--- /dev/null
+From e549d190f7b5f94e9ab36bd965028112914d010d Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Fri, 1 Apr 2016 11:00:15 +0800
+Subject: ALSA: hda - fix front mic problem for a HP desktop
+
+From: Hui Wang <hui.wang@canonical.com>
+
+commit e549d190f7b5f94e9ab36bd965028112914d010d upstream.
+
+The front mic jack (pink color) can't detect any plug or unplug. After
+applying this fix, both detecting function and recording function
+work well.
+
+BugLink: https://bugs.launchpad.net/bugs/1564712
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4759,6 +4759,7 @@ enum {
+ ALC255_FIXUP_DELL_SPK_NOISE,
+ ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC280_FIXUP_HP_HEADSET_MIC,
++ ALC221_FIXUP_HP_FRONT_MIC,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -5401,6 +5402,13 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MIC,
+ },
++ [ALC221_FIXUP_HP_FRONT_MIC] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x02a19020 }, /* Front Mic */
++ { }
++ },
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -5506,6 +5514,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
--- /dev/null
+From f883982dc1b117f04579f0896821cd9f2e397f94 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 25 Feb 2016 14:31:59 +0100
+Subject: ALSA: hda - Fix headset support and noise on HP EliteBook 755 G2
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit f883982dc1b117f04579f0896821cd9f2e397f94 upstream.
+
+HP EliteBook 755 G2 with ALC3228 (ALC280) codec [103c:221c] requires
+the known fixup (ALC269_FIXUP_HEADSET_MIC) for making the headset mic
+working. Also, it suffers from the loopback noise problem, so we
+should disable aamix path as well.
+
+Reported-by: Derick Eddington <derick.eddington@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4758,6 +4758,7 @@ enum {
+ ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY,
+ ALC255_FIXUP_DELL_SPK_NOISE,
+ ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
++ ALC280_FIXUP_HP_HEADSET_MIC,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -5394,6 +5395,12 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE
+ },
++ [ALC280_FIXUP_HP_HEADSET_MIC] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_disable_aamix,
++ .chained = true,
++ .chain_id = ALC269_FIXUP_HEADSET_MIC,
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -5498,6 +5505,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x2335, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++ SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
--- /dev/null
+From 2ae955774f29bbd7d16149cb0ae8d0319bf2ecc4 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Thu, 25 Feb 2016 09:37:05 +0100
+Subject: ALSA: hda - Fixup speaker pass-through control for nid 0x14 on ALC225
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit 2ae955774f29bbd7d16149cb0ae8d0319bf2ecc4 upstream.
+
+On one of the machines we enable, we found that the actual speaker volume
+did not always correspond to the volume set in alsamixer. This patch
+fixes that problem.
+
+This patch was orginally written by Kailang @ Realtek, I've rebased it
+to fit sound git master.
+
+BugLink: https://bugs.launchpad.net/bugs/1549660
+Co-Authored-By: Kailang <kailang@realtek.com>
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -3801,6 +3801,10 @@ static void alc_headset_mode_mic_in(stru
+
+ static void alc_headset_mode_default(struct hda_codec *codec)
+ {
++ static struct coef_fw coef0225[] = {
++ UPDATE_COEF(0x45, 0x3f<<10, 0x34<<10),
++ {}
++ };
+ static struct coef_fw coef0255[] = {
+ WRITE_COEF(0x45, 0xc089),
+ WRITE_COEF(0x45, 0xc489),
+@@ -3842,6 +3846,9 @@ static void alc_headset_mode_default(str
+ };
+
+ switch (codec->core.vendor_id) {
++ case 0x10ec0225:
++ alc_process_coef_fw(codec, coef0225);
++ break;
+ case 0x10ec0255:
+ case 0x10ec0256:
+ alc_process_coef_fw(codec, coef0255);
+@@ -4750,6 +4757,7 @@ enum {
+ ALC293_FIXUP_LENOVO_SPK_NOISE,
+ ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY,
+ ALC255_FIXUP_DELL_SPK_NOISE,
++ ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -5375,6 +5383,17 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
+ },
++ [ALC225_FIXUP_DELL1_MIC_NO_PRESENCE] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ /* Disable pass-through path for FRONT 14h */
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x36 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x57d7 },
++ {}
++ },
++ .chained = true,
++ .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -5648,10 +5667,10 @@ static const struct hda_model_fixup alc2
+ {0x21, 0x03211020}
+
+ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+- SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
++ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC225_STANDARD_PINS,
+ {0x14, 0x901701a0}),
+- SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
++ SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC225_STANDARD_PINS,
+ {0x14, 0x901701b0}),
+ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL2_MIC_NO_PRESENCE,
--- /dev/null
+From c636b95ec5980345674ad7960a3c67135a84b687 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Mon, 11 Apr 2016 16:55:26 +0200
+Subject: ALSA: hda/realtek - Enable the ALC292 dock fixup on the Thinkpad T460s
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit c636b95ec5980345674ad7960a3c67135a84b687 upstream.
+
+The Lenovo Thinkpad T460s requires the alc_fixup_tpt440_dock as well in
+order to get working sound output on the docking stations headphone jack.
+
+Patch tested on a Thinkpad T460s (20F9CT01WW) using a ThinkPad Ultradock
+on kernel 4.4.6.
+
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Tested-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4760,6 +4760,7 @@ enum {
+ ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC280_FIXUP_HP_HEADSET_MIC,
+ ALC221_FIXUP_HP_FRONT_MIC,
++ ALC292_FIXUP_TPT460,
+ };
+
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -5409,6 +5410,12 @@ static const struct hda_fixup alc269_fix
+ { }
+ },
+ },
++ [ALC292_FIXUP_TPT460] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_tpt440_dock,
++ .chained = true,
++ .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE,
++ },
+ };
+
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -5563,7 +5570,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x2218, "Thinkpad X1 Carbon 2nd", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
+- SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
++ SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC292_FIXUP_TPT460),
+ SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+@@ -5658,6 +5665,7 @@ static const struct hda_model_fixup alc2
+ {.id = ALC283_FIXUP_SENSE_COMBO_JACK, .name = "alc283-sense-combo"},
+ {.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"},
+ {.id = ALC292_FIXUP_TPT440, .name = "tpt440"},
++ {.id = ALC292_FIXUP_TPT460, .name = "tpt460"},
+ {}
+ };
+ #define ALC225_STANDARD_PINS \
--- /dev/null
+From b4203ff5464da00b7812e7b480192745b0d66bbf Mon Sep 17 00:00:00 2001
+From: Dennis Kadioglu <denk@post.com>
+Date: Wed, 6 Apr 2016 08:39:01 +0200
+Subject: ALSA: usb-audio: Add a quirk for Plantronics BT300
+
+From: Dennis Kadioglu <denk@post.com>
+
+commit b4203ff5464da00b7812e7b480192745b0d66bbf upstream.
+
+Plantronics BT300 does not support reading the sample rate which leads
+to many lines of "cannot get freq at ep 0x1". This patch adds the USB
+ID of the BT300 to quirks.c and avoids those error messages.
+
+Signed-off-by: Dennis Kadioglu <denk@post.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1135,6 +1135,7 @@ bool snd_usb_get_sample_rate_quirk(struc
+ case USB_ID(0x045E, 0x076F): /* MS Lifecam HD-6000 */
+ case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */
+ case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */
++ case USB_ID(0x047F, 0x0415): /* Plantronics BT-300 */
+ case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */
+ case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
+ case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
--- /dev/null
+From f03b24a851d32ca85dacab01785b24a7ee717d37 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 4 Apr 2016 11:47:50 +0200
+Subject: ALSA: usb-audio: Add a sample rate quirk for Phoenix Audio TMX320
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit f03b24a851d32ca85dacab01785b24a7ee717d37 upstream.
+
+Phoenix Audio TMX320 gives the similar error when the sample rate is
+asked:
+ usb 2-1.3: 2:1: cannot get freq at ep 0x85
+ usb 2-1.3: 1:1: cannot get freq at ep 0x2
+ ....
+
+Add the corresponding USB-device ID (1de7:0014) to
+snd_usb_get_sample_rate_quirk() list.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=110221
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1138,6 +1138,7 @@ bool snd_usb_get_sample_rate_quirk(struc
+ case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */
+ case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
+ case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
++ case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */
+ case USB_ID(0x21B4, 0x0081): /* AudioQuest DragonFly */
+ return true;
+ }
--- /dev/null
+From adcdd0d5a1cb779f6d455ae70882c19c527627a8 Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Tue, 12 Apr 2016 10:55:03 +0800
+Subject: ALSA: usb-audio: Skip volume controls triggers hangup on Dell USB Dock
+
+From: Kailang Yang <kailang@realtek.com>
+
+commit adcdd0d5a1cb779f6d455ae70882c19c527627a8 upstream.
+
+This is Dell usb dock audio workaround.
+It was fixed the master volume keep lower.
+
+[Some background: the patch essentially skips the controls of a couple
+ of FU volumes. Although the firmware exposes the dB and the value
+ information via the usb descriptor, changing the values (we set the
+ min volume as default) screws up the device. Although this has been
+ fixed in the newer firmware, the devices are shipped with the old
+ firmware, thus we need the workaround in the driver side. -- tiwai]
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/mixer_maps.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -349,6 +349,16 @@ static struct usbmix_name_map bose_compa
+ };
+
+ /*
++ * Dell usb dock with ALC4020 codec had a firmware problem where it got
++ * screwed up when zero volume is passed; just skip it as a workaround
++ */
++static const struct usbmix_name_map dell_alc4020_map[] = {
++ { 16, NULL },
++ { 19, NULL },
++ { 0 }
++};
++
++/*
+ * Control map entries
+ */
+
+@@ -431,6 +441,10 @@ static struct usbmix_ctl_map usbmix_ctl_
+ .map = aureon_51_2_map,
+ },
+ {
++ .id = USB_ID(0x0bda, 0x4014),
++ .map = dell_alc4020_map,
++ },
++ {
+ .id = USB_ID(0x0dba, 0x1000),
+ .map = mbox1_map,
+ },
--- /dev/null
+From 972e6a993f278b416a8ee3ec65475724fc36feb2 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Wed, 23 Mar 2016 12:17:09 -0400
+Subject: HID: usbhid: fix inconsistent reset/resume/reset-resume behavior
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 972e6a993f278b416a8ee3ec65475724fc36feb2 upstream.
+
+The usbhid driver has inconsistently duplicated code in its post-reset,
+resume, and reset-resume pathways.
+
+ reset-resume doesn't check HID_STARTED before trying to
+ restart the I/O queues.
+
+ resume fails to clear the HID_SUSPENDED flag if HID_STARTED
+ isn't set.
+
+ resume calls usbhid_restart_queues() with usbhid->lock held
+ and the others call it without holding the lock.
+
+The first item in particular causes a problem following a reset-resume
+if the driver hasn't started up its I/O. URB submission fails because
+usbhid->urbin is NULL, and this triggers an unending reset-retry loop.
+
+This patch fixes the problem by creating a new subroutine,
+hid_restart_io(), to carry out all the common activities. It also
+adds some checks that were missing in the original code:
+
+ After a reset, there's no need to clear any halted endpoints.
+
+ After a resume, if a reset is pending there's no need to
+ restart any I/O until the reset is finished.
+
+ After a resume, if the interrupt-IN endpoint is halted there's
+ no need to submit the input URB until the halt has been
+ cleared.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Daniel Fraga <fragabr@gmail.com>
+Tested-by: Daniel Fraga <fragabr@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/usbhid/hid-core.c | 73 +++++++++++++++++++++---------------------
+ 1 file changed, 37 insertions(+), 36 deletions(-)
+
+--- a/drivers/hid/usbhid/hid-core.c
++++ b/drivers/hid/usbhid/hid-core.c
+@@ -951,14 +951,6 @@ static int usbhid_output_report(struct h
+ return ret;
+ }
+
+-static void usbhid_restart_queues(struct usbhid_device *usbhid)
+-{
+- if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl))
+- usbhid_restart_out_queue(usbhid);
+- if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl))
+- usbhid_restart_ctrl_queue(usbhid);
+-}
+-
+ static void hid_free_buffers(struct usb_device *dev, struct hid_device *hid)
+ {
+ struct usbhid_device *usbhid = hid->driver_data;
+@@ -1404,6 +1396,37 @@ static void hid_cease_io(struct usbhid_d
+ usb_kill_urb(usbhid->urbout);
+ }
+
++static void hid_restart_io(struct hid_device *hid)
++{
++ struct usbhid_device *usbhid = hid->driver_data;
++ int clear_halt = test_bit(HID_CLEAR_HALT, &usbhid->iofl);
++ int reset_pending = test_bit(HID_RESET_PENDING, &usbhid->iofl);
++
++ spin_lock_irq(&usbhid->lock);
++ clear_bit(HID_SUSPENDED, &usbhid->iofl);
++ usbhid_mark_busy(usbhid);
++
++ if (clear_halt || reset_pending)
++ schedule_work(&usbhid->reset_work);
++ usbhid->retry_delay = 0;
++ spin_unlock_irq(&usbhid->lock);
++
++ if (reset_pending || !test_bit(HID_STARTED, &usbhid->iofl))
++ return;
++
++ if (!clear_halt) {
++ if (hid_start_in(hid) < 0)
++ hid_io_error(hid);
++ }
++
++ spin_lock_irq(&usbhid->lock);
++ if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl))
++ usbhid_restart_out_queue(usbhid);
++ if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl))
++ usbhid_restart_ctrl_queue(usbhid);
++ spin_unlock_irq(&usbhid->lock);
++}
++
+ /* Treat USB reset pretty much the same as suspend/resume */
+ static int hid_pre_reset(struct usb_interface *intf)
+ {
+@@ -1453,14 +1476,14 @@ static int hid_post_reset(struct usb_int
+ return 1;
+ }
+
++ /* No need to do another reset or clear a halted endpoint */
+ spin_lock_irq(&usbhid->lock);
+ clear_bit(HID_RESET_PENDING, &usbhid->iofl);
++ clear_bit(HID_CLEAR_HALT, &usbhid->iofl);
+ spin_unlock_irq(&usbhid->lock);
+ hid_set_idle(dev, intf->cur_altsetting->desc.bInterfaceNumber, 0, 0);
+- status = hid_start_in(hid);
+- if (status < 0)
+- hid_io_error(hid);
+- usbhid_restart_queues(usbhid);
++
++ hid_restart_io(hid);
+
+ return 0;
+ }
+@@ -1483,25 +1506,9 @@ void usbhid_put_power(struct hid_device
+ #ifdef CONFIG_PM
+ static int hid_resume_common(struct hid_device *hid, bool driver_suspended)
+ {
+- struct usbhid_device *usbhid = hid->driver_data;
+- int status;
+-
+- spin_lock_irq(&usbhid->lock);
+- clear_bit(HID_SUSPENDED, &usbhid->iofl);
+- usbhid_mark_busy(usbhid);
+-
+- if (test_bit(HID_CLEAR_HALT, &usbhid->iofl) ||
+- test_bit(HID_RESET_PENDING, &usbhid->iofl))
+- schedule_work(&usbhid->reset_work);
+- usbhid->retry_delay = 0;
+-
+- usbhid_restart_queues(usbhid);
+- spin_unlock_irq(&usbhid->lock);
+-
+- status = hid_start_in(hid);
+- if (status < 0)
+- hid_io_error(hid);
++ int status = 0;
+
++ hid_restart_io(hid);
+ if (driver_suspended && hid->driver && hid->driver->resume)
+ status = hid->driver->resume(hid);
+ return status;
+@@ -1570,12 +1577,8 @@ static int hid_suspend(struct usb_interf
+ static int hid_resume(struct usb_interface *intf)
+ {
+ struct hid_device *hid = usb_get_intfdata (intf);
+- struct usbhid_device *usbhid = hid->driver_data;
+ int status;
+
+- if (!test_bit(HID_STARTED, &usbhid->iofl))
+- return 0;
+-
+ status = hid_resume_common(hid, true);
+ dev_dbg(&intf->dev, "resume status %d\n", status);
+ return 0;
+@@ -1584,10 +1587,8 @@ static int hid_resume(struct usb_interfa
+ static int hid_reset_resume(struct usb_interface *intf)
+ {
+ struct hid_device *hid = usb_get_intfdata(intf);
+- struct usbhid_device *usbhid = hid->driver_data;
+ int status;
+
+- clear_bit(HID_SUSPENDED, &usbhid->iofl);
+ status = hid_post_reset(intf);
+ if (status >= 0 && hid->driver && hid->driver->reset_resume) {
+ int ret = hid->driver->reset_resume(hid);
--- /dev/null
+From 580549ef6b3e3fb3b958de490ca99f43a089a2cf Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Fri, 25 Mar 2016 15:26:55 +0100
+Subject: HID: wacom: fix Bamboo ONE oops
+
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+
+commit 580549ef6b3e3fb3b958de490ca99f43a089a2cf upstream.
+
+Looks like recent changes in the Wacom driver made the Bamboo ONE crashes.
+The tablet behaves as if it was a regular Bamboo device with pen, touch
+and pad, but there is no physical pad connected to it.
+The weird part is that the pad is still sending events and given that
+there is no input node connected to it, we get anull pointer exception.
+
+Link: https://bugzilla.redhat.com/show_bug.cgi?id=1317116
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Acked-by: Ping Cheng <pingc@wacom.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/wacom_wac.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -2493,6 +2493,17 @@ void wacom_setup_device_quirks(struct wa
+ }
+
+ /*
++ * Hack for the Bamboo One:
++ * the device presents a PAD/Touch interface as most Bamboos and even
++ * sends ghosts PAD data on it. However, later, we must disable this
++ * ghost interface, and we can not detect it unless we set it here
++ * to WACOM_DEVICETYPE_PAD or WACOM_DEVICETYPE_TOUCH.
++ */
++ if (features->type == BAMBOO_PEN &&
++ features->pktlen == WACOM_PKGLEN_BBTOUCH3)
++ features->device_type |= WACOM_DEVICETYPE_PAD;
++
++ /*
+ * Raw Wacom-mode pen and touch events both come from interface
+ * 0, whose HID descriptor has an application usage of 0xFF0D
+ * (i.e., WACOM_VENDORDEFINED_PEN). We route pen packets back
--- /dev/null
+From 67b4eab91caf2ad574cab1b17ae09180ea2e116e Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Wed, 17 Feb 2016 12:26:38 -0600
+Subject: Revert "PCI: Add helpers to manage pci_dev->irq and pci_dev->irq_managed"
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+commit 67b4eab91caf2ad574cab1b17ae09180ea2e116e upstream.
+
+Revert 811a4e6fce09 ("PCI: Add helpers to manage pci_dev->irq and
+pci_dev->irq_managed").
+
+This is part of reverting 991de2e59090 ("PCI, x86: Implement
+pcibios_alloc_irq() and pcibios_free_irq()") to fix regressions it
+introduced.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=111211
+Fixes: 991de2e59090 ("PCI, x86: Implement pcibios_alloc_irq() and pcibios_free_irq()")
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Rafael J. Wysocki <rafael@kernel.org>
+CC: Jiang Liu <jiang.liu@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/pci/intel_mid_pci.c | 4 ++--
+ arch/x86/pci/irq.c | 10 ++++++----
+ drivers/acpi/pci_irq.c | 10 ++++++----
+ include/linux/pci.h | 17 -----------------
+ 4 files changed, 14 insertions(+), 27 deletions(-)
+
+--- a/arch/x86/pci/intel_mid_pci.c
++++ b/arch/x86/pci/intel_mid_pci.c
+@@ -215,7 +215,7 @@ static int intel_mid_pci_irq_enable(stru
+ int polarity;
+ int ret;
+
+- if (pci_has_managed_irq(dev))
++ if (dev->irq_managed && dev->irq > 0)
+ return 0;
+
+ switch (intel_mid_identify_cpu()) {
+@@ -256,7 +256,7 @@ static int intel_mid_pci_irq_enable(stru
+
+ static void intel_mid_pci_irq_disable(struct pci_dev *dev)
+ {
+- if (pci_has_managed_irq(dev)) {
++ if (dev->irq_managed && dev->irq > 0) {
+ mp_unmap_irq(dev->irq);
+ dev->irq_managed = 0;
+ /*
+--- a/arch/x86/pci/irq.c
++++ b/arch/x86/pci/irq.c
+@@ -1202,7 +1202,7 @@ static int pirq_enable_irq(struct pci_de
+ struct pci_dev *temp_dev;
+ int irq;
+
+- if (pci_has_managed_irq(dev))
++ if (dev->irq_managed && dev->irq > 0)
+ return 0;
+
+ irq = IO_APIC_get_PCI_irq_vector(dev->bus->number,
+@@ -1230,7 +1230,8 @@ static int pirq_enable_irq(struct pci_de
+ }
+ dev = temp_dev;
+ if (irq >= 0) {
+- pci_set_managed_irq(dev, irq);
++ dev->irq_managed = 1;
++ dev->irq = irq;
+ dev_info(&dev->dev, "PCI->APIC IRQ transform: "
+ "INT %c -> IRQ %d\n", 'A' + pin - 1, irq);
+ return 0;
+@@ -1258,8 +1259,9 @@ static int pirq_enable_irq(struct pci_de
+
+ static void pirq_disable_irq(struct pci_dev *dev)
+ {
+- if (io_apic_assign_pci_irqs && pci_has_managed_irq(dev)) {
++ if (io_apic_assign_pci_irqs && dev->irq_managed && dev->irq) {
+ mp_unmap_irq(dev->irq);
+- pci_reset_managed_irq(dev);
++ dev->irq = 0;
++ dev->irq_managed = 0;
+ }
+ }
+--- a/drivers/acpi/pci_irq.c
++++ b/drivers/acpi/pci_irq.c
+@@ -409,7 +409,7 @@ int acpi_pci_irq_enable(struct pci_dev *
+ return 0;
+ }
+
+- if (pci_has_managed_irq(dev))
++ if (dev->irq_managed && dev->irq > 0)
+ return 0;
+
+ entry = acpi_pci_irq_lookup(dev, pin);
+@@ -454,7 +454,8 @@ int acpi_pci_irq_enable(struct pci_dev *
+ kfree(entry);
+ return rc;
+ }
+- pci_set_managed_irq(dev, rc);
++ dev->irq = rc;
++ dev->irq_managed = 1;
+
+ if (link)
+ snprintf(link_desc, sizeof(link_desc), " -> Link[%s]", link);
+@@ -477,7 +478,7 @@ void acpi_pci_irq_disable(struct pci_dev
+ u8 pin;
+
+ pin = dev->pin;
+- if (!pin || !pci_has_managed_irq(dev))
++ if (!pin || !dev->irq_managed || dev->irq <= 0)
+ return;
+
+ entry = acpi_pci_irq_lookup(dev, pin);
+@@ -499,6 +500,7 @@ void acpi_pci_irq_disable(struct pci_dev
+ dev_dbg(&dev->dev, "PCI INT %c disabled\n", pin_name(pin));
+ if (gsi >= 0) {
+ acpi_unregister_gsi(gsi);
+- pci_reset_managed_irq(dev);
++ dev->irq_managed = 0;
++ dev->irq = 0;
+ }
+ }
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -989,23 +989,6 @@ static inline int pci_is_managed(struct
+ return pdev->is_managed;
+ }
+
+-static inline void pci_set_managed_irq(struct pci_dev *pdev, unsigned int irq)
+-{
+- pdev->irq = irq;
+- pdev->irq_managed = 1;
+-}
+-
+-static inline void pci_reset_managed_irq(struct pci_dev *pdev)
+-{
+- pdev->irq = 0;
+- pdev->irq_managed = 0;
+-}
+-
+-static inline bool pci_has_managed_irq(struct pci_dev *pdev)
+-{
+- return pdev->irq_managed && pdev->irq > 0;
+-}
+-
+ void pci_disable_device(struct pci_dev *dev);
+
+ extern unsigned int pcibios_max_latency;
--- /dev/null
+From 6c777e8799a93e3bdb67bec622429e1b48dc90fb Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Wed, 17 Feb 2016 12:26:42 -0600
+Subject: Revert "PCI, x86: Implement pcibios_alloc_irq() and pcibios_free_irq()"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+commit 6c777e8799a93e3bdb67bec622429e1b48dc90fb upstream.
+
+991de2e59090 ("PCI, x86: Implement pcibios_alloc_irq() and
+pcibios_free_irq()") appeared in v4.3 and helps support IOAPIC hotplug.
+
+Олег reported that the Elcus-1553 TA1-PCI driver worked in v4.2 but not
+v4.3 and bisected it to 991de2e59090. Sunjin reported that the RocketRAID
+272x driver worked in v4.2 but not v4.3. In both cases booting with
+"pci=routirq" is a workaround.
+
+I think the problem is that after 991de2e59090, we no longer call
+pcibios_enable_irq() for upstream bridges. Prior to 991de2e59090, when a
+driver called pci_enable_device(), we recursively called
+pcibios_enable_irq() for upstream bridges via pci_enable_bridge().
+
+After 991de2e59090, we call pcibios_enable_irq() from pci_device_probe()
+instead of the pci_enable_device() path, which does *not* call
+pcibios_enable_irq() for upstream bridges.
+
+Revert 991de2e59090 to fix these driver regressions.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=111211
+Fixes: 991de2e59090 ("PCI, x86: Implement pcibios_alloc_irq() and pcibios_free_irq()")
+Reported-and-tested-by: Олег Мороз <oleg.moroz@mcc.vniiem.ru>
+Reported-by: Sunjin Yang <fan4326@gmail.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Rafael J. Wysocki <rafael@kernel.org>
+CC: Jiang Liu <jiang.liu@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/pci_x86.h | 2 ++
+ arch/x86/pci/common.c | 20 +++++++++++---------
+ arch/x86/pci/intel_mid_pci.c | 7 ++-----
+ arch/x86/pci/irq.c | 15 ++++++++++++++-
+ drivers/acpi/pci_irq.c | 9 ++++++++-
+ 5 files changed, 37 insertions(+), 16 deletions(-)
+
+--- a/arch/x86/include/asm/pci_x86.h
++++ b/arch/x86/include/asm/pci_x86.h
+@@ -93,6 +93,8 @@ extern raw_spinlock_t pci_config_lock;
+ extern int (*pcibios_enable_irq)(struct pci_dev *dev);
+ extern void (*pcibios_disable_irq)(struct pci_dev *dev);
+
++extern bool mp_should_keep_irq(struct device *dev);
++
+ struct pci_raw_ops {
+ int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
+ int reg, int len, u32 *val);
+--- a/arch/x86/pci/common.c
++++ b/arch/x86/pci/common.c
+@@ -673,20 +673,22 @@ int pcibios_add_device(struct pci_dev *d
+ return 0;
+ }
+
+-int pcibios_alloc_irq(struct pci_dev *dev)
++int pcibios_enable_device(struct pci_dev *dev, int mask)
+ {
+- return pcibios_enable_irq(dev);
+-}
++ int err;
+
+-void pcibios_free_irq(struct pci_dev *dev)
+-{
+- if (pcibios_disable_irq)
+- pcibios_disable_irq(dev);
++ if ((err = pci_enable_resources(dev, mask)) < 0)
++ return err;
++
++ if (!pci_dev_msi_enabled(dev))
++ return pcibios_enable_irq(dev);
++ return 0;
+ }
+
+-int pcibios_enable_device(struct pci_dev *dev, int mask)
++void pcibios_disable_device (struct pci_dev *dev)
+ {
+- return pci_enable_resources(dev, mask);
++ if (!pci_dev_msi_enabled(dev) && pcibios_disable_irq)
++ pcibios_disable_irq(dev);
+ }
+
+ int pci_ext_cfg_avail(void)
+--- a/arch/x86/pci/intel_mid_pci.c
++++ b/arch/x86/pci/intel_mid_pci.c
+@@ -256,13 +256,10 @@ static int intel_mid_pci_irq_enable(stru
+
+ static void intel_mid_pci_irq_disable(struct pci_dev *dev)
+ {
+- if (dev->irq_managed && dev->irq > 0) {
++ if (!mp_should_keep_irq(&dev->dev) && dev->irq_managed &&
++ dev->irq > 0) {
+ mp_unmap_irq(dev->irq);
+ dev->irq_managed = 0;
+- /*
+- * Don't reset dev->irq here, otherwise
+- * intel_mid_pci_irq_enable() will fail on next call.
+- */
+ }
+ }
+
+--- a/arch/x86/pci/irq.c
++++ b/arch/x86/pci/irq.c
+@@ -1257,9 +1257,22 @@ static int pirq_enable_irq(struct pci_de
+ return 0;
+ }
+
++bool mp_should_keep_irq(struct device *dev)
++{
++ if (dev->power.is_prepared)
++ return true;
++#ifdef CONFIG_PM
++ if (dev->power.runtime_status == RPM_SUSPENDING)
++ return true;
++#endif
++
++ return false;
++}
++
+ static void pirq_disable_irq(struct pci_dev *dev)
+ {
+- if (io_apic_assign_pci_irqs && dev->irq_managed && dev->irq) {
++ if (io_apic_assign_pci_irqs && !mp_should_keep_irq(&dev->dev) &&
++ dev->irq_managed && dev->irq) {
+ mp_unmap_irq(dev->irq);
+ dev->irq = 0;
+ dev->irq_managed = 0;
+--- a/drivers/acpi/pci_irq.c
++++ b/drivers/acpi/pci_irq.c
+@@ -481,6 +481,14 @@ void acpi_pci_irq_disable(struct pci_dev
+ if (!pin || !dev->irq_managed || dev->irq <= 0)
+ return;
+
++ /* Keep IOAPIC pin configuration when suspending */
++ if (dev->dev.power.is_prepared)
++ return;
++#ifdef CONFIG_PM
++ if (dev->dev.power.runtime_status == RPM_SUSPENDING)
++ return;
++#endif
++
+ entry = acpi_pci_irq_lookup(dev, pin);
+ if (!entry)
+ return;
+@@ -501,6 +509,5 @@ void acpi_pci_irq_disable(struct pci_dev
+ if (gsi >= 0) {
+ acpi_unregister_gsi(gsi);
+ dev->irq_managed = 0;
+- dev->irq = 0;
+ }
+ }
--- /dev/null
+From e5bdfd50d6f76077bf8441d130c606229e100d40 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Sat, 20 Feb 2016 14:19:34 -0800
+Subject: Revert "usb: hub: do not clear BOS field during reset device"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit e5bdfd50d6f76077bf8441d130c606229e100d40 upstream.
+
+This reverts commit d8f00cd685f5c8e0def8593e520a7fef12c22407.
+
+Tony writes:
+
+This upstream commit is causing an oops:
+d8f00cd685f5 ("usb: hub: do not clear BOS field during reset device")
+
+This patch has already been included in several -stable kernels. Here
+are the affected kernels:
+4.5.0-rc4 (current git)
+4.4.2
+4.3.6 (currently in review)
+4.1.18
+3.18.27
+3.14.61
+
+How to reproduce the problem:
+Boot kernel with slub debugging enabled (otherwise memory corruption
+will cause random oopses later instead of immediately)
+Plug in USB 3.0 disk to xhci USB 3.0 port
+dd if=/dev/sdc of=/dev/null bs=65536
+(where /dev/sdc is the USB 3.0 disk)
+Unplug USB cable while dd is still going
+Oops is immediate:
+
+Reported-by: Tony Battersby <tonyb@cybernetics.com>
+Cc: Du, Changbin <changbin.du@intel.com>
+Cc: Roger Quadros <rogerq@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/core/hub.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -5392,6 +5392,7 @@ static int usb_reset_and_verify_device(s
+ }
+
+ bos = udev->bos;
++ udev->bos = NULL;
+
+ for (i = 0; i < SET_CONFIG_TRIES; ++i) {
+
+@@ -5484,11 +5485,8 @@ done:
+ usb_set_usb2_hardware_lpm(udev, 1);
+ usb_unlocked_enable_lpm(udev);
+ usb_enable_ltm(udev);
+- /* release the new BOS descriptor allocated by hub_port_init() */
+- if (udev->bos != bos) {
+- usb_release_bos_descriptor(udev);
+- udev->bos = bos;
+- }
++ usb_release_bos_descriptor(udev);
++ udev->bos = bos;
+ return 0;
+
+ re_enumerate:
--- /dev/null
+From fe25d078874f2c29c38f4160467d74f5756537c9 Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Wed, 17 Feb 2016 12:26:33 -0600
+Subject: Revert "x86/PCI: Don't alloc pcibios-irq when MSI is enabled"
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+commit fe25d078874f2c29c38f4160467d74f5756537c9 upstream.
+
+Revert 8affb487d4a4 ("x86/PCI: Don't alloc pcibios-irq when MSI is
+enabled").
+
+This is part of reverting 991de2e59090 ("PCI, x86: Implement
+pcibios_alloc_irq() and pcibios_free_irq()") to fix regressions it
+introduced.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=111211
+Fixes: 991de2e59090 ("PCI, x86: Implement pcibios_alloc_irq() and pcibios_free_irq()")
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Rafael J. Wysocki <rafael@kernel.org>
+CC: Jiang Liu <jiang.liu@linux.intel.com>
+CC: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/pci/common.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/arch/x86/pci/common.c
++++ b/arch/x86/pci/common.c
+@@ -675,14 +675,6 @@ int pcibios_add_device(struct pci_dev *d
+
+ int pcibios_alloc_irq(struct pci_dev *dev)
+ {
+- /*
+- * If the PCI device was already claimed by core code and has
+- * MSI enabled, probing of the pcibios IRQ will overwrite
+- * dev->irq. So bail out if MSI is already enabled.
+- */
+- if (pci_dev_msi_enabled(dev))
+- return -EBUSY;
+-
+ return pcibios_enable_irq(dev);
+ }
+
perf-do-not-double-free.patch
perf-cure-event-pending_disable-race.patch
mmc-sdhci-pci-add-support-and-pci-ids-for-more-broxton-host-controllers.patch
+alsa-hda-fixup-speaker-pass-through-control-for-nid-0x14-on-alc225.patch
+alsa-hda-fix-headset-support-and-noise-on-hp-elitebook-755-g2.patch
+alsa-hda-fix-front-mic-problem-for-a-hp-desktop.patch
+alsa-hda-realtek-enable-the-alc292-dock-fixup-on-the-thinkpad-t460s.patch
+alsa-usb-audio-add-a-sample-rate-quirk-for-phoenix-audio-tmx320.patch
+alsa-usb-audio-add-a-quirk-for-plantronics-bt300.patch
+alsa-usb-audio-skip-volume-controls-triggers-hangup-on-dell-usb-dock.patch
+hid-wacom-fix-bamboo-one-oops.patch
+hid-usbhid-fix-inconsistent-reset-resume-reset-resume-behavior.patch
+revert-x86-pci-don-t-alloc-pcibios-irq-when-msi-is-enabled.patch
+revert-pci-add-helpers-to-manage-pci_dev-irq-and-pci_dev-irq_managed.patch
+revert-pci-x86-implement-pcibios_alloc_irq-and-pcibios_free_irq.patch
+staging-android-ion-set-the-length-of-the-dma-sg-entries-in-buffer.patch
+usbvision-fix-overflow-of-interfaces-array.patch
+usbvision-fix-crash-on-detecting-device-with-invalid-configuration.patch
+revert-usb-hub-do-not-clear-bos-field-during-reset-device.patch
--- /dev/null
+From 70bc916b2c80913753fb188d4daee50a64d21ba0 Mon Sep 17 00:00:00 2001
+From: Liviu Dudau <Liviu.Dudau@arm.com>
+Date: Thu, 21 Jan 2016 11:57:47 +0000
+Subject: staging: android: ion: Set the length of the DMA sg entries in buffer
+
+From: Liviu Dudau <Liviu.Dudau@arm.com>
+
+commit 70bc916b2c80913753fb188d4daee50a64d21ba0 upstream.
+
+ion_buffer_create() will allocate a buffer and then create a DMA
+mapping for it, but it forgot to set the length of the page entries.
+
+Signed-off-by: Liviu Dudau <Liviu.Dudau@arm.com>
+Signed-off-by: Jon Medhurst <tixy@linaro.org>
+Acked-by: Laura Abbott <labbott@redhat.com>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/android/ion/ion.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/android/ion/ion.c
++++ b/drivers/staging/android/ion/ion.c
+@@ -251,8 +251,10 @@ static struct ion_buffer *ion_buffer_cre
+ * memory coming from the heaps is ready for dma, ie if it has a
+ * cached mapping that mapping has been invalidated
+ */
+- for_each_sg(buffer->sg_table->sgl, sg, buffer->sg_table->nents, i)
++ for_each_sg(buffer->sg_table->sgl, sg, buffer->sg_table->nents, i) {
+ sg_dma_address(sg) = sg_phys(sg);
++ sg_dma_len(sg) = sg->length;
++ }
+ mutex_lock(&dev->buffer_lock);
+ ion_buffer_add(dev, buffer);
+ mutex_unlock(&dev->buffer_lock);
--- /dev/null
+From fa52bd506f274b7619955917abfde355e3d19ffe Mon Sep 17 00:00:00 2001
+From: Vladis Dronov <vdronov@redhat.com>
+Date: Mon, 16 Nov 2015 15:55:11 -0200
+Subject: [media] usbvision: fix crash on detecting device with invalid configuration
+
+From: Vladis Dronov <vdronov@redhat.com>
+
+commit fa52bd506f274b7619955917abfde355e3d19ffe upstream.
+
+The usbvision driver crashes when a specially crafted usb device with invalid
+number of interfaces or endpoints is detected. This fix adds checks that the
+device has proper configuration expected by the driver.
+
+Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
+Signed-off-by: Vladis Dronov <vdronov@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/usbvision/usbvision-video.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/usb/usbvision/usbvision-video.c
++++ b/drivers/media/usb/usbvision/usbvision-video.c
+@@ -1470,9 +1470,23 @@ static int usbvision_probe(struct usb_in
+
+ if (usbvision_device_data[model].interface >= 0)
+ interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0];
+- else
++ else if (ifnum < dev->actconfig->desc.bNumInterfaces)
+ interface = &dev->actconfig->interface[ifnum]->altsetting[0];
++ else {
++ dev_err(&intf->dev, "interface %d is invalid, max is %d\n",
++ ifnum, dev->actconfig->desc.bNumInterfaces - 1);
++ ret = -ENODEV;
++ goto err_usb;
++ }
++
++ if (interface->desc.bNumEndpoints < 2) {
++ dev_err(&intf->dev, "interface %d has %d endpoints, but must"
++ " have minimum 2\n", ifnum, interface->desc.bNumEndpoints);
++ ret = -ENODEV;
++ goto err_usb;
++ }
+ endpoint = &interface->endpoint[1].desc;
++
+ if (!usb_endpoint_xfer_isoc(endpoint)) {
+ dev_err(&intf->dev, "%s: interface %d. has non-ISO endpoint!\n",
+ __func__, ifnum);
--- /dev/null
+From 588afcc1c0e45358159090d95bf7b246fb67565f Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Tue, 27 Oct 2015 09:51:34 -0200
+Subject: [media] usbvision fix overflow of interfaces array
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit 588afcc1c0e45358159090d95bf7b246fb67565f upstream.
+
+This fixes the crash reported in:
+http://seclists.org/bugtraq/2015/Oct/35
+The interface number needs a sanity check.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Cc: Vladis Dronov <vdronov@redhat.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/usbvision/usbvision-video.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/media/usb/usbvision/usbvision-video.c
++++ b/drivers/media/usb/usbvision/usbvision-video.c
+@@ -1461,6 +1461,13 @@ static int usbvision_probe(struct usb_in
+ printk(KERN_INFO "%s: %s found\n", __func__,
+ usbvision_device_data[model].model_string);
+
++ /*
++ * this is a security check.
++ * an exploit using an incorrect bInterfaceNumber is known
++ */
++ if (ifnum >= USB_MAXINTERFACES || !dev->actconfig->interface[ifnum])
++ return -ENODEV;
++
+ if (usbvision_device_data[model].interface >= 0)
+ interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0];
+ else
projects / thirdparty / kernel / stable-queue.git / commitdiff
