Update to 5.19.9-1

10 files changed, 306 insertions, 117 deletions

diff --git a/.SRCINFO b/.SRCINFO
index c4c9e0ad78ae..5055c1a22cc7 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,5 +1,5 @@
 pkgbase = linux-ck
-	pkgver = 5.19.8
+	pkgver = 5.19.9
 	pkgrel = 1
 	url = https://wiki.archlinux.org/index.php/Linux-ck
 	arch = x86_64
@@ -11,8 +11,8 @@ pkgbase = linux-ck
 	makedepends = tar
 	makedepends = xz
 	options = !strip
-	source = https://www.kernel.org/pub/linux/kernel/v5.x/linux-5.19.8.tar.xz
-	source = https://www.kernel.org/pub/linux/kernel/v5.x/linux-5.19.8.tar.sign
+	source = https://www.kernel.org/pub/linux/kernel/v5.x/linux-5.19.9.tar.xz
+	source = https://www.kernel.org/pub/linux/kernel/v5.x/linux-5.19.9.tar.sign
 	source = config
 	source = more-uarches-20220315.tar.gz::https://github.com/graysky2/kernel_compiler_patch/archive/20220315.tar.gz
 	source = ck-hrtimer-9b792e6dc19ee6bd70e7c71f579f4d87ff929c60.tar.gz::https://github.com/graysky2/linux-patches/archive/9b792e6dc19ee6bd70e7c71f579f4d87ff929c60.tar.gz
@@ -21,20 +21,22 @@ pkgbase = linux-ck
 	source = 0003-drm-i915-Ensure-damage-clip-area-is-within-pipe-area.patch
 	source = 0004-mm-vmscan-fix-extreme-overreclaim-and-swap-floods.patch
 	source = 0005-soundwire-intel-use-pm_runtime_resume-on-component-p.patch
-	source = 0006-ALSA-hda-Once-again-fix-regression-of-page-allocatio.patch
+	source = 0006-Bluetooth-fix-deadlock-for-RFCOMM-sk-state-change.patch
+	source = 0007-ASoC-Intel-sof_sdw-add-support-for-Dell-SKU-0AFF.patch
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
-	sha256sums = 616308795a952a6a39b4c74807c33916850eb7166d8ed7c9a87a1ba55d7487ce
+	sha256sums = 0ad5b5986693adc1962be807bc3a64423a24b6a9da9df39b259d7e3bfd927f37
 	sha256sums = SKIP
 	sha256sums = ec58b63109b23d318af62b48a4f43e3042ddb45e71060c885d5d03f2cb3760b0
 	sha256sums = 5a29d172d442a3f31a402d7d306aaa292b0b5ea29139d05080a55e2425f48c5c
 	sha256sums = 7037fa27b33666a3bd20c888c667efb218e95e45af8debe591896cc79fe69c76
-	sha256sums = 83a1b84ec09bd349edc4d13aaa6a4066f5aa1416531c06f9f9758dc60fa16cb7
-	sha256sums = a0e101e199949c1571352e4b5b60810db5889f1280392c36ddf54077f9b205f9
-	sha256sums = 320d6e730ea46059b5faae642b3ea7bca13fd87b3520341a67c440495a58ff73
-	sha256sums = 2f3d0db25f54a575a6fd075964309925adaa31edd61979931991c94474cb1513
-	sha256sums = 81d7b8bd2799e3b9146b9c0fa72f0cf469da797d9e955d307775231424e2cf3b
-	sha256sums = 738b731aa36d2ef7986ef80769c471fc7d1d9dd6b3fe307137059ec154e743a3
+	sha256sums = f5b98194f60eddefbf9795f301226ecb8d32d813d9afd5a7c537b2aa6219125b
+	sha256sums = 87432d9a9941b8e569622506f61245dbe7b9352237ca363916ea001998489ba3
+	sha256sums = 6f221e492758fc4e0c7cf1f0954efbf6b069e532ee42ff43e108485d7c30e84b
+	sha256sums = c4005e6dce00f3e6cae5bc64b27b5551f9bb8c990db73162705e34dd3a9f2896
+	sha256sums = ceeed61a6d73cbde0b58f9488477d3f18b66ab6b508ffad8045576bf775e26fb
+	sha256sums = 8da24383e4114aee0da36f9797389ffa6c91e55ca1730526496ac420a15444d9
+	sha256sums = d648e9811694fcd6a7c8b6aa988606f4ebb60e5d8a478f3a6e4778aa91f3070c
 
 pkgname = linux-ck
 	pkgdesc = The Linux kernel and modules with ck's hrtimer patches
diff --git a/0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch b/0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch
index 2f3b6e570002..5a3822c7742d 100644
--- a/0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch
+++ b/0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch
@@ -1,7 +1,7 @@
-From 94b991f547408a533740c69260971d38cfb01075 Mon Sep 17 00:00:00 2001
+From dd8fc5a102fde53524319e0753af627393db1257 Mon Sep 17 00:00:00 2001
 From: "Jan Alexander Steffens (heftig)" <jan.steffens@gmail.com>
 Date: Mon, 16 Sep 2019 04:53:20 +0200
-Subject: [PATCH 1/7] ZEN: Add sysctl and CONFIG to disallow unprivileged
+Subject: [PATCH 1/8] ZEN: Add sysctl and CONFIG to disallow unprivileged
  CLONE_NEWUSER
 
 Our default behavior continues to match the vanilla kernel.
@@ -63,7 +63,7 @@ index c7900e8975f1..ca4e43b7f31f 100644
  	bool "PID Namespaces"
  	default y
 diff --git a/kernel/fork.c b/kernel/fork.c
-index 9d44f2d46c69..e5ba00a7e3b2 100644
+index d587c85f35b1..3d8e44ef18e5 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
 @@ -99,6 +99,10 @@
@@ -77,7 +77,7 @@ index 9d44f2d46c69..e5ba00a7e3b2 100644
  #include <asm/pgalloc.h>
  #include <linux/uaccess.h>
  #include <asm/mmu_context.h>
-@@ -1995,6 +1999,10 @@ static __latent_entropy struct task_struct *copy_process(
+@@ -1996,6 +2000,10 @@ static __latent_entropy struct task_struct *copy_process(
  	if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
  		return ERR_PTR(-EINVAL);
  
@@ -88,7 +88,7 @@ index 9d44f2d46c69..e5ba00a7e3b2 100644
  	/*
  	 * Thread groups must share signals as well, and detached threads
  	 * can only be started up within the thread group.
-@@ -3143,6 +3151,12 @@ int ksys_unshare(unsigned long unshare_flags)
+@@ -3144,6 +3152,12 @@ int ksys_unshare(unsigned long unshare_flags)
  	if (unshare_flags & CLONE_NEWNS)
  		unshare_flags |= CLONE_FS;
  
diff --git a/0002-drm-i915-psr-Use-full-update-In-case-of-area-calcula.patch b/0002-drm-i915-psr-Use-full-update-In-case-of-area-calcula.patch
index ffcc23b4a15d..da47fe3a8b61 100644
--- a/0002-drm-i915-psr-Use-full-update-In-case-of-area-calcula.patch
+++ b/0002-drm-i915-psr-Use-full-update-In-case-of-area-calcula.patch
@@ -1,7 +1,7 @@
-From a109628df29f8cde35ffcdeda2d6f5181a85d59c Mon Sep 17 00:00:00 2001
+From 0e5136bc9576232f2d44833d7a15bf2c6c9edbf2 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jouni=20H=C3=B6gander?= <jouni.hogander@intel.com>
 Date: Fri, 13 May 2022 17:28:10 +0300
-Subject: [PATCH 2/7] drm/i915/psr: Use full update In case of area calculation
+Subject: [PATCH 2/8] drm/i915/psr: Use full update In case of area calculation
  fails
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
diff --git a/0003-drm-i915-Ensure-damage-clip-area-is-within-pipe-area.patch b/0003-drm-i915-Ensure-damage-clip-area-is-within-pipe-area.patch
index 6fe1cad7e326..2e173581e9f5 100644
--- a/0003-drm-i915-Ensure-damage-clip-area-is-within-pipe-area.patch
+++ b/0003-drm-i915-Ensure-damage-clip-area-is-within-pipe-area.patch
@@ -1,7 +1,7 @@
-From 8a07cff9f880a1d528c3d4fd19c3bc3b86fb87f3 Mon Sep 17 00:00:00 2001
+From 871115942e18746d6447d21acd3e29475e462833 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jouni=20H=C3=B6gander?= <jouni.hogander@intel.com>
 Date: Fri, 13 May 2022 17:28:11 +0300
-Subject: [PATCH 3/7] drm/i915: Ensure damage clip area is within pipe area
+Subject: [PATCH 3/8] drm/i915: Ensure damage clip area is within pipe area
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
diff --git a/0004-mm-vmscan-fix-extreme-overreclaim-and-swap-floods.patch b/0004-mm-vmscan-fix-extreme-overreclaim-and-swap-floods.patch
index 6de1bcb3e1b5..6b488ceb9d1a 100644
--- a/0004-mm-vmscan-fix-extreme-overreclaim-and-swap-floods.patch
+++ b/0004-mm-vmscan-fix-extreme-overreclaim-and-swap-floods.patch
@@ -1,7 +1,7 @@
-From 8da1f278ee7823d1d3d4438131bc0d33f19e9918 Mon Sep 17 00:00:00 2001
+From b9704df188992e9cc80705576d117763666b2ea1 Mon Sep 17 00:00:00 2001
 From: Johannes Weiner <hannes@cmpxchg.org>
 Date: Tue, 2 Aug 2022 12:28:11 -0400
-Subject: [PATCH 4/7] mm: vmscan: fix extreme overreclaim and swap floods
+Subject: [PATCH 4/8] mm: vmscan: fix extreme overreclaim and swap floods
 
 During proactive reclaim, we sometimes observe severe overreclaim,
 with several thousand times more pages reclaimed than requested.
diff --git a/0005-soundwire-intel-use-pm_runtime_resume-on-component-p.patch b/0005-soundwire-intel-use-pm_runtime_resume-on-component-p.patch
index 8f79fc15dc28..e6d95db81f19 100644
--- a/0005-soundwire-intel-use-pm_runtime_resume-on-component-p.patch
+++ b/0005-soundwire-intel-use-pm_runtime_resume-on-component-p.patch
@@ -1,7 +1,7 @@
-From aaaa4d04d55ded0ec738ae5a6f927eeec66434e3 Mon Sep 17 00:00:00 2001
+From da1409fa455e40de842f67a861dd29ce1dddc25b Mon Sep 17 00:00:00 2001
 From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
 Date: Tue, 21 Jun 2022 17:56:40 -0500
-Subject: [PATCH 5/7] soundwire: intel: use pm_runtime_resume() on component
+Subject: [PATCH 5/8] soundwire: intel: use pm_runtime_resume() on component
  probe
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
diff --git a/0006-ALSA-hda-Once-again-fix-regression-of-page-allocatio.patch b/0006-ALSA-hda-Once-again-fix-regression-of-page-allocatio.patch
deleted file mode 100644
index 1ac907bc602e..000000000000
--- a/0006-ALSA-hda-Once-again-fix-regression-of-page-allocatio.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-From a72ed1112caeb42af858924293b47029d7bc8500 Mon Sep 17 00:00:00 2001
-From: Takashi Iwai <tiwai@suse.de>
-Date: Tue, 6 Sep 2022 11:03:19 +0200
-Subject: [PATCH 6/7] ALSA: hda: Once again fix regression of page allocations
- with IOMMU
-
-The last fix for trying to recover the regression on AMD platforms,
-unfortunately, leaded to yet another regression: it turned out that
-IOMMUs don't like the usage of raw page allocations.
-
-This is yet another attempt for addressing the log saga; at this time,
-we re-use the existing buffer allocation mechanism with SG-pages
-although we require only single pages.  The SG buffer allocation
-itself was confirmed to work for stream buffers, so it's relatively
-easy to adapt for other places.
-
-The only problem is: although the HD-audio code is accessing the
-address directly via dmab->address field, SG-pages don't set up it.
-For the ease of adaption, we now set up the dmab->addr field from the
-address of the first page as default, so that it can run with the
-HD-audio driver code as-is without the excessive call of
-snd_sgbuf_get_addr() multiple times; that's the only change in the
-memalloc helper side.  The rest is nothing but a flip of the dma_type
-field in the HD-audio side.
-
-Fixes: a8d302a0b770 ("ALSA: memalloc: Revive x86-specific WC page allocations again")
-Reported-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
-Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
-Cc: <stable@vger.kernel.org>
-Link: https://lore.kernel.org/r/CABXGCsO+kB2t5QyHY-rUe76npr1m0-5JOtt8g8SiHUo34ur7Ww@mail.gmail.com
-Link: https://bugzilla.kernel.org/show_bug.cgi?id=216112
-Link: https://bugzilla.kernel.org/show_bug.cgi?id=216363
-Link: https://lore.kernel.org/r/20220906090319.23358-1-tiwai@suse.de
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
----
- sound/core/memalloc.c     | 9 +++++++--
- sound/pci/hda/hda_intel.c | 2 +-
- 2 files changed, 8 insertions(+), 3 deletions(-)
-
-diff --git a/sound/core/memalloc.c b/sound/core/memalloc.c
-index 55b3c49ba61d..244afc38ddca 100644
---- a/sound/core/memalloc.c
-+++ b/sound/core/memalloc.c
-@@ -535,10 +535,13 @@ static void *snd_dma_noncontig_alloc(struct snd_dma_buffer *dmab, size_t size)
- 	dmab->dev.need_sync = dma_need_sync(dmab->dev.dev,
- 					    sg_dma_address(sgt->sgl));
- 	p = dma_vmap_noncontiguous(dmab->dev.dev, size, sgt);
--	if (p)
-+	if (p) {
- 		dmab->private_data = sgt;
--	else
-+		/* store the first page address for convenience */
-+		dmab->addr = snd_sgbuf_get_addr(dmab, 0);
-+	} else {
- 		dma_free_noncontiguous(dmab->dev.dev, size, sgt, dmab->dev.dir);
-+	}
- 	return p;
- }
- 
-@@ -772,6 +775,8 @@ static void *snd_dma_sg_fallback_alloc(struct snd_dma_buffer *dmab, size_t size)
- 	if (!p)
- 		goto error;
- 	dmab->private_data = sgbuf;
-+	/* store the first page address for convenience */
-+	dmab->addr = snd_sgbuf_get_addr(dmab, 0);
- 	return p;
- 
-  error:
-diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
-index a77165bd92a9..b20694fd69de 100644
---- a/sound/pci/hda/hda_intel.c
-+++ b/sound/pci/hda/hda_intel.c
-@@ -1817,7 +1817,7 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci,
- 
- 	/* use the non-cached pages in non-snoop mode */
- 	if (!azx_snoop(chip))
--		azx_bus(chip)->dma_type = SNDRV_DMA_TYPE_DEV_WC;
-+		azx_bus(chip)->dma_type = SNDRV_DMA_TYPE_DEV_WC_SG;
- 
- 	if (chip->driver_type == AZX_DRIVER_NVIDIA) {
- 		dev_dbg(chip->card->dev, "Enable delay in RIRB handling\n");
--- 
-2.37.3
-
diff --git a/0006-Bluetooth-fix-deadlock-for-RFCOMM-sk-state-change.patch b/0006-Bluetooth-fix-deadlock-for-RFCOMM-sk-state-change.patch
new file mode 100644
index 000000000000..6e3b92597bcd
--- /dev/null
+++ b/0006-Bluetooth-fix-deadlock-for-RFCOMM-sk-state-change.patch
@@ -0,0 +1,231 @@
+From fbfd3021298487e5eba89a3bc398d3f92e36e51d Mon Sep 17 00:00:00 2001
+From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+Date: Mon, 4 Oct 2021 14:07:34 -0400
+Subject: [PATCH 6/8] Bluetooth: fix deadlock for RFCOMM sk state change
+
+Syzbot reports the following task hang [1]:
+
+INFO: task syz-executor255:8499 blocked for more than 143 seconds.
+      Not tainted 5.14.0-rc7-syzkaller #0
+
+Call Trace:
+ context_switch kernel/sched/core.c:4681 [inline]
+ __schedule+0x93a/0x26f0 kernel/sched/core.c:5938
+ schedule+0xd3/0x270 kernel/sched/core.c:6017
+ __lock_sock+0x13d/0x260 net/core/sock.c:2644
+ lock_sock_nested+0xf6/0x120 net/core/sock.c:3185
+ lock_sock include/net/sock.h:1612 [inline]
+ rfcomm_sk_state_change+0xb4/0x390 net/bluetooth/rfcomm/sock.c:73
+ __rfcomm_dlc_close+0x1b6/0x8a0 net/bluetooth/rfcomm/core.c:489
+ rfcomm_dlc_close+0x1ea/0x240 net/bluetooth/rfcomm/core.c:520
+ __rfcomm_sock_close+0xac/0x260 net/bluetooth/rfcomm/sock.c:220
+ rfcomm_sock_shutdown+0xe9/0x210 net/bluetooth/rfcomm/sock.c:931
+ rfcomm_sock_release+0x5f/0x140 net/bluetooth/rfcomm/sock.c:951
+ __sock_release+0xcd/0x280 net/socket.c:649
+ sock_close+0x18/0x20 net/socket.c:1314
+ __fput+0x288/0x920 fs/file_table.c:280
+ task_work_run+0xdd/0x1a0 kernel/task_work.c:164
+ exit_task_work include/linux/task_work.h:32 [inline]
+ do_exit+0xbd4/0x2a60 kernel/exit.c:825
+ do_group_exit+0x125/0x310 kernel/exit.c:922
+ get_signal+0x47f/0x2160 kernel/signal.c:2808
+ arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865
+ handle_signal_work kernel/entry/common.c:148 [inline]
+ exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
+ exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
+ __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
+ syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
+ do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+
+Showing all locks held in the system:
+1 lock held by khungtaskd/1653:
+ #0: ffffffff8b97c280 (rcu_read_lock){....}-{1:2}, at:
+ debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6446
+1 lock held by krfcommd/4781:
+ #0: ffffffff8d306528 (rfcomm_mutex){+.+.}-{3:3}, at:
+ rfcomm_process_sessions net/bluetooth/rfcomm/core.c:1979 [inline]
+ #0: ffffffff8d306528 (rfcomm_mutex){+.+.}-{3:3}, at:
+ rfcomm_run+0x2ed/0x4a20 net/bluetooth/rfcomm/core.c:2086
+2 locks held by in:imklog/8206:
+ #0: ffff8880182ce5f0 (&f->f_pos_lock){+.+.}-{3:3}, at:
+ __fdget_pos+0xe9/0x100 fs/file.c:974
+ #1: ffff8880b9c51a58 (&rq->__lock){-.-.}-{2:2}, at:
+ raw_spin_rq_lock_nested kernel/sched/core.c:460 [inline]
+ #1: ffff8880b9c51a58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock
+ kernel/sched/sched.h:1307 [inline]
+ #1: ffff8880b9c51a58 (&rq->__lock){-.-.}-{2:2}, at: rq_lock
+ kernel/sched/sched.h:1610 [inline]
+ #1: ffff8880b9c51a58 (&rq->__lock){-.-.}-{2:2}, at:
+ __schedule+0x233/0x26f0 kernel/sched/core.c:5852
+4 locks held by syz-executor255/8499:
+ #0: ffff888039a83690 (&sb->s_type->i_mutex_key#13){+.+.}-{3:3}, at:
+ inode_lock include/linux/fs.h:774 [inline]
+ #0: ffff888039a83690 (&sb->s_type->i_mutex_key#13){+.+.}-{3:3}, at:
+ __sock_release+0x86/0x280 net/socket.c:648
+ #1:
+ ffff88802fa31120 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0},
+ at: lock_sock include/net/sock.h:1612 [inline]
+ #1:
+ ffff88802fa31120 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0},
+ at: rfcomm_sock_shutdown+0x54/0x210 net/bluetooth/rfcomm/sock.c:928
+ #2: ffffffff8d306528 (rfcomm_mutex){+.+.}-{3:3}, at:
+ rfcomm_dlc_close+0x34/0x240 net/bluetooth/rfcomm/core.c:507
+ #3: ffff888141bd6d28 (&d->lock){+.+.}-{3:3}, at:
+ __rfcomm_dlc_close+0x162/0x8a0 net/bluetooth/rfcomm/core.c:487
+==================================================================
+
+The task hangs because of a deadlock that occurs when lock_sock() is
+called in rfcomm_sk_state_change(). One such call stack is:
+
+  rfcomm_sock_shutdown():
+    lock_sock();
+    __rfcomm_sock_close():
+      rfcomm_dlc_close():
+        __rfcomm_dlc_close():
+          rfcomm_dlc_lock();
+          rfcomm_sk_state_change():
+            lock_sock();
+
+lock_sock() has to be called when the sk state is changed because the
+lock is not always held when rfcomm_sk_state_change() is
+called. However, besides the recursive deadlock, there is also an
+issue of a lock hierarchy inversion between rfcomm_dlc_lock() and
+lock_sock() if the socket is locked in rfcomm_sk_state_change().
+
+To avoid these issues, we can instead schedule the sk state change in
+the global workqueue. This is already the implicit assumption about
+how sk state changes happen. For example, in rfcomm_sock_shutdown(),
+the call to __rfcomm_sock_close() is followed by
+bt_sock_wait_state().
+
+Additionally, the call to rfcomm_sock_kill() inside
+rfcomm_sk_state_change() should be removed. The socket shouldn't be
+killed here because only rfcomm_sock_release() calls sock_orphan(),
+which it already follows up with a call to rfcomm_sock_kill().
+
+Fixes: b7ce436a5d79 ("Bluetooth: switch to lock_sock in RFCOMM")
+Link: https://syzkaller.appspot.com/bug?extid=7d51f807c81b190a127d [1]
+Reported-by: syzbot+7d51f807c81b190a127d@syzkaller.appspotmail.com
+Tested-by: syzbot+7d51f807c81b190a127d@syzkaller.appspotmail.com
+Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
+Cc: Hillf Danton <hdanton@sina.com>
+---
+ include/net/bluetooth/rfcomm.h |  3 +++
+ net/bluetooth/rfcomm/core.c    |  2 ++
+ net/bluetooth/rfcomm/sock.c    | 34 ++++++++++++++++++++++------------
+ 3 files changed, 27 insertions(+), 12 deletions(-)
+
+diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
+index 99d26879b02a..a92799fc5e74 100644
+--- a/include/net/bluetooth/rfcomm.h
++++ b/include/net/bluetooth/rfcomm.h
+@@ -171,6 +171,7 @@ struct rfcomm_dlc {
+ 	struct rfcomm_session *session;
+ 	struct sk_buff_head   tx_queue;
+ 	struct timer_list     timer;
++	struct work_struct    state_change_work;
+ 
+ 	struct mutex  lock;
+ 	unsigned long state;
+@@ -186,6 +187,7 @@ struct rfcomm_dlc {
+ 	u8            sec_level;
+ 	u8            role_switch;
+ 	u32           defer_setup;
++	int           err;
+ 
+ 	uint          mtu;
+ 	uint          cfc;
+@@ -310,6 +312,7 @@ struct rfcomm_pinfo {
+ 	u8     role_switch;
+ };
+ 
++void __rfcomm_sk_state_change(struct work_struct *work);
+ int  rfcomm_init_sockets(void);
+ void rfcomm_cleanup_sockets(void);
+ 
+diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
+index 7324764384b6..c6494e85cd68 100644
+--- a/net/bluetooth/rfcomm/core.c
++++ b/net/bluetooth/rfcomm/core.c
+@@ -289,6 +289,7 @@ static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
+ 	d->flags      = 0;
+ 	d->mscex      = 0;
+ 	d->sec_level  = BT_SECURITY_LOW;
++	d->err        = 0;
+ 	d->mtu        = RFCOMM_DEFAULT_MTU;
+ 	d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
+ 
+@@ -306,6 +307,7 @@ struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
+ 	timer_setup(&d->timer, rfcomm_dlc_timeout, 0);
+ 
+ 	skb_queue_head_init(&d->tx_queue);
++	INIT_WORK(&d->state_change_work, __rfcomm_sk_state_change);
+ 	mutex_init(&d->lock);
+ 	refcount_set(&d->refcnt, 1);
+ 
+diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
+index 4bf4ea6cbb5e..4850dafbaa05 100644
+--- a/net/bluetooth/rfcomm/sock.c
++++ b/net/bluetooth/rfcomm/sock.c
+@@ -61,19 +61,22 @@ static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
+ 		rfcomm_dlc_throttle(d);
+ }
+ 
+-static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
++void __rfcomm_sk_state_change(struct work_struct *work)
+ {
++	struct rfcomm_dlc *d = container_of(work, struct rfcomm_dlc,
++					    state_change_work);
+ 	struct sock *sk = d->owner, *parent;
+ 
+ 	if (!sk)
+ 		return;
+ 
+-	BT_DBG("dlc %p state %ld err %d", d, d->state, err);
+-
+ 	lock_sock(sk);
++	rfcomm_dlc_lock(d);
+ 
+-	if (err)
+-		sk->sk_err = err;
++	BT_DBG("dlc %p state %ld err %d", d, d->state, d->err);
++
++	if (d->err)
++		sk->sk_err = d->err;
+ 
+ 	sk->sk_state = d->state;
+ 
+@@ -91,15 +94,22 @@ static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
+ 		sk->sk_state_change(sk);
+ 	}
+ 
++	rfcomm_dlc_unlock(d);
+ 	release_sock(sk);
++	sock_put(sk);
++}
+ 
+-	if (parent && sock_flag(sk, SOCK_ZAPPED)) {
+-		/* We have to drop DLC lock here, otherwise
+-		 * rfcomm_sock_destruct() will dead lock. */
+-		rfcomm_dlc_unlock(d);
+-		rfcomm_sock_kill(sk);
+-		rfcomm_dlc_lock(d);
+-	}
++static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
++{
++	struct sock *sk = d->owner;
++
++	if (!sk)
++		return;
++
++	d->err = err;
++	sock_hold(sk);
++	if (!schedule_work(&d->state_change_work))
++		sock_put(sk);
+ }
+ 
+ /* ---- Socket functions ---- */
+-- 
+2.37.3
+
diff --git a/0007-ASoC-Intel-sof_sdw-add-support-for-Dell-SKU-0AFF.patch b/0007-ASoC-Intel-sof_sdw-add-support-for-Dell-SKU-0AFF.patch
new file mode 100644
index 000000000000..5d070ad3975a
--- /dev/null
+++ b/0007-ASoC-Intel-sof_sdw-add-support-for-Dell-SKU-0AFF.patch
@@ -0,0 +1,38 @@
+From 607f9debebf0e703fbff44d0d0133dcc7d763f78 Mon Sep 17 00:00:00 2001
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Date: Tue, 13 Sep 2022 10:10:36 +0200
+Subject: [PATCH 7/8] ASoC: Intel: sof_sdw: add support for Dell SKU 0AFF
+
+Yet another SKU that needs a quirk for jack detection and four-speaker
+support.
+
+BugLink: https://github.com/thesofproject/linux/issues/3777
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+---
+ sound/soc/intel/boards/sof_sdw.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c
+index ad826ad82d51..cfeef8994be3 100644
+--- a/sound/soc/intel/boards/sof_sdw.c
++++ b/sound/soc/intel/boards/sof_sdw.c
+@@ -256,6 +256,16 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {
+ 		.driver_data = (void *)(SOF_SDW_TGL_HDMI |
+ 					SOF_SDW_FOUR_SPK),
+ 	},
++	{
++		.callback = sof_sdw_quirk_cb,
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc"),
++			DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "0AFF")
++		},
++		.driver_data = (void *)(SOF_SDW_TGL_HDMI |
++					RT711_JD2 |
++					SOF_SDW_FOUR_SPK),
++	},
+ 	{
+ 		.callback = sof_sdw_quirk_cb,
+ 		.matches = {
+-- 
+2.37.3
+
diff --git a/PKGBUILD b/PKGBUILD
index 31ca9025f806..7dc9e3851ad4 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -68,7 +68,7 @@ _subarch=
 
 ### IMPORTANT: Do no edit below this line unless you know what you're doing
 pkgbase=linux-ck
-pkgver=5.19.8
+pkgver=5.19.9
 pkgrel=1
 arch=(x86_64)
 url="https://wiki.archlinux.org/index.php/Linux-ck"
@@ -95,23 +95,25 @@ source=(
   0003-drm-i915-Ensure-damage-clip-area-is-within-pipe-area.patch
   0004-mm-vmscan-fix-extreme-overreclaim-and-swap-floods.patch
   0005-soundwire-intel-use-pm_runtime_resume-on-component-p.patch
-  0006-ALSA-hda-Once-again-fix-regression-of-page-allocatio.patch
+  0006-Bluetooth-fix-deadlock-for-RFCOMM-sk-state-change.patch
+  0007-ASoC-Intel-sof_sdw-add-support-for-Dell-SKU-0AFF.patch
 )
 validpgpkeys=(
   'ABAF11C65A2970B130ABE3C479BE3E4300411886'  # Linus Torvalds
   '647F28654894E3BD457199BE38DBBDC86092693E'  # Greg Kroah-Hartman
 )
-sha256sums=('616308795a952a6a39b4c74807c33916850eb7166d8ed7c9a87a1ba55d7487ce'
+sha256sums=('0ad5b5986693adc1962be807bc3a64423a24b6a9da9df39b259d7e3bfd927f37'
             'SKIP'
             'ec58b63109b23d318af62b48a4f43e3042ddb45e71060c885d5d03f2cb3760b0'
             '5a29d172d442a3f31a402d7d306aaa292b0b5ea29139d05080a55e2425f48c5c'
             '7037fa27b33666a3bd20c888c667efb218e95e45af8debe591896cc79fe69c76'
-            '83a1b84ec09bd349edc4d13aaa6a4066f5aa1416531c06f9f9758dc60fa16cb7'
-            'a0e101e199949c1571352e4b5b60810db5889f1280392c36ddf54077f9b205f9'
-            '320d6e730ea46059b5faae642b3ea7bca13fd87b3520341a67c440495a58ff73'
-            '2f3d0db25f54a575a6fd075964309925adaa31edd61979931991c94474cb1513'
-            '81d7b8bd2799e3b9146b9c0fa72f0cf469da797d9e955d307775231424e2cf3b'
-            '738b731aa36d2ef7986ef80769c471fc7d1d9dd6b3fe307137059ec154e743a3')
+            'f5b98194f60eddefbf9795f301226ecb8d32d813d9afd5a7c537b2aa6219125b'
+            '87432d9a9941b8e569622506f61245dbe7b9352237ca363916ea001998489ba3'
+            '6f221e492758fc4e0c7cf1f0954efbf6b069e532ee42ff43e108485d7c30e84b'
+            'c4005e6dce00f3e6cae5bc64b27b5551f9bb8c990db73162705e34dd3a9f2896'
+            'ceeed61a6d73cbde0b58f9488477d3f18b66ab6b508ffad8045576bf775e26fb'
+            '8da24383e4114aee0da36f9797389ffa6c91e55ca1730526496ac420a15444d9'
+            'd648e9811694fcd6a7c8b6aa988606f4ebb60e5d8a478f3a6e4778aa91f3070c')
 
 prepare() {
   cd linux-${pkgver}