Updated to 5.19.9

9 files changed, 303 insertions, 114 deletions

diff --git a/0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch b/0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch
index 9a1d231..b1bfa40 100644
--- a/0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch
+++ b/0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch
@@ -1,7 +1,7 @@
-From 94b991f547408a533740c69260971d38cfb01075 Mon Sep 17 00:00:00 2001
+From dd8fc5a102fde53524319e0753af627393db1257 Mon Sep 17 00:00:00 2001
 From: "Jan Alexander Steffens (heftig)" <jan.steffens@gmail.com>
 Date: Mon, 16 Sep 2019 04:53:20 +0200
-Subject: [PATCH 1/7] ZEN: Add sysctl and CONFIG to disallow unprivileged
+Subject: [PATCH 1/8] ZEN: Add sysctl and CONFIG to disallow unprivileged
  CLONE_NEWUSER
 
 Our default behavior continues to match the vanilla kernel.
@@ -63,7 +63,7 @@ index c7900e8975f1..ca4e43b7f31f 100644
  	bool "PID Namespaces"
  	default y
 diff --git a/kernel/fork.c b/kernel/fork.c
-index 9d44f2d46c69..e5ba00a7e3b2 100644
+index d587c85f35b1..3d8e44ef18e5 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
 @@ -99,6 +99,10 @@
@@ -77,7 +77,7 @@ index 9d44f2d46c69..e5ba00a7e3b2 100644
  #include <asm/pgalloc.h>
  #include <linux/uaccess.h>
  #include <asm/mmu_context.h>
-@@ -1995,6 +1999,10 @@ static __latent_entropy struct task_struct *copy_process(
+@@ -1996,6 +2000,10 @@ static __latent_entropy struct task_struct *copy_process(
  	if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
  		return ERR_PTR(-EINVAL);
  
@@ -88,7 +88,7 @@ index 9d44f2d46c69..e5ba00a7e3b2 100644
  	/*
  	 * Thread groups must share signals as well, and detached threads
  	 * can only be started up within the thread group.
-@@ -3143,6 +3151,12 @@ int ksys_unshare(unsigned long unshare_flags)
+@@ -3144,6 +3152,12 @@ int ksys_unshare(unsigned long unshare_flags)
  	if (unshare_flags & CLONE_NEWNS)
  		unshare_flags |= CLONE_FS;
  
diff --git a/0002-drm-i915-psr-Use-full-update-In-case-of-area-calcula.patch b/0002-drm-i915-psr-Use-full-update-In-case-of-area-calcula.patch
index e080fa6..c3e83d6 100644
--- a/0002-drm-i915-psr-Use-full-update-In-case-of-area-calcula.patch
+++ b/0002-drm-i915-psr-Use-full-update-In-case-of-area-calcula.patch
@@ -1,7 +1,7 @@
-From a109628df29f8cde35ffcdeda2d6f5181a85d59c Mon Sep 17 00:00:00 2001
+From 0e5136bc9576232f2d44833d7a15bf2c6c9edbf2 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jouni=20H=C3=B6gander?= <jouni.hogander@intel.com>
 Date: Fri, 13 May 2022 17:28:10 +0300
-Subject: [PATCH 2/7] drm/i915/psr: Use full update In case of area calculation
+Subject: [PATCH 2/8] drm/i915/psr: Use full update In case of area calculation
  fails
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
diff --git a/0003-drm-i915-Ensure-damage-clip-area-is-within-pipe-area.patch b/0003-drm-i915-Ensure-damage-clip-area-is-within-pipe-area.patch
index 625826b..b1f2d43 100644
--- a/0003-drm-i915-Ensure-damage-clip-area-is-within-pipe-area.patch
+++ b/0003-drm-i915-Ensure-damage-clip-area-is-within-pipe-area.patch
@@ -1,7 +1,7 @@
-From 8a07cff9f880a1d528c3d4fd19c3bc3b86fb87f3 Mon Sep 17 00:00:00 2001
+From 871115942e18746d6447d21acd3e29475e462833 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jouni=20H=C3=B6gander?= <jouni.hogander@intel.com>
 Date: Fri, 13 May 2022 17:28:11 +0300
-Subject: [PATCH 3/7] drm/i915: Ensure damage clip area is within pipe area
+Subject: [PATCH 3/8] drm/i915: Ensure damage clip area is within pipe area
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
diff --git a/0004-mm-vmscan-fix-extreme-overreclaim-and-swap-floods.patch b/0004-mm-vmscan-fix-extreme-overreclaim-and-swap-floods.patch
index ee51c1c..b36cf37 100644
--- a/0004-mm-vmscan-fix-extreme-overreclaim-and-swap-floods.patch
+++ b/0004-mm-vmscan-fix-extreme-overreclaim-and-swap-floods.patch
@@ -1,7 +1,7 @@
-From 8da1f278ee7823d1d3d4438131bc0d33f19e9918 Mon Sep 17 00:00:00 2001
+From b9704df188992e9cc80705576d117763666b2ea1 Mon Sep 17 00:00:00 2001
 From: Johannes Weiner <hannes@cmpxchg.org>
 Date: Tue, 2 Aug 2022 12:28:11 -0400
-Subject: [PATCH 4/7] mm: vmscan: fix extreme overreclaim and swap floods
+Subject: [PATCH 4/8] mm: vmscan: fix extreme overreclaim and swap floods
 
 During proactive reclaim, we sometimes observe severe overreclaim,
 with several thousand times more pages reclaimed than requested.
diff --git a/0005-soundwire-intel-use-pm_runtime_resume-on-component-p.patch b/0005-soundwire-intel-use-pm_runtime_resume-on-component-p.patch
index d686ce1..a41c287 100644
--- a/0005-soundwire-intel-use-pm_runtime_resume-on-component-p.patch
+++ b/0005-soundwire-intel-use-pm_runtime_resume-on-component-p.patch
@@ -1,7 +1,7 @@
-From aaaa4d04d55ded0ec738ae5a6f927eeec66434e3 Mon Sep 17 00:00:00 2001
+From da1409fa455e40de842f67a861dd29ce1dddc25b Mon Sep 17 00:00:00 2001
 From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
 Date: Tue, 21 Jun 2022 17:56:40 -0500
-Subject: [PATCH 5/7] soundwire: intel: use pm_runtime_resume() on component
+Subject: [PATCH 5/8] soundwire: intel: use pm_runtime_resume() on component
  probe
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
diff --git a/0006-ALSA-hda-Once-again-fix-regression-of-page-allocatio.patch b/0006-ALSA-hda-Once-again-fix-regression-of-page-allocatio.patch
deleted file mode 100644
index 93ce067..0000000
--- a/0006-ALSA-hda-Once-again-fix-regression-of-page-allocatio.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From a72ed1112caeb42af858924293b47029d7bc8500 Mon Sep 17 00:00:00 2001
-From: Takashi Iwai <tiwai@suse.de>
-Date: Tue, 6 Sep 2022 11:03:19 +0200
-Subject: [PATCH 6/7] ALSA: hda: Once again fix regression of page allocations
- with IOMMU
-
-The last fix for trying to recover the regression on AMD platforms,
-unfortunately, leaded to yet another regression: it turned out that
-IOMMUs don't like the usage of raw page allocations.
-
-This is yet another attempt for addressing the log saga; at this time,
-we re-use the existing buffer allocation mechanism with SG-pages
-although we require only single pages.  The SG buffer allocation
-itself was confirmed to work for stream buffers, so it's relatively
-easy to adapt for other places.
-
-The only problem is: although the HD-audio code is accessing the
-address directly via dmab->address field, SG-pages don't set up it.
-For the ease of adaption, we now set up the dmab->addr field from the
-address of the first page as default, so that it can run with the
-HD-audio driver code as-is without the excessive call of
-snd_sgbuf_get_addr() multiple times; that's the only change in the
-memalloc helper side.  The rest is nothing but a flip of the dma_type
-field in the HD-audio side.
-
-Fixes: a8d302a0b770 ("ALSA: memalloc: Revive x86-specific WC page allocations again")
-Reported-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
-Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
-Cc: <stable@vger.kernel.org>
-Link: https://lore.kernel.org/r/CABXGCsO+kB2t5QyHY-rUe76npr1m0-5JOtt8g8SiHUo34ur7Ww@mail.gmail.com
-Link: https://bugzilla.kernel.org/show_bug.cgi?id=216112
-Link: https://bugzilla.kernel.org/show_bug.cgi?id=216363
-Link: https://lore.kernel.org/r/20220906090319.23358-1-tiwai@suse.de
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
----
- sound/core/memalloc.c     | 9 +++++++--
- sound/pci/hda/hda_intel.c | 2 +-
- 2 files changed, 8 insertions(+), 3 deletions(-)
-
-diff --git a/sound/core/memalloc.c b/sound/core/memalloc.c
-index 55b3c49ba61d..244afc38ddca 100644
---- a/sound/core/memalloc.c
-+++ b/sound/core/memalloc.c
-@@ -535,10 +535,13 @@ static void *snd_dma_noncontig_alloc(struct snd_dma_buffer *dmab, size_t size)
- 	dmab->dev.need_sync = dma_need_sync(dmab->dev.dev,
- 					    sg_dma_address(sgt->sgl));
- 	p = dma_vmap_noncontiguous(dmab->dev.dev, size, sgt);
--	if (p)
-+	if (p) {
- 		dmab->private_data = sgt;
--	else
-+		/* store the first page address for convenience */
-+		dmab->addr = snd_sgbuf_get_addr(dmab, 0);
-+	} else {
- 		dma_free_noncontiguous(dmab->dev.dev, size, sgt, dmab->dev.dir);
-+	}
- 	return p;
- }
- 
-@@ -772,6 +775,8 @@ static void *snd_dma_sg_fallback_alloc(struct snd_dma_buffer *dmab, size_t size)
- 	if (!p)
- 		goto error;
- 	dmab->private_data = sgbuf;
-+	/* store the first page address for convenience */
-+	dmab->addr = snd_sgbuf_get_addr(dmab, 0);
- 	return p;
- 
-  error:
-diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
-index a77165bd92a9..b20694fd69de 100644
---- a/sound/pci/hda/hda_intel.c
-+++ b/sound/pci/hda/hda_intel.c
-@@ -1817,7 +1817,7 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci,
- 
- 	/* use the non-cached pages in non-snoop mode */
- 	if (!azx_snoop(chip))
--		azx_bus(chip)->dma_type = SNDRV_DMA_TYPE_DEV_WC;
-+		azx_bus(chip)->dma_type = SNDRV_DMA_TYPE_DEV_WC_SG;
- 
- 	if (chip->driver_type == AZX_DRIVER_NVIDIA) {
- 		dev_dbg(chip->card->dev, "Enable delay in RIRB handling\n");
--- 
-2.37.2
-
diff --git a/0006-Bluetooth-fix-deadlock-for-RFCOMM-sk-state-change.patch b/0006-Bluetooth-fix-deadlock-for-RFCOMM-sk-state-change.patch
new file mode 100644
index 0000000..b9a5bf6
--- /dev/null
+++ b/0006-Bluetooth-fix-deadlock-for-RFCOMM-sk-state-change.patch
@@ -0,0 +1,231 @@
+From fbfd3021298487e5eba89a3bc398d3f92e36e51d Mon Sep 17 00:00:00 2001
+From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+Date: Mon, 4 Oct 2021 14:07:34 -0400
+Subject: [PATCH 6/8] Bluetooth: fix deadlock for RFCOMM sk state change
+
+Syzbot reports the following task hang [1]:
+
+INFO: task syz-executor255:8499 blocked for more than 143 seconds.
+      Not tainted 5.14.0-rc7-syzkaller #0
+
+Call Trace:
+ context_switch kernel/sched/core.c:4681 [inline]
+ __schedule+0x93a/0x26f0 kernel/sched/core.c:5938
+ schedule+0xd3/0x270 kernel/sched/core.c:6017
+ __lock_sock+0x13d/0x260 net/core/sock.c:2644
+ lock_sock_nested+0xf6/0x120 net/core/sock.c:3185
+ lock_sock include/net/sock.h:1612 [inline]
+ rfcomm_sk_state_change+0xb4/0x390 net/bluetooth/rfcomm/sock.c:73
+ __rfcomm_dlc_close+0x1b6/0x8a0 net/bluetooth/rfcomm/core.c:489
+ rfcomm_dlc_close+0x1ea/0x240 net/bluetooth/rfcomm/core.c:520
+ __rfcomm_sock_close+0xac/0x260 net/bluetooth/rfcomm/sock.c:220
+ rfcomm_sock_shutdown+0xe9/0x210 net/bluetooth/rfcomm/sock.c:931
+ rfcomm_sock_release+0x5f/0x140 net/bluetooth/rfcomm/sock.c:951
+ __sock_release+0xcd/0x280 net/socket.c:649
+ sock_close+0x18/0x20 net/socket.c:1314
+ __fput+0x288/0x920 fs/file_table.c:280
+ task_work_run+0xdd/0x1a0 kernel/task_work.c:164
+ exit_task_work include/linux/task_work.h:32 [inline]
+ do_exit+0xbd4/0x2a60 kernel/exit.c:825
+ do_group_exit+0x125/0x310 kernel/exit.c:922
+ get_signal+0x47f/0x2160 kernel/signal.c:2808
+ arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865
+ handle_signal_work kernel/entry/common.c:148 [inline]
+ exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
+ exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
+ __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
+ syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
+ do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Showing all locks held in the system:
+1 lock held by khungtaskd/1653:
+ #0: ffffffff8b97c280 (rcu_read_lock){....}-{1:2}, at:
+ debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6446
+1 lock held by krfcommd/4781:
+ #0: ffffffff8d306528 (rfcomm_mutex){+.+.}-{3:3}, at:
+ rfcomm_process_sessions net/bluetooth/rfcomm/core.c:1979 [inline]
+ #0: ffffffff8d306528 (rfcomm_mutex){+.+.}-{3:3}, at:
+ rfcomm_run+0x2ed/0x4a20 net/bluetooth/rfcomm/core.c:2086
+2 locks held by in:imklog/8206:
+ #0: ffff8880182ce5f0 (&f->f_pos_lock){+.+.}-{3:3}, at:
+ __fdget_pos+0xe9/0x100 fs/file.c:974
+ #1: ffff8880b9c51a58 (&rq->__lock){-.-.}-{2:2}, at:
+ raw_spin_rq_lock_nested kernel/sched/core.c:460 [inline]
+ #1: ffff8880b9c51a58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock
+ kernel/sched/sched.h:1307 [inline]
+ #1: ffff8880b9c51a58 (&rq->__lock){-.-.}-{2:2}, at: rq_lock
+ kernel/sched/sched.h:1610 [inline]
+ #1: ffff8880b9c51a58 (&rq->__lock){-.-.}-{2:2}, at:
+ __schedule+0x233/0x26f0 kernel/sched/core.c:5852
+4 locks held by syz-executor255/8499:
+ #0: ffff888039a83690 (&sb->s_type->i_mutex_key#13){+.+.}-{3:3}, at:
+ inode_lock include/linux/fs.h:774 [inline]
+ #0: ffff888039a83690 (&sb->s_type->i_mutex_key#13){+.+.}-{3:3}, at:
+ __sock_release+0x86/0x280 net/socket.c:648
+ #1:
+ ffff88802fa31120 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0},
+ at: lock_sock include/net/sock.h:1612 [inline]
+ #1:
+ ffff88802fa31120 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0},
+ at: rfcomm_sock_shutdown+0x54/0x210 net/bluetooth/rfcomm/sock.c:928
+ #2: ffffffff8d306528 (rfcomm_mutex){+.+.}-{3:3}, at:
+ rfcomm_dlc_close+0x34/0x240 net/bluetooth/rfcomm/core.c:507
+ #3: ffff888141bd6d28 (&d->lock){+.+.}-{3:3}, at:
+ __rfcomm_dlc_close+0x162/0x8a0 net/bluetooth/rfcomm/core.c:487
+==================================================================
+
+The task hangs because of a deadlock that occurs when lock_sock() is
+called in rfcomm_sk_state_change(). One such call stack is:
+
+  rfcomm_sock_shutdown():
+    lock_sock();
+    __rfcomm_sock_close():
+      rfcomm_dlc_close():
+        __rfcomm_dlc_close():
+          rfcomm_dlc_lock();
+          rfcomm_sk_state_change():
+            lock_sock();
+
+lock_sock() has to be called when the sk state is changed because the
+lock is not always held when rfcomm_sk_state_change() is
+called. However, besides the recursive deadlock, there is also an
+issue of a lock hierarchy inversion between rfcomm_dlc_lock() and
+lock_sock() if the socket is locked in rfcomm_sk_state_change().
+
+To avoid these issues, we can instead schedule the sk state change in
+the global workqueue. This is already the implicit assumption about
+how sk state changes happen. For example, in rfcomm_sock_shutdown(),
+the call to __rfcomm_sock_close() is followed by
+bt_sock_wait_state().
+
+Additionally, the call to rfcomm_sock_kill() inside
+rfcomm_sk_state_change() should be removed. The socket shouldn't be
+killed here because only rfcomm_sock_release() calls sock_orphan(),
+which it already follows up with a call to rfcomm_sock_kill().
+
+Fixes: b7ce436a5d79 ("Bluetooth: switch to lock_sock in RFCOMM")
+Link: https://syzkaller.appspot.com/bug?extid=7d51f807c81b190a127d [1]
+Reported-by: syzbot+7d51f807c81b190a127d@syzkaller.appspotmail.com
+Tested-by: syzbot+7d51f807c81b190a127d@syzkaller.appspotmail.com
+Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+Cc: Hillf Danton <hdanton@sina.com>
+---
+ include/net/bluetooth/rfcomm.h |  3 +++
+ net/bluetooth/rfcomm/core.c    |  2 ++
+ net/bluetooth/rfcomm/sock.c    | 34 ++++++++++++++++++++++------------
+ 3 files changed, 27 insertions(+), 12 deletions(-)
+
+diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
+index 99d26879b02a..a92799fc5e74 100644
+--- a/include/net/bluetooth/rfcomm.h
++++ b/include/net/bluetooth/rfcomm.h
+@@ -171,6 +171,7 @@ struct rfcomm_dlc {
+ 	struct rfcomm_session *session;
+ 	struct sk_buff_head   tx_queue;
+ 	struct timer_list     timer;
++	struct work_struct    state_change_work;
+ 
+ 	struct mutex  lock;
+ 	unsigned long state;
+@@ -186,6 +187,7 @@ struct rfcomm_dlc {
+ 	u8            sec_level;
+ 	u8            role_switch;
+ 	u32           defer_setup;
++	int           err;
+ 
+ 	uint          mtu;
+ 	uint          cfc;
+@@ -310,6 +312,7 @@ struct rfcomm_pinfo {
+ 	u8     role_switch;
+ };
+ 
++void __rfcomm_sk_state_change(struct work_struct *work);
+ int  rfcomm_init_sockets(void);
+ void rfcomm_cleanup_sockets(void);
+ 
+diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
+index 7324764384b6..c6494e85cd68 100644
+--- a/net/bluetooth/rfcomm/core.c
++++ b/net/bluetooth/rfcomm/core.c
+@@ -289,6 +289,7 @@ static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
+ 	d->flags      = 0;
+ 	d->mscex      = 0;
+ 	d->sec_level  = BT_SECURITY_LOW;
++	d->err        = 0;
+ 	d->mtu        = RFCOMM_DEFAULT_MTU;
+ 	d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
+ 
+@@ -306,6 +307,7 @@ struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
+ 	timer_setup(&d->timer, rfcomm_dlc_timeout, 0);
+ 
+ 	skb_queue_head_init(&d->tx_queue);
++	INIT_WORK(&d->state_change_work, __rfcomm_sk_state_change);
+ 	mutex_init(&d->lock);
+ 	refcount_set(&d->refcnt, 1);
+ 
+diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
+index 4bf4ea6cbb5e..4850dafbaa05 100644
+--- a/net/bluetooth/rfcomm/sock.c
++++ b/net/bluetooth/rfcomm/sock.c
+@@ -61,19 +61,22 @@ static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
+ 		rfcomm_dlc_throttle(d);
+ }
+ 
+-static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
++void __rfcomm_sk_state_change(struct work_struct *work)
+ {
++	struct rfcomm_dlc *d = container_of(work, struct rfcomm_dlc,
++					    state_change_work);
+ 	struct sock *sk = d->owner, *parent;
+ 
+ 	if (!sk)
+ 		return;
+ 
+-	BT_DBG("dlc %p state %ld err %d", d, d->state, err);
+-
+ 	lock_sock(sk);
++	rfcomm_dlc_lock(d);
+ 
+-	if (err)
+-		sk->sk_err = err;
++	BT_DBG("dlc %p state %ld err %d", d, d->state, d->err);
++
++	if (d->err)
++		sk->sk_err = d->err;
+ 
+ 	sk->sk_state = d->state;
+ 
+@@ -91,15 +94,22 @@ static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
+ 		sk->sk_state_change(sk);
+ 	}
+ 
++	rfcomm_dlc_unlock(d);
+ 	release_sock(sk);
++	sock_put(sk);
++}
+ 
+-	if (parent && sock_flag(sk, SOCK_ZAPPED)) {
+-		/* We have to drop DLC lock here, otherwise
+-		 * rfcomm_sock_destruct() will dead lock. */
+-		rfcomm_dlc_unlock(d);
+-		rfcomm_sock_kill(sk);
+-		rfcomm_dlc_lock(d);
+-	}
++static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
++{
++	struct sock *sk = d->owner;
++
++	if (!sk)
++		return;
++
++	d->err = err;
++	sock_hold(sk);
++	if (!schedule_work(&d->state_change_work))
++		sock_put(sk);
+ }
+ 
+ /* ---- Socket functions ---- */
+-- 
+2.37.2
+
diff --git a/0007-ASoC-Intel-sof_sdw-add-support-for-Dell-SKU-0AFF.patch b/0007-ASoC-Intel-sof_sdw-add-support-for-Dell-SKU-0AFF.patch
new file mode 100644
index 0000000..0789532
--- /dev/null
+++ b/0007-ASoC-Intel-sof_sdw-add-support-for-Dell-SKU-0AFF.patch
@@ -0,0 +1,38 @@
+From 607f9debebf0e703fbff44d0d0133dcc7d763f78 Mon Sep 17 00:00:00 2001
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Date: Tue, 13 Sep 2022 10:10:36 +0200
+Subject: [PATCH 7/8] ASoC: Intel: sof_sdw: add support for Dell SKU 0AFF
+
+Yet another SKU that needs a quirk for jack detection and four-speaker
+support.
+
+BugLink: https://github.com/thesofproject/linux/issues/3777
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+---
+ sound/soc/intel/boards/sof_sdw.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index ad826ad82d51..cfeef8994be3 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -256,6 +256,16 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+ 		.driver_data = (void *)(SOF_SDW_TGL_HDMI |
+ 					SOF_SDW_FOUR_SPK),
+ 	},
++	{
++		.callback = sof_sdw_quirk_cb,
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"),
++			DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0AFF")
++		},
++		.driver_data = (void *)(SOF_SDW_TGL_HDMI |
++					RT711_JD2 |
++					SOF_SDW_FOUR_SPK),
++	},
+ 	{
+ 		.callback = sof_sdw_quirk_cb,
+ 		.matches = {
+-- 
+2.37.2
+
diff --git a/PKGBUILD b/PKGBUILD
index 546ecfe..0390831 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -19,7 +19,7 @@ _custom=0
 pkgbase=linux
 _supver=5
 _majver=19
-_minver=8
+_minver=9
 _gccpatchver='20220315'
 _gccpatchker='5.17+'
   if [ "$_minver" == "0" ]; then
@@ -47,7 +47,8 @@ source=(
   0003-drm-i915-Ensure-damage-clip-area-is-within-pipe-area.patch
   0004-mm-vmscan-fix-extreme-overreclaim-and-swap-floods.patch
   0005-soundwire-intel-use-pm_runtime_resume-on-component-p.patch
-  0006-ALSA-hda-Once-again-fix-regression-of-page-allocatio.patch
+  0006-Bluetooth-fix-deadlock-for-RFCOMM-sk-state-change.patch
+  0007-ASoC-Intel-sof_sdw-add-support-for-Dell-SKU-0AFF.patch
   kernel_compiler_patch-${_gccpatchver}.tar.gz::https://github.com/graysky2/kernel_compiler_patch/archive/${_gccpatchver}.tar.gz
   ath9k-regdom-hack.patch
   raid6-default-algo.patch
@@ -57,27 +58,29 @@ validpgpkeys=(
   '647F28654894E3BD457199BE38DBBDC86092693E'  # Greg Kroah-Hartman
 )
 # https://www.kernel.org/pub/linux/kernel/v5.x/sha256sums.asc
-sha256sums=('616308795a952a6a39b4c74807c33916850eb7166d8ed7c9a87a1ba55d7487ce'
+sha256sums=('0ad5b5986693adc1962be807bc3a64423a24b6a9da9df39b259d7e3bfd927f37'
             'SKIP'
             '9c432835f1946ae193f59a2bb31fe1710fc3c19a155e076c61ce8d5c67716085'
-            '01cc6ce2532e8d1e7b09356685bbd6411511db172623dffc9893648cfcec965b'
-            'cb1d989d6d2933aa7014a54ada1d211d1ce7ec4e151b796e31c91b315fcfcdac'
-            'c780396f89f014b8af75a05b46873c9034444ae3fb4f79dfb9573838b4c9e96c'
-            'ff8f03fdb1d47fae5a0b963dce81b07d10bbb2d97e5e7364690f70110e8cf59a'
-            'e29c3d59d7a2fe43fb86d78145f039632c5f124f6a42d712fa99e87fe24ac052'
-            '807d79f002fe0ef0404f20ad28549a2860eb3eb34b297a3fdcd2481d6b7c5a20'
+            '3368a8c950e18e8ed91a30bff8c630bdb3bafb1110aa7ffcbeee74d549044daa'
+            '5aa0ead53e4c9f382f0c99704601eea9a7fb97daba452162a398b78c0aa0aa8b'
+            '8c9e6e262eeea148bbfa09a8a6b6be8551ad2b1fa8cbdf3114739b1cff0b2953'
+            'b470d364fae42003b8b6d9e2913729163d02094de48bc4dfe42910607ca9a30c'
+            '6b77f23e6f9dc059511f1d0e03d18b54abe1d4b2b7d6f7752cb3363731a10242'
+            '59299441f222661a3fa838370408d3a08a04fc5726586fbdb1b2e9b357742964'
+            '11b2c766d1806f5f727fe915a3406a72e0db6553b4949a8279be3a777b628a7e'
             '5a29d172d442a3f31a402d7d306aaa292b0b5ea29139d05080a55e2425f48c5c'
             'e9e0d289170b7fb598b572d9c892ae8d1420952034aa415e8b3334f20a58edcc'
             '6ab863c8cfe6e0dd53a9d6455872fd4391508a8b97ab92e3f13558a6617b12a6')
-b2sums=('59731fb2ceb6b1e6bb79121b0e07c755d2ce37cdf6b82458fe24bf6bb25f88f9d18dd2b657988842bb7b2a1c2ba685fdf3bf130bfca8960b801cd6ee1a973932'
+b2sums=('2f42b30510e8b778e78d5945b8cf0d5f67e95470414043128470108251a10a5a67841f5f508253a3bd93ebc4203a93e9947dcf7f4aabbe37e09390e7b25b52b0'
         'SKIP'
         'db611718464698e8dcc5332d441e0a807b5d6bb42c609b453035a1230b05ee5d7a7cef36a3c3477e389527cf816f645d582f43a50442d66692fe3a5e8a410c69'
-        'fce7cffc63bdee190179171bd3a1b4c63924f6f20fe2cf365ba25763a423ff91e6f83917f5c07e6c436ffcbc5f3b49c474c1e8d430730cbbba7b83c75fb3ccc9'
-        '3ea126197266d596617941c7f36c29e48b5167b817f19ac24485bafd3815e16eb33589432ca038cd283255b5fd4c4d66f0986b0bb50c3fa50022017ee1bf8507'
-        '471201842b50e639fb3b7a9e01ec311a7384c38c3a6678cde02d83e58711c5634e93702aae43b07ca758de8ada5363c2d42ba2c22b9e2e0eeb9a6be6526894b0'
-        '25f6d4310920e7bb72b1da2f208b40b2e65ea1112b7deb24752b5d694155167eb431322c31f9dde5258e7bcf453e0ce0903bc07b1e515fe7cbbda2bec4392637'
-        'c137261768ac53a7e7b97f8f86b563a0f41f077f22297ed3c96ca595345c9fcc040461fd33e83af07223ee20d940afb5b5b2001c6ccf433d79453b3d9c14f912'
-        'fb083e1cb1145a02ab7225240885f40595b86f5440b4b0c52587af4cd4e8395ae212b28754d3541f705e9044b4bc11882d2cd9fb90be2fa92370bbfaac716041'
+        'c5b9d7b7a13c91f9de51a86615744b55cd8992e3f16715ec70887c460ac38a09cd9db85714c106cd5c43faa58587443512b362401bdf1e0b78c551ee6ab1dfdf'
+        '8165c54c90861a41c7ff163f5c5f24849bb3d87067f345fa0b9a7b577c775d748b8fef2efa4decbf03417a4031762e6e26ac4bcae66c6bb55d658f02bb3ce9d0'
+        'a74f5becc6b51efdfd99c7e5433a0b2dac57196c435a5f0682ba80a6254d481984f2c5cd56eb0464d61b9382a7e681f9ea971a81d4aadb122e872c2b6963ec9b'
+        '415f242da94c05f062ff2878f880695c620eae3a1f1fe808fe429056c770f7f69cee9f7269cc8ecdc683ddfd9f697f25d0507b5c929bf4d77b6d15e8e0f31304'
+        '1887b1ed1406c3b998f2888788ea6da08714bf87fcf6fffcca4fc7e63fe4f83f800a754296c7f4cf0bafb0fe95282b85e6a69118dad6b74b6ce29619360792cd'
+        '497de3140fc8d64cbe78c2bdbc6679391209dab64a500c5e007549996b8134e18fb4a4c1979587bc97fda3b5d1bcbab0d47c96355524ed8653ff6d0bb2ce1f49'
+        '2e55a91f28ff9dee28cbab07701c0419c6b29f7982390fdc9e5cefdfe9f658f88b7000cff0f1dd4426afb9df69b33d69cbe9e1d957cc6a1bd95e723ff3c42252'
         '20674a8fcc0a85726e06460a7dbccfe731c46bf377cc3bf511b7591175e7df892f271bc1909e77d9a02913c753d241493502c5ab15d9f78e95f31aa4399c2c27'
         'b6ef77035611139fa9a6d5b8d30570e2781bb4da483bb569884b0bd0129b62e0b82a5a6776fefe43fee801c70d39de1ea4d4c177f7cedd5ac135e3c64f7b895a'
         'e94aa35d92cec92f4b0d487e0569790f3b712b9eaa5107f14a4200578e398ca740bf369f30f070c8beb56a72d1a6d0fc06beb650d798a64f44abe5e3af327728')
@@ -104,7 +107,8 @@ prepare() {
   patch -p1 -i ../0003-drm-i915-Ensure-damage-clip-area-is-within-pipe-area.patch
   patch -p1 -i ../0004-mm-vmscan-fix-extreme-overreclaim-and-swap-floods.patch
   patch -p1 -i ../0005-soundwire-intel-use-pm_runtime_resume-on-component-p.patch
-  patch -p1 -i ../0006-ALSA-hda-Once-again-fix-regression-of-page-allocatio.patch
+  patch -p1 -i ../0006-Bluetooth-fix-deadlock-for-RFCOMM-sk-state-change.patch
+  patch -p1 -i ../0007-ASoC-Intel-sof_sdw-add-support-for-Dell-SKU-0AFF.patch
 
   # graysky gcc patch
   echo "Applying graysky gcc patch"