e035d69f9de5..422d65f9179ba 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -577,6 +577,7 @@ static void alc_shutup_pins(struct hda_codec *codec)
+ switch (codec->core.vendor_id) {
+ case 0x10ec0236:
+ case 0x10ec0256:
++ case 0x10ec0257:
+ case 0x19e58326:
+ case 0x10ec0283:
+ case 0x10ec0285:
+--
+2.43.0
+
--- /dev/null
+From 6d50496963bb44ca476f06a6d64ef87149b64802 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2024 20:17:36 +0200
+Subject: ALSA: mixer_oss: Remove some incorrect kfree_const() usages
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 368e4663c557de4a33f321b44e7eeec0a21b2e4e ]
+
+"assigned" and "assigned->name" are allocated in snd_mixer_oss_proc_write()
+using kmalloc() and kstrdup(), so there is no point in using kfree_const()
+to free these resources.
+
+Switch to the more standard kfree() to free these resources.
+
+This could avoid a memory leak.
+
+Fixes: 454f5ec1d2b7 ("ALSA: mixer: oss: Constify snd_mixer_oss_assign_table definition")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://patch.msgid.link/63ac20f64234b7c9ea87a7fa9baf41e8255852f7.1727374631.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/oss/mixer_oss.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/oss/mixer_oss.c b/sound/core/oss/mixer_oss.c
+index 9620115cfdc09..c8291869ef906 100644
+--- a/sound/core/oss/mixer_oss.c
++++ b/sound/core/oss/mixer_oss.c
+@@ -967,8 +967,8 @@ static void snd_mixer_oss_slot_free(struct snd_mixer_oss_slot *chn)
+ struct slot *p = chn->private_data;
+ if (p) {
+ if (p->allocated && p->assigned) {
+- kfree_const(p->assigned->name);
+- kfree_const(p->assigned);
++ kfree(p->assigned->name);
++ kfree(p->assigned);
+ }
+ kfree(p);
+ }
+--
+2.43.0
+
--- /dev/null
+From 43afe944638ab27fee97c30f88a90a2e2df04091 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2024 10:56:59 +0800
+Subject: ASoC: imx-card: Set card.owner to avoid a warning calltrace if SND=m
+
+From: Hui Wang <hui.wang@canonical.com>
+
+[ Upstream commit 47d7d3fd72afc7dcd548806291793ee6f3848215 ]
+
+In most Linux distribution kernels, the SND is set to m, in such a
+case, when booting the kernel on i.MX8MP EVK board, there is a
+warning calltrace like below:
+ Call trace:
+ snd_card_init+0x484/0x4cc [snd]
+ snd_card_new+0x70/0xa8 [snd]
+ snd_soc_bind_card+0x310/0xbd0 [snd_soc_core]
+ snd_soc_register_card+0xf0/0x108 [snd_soc_core]
+ devm_snd_soc_register_card+0x4c/0xa4 [snd_soc_core]
+
+That is because the card.owner is not set, a warning calltrace is
+raised in the snd_card_init() due to it.
+
+Fixes: aa736700f42f ("ASoC: imx-card: Add imx-card machine driver")
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Link: https://patch.msgid.link/20241002025659.723544-1-hui.wang@canonical.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/imx-card.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/fsl/imx-card.c b/sound/soc/fsl/imx-card.c
+index d59f5efbf7ed5..223234f6172b2 100644
+--- a/sound/soc/fsl/imx-card.c
++++ b/sound/soc/fsl/imx-card.c
+@@ -731,6 +731,7 @@ static int imx_card_probe(struct platform_device *pdev)
+
+ data->plat_data = plat_data;
+ data->card.dev = &pdev->dev;
++ data->card.owner = THIS_MODULE;
+
+ dev_set_drvdata(&pdev->dev, &data->card);
+ snd_soc_card_set_drvdata(&data->card, data);
+--
+2.43.0
+
--- /dev/null
+From f344e3313eeb3d339bcb47791407ef3893ca229c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2024 19:35:57 +0000
+Subject: f2fs: Require FMODE_WRITE for atomic write ioctls
+
+From: Jann Horn <jannh@google.com>
+
+commit 4f5a100f87f32cb65d4bb1ad282a08c92f6f591e upstream.
+
+The F2FS ioctls for starting and committing atomic writes check for
+inode_owner_or_capable(), but this does not give LSMs like SELinux or
+Landlock an opportunity to deny the write access - if the caller's FSUID
+matches the inode's UID, inode_owner_or_capable() immediately returns true.
+
+There are scenarios where LSMs want to deny a process the ability to write
+particular files, even files that the FSUID of the process owns; but this
+can currently partially be bypassed using atomic write ioctls in two ways:
+
+ - F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE can
+ truncate an inode to size 0
+ - F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE can revert
+ changes another process concurrently made to a file
+
+Fix it by requiring FMODE_WRITE for these operations, just like for
+F2FS_IOC_MOVE_RANGE. Since any legitimate caller should only be using these
+ioctls when intending to write into the file, that seems unlikely to break
+anything.
+
+Fixes: 88b88a667971 ("f2fs: support atomic writes")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jann Horn <jannh@google.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Reviewed-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index ee20d79bd93e4..b38ce5a7a2ef2 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2010,6 +2010,9 @@ static int f2fs_ioc_start_atomic_write(struct file *filp)
+ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ int ret;
+
++ if (!(filp->f_mode & FMODE_WRITE))
++ return -EBADF;
++
+ if (!inode_owner_or_capable(&init_user_ns, inode))
+ return -EACCES;
+
+@@ -2080,6 +2083,9 @@ static int f2fs_ioc_commit_atomic_write(struct file *filp)
+ struct inode *inode = file_inode(filp);
+ int ret;
+
++ if (!(filp->f_mode & FMODE_WRITE))
++ return -EBADF;
++
+ if (!inode_owner_or_capable(&init_user_ns, inode))
+ return -EACCES;
+
+@@ -2122,6 +2128,9 @@ static int f2fs_ioc_start_volatile_write(struct file *filp)
+ struct inode *inode = file_inode(filp);
+ int ret;
+
++ if (!(filp->f_mode & FMODE_WRITE))
++ return -EBADF;
++
+ if (!inode_owner_or_capable(&init_user_ns, inode))
+ return -EACCES;
+
+@@ -2157,6 +2166,9 @@ static int f2fs_ioc_release_volatile_write(struct file *filp)
+ struct inode *inode = file_inode(filp);
+ int ret;
+
++ if (!(filp->f_mode & FMODE_WRITE))
++ return -EBADF;
++
+ if (!inode_owner_or_capable(&init_user_ns, inode))
+ return -EACCES;
+
+@@ -2186,6 +2198,9 @@ static int f2fs_ioc_abort_volatile_write(struct file *filp)
+ struct inode *inode = file_inode(filp);
+ int ret;
+
++ if (!(filp->f_mode & FMODE_WRITE))
++ return -EBADF;
++
+ if (!inode_owner_or_capable(&init_user_ns, inode))
+ return -EACCES;
+
+--
+2.43.0
+
--- /dev/null
+From 422a3ff5025b224ddb699e5e6a01cdfef33941b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Aug 2021 23:41:40 +0200
+Subject: i2c: xiic: Fix broken locking on tx_msg
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit c119e7d00c916881913011e6f4c6ac349a41e4e2 ]
+
+The tx_msg is set from multiple places, sometimes without locking,
+which fall apart on any SMP system. Only ever access tx_msg inside
+the driver mutex.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Acked-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Stable-dep-of: 1d4a1adbed25 ("i2c: xiic: Try re-initialization on bus busy timeout")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 26 ++++++++++++++++----------
+ 1 file changed, 16 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index 9652e8bea2d0b..7b9ec379733eb 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -170,7 +170,7 @@ struct xiic_i2c {
+ #define xiic_tx_space(i2c) ((i2c)->tx_msg->len - (i2c)->tx_pos)
+ #define xiic_rx_space(i2c) ((i2c)->rx_msg->len - (i2c)->rx_pos)
+
+-static int xiic_start_xfer(struct xiic_i2c *i2c);
++static int xiic_start_xfer(struct xiic_i2c *i2c, struct i2c_msg *msgs, int num);
+ static void __xiic_start_xfer(struct xiic_i2c *i2c);
+
+ /*
+@@ -701,15 +701,25 @@ static void __xiic_start_xfer(struct xiic_i2c *i2c)
+
+ }
+
+-static int xiic_start_xfer(struct xiic_i2c *i2c)
++static int xiic_start_xfer(struct xiic_i2c *i2c, struct i2c_msg *msgs, int num)
+ {
+ int ret;
++
+ mutex_lock(&i2c->lock);
+
++ ret = xiic_busy(i2c);
++ if (ret)
++ goto out;
++
++ i2c->tx_msg = msgs;
++ i2c->rx_msg = NULL;
++ i2c->nmsgs = num;
++
+ ret = xiic_reinit(i2c);
+ if (!ret)
+ __xiic_start_xfer(i2c);
+
++out:
+ mutex_unlock(&i2c->lock);
+
+ return ret;
+@@ -727,14 +737,7 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ if (err < 0)
+ return err;
+
+- err = xiic_busy(i2c);
+- if (err)
+- goto out;
+-
+- i2c->tx_msg = msgs;
+- i2c->nmsgs = num;
+-
+- err = xiic_start_xfer(i2c);
++ err = xiic_start_xfer(i2c, msgs, num);
+ if (err < 0) {
+ dev_err(adap->dev.parent, "Error xiic_start_xfer\n");
+ goto out;
+@@ -742,9 +745,11 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+
+ if (wait_event_timeout(i2c->wait, (i2c->state == STATE_ERROR) ||
+ (i2c->state == STATE_DONE), HZ)) {
++ mutex_lock(&i2c->lock);
+ err = (i2c->state == STATE_DONE) ? num : -EIO;
+ goto out;
+ } else {
++ mutex_lock(&i2c->lock);
+ i2c->tx_msg = NULL;
+ i2c->rx_msg = NULL;
+ i2c->nmsgs = 0;
+@@ -752,6 +757,7 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ goto out;
+ }
+ out:
++ mutex_unlock(&i2c->lock);
+ pm_runtime_mark_last_busy(i2c->dev);
+ pm_runtime_put_autosuspend(i2c->dev);
+ return err;
+--
+2.43.0
+
--- /dev/null
+From 068cb3cc3f6f2b9058a627aef8d98a4415a10c61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Aug 2021 23:41:45 +0200
+Subject: i2c: xiic: Fix RX IRQ busy check
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 294b29f15469e90893c2b72a738a962ee02a12eb ]
+
+In case the XIIC does TX/RX transfer, make sure no other kernel thread
+can start another TX transfer at the same time. This could happen since
+the driver only checks tx_msg for being non-NULL and returns -EBUSY in
+that case, however it is necessary to check also rx_msg for the same.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Acked-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Stable-dep-of: 1d4a1adbed25 ("i2c: xiic: Try re-initialization on bus busy timeout")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index b5368d11b5240..3444e4d017f7f 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -545,7 +545,7 @@ static int xiic_busy(struct xiic_i2c *i2c)
+ int tries = 3;
+ int err;
+
+- if (i2c->tx_msg)
++ if (i2c->tx_msg || i2c->rx_msg)
+ return -EBUSY;
+
+ /* In single master mode bus can only be busy, when in use by this
+--
+2.43.0
+
--- /dev/null
+From 7d12f50c490ff69fb263d0b4fbb29ad87804115a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 May 2024 12:03:24 -0400
+Subject: i2c: xiic: improve error message when transfer fails to start
+
+From: Marc Ferland <marc.ferland@sonatest.com>
+
+[ Upstream commit ee1691d0ae103ba7fd9439800ef454674fadad27 ]
+
+xiic_start_xfer can fail for different reasons:
+
+- EBUSY: bus is busy or i2c messages still in tx_msg or rx_msg
+- ETIMEDOUT: timed-out trying to clear the RX fifo
+- EINVAL: wrong clock settings
+
+Both EINVAL and ETIMEDOUT will currently print a specific error
+message followed by a generic one, for example:
+
+ Failed to clear rx fifo
+ Error xiic_start_xfer
+
+however EBUSY will simply output the generic message:
+
+ Error xiic_start_xfer
+
+which is not really helpful.
+
+This commit adds a new error message when a busy condition is detected
+and also removes the generic message since it does not provide any
+relevant information to the user.
+
+Signed-off-by: Marc Ferland <marc.ferland@sonatest.com>
+Acked-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Stable-dep-of: 1d4a1adbed25 ("i2c: xiic: Try re-initialization on bus busy timeout")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index 695233db07acd..1ecd26e673d47 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -711,8 +711,11 @@ static int xiic_start_xfer(struct xiic_i2c *i2c, struct i2c_msg *msgs, int num)
+ mutex_lock(&i2c->lock);
+
+ ret = xiic_busy(i2c);
+- if (ret)
++ if (ret) {
++ dev_err(i2c->adap.dev.parent,
++ "cannot start a transfer while busy\n");
+ goto out;
++ }
+
+ i2c->tx_msg = msgs;
+ i2c->rx_msg = NULL;
+@@ -742,10 +745,8 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ return err;
+
+ err = xiic_start_xfer(i2c, msgs, num);
+- if (err < 0) {
+- dev_err(adap->dev.parent, "Error xiic_start_xfer\n");
++ if (err < 0)
+ goto out;
+- }
+
+ err = wait_for_completion_timeout(&i2c->completion, XIIC_XFER_TIMEOUT);
+ mutex_lock(&i2c->lock);
+--
+2.43.0
+
--- /dev/null
+From 77c148105ca0e65669fac1139e3714a896635e34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Aug 2021 23:41:43 +0200
+Subject: i2c: xiic: Switch from waitqueue to completion
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit fdacc3c7405d1fc33c1f2771699a4fc24551e480 ]
+
+There will never be threads queueing up in the xiic_xmit(), use
+completion synchronization primitive to wait for the interrupt
+handler thread to complete instead as it is much better fit and
+there is no need to overload it for this purpose.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Acked-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Stable-dep-of: 1d4a1adbed25 ("i2c: xiic: Try re-initialization on bus busy timeout")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 33 ++++++++++++++++++---------------
+ 1 file changed, 18 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index 7b9ec379733eb..b5368d11b5240 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -23,7 +23,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/i2c.h>
+ #include <linux/interrupt.h>
+-#include <linux/wait.h>
++#include <linux/completion.h>
+ #include <linux/platform_data/i2c-xiic.h>
+ #include <linux/io.h>
+ #include <linux/slab.h>
+@@ -48,7 +48,7 @@ enum xiic_endian {
+ * struct xiic_i2c - Internal representation of the XIIC I2C bus
+ * @dev: Pointer to device structure
+ * @base: Memory base of the HW registers
+- * @wait: Wait queue for callers
++ * @completion: Completion for callers
+ * @adap: Kernel adapter representation
+ * @tx_msg: Messages from above to be sent
+ * @lock: Mutual exclusion
+@@ -64,7 +64,7 @@ enum xiic_endian {
+ struct xiic_i2c {
+ struct device *dev;
+ void __iomem *base;
+- wait_queue_head_t wait;
++ struct completion completion;
+ struct i2c_adapter adap;
+ struct i2c_msg *tx_msg;
+ struct mutex lock;
+@@ -160,6 +160,9 @@ struct xiic_i2c {
+ #define XIIC_PM_TIMEOUT 1000 /* ms */
+ /* timeout waiting for the controller to respond */
+ #define XIIC_I2C_TIMEOUT (msecs_to_jiffies(1000))
++/* timeout waiting for the controller finish transfers */
++#define XIIC_XFER_TIMEOUT (msecs_to_jiffies(10000))
++
+ /*
+ * The following constant is used for the device global interrupt enable
+ * register, to enable all interrupts for the device, this is the only bit
+@@ -367,7 +370,7 @@ static void xiic_wakeup(struct xiic_i2c *i2c, int code)
+ i2c->rx_msg = NULL;
+ i2c->nmsgs = 0;
+ i2c->state = code;
+- wake_up(&i2c->wait);
++ complete(&i2c->completion);
+ }
+
+ static irqreturn_t xiic_process(int irq, void *dev_id)
+@@ -714,6 +717,7 @@ static int xiic_start_xfer(struct xiic_i2c *i2c, struct i2c_msg *msgs, int num)
+ i2c->tx_msg = msgs;
+ i2c->rx_msg = NULL;
+ i2c->nmsgs = num;
++ init_completion(&i2c->completion);
+
+ ret = xiic_reinit(i2c);
+ if (!ret)
+@@ -740,23 +744,23 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ err = xiic_start_xfer(i2c, msgs, num);
+ if (err < 0) {
+ dev_err(adap->dev.parent, "Error xiic_start_xfer\n");
+- goto out;
++ return err;
+ }
+
+- if (wait_event_timeout(i2c->wait, (i2c->state == STATE_ERROR) ||
+- (i2c->state == STATE_DONE), HZ)) {
+- mutex_lock(&i2c->lock);
+- err = (i2c->state == STATE_DONE) ? num : -EIO;
+- goto out;
+- } else {
+- mutex_lock(&i2c->lock);
++ err = wait_for_completion_timeout(&i2c->completion, XIIC_XFER_TIMEOUT);
++ mutex_lock(&i2c->lock);
++ if (err == 0) { /* Timeout */
+ i2c->tx_msg = NULL;
+ i2c->rx_msg = NULL;
+ i2c->nmsgs = 0;
+ err = -ETIMEDOUT;
+- goto out;
++ } else if (err < 0) { /* Completion error */
++ i2c->tx_msg = NULL;
++ i2c->rx_msg = NULL;
++ i2c->nmsgs = 0;
++ } else {
++ err = (i2c->state == STATE_DONE) ? num : -EIO;
+ }
+-out:
+ mutex_unlock(&i2c->lock);
+ pm_runtime_mark_last_busy(i2c->dev);
+ pm_runtime_put_autosuspend(i2c->dev);
+@@ -819,7 +823,6 @@ static int xiic_i2c_probe(struct platform_device *pdev)
+ DRIVER_NAME " %s", pdev->name);
+
+ mutex_init(&i2c->lock);
+- init_waitqueue_head(&i2c->wait);
+
+ i2c->clk = devm_clk_get(&pdev->dev, NULL);
+ if (IS_ERR(i2c->clk))
+--
+2.43.0
+
--- /dev/null
+From 3ab766e58da63cef72fe6132d6943d74d5f6ec73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2024 22:16:53 +0200
+Subject: i2c: xiic: Try re-initialization on bus busy timeout
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+[ Upstream commit 1d4a1adbed2582444aaf97671858b7d12915bd05 ]
+
+In the event that the I2C bus was powered down when the I2C controller
+driver loads, or some spurious pulses occur on the I2C bus, it's
+possible that the controller detects a spurious I2C "start" condition.
+In this situation it may continue to report the bus is busy indefinitely
+and block the controller from working.
+
+The "single-master" DT flag can be specified to disable bus busy checks
+entirely, but this may not be safe to use in situations where other I2C
+masters may potentially exist.
+
+In the event that the controller reports "bus busy" for too long when
+starting a transaction, we can try reinitializing the controller to see
+if the busy condition clears. This allows recovering from this scenario.
+
+Fixes: e1d5b6598cdc ("i2c: Add support for Xilinx XPS IIC Bus Interface")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Cc: <stable@vger.kernel.org> # v2.6.34+
+Reviewed-by: Manikanta Guntupalli <manikanta.guntupalli@amd.com>
+Acked-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 41 ++++++++++++++++++++++-------------
+ 1 file changed, 26 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index 1ecd26e673d47..c1065ca54fb3e 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -540,23 +540,11 @@ static int xiic_bus_busy(struct xiic_i2c *i2c)
+ return (sr & XIIC_SR_BUS_BUSY_MASK) ? -EBUSY : 0;
+ }
+
+-static int xiic_busy(struct xiic_i2c *i2c)
++static int xiic_wait_not_busy(struct xiic_i2c *i2c)
+ {
+ int tries = 3;
+ int err;
+
+- if (i2c->tx_msg || i2c->rx_msg)
+- return -EBUSY;
+-
+- /* In single master mode bus can only be busy, when in use by this
+- * driver. If the register indicates bus being busy for some reason we
+- * should ignore it, since bus will never be released and i2c will be
+- * stuck forever.
+- */
+- if (i2c->singlemaster) {
+- return 0;
+- }
+-
+ /* for instance if previous transfer was terminated due to TX error
+ * it might be that the bus is on it's way to become available
+ * give it at most 3 ms to wake
+@@ -710,13 +698,36 @@ static int xiic_start_xfer(struct xiic_i2c *i2c, struct i2c_msg *msgs, int num)
+
+ mutex_lock(&i2c->lock);
+
+- ret = xiic_busy(i2c);
+- if (ret) {
++ if (i2c->tx_msg || i2c->rx_msg) {
+ dev_err(i2c->adap.dev.parent,
+ "cannot start a transfer while busy\n");
++ ret = -EBUSY;
+ goto out;
+ }
+
++ /* In single master mode bus can only be busy, when in use by this
++ * driver. If the register indicates bus being busy for some reason we
++ * should ignore it, since bus will never be released and i2c will be
++ * stuck forever.
++ */
++ if (!i2c->singlemaster) {
++ ret = xiic_wait_not_busy(i2c);
++ if (ret) {
++ /* If the bus is stuck in a busy state, such as due to spurious low
++ * pulses on the bus causing a false start condition to be detected,
++ * then try to recover by re-initializing the controller and check
++ * again if the bus is still busy.
++ */
++ dev_warn(i2c->adap.dev.parent, "I2C bus busy timeout, reinitializing\n");
++ ret = xiic_reinit(i2c);
++ if (ret)
++ goto out;
++ ret = xiic_wait_not_busy(i2c);
++ if (ret)
++ goto out;
++ }
++ }
++
+ i2c->tx_msg = msgs;
+ i2c->rx_msg = NULL;
+ i2c->nmsgs = num;
+--
+2.43.0
+
--- /dev/null
+From 5d57038e7fabcd03072efe01019f3ac70315c33a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 19:10:22 -0700
+Subject: i2c: xiic: xiic_xfer(): Fix runtime PM leak on error path
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+[ Upstream commit d663d93bb47e7ab45602b227701022d8aa16040a ]
+
+The xiic_xfer() function gets a runtime PM reference when the function is
+entered. This reference is released when the function is exited. There is
+currently one error path where the function exits directly, which leads to
+a leak of the runtime PM reference.
+
+Make sure that this error path also releases the runtime PM reference.
+
+Fixes: fdacc3c7405d ("i2c: xiic: Switch from waitqueue to completion")
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Reviewed-by: Michal Simek <michal.simek@amd.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Stable-dep-of: 1d4a1adbed25 ("i2c: xiic: Try re-initialization on bus busy timeout")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-xiic.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index 3444e4d017f7f..695233db07acd 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -744,7 +744,7 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ err = xiic_start_xfer(i2c, msgs, num);
+ if (err < 0) {
+ dev_err(adap->dev.parent, "Error xiic_start_xfer\n");
+- return err;
++ goto out;
+ }
+
+ err = wait_for_completion_timeout(&i2c->completion, XIIC_XFER_TIMEOUT);
+@@ -762,6 +762,8 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
+ err = (i2c->state == STATE_DONE) ? num : -EIO;
+ }
+ mutex_unlock(&i2c->lock);
++
++out:
+ pm_runtime_mark_last_busy(i2c->dev);
+ pm_runtime_put_autosuspend(i2c->dev);
+ return err;
+--
+2.43.0
+
--- /dev/null
+From 9315b42c5602c380b761a56b28f9f5da0ca43959 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Mar 2024 11:37:08 +0100
+Subject: media: usbtv: Remove useless locks in usbtv_video_free()
+
+From: Benjamin Gaignard <benjamin.gaignard@collabora.com>
+
+[ Upstream commit 65e6a2773d655172143cc0b927cdc89549842895 ]
+
+Remove locks calls in usbtv_video_free() because
+are useless and may led to a deadlock as reported here:
+https://syzkaller.appspot.com/x/bisect.txt?x=166dc872180000
+Also remove usbtv_stop() call since it will be called when
+unregistering the device.
+
+Before 'c838530d230b' this issue would only be noticed if you
+disconnect while streaming and now it is noticeable even when
+disconnecting while not streaming.
+
+Fixes: c838530d230b ("media: media videobuf2: Be more flexible on the number of queue stored buffers")
+Fixes: f3d27f34fdd7 ("[media] usbtv: Add driver for Fushicai USBTV007 video frame grabber")
+
+Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
+Reviewed-by: Tomasz Figa <tfiga@chromium.org>
+Tested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+[hverkuil: fix minor spelling mistake in log message]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/usbtv/usbtv-video.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/drivers/media/usb/usbtv/usbtv-video.c b/drivers/media/usb/usbtv/usbtv-video.c
+index a714ad77ca8e2..e5fcf53229812 100644
+--- a/drivers/media/usb/usbtv/usbtv-video.c
++++ b/drivers/media/usb/usbtv/usbtv-video.c
+@@ -959,15 +959,8 @@ int usbtv_video_init(struct usbtv *usbtv)
+
+ void usbtv_video_free(struct usbtv *usbtv)
+ {
+- mutex_lock(&usbtv->vb2q_lock);
+- mutex_lock(&usbtv->v4l2_lock);
+-
+- usbtv_stop(usbtv);
+ vb2_video_unregister_device(&usbtv->vdev);
+ v4l2_device_disconnect(&usbtv->v4l2_dev);
+
+- mutex_unlock(&usbtv->v4l2_lock);
+- mutex_unlock(&usbtv->vb2q_lock);
+-
+ v4l2_device_put(&usbtv->v4l2_dev);
+ }
+--
+2.43.0
+
ipv4-ip_gre-fix-drops-of-small-packets-in-ipgre_xmit.patch
ppp-do-not-assume-bh-is-held-in-ppp_channel_bridge_i.patch
sctp-set-sk_state-back-to-closed-if-autobind-fails-i.patch
+i2c-xiic-fix-broken-locking-on-tx_msg.patch
+i2c-xiic-switch-from-waitqueue-to-completion.patch
+i2c-xiic-fix-rx-irq-busy-check.patch
+i2c-xiic-xiic_xfer-fix-runtime-pm-leak-on-error-path.patch
+i2c-xiic-improve-error-message-when-transfer-fails-t.patch
+i2c-xiic-try-re-initialization-on-bus-busy-timeout.patch
+media-usbtv-remove-useless-locks-in-usbtv_video_free.patch
+alsa-mixer_oss-remove-some-incorrect-kfree_const-usa.patch
+alsa-hda-realtek-fix-the-push-button-function-for-th.patch
+alsa-hda-generic-unconditionally-prefer-preferred_da.patch
+asoc-imx-card-set-card.owner-to-avoid-a-warning-call.patch
+alsa-hda-conexant-fix-conflicting-quirk-for-system76.patch
+f2fs-require-fmode_write-for-atomic-write-ioctls.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
