--- /dev/null
+From 6ffc0898b29a2811a6c0569c5dd9b581980110df Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Wed, 13 May 2015 13:28:54 +0200
+Subject: ALSA: hda - Add Conexant codecs CX20721, CX20722, CX20723 and CX20724
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit 6ffc0898b29a2811a6c0569c5dd9b581980110df upstream.
+
+This patch adds support for Conexant HD Audio codecs
+CX20721, CX20722, CX20723 and CX20724.
+
+BugLink: https://bugs.launchpad.net/bugs/1454656
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_conexant.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -973,6 +973,14 @@ static const struct hda_codec_preset snd
+ .patch = patch_conexant_auto },
+ { .id = 0x14f150b9, .name = "CX20665",
+ .patch = patch_conexant_auto },
++ { .id = 0x14f150f1, .name = "CX20721",
++ .patch = patch_conexant_auto },
++ { .id = 0x14f150f2, .name = "CX20722",
++ .patch = patch_conexant_auto },
++ { .id = 0x14f150f3, .name = "CX20723",
++ .patch = patch_conexant_auto },
++ { .id = 0x14f150f4, .name = "CX20724",
++ .patch = patch_conexant_auto },
+ { .id = 0x14f1510f, .name = "CX20751/2",
+ .patch = patch_conexant_auto },
+ { .id = 0x14f15110, .name = "CX20751/2",
+@@ -1007,6 +1015,10 @@ MODULE_ALIAS("snd-hda-codec-id:14f150ab"
+ MODULE_ALIAS("snd-hda-codec-id:14f150ac");
+ MODULE_ALIAS("snd-hda-codec-id:14f150b8");
+ MODULE_ALIAS("snd-hda-codec-id:14f150b9");
++MODULE_ALIAS("snd-hda-codec-id:14f150f1");
++MODULE_ALIAS("snd-hda-codec-id:14f150f2");
++MODULE_ALIAS("snd-hda-codec-id:14f150f3");
++MODULE_ALIAS("snd-hda-codec-id:14f150f4");
+ MODULE_ALIAS("snd-hda-codec-id:14f1510f");
+ MODULE_ALIAS("snd-hda-codec-id:14f15110");
+ MODULE_ALIAS("snd-hda-codec-id:14f15111");
--- /dev/null
+From 88776f366ede7d9cdce60bd2c9753dd6d6fa8b77 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 1 May 2015 09:20:34 +0200
+Subject: ALSA: hda - Add headphone quirk for Lifebook E752
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 88776f366ede7d9cdce60bd2c9753dd6d6fa8b77 upstream.
+
+Fujitsu Lifebook E752 laptop needs a similar quirk done for Lifebook
+T731. Otherwise the headphone is always muted.
+
+Reported-and-tested-by: Christian Weber <we_chris@hotmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5027,6 +5027,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x104d, 0x9099, "Sony VAIO S13", ALC275_FIXUP_SONY_DISABLE_AAMIX),
+ SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
+ SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
++ SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN),
+ SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
+ SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
+ SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_BXBT2807_MIC),
--- /dev/null
+From 9b5a4e395c2f39fae89f75e4a749be5dba342d22 Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Mon, 11 May 2015 14:04:14 +0200
+Subject: ALSA: hda - Add headset mic quirk for Dell Inspiron 5548
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit 9b5a4e395c2f39fae89f75e4a749be5dba342d22 upstream.
+
+This enables the headset microphone on Dell Inspiron 5548,
+or at least some variants of it.
+
+BugLink: https://bugs.launchpad.net/bugs/1452175
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5247,6 +5247,13 @@ static const struct snd_hda_pin_quirk al
+ {0x17, 0x40000000},
+ {0x1d, 0x40700001},
+ {0x21, 0x02211050}),
++ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell Inspiron 5548", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++ ALC255_STANDARD_PINS,
++ {0x12, 0x90a60180},
++ {0x14, 0x90170130},
++ {0x17, 0x40000000},
++ {0x1d, 0x40700001},
++ {0x21, 0x02211040}),
+ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC256_STANDARD_PINS,
+ {0x13, 0x40000000}),
--- /dev/null
+From 0fa372b6c95013af1334b3d5c9b5f03a70ecedab Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 27 May 2015 16:17:19 +0200
+Subject: ALSA: hda - Fix noise on AMD radeon 290x controller
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 0fa372b6c95013af1334b3d5c9b5f03a70ecedab upstream.
+
+A new AMD controller [1002:aac8] seems to need the quirk for other AMD
+NS HDMI stuff, otherwise it gives noisy sounds.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=99021
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_intel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2108,6 +2108,8 @@ static const struct pci_device_id azx_id
+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ { PCI_DEVICE(0x1002, 0xaab0),
+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
++ { PCI_DEVICE(0x1002, 0xaac8),
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ /* VIA VT8251/VT8237A */
+ { PCI_DEVICE(0x1106, 0x3288),
+ .driver_data = AZX_DRIVER_VIA | AZX_DCAPS_POSFIX_VIA },
--- /dev/null
+From 09ea997677cd44ebe7f42573119aaf46b775c683 Mon Sep 17 00:00:00 2001
+From: Ansgar Hegerfeld <linux@hegerfeld.org>
+Date: Thu, 14 May 2015 12:31:32 +0200
+Subject: ALSA: hda/realtek - ALC292 dock fix for Thinkpad L450
+
+From: Ansgar Hegerfeld <linux@hegerfeld.org>
+
+commit 09ea997677cd44ebe7f42573119aaf46b775c683 upstream.
+
+The Lenovo ThinkPad L450 requires the ALC292_FIXUP_TPT440_DOCK fix in
+order to get sound output on the docking stations audio port.
+
+This patch was tested using a ThinkPad L450 (20DSS00B00) using kernel
+4.0.3 and a ThinkPad Pro Dock.
+
+Signed-off-by: Ansgar Hegerfeld <linux@hegerfeld.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5057,6 +5057,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x5026, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x5034, "Thinkpad T450", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x5036, "Thinkpad T450s", ALC292_FIXUP_TPT440_DOCK),
++ SND_PCI_QUIRK(0x17aa, 0x503c, "Thinkpad L450", ALC292_FIXUP_TPT440_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
+ SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
--- /dev/null
+From ae425bb2a05bebe786a25cc8ae64e9d16c4d9b83 Mon Sep 17 00:00:00 2001
+From: "Vittorio G (VittGam)" <linuxbugs@vittgam.net>
+Date: Fri, 22 May 2015 21:15:19 +0200
+Subject: ALSA: usb-audio: Add quirk for MS LifeCam HD-3000
+
+From: "Vittorio G (VittGam)" <linuxbugs@vittgam.net>
+
+commit ae425bb2a05bebe786a25cc8ae64e9d16c4d9b83 upstream.
+
+Microsoft LifeCam HD-3000 (045e:0779) needs a similar quirk for
+suppressing the unsupported sample rate inquiry.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=98481
+Signed-off-by: Vittorio Gambaletta <linuxbugs@vittgam.net>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1118,6 +1118,7 @@ bool snd_usb_get_sample_rate_quirk(struc
+ case USB_ID(0x045E, 0x075D): /* MS Lifecam Cinema */
+ case USB_ID(0x045E, 0x076D): /* MS Lifecam HD-5000 */
+ case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */
++ case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */
+ case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
+ return true;
+ }
--- /dev/null
+From fa94b0d72511add5822dc4124f2a3eae66b8863f Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 19 May 2015 10:46:49 +0200
+Subject: ALSA: usb-audio: Add quirk for MS LifeCam Studio
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit fa94b0d72511add5822dc4124f2a3eae66b8863f upstream.
+
+Microsoft LifeCam Studio (045e:0772) needs a similar quirk for
+suppressing the wrong sample rate inquiry.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=98481
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1117,6 +1117,7 @@ bool snd_usb_get_sample_rate_quirk(struc
+ switch (chip->usb_id) {
+ case USB_ID(0x045E, 0x075D): /* MS Lifecam Cinema */
+ case USB_ID(0x045E, 0x076D): /* MS Lifecam HD-5000 */
++ case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */
+ case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
+ return true;
+ }
--- /dev/null
+From fdb6eb0a12871d5bfaf266c5a0d5259a5437a72f Mon Sep 17 00:00:00 2001
+From: Koro Chen <koro.chen@mediatek.com>
+Date: Mon, 11 May 2015 10:36:53 +0800
+Subject: ASoC: dapm: Modify widget stream name according to prefix
+
+From: Koro Chen <koro.chen@mediatek.com>
+
+commit fdb6eb0a12871d5bfaf266c5a0d5259a5437a72f upstream.
+
+When there is prefix specified, currently we will add this prefix in
+widget->name, but not in widget->sname.
+it causes failure at snd_soc_dapm_link_dai_widgets:
+
+if (!w->sname || !strstr(w->sname, dai_w->name))
+
+because dai_w->name has prefix added, but w->sname does not.
+We should also add prefix for stream name
+
+Signed-off-by: Koro Chen <koro.chen@mediatek.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/soc-dapm.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -3074,11 +3074,16 @@ snd_soc_dapm_new_control(struct snd_soc_
+ }
+
+ prefix = soc_dapm_prefix(dapm);
+- if (prefix)
++ if (prefix) {
+ w->name = kasprintf(GFP_KERNEL, "%s %s", prefix, widget->name);
+- else
++ if (widget->sname)
++ w->sname = kasprintf(GFP_KERNEL, "%s %s", prefix,
++ widget->sname);
++ } else {
+ w->name = kasprintf(GFP_KERNEL, "%s", widget->name);
+-
++ if (widget->sname)
++ w->sname = kasprintf(GFP_KERNEL, "%s", widget->sname);
++ }
+ if (w->name == NULL) {
+ kfree(w);
+ return NULL;
--- /dev/null
+From 545774bd6e1427d98dde77244329d2311c5eca6f Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@ingics.com>
+Date: Mon, 27 Apr 2015 14:51:35 +0800
+Subject: ASoC: mc13783: Fix wrong mask value used in mc13xxx_reg_rmw() calls
+
+From: Axel Lin <axel.lin@ingics.com>
+
+commit 545774bd6e1427d98dde77244329d2311c5eca6f upstream.
+
+mc13xxx_reg_rmw() won't change any bit if passing 0 to the mask field.
+Pass AUDIO_SSI_SEL instead of 0 for the mask field to set AUDIO_SSI_SEL
+bit.
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/mc13783.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/codecs/mc13783.c
++++ b/sound/soc/codecs/mc13783.c
+@@ -623,14 +623,14 @@ static int mc13783_probe(struct snd_soc_
+ AUDIO_SSI_SEL, 0);
+ else
+ mc13xxx_reg_rmw(priv->mc13xxx, MC13783_AUDIO_CODEC,
+- 0, AUDIO_SSI_SEL);
++ AUDIO_SSI_SEL, AUDIO_SSI_SEL);
+
+ if (priv->dac_ssi_port == MC13783_SSI1_PORT)
+ mc13xxx_reg_rmw(priv->mc13xxx, MC13783_AUDIO_DAC,
+ AUDIO_SSI_SEL, 0);
+ else
+ mc13xxx_reg_rmw(priv->mc13xxx, MC13783_AUDIO_DAC,
+- 0, AUDIO_SSI_SEL);
++ AUDIO_SSI_SEL, AUDIO_SSI_SEL);
+
+ return 0;
+ }
--- /dev/null
+From 810e4425c224af6be67dff68c8832af1b5a11f89 Mon Sep 17 00:00:00 2001
+From: Vasily Khoruzhick <anarsoul@gmail.com>
+Date: Sun, 3 May 2015 21:11:47 +0300
+Subject: ASoC: uda1380: Avoid accessing i2c bus when codec is disabled
+
+From: Vasily Khoruzhick <anarsoul@gmail.com>
+
+commit 810e4425c224af6be67dff68c8832af1b5a11f89 upstream.
+
+set_dai_fmt_both() callback is called from snd_soc_runtime_set_dai_fmt()
+which is called from snd_soc_register_card(), but at this time codec
+is not powered on yet. Replace direct i2c write with regcache write.
+
+Fixes: 5f0acedddf533c (ASoC: rx1950_uda1380: Use static DAI format setup)
+Fixes: 5cc10b9b77c234 (ASoC: h1940_uda1380: Use static DAI format setup)
+Signed-off-by: Vasily Khoruzhick <anarsoul@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/uda1380.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/uda1380.c
++++ b/sound/soc/codecs/uda1380.c
+@@ -437,7 +437,7 @@ static int uda1380_set_dai_fmt_both(stru
+ if ((fmt & SND_SOC_DAIFMT_MASTER_MASK) != SND_SOC_DAIFMT_CBS_CFS)
+ return -EINVAL;
+
+- uda1380_write(codec, UDA1380_IFACE, iface);
++ uda1380_write_reg_cache(codec, UDA1380_IFACE, iface);
+
+ return 0;
+ }
--- /dev/null
+From 85e36a1f4a735d991ba5106781ea48e89a0b8901 Mon Sep 17 00:00:00 2001
+From: Zidan Wang <zidan.wang@freescale.com>
+Date: Tue, 12 May 2015 14:58:36 +0800
+Subject: ASoC: wm8960: fix "RINPUT3" audio route error
+
+From: Zidan Wang <zidan.wang@freescale.com>
+
+commit 85e36a1f4a735d991ba5106781ea48e89a0b8901 upstream.
+
+It should be "RINPUT3" instead of "LINPUT3" route to "Right Input
+Mixer".
+
+Signed-off-by: Zidan Wang <zidan.wang@freescale.com>
+Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm8960.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -395,7 +395,7 @@ static const struct snd_soc_dapm_route a
+ { "Right Input Mixer", "Boost Switch", "Right Boost Mixer", },
+ { "Right Input Mixer", NULL, "RINPUT1", }, /* Really Boost Switch */
+ { "Right Input Mixer", NULL, "RINPUT2" },
+- { "Right Input Mixer", NULL, "LINPUT3" },
++ { "Right Input Mixer", NULL, "RINPUT3" },
+
+ { "Left ADC", NULL, "Left Input Mixer" },
+ { "Right ADC", NULL, "Right Input Mixer" },
--- /dev/null
+From 17fc2e0a3db11889e942c5ab15a1fcb876638f25 Mon Sep 17 00:00:00 2001
+From: Zidan Wang <zidan.wang@freescale.com>
+Date: Tue, 12 May 2015 14:58:50 +0800
+Subject: ASoC: wm8994: correct BCLK DIV 348 to 384
+
+From: Zidan Wang <zidan.wang@freescale.com>
+
+commit 17fc2e0a3db11889e942c5ab15a1fcb876638f25 upstream.
+
+According to the RM of wm8958, BCLK DIV 348 doesn't exist, correct it
+to 384.
+
+Signed-off-by: Zidan Wang <zidan.wang@freescale.com>
+Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm8994.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -2754,7 +2754,7 @@ static struct {
+ };
+
+ static int fs_ratios[] = {
+- 64, 128, 192, 256, 348, 512, 768, 1024, 1408, 1536
++ 64, 128, 192, 256, 384, 512, 768, 1024, 1408, 1536
+ };
+
+ static int bclk_divs[] = {
--- /dev/null
+From 7d072b404c5d8f1e0b62b6bc488dfeaa61bd2d8d Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend@broadcom.com>
+Date: Tue, 26 May 2015 13:19:46 +0200
+Subject: brcmfmac: avoid null pointer access when brcmf_msgbuf_get_pktid() fails
+
+From: Arend van Spriel <arend@broadcom.com>
+
+commit 7d072b404c5d8f1e0b62b6bc488dfeaa61bd2d8d upstream.
+
+The function brcmf_msgbuf_get_pktid() may return a NULL pointer so
+the callers should check the return pointer before accessing it to
+avoid the crash below (see [1]):
+
+brcmfmac: brcmf_msgbuf_get_pktid: Invalid packet id 273 (not in use)
+BUG: unable to handle kernel NULL pointer dereference at 0000000000000080
+IP: [<ffffffff8145b225>] skb_pull+0x5/0x50
+PGD 0
+Oops: 0000 [#1] PREEMPT SMP
+Modules linked in: pci_stub vboxpci(O) vboxnetflt(O) vboxnetadp(O) vboxdrv(O)
+ snd_hda_codec_hdmi bnep mousedev hid_generic ushwmon msr ext4 crc16 mbcache
+ jbd2 sd_mod uas usb_storage ahci libahci libata scsi_mod xhci_pci xhci_hcd
+ usbcore usb_common
+CPU: 0 PID: 1661 Comm: irq/61-brcmf_pc Tainted: G O 4.0.1-MacbookPro-ARCH #1
+Hardware name: Apple Inc. MacBookPro12,1/Mac-E43C1C25D4880AD6,
+ BIOS MBP121.88Z.0167.B02.1503241251 03/24/2015
+task: ffff880264203cc0 ti: ffff88025ffe4000 task.ti: ffff88025ffe4000
+RIP: 0010:[<ffffffff8145b225>] [<ffffffff8145b225>] skb_pull+0x5/0x50
+RSP: 0018:ffff88025ffe7d40 EFLAGS: 00010202
+RAX: 0000000000000000 RBX: ffff88008a33c000 RCX: 0000000000000044
+RDX: 0000000000000000 RSI: 000000000000004a RDI: 0000000000000000
+RBP: ffff88025ffe7da8 R08: 0000000000000096 R09: 000000000000004a
+R10: 0000000000000000 R11: 000000000000048e R12: ffff88025ff14f00
+R13: 0000000000000000 R14: ffff880263b48200 R15: ffff88008a33c000
+FS: 0000000000000000(0000) GS:ffff88026ec00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000000000080 CR3: 000000000180b000 CR4: 00000000003407f0
+Stack:
+ ffffffffa06aed74 ffff88025ffe7dc8 ffff880263b48270 ffff880263b48278
+ 05ea88020000004a 0002ffff81014635 000000001720b2f6 ffff88026ec116c0
+ ffff880263b48200 0000000000010000 ffff880263b4ae00 ffff880264203cc0
+Call Trace:
+ [<ffffffffa06aed74>] ? brcmf_msgbuf_process_rx+0x404/0x480 [brcmfmac]
+ [<ffffffff810cea60>] ? irq_finalize_oneshot.part.30+0xf0/0xf0
+ [<ffffffffa06afb55>] brcmf_proto_msgbuf_rx_trigger+0x35/0xf0 [brcmfmac]
+ [<ffffffffa06baf2a>] brcmf_pcie_isr_thread_v2+0x8a/0x130 [brcmfmac]
+ [<ffffffff810cea80>] irq_thread_fn+0x20/0x50
+ [<ffffffff810ceddf>] irq_thread+0x13f/0x170
+ [<ffffffff810cebf0>] ? wake_threads_waitq+0x30/0x30
+ [<ffffffff810ceca0>] ? irq_thread_dtor+0xb0/0xb0
+ [<ffffffff81092a08>] kthread+0xd8/0xf0
+ [<ffffffff81092930>] ? kthread_create_on_node+0x1c0/0x1c0
+ [<ffffffff8156d898>] ret_from_fork+0x58/0x90
+ [<ffffffff81092930>] ? kthread_create_on_node+0x1c0/0x1c0
+Code: 01 83 e2 f7 88 50 01 48 83 c4 08 5b 5d f3 c3 0f 1f 80 00 00 00 00 83 e2
+ f7 88 50 01 c3 66 0f 1f 84 00 00 00 00 00 0f 1f
+RIP [<ffffffff8145b225>] skb_pull+0x5/0x50
+ RSP <ffff88025ffe7d40>
+CR2: 0000000000000080
+---[ end trace b074c0f90e7c997d ]---
+
+[1] http://mid.gmane.org/20150430193259.GA5630@googlemail.com
+
+Reported-by: Michael Hornung <mhornung.linux@gmail.com>
+Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
+Signed-off-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+@@ -512,11 +512,9 @@ static int brcmf_msgbuf_query_dcmd(struc
+ msgbuf->rx_pktids,
+ msgbuf->ioctl_resp_pktid);
+ if (msgbuf->ioctl_resp_ret_len != 0) {
+- if (!skb) {
+- brcmf_err("Invalid packet id idx recv'd %d\n",
+- msgbuf->ioctl_resp_pktid);
++ if (!skb)
+ return -EBADF;
+- }
++
+ memcpy(buf, skb->data, (len < msgbuf->ioctl_resp_ret_len) ?
+ len : msgbuf->ioctl_resp_ret_len);
+ }
+@@ -875,10 +873,8 @@ brcmf_msgbuf_process_txstatus(struct brc
+ flowid -= BRCMF_NROF_H2D_COMMON_MSGRINGS;
+ skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
+ msgbuf->tx_pktids, idx);
+- if (!skb) {
+- brcmf_err("Invalid packet id idx recv'd %d\n", idx);
++ if (!skb)
+ return;
+- }
+
+ set_bit(flowid, msgbuf->txstatus_done_map);
+ commonring = msgbuf->flowrings[flowid];
+@@ -1157,6 +1153,8 @@ brcmf_msgbuf_process_rx_complete(struct
+
+ skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,
+ msgbuf->rx_pktids, idx);
++ if (!skb)
++ return;
+
+ if (data_offset)
+ skb_pull(skb, data_offset);
--- /dev/null
+From 2159184ea01e4ae7d15f2017e296d4bc82d5aeb0 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Thu, 28 May 2015 23:09:19 -0400
+Subject: d_walk() might skip too much
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 2159184ea01e4ae7d15f2017e296d4bc82d5aeb0 upstream.
+
+when we find that a child has died while we'd been trying to ascend,
+we should go into the first live sibling itself, rather than its sibling.
+
+Off-by-one in question had been introduced in "deal with deadlock in
+d_walk()" and the fix needs to be backported to all branches this one
+has been backported to.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/dcache.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -1205,13 +1205,13 @@ ascend:
+ /* might go back up the wrong parent if we have had a rename. */
+ if (need_seqretry(&rename_lock, seq))
+ goto rename_retry;
+- next = child->d_child.next;
+- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++ /* go into the first sibling still alive */
++ do {
++ next = child->d_child.next;
+ if (next == &this_parent->d_subdirs)
+ goto ascend;
+ child = list_entry(next, struct dentry, d_child);
+- next = next->next;
+- }
++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
+ rcu_read_unlock();
+ goto resume;
+ }
--- /dev/null
+From f18c34e483ff6b1d9866472221e4015b3a4698e4 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Tue, 2 Jun 2015 17:10:28 +0200
+Subject: lib: Fix strnlen_user() to not touch memory after specified maximum
+
+From: Jan Kara <jack@suse.cz>
+
+commit f18c34e483ff6b1d9866472221e4015b3a4698e4 upstream.
+
+If the specified maximum length of the string is a multiple of unsigned
+long, we would load one long behind the specified maximum. If that
+happens to be in a next page, we can hit a page fault although we were
+not expected to.
+
+Fix the off-by-one bug in the test whether we are at the end of the
+specified range.
+
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/strnlen_user.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/lib/strnlen_user.c
++++ b/lib/strnlen_user.c
+@@ -57,7 +57,8 @@ static inline long do_strnlen_user(const
+ return res + find_zero(data) + 1 - align;
+ }
+ res += sizeof(unsigned long);
+- if (unlikely(max < sizeof(unsigned long)))
++ /* We already handled 'unsigned long' bytes. Did we do it all ? */
++ if (unlikely(max <= sizeof(unsigned long)))
+ break;
+ max -= sizeof(unsigned long);
+ if (unlikely(__get_user(c,(unsigned long __user *)(src+res))))
--- /dev/null
+From 37815bf866ab6722a47550f8d25ad3f1a16a680c Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <rostedt@goodmis.org>
+Date: Sat, 9 May 2015 03:06:23 +0930
+Subject: module: Call module notifier on failure after complete_formation()
+
+From: Steven Rostedt <rostedt@goodmis.org>
+
+commit 37815bf866ab6722a47550f8d25ad3f1a16a680c upstream.
+
+The module notifier call chain for MODULE_STATE_COMING was moved up before
+the parsing of args, into the complete_formation() call. But if the module failed
+to load after that, the notifier call chain for MODULE_STATE_GOING was
+never called and that prevented the users of those call chains from
+cleaning up anything that was allocated.
+
+Link: http://lkml.kernel.org/r/554C52B9.9060700@gmail.com
+
+Reported-by: Pontus Fuchs <pontus.fuchs@gmail.com>
+Fixes: 4982223e51e8 "module: set nx before marking module MODULE_STATE_COMING"
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/module.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -3366,6 +3366,9 @@ static int load_module(struct load_info
+ module_bug_cleanup(mod);
+ mutex_unlock(&module_mutex);
+
++ blocking_notifier_call_chain(&module_notify_list,
++ MODULE_STATE_GOING, mod);
++
+ /* we can't deallocate the module until we clear memory protection */
+ unset_module_init_ro_nx(mod);
+ unset_module_core_ro_nx(mod);
--- /dev/null
+From ec04847c0c5b471bab2dacceadfdb803a9d1a2ea Mon Sep 17 00:00:00 2001
+From: Tatyana Nikolova <Tatyana.E.Nikolova@intel.com>
+Date: Fri, 8 May 2015 16:36:33 -0500
+Subject: RDMA/core: Fix for parsing netlink string attribute
+
+From: Tatyana Nikolova <Tatyana.E.Nikolova@intel.com>
+
+commit ec04847c0c5b471bab2dacceadfdb803a9d1a2ea upstream.
+
+The string iwpm_ulib_name is recorded in a nlmsg as a netlink attribute.
+Without this fix parsing of the nlmsg by the userspace port mapper service fails
+because of unknown attribute length, causing the port mapper service not to
+register the client, which has sent the nlmsg.
+
+Signed-off-by: Tatyana Nikolova <tatyana.e.nikolova@intel.com>
+Reviewed-By: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/iwpm_msg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/core/iwpm_msg.c
++++ b/drivers/infiniband/core/iwpm_msg.c
+@@ -33,7 +33,7 @@
+
+ #include "iwpm_util.h"
+
+-static const char iwpm_ulib_name[] = "iWarpPortMapperUser";
++static const char iwpm_ulib_name[IWPM_ULIBNAME_SIZE] = "iWarpPortMapperUser";
+ static int iwpm_ulib_version = 3;
+ static int iwpm_user_pid = IWPM_PID_UNDEFINED;
+ static atomic_t echo_nlmsg_seq;
--- /dev/null
+From 3530febb5c7636f6b26d15637f68296804d26491 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sun, 24 May 2015 08:27:52 +0200
+Subject: Revert "ALSA: hda - Add mute-LED mode control to Thinkpad"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 3530febb5c7636f6b26d15637f68296804d26491 upstream.
+
+This reverts commit 7290006d8c0900c56d8c58428134f02c35109d17.
+
+Through the regression report, it was revealed that the
+tpacpi_led_set() call to thinkpad_acpi helper doesn't only toggle the
+mute LED but actually mutes the sound. This is contradiction to the
+expectation, and rather confuses user.
+
+According to Henrique, it's not trivial to judge which TP model
+behaves "LED-only" and which model does whatever more intrusive, as
+Lenovo's implementations vary model by model. So, from the safety
+reason, we should revert the patch for now.
+
+Reported-by: Martin Steigerwald <martin@lichtvoll.de>
+Cc: Pali Rohár <pali.rohar@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/thinkpad_helper.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/sound/pci/hda/thinkpad_helper.c
++++ b/sound/pci/hda/thinkpad_helper.c
+@@ -72,7 +72,6 @@ static void hda_fixup_thinkpad_acpi(stru
+ if (led_set_func(TPACPI_LED_MUTE, false) >= 0) {
+ old_vmaster_hook = spec->vmaster_mute.hook;
+ spec->vmaster_mute.hook = update_tpacpi_mute_led;
+- spec->vmaster_mute_enum = 1;
+ removefunc = false;
+ }
+ if (led_set_func(TPACPI_LED_MICMUTE, false) >= 0) {
hwmon-nct6683-add-missing-sysfs-attribute-initialization.patch
clk-exynos5420-restore-gate_bus_top-on-suspend.patch
clk-add-missing-lock-when-call-clk_core_enable-in-clk_set_parent.patch
+brcmfmac-avoid-null-pointer-access-when-brcmf_msgbuf_get_pktid-fails.patch
+lib-fix-strnlen_user-to-not-touch-memory-after-specified-maximum.patch
+d_walk-might-skip-too-much.patch
+module-call-module-notifier-on-failure-after-complete_formation.patch
+alsa-usb-audio-add-quirk-for-ms-lifecam-studio.patch
+alsa-hda-add-conexant-codecs-cx20721-cx20722-cx20723-and-cx20724.patch
+alsa-hda-add-headphone-quirk-for-lifebook-e752.patch
+alsa-hda-add-headset-mic-quirk-for-dell-inspiron-5548.patch
+alsa-hda-realtek-alc292-dock-fix-for-thinkpad-l450.patch
+alsa-usb-audio-add-quirk-for-ms-lifecam-hd-3000.patch
+revert-alsa-hda-add-mute-led-mode-control-to-thinkpad.patch
+alsa-hda-fix-noise-on-amd-radeon-290x-controller.patch
+asoc-mc13783-fix-wrong-mask-value-used-in-mc13xxx_reg_rmw-calls.patch
+asoc-uda1380-avoid-accessing-i2c-bus-when-codec-is-disabled.patch
+asoc-dapm-modify-widget-stream-name-according-to-prefix.patch
+asoc-wm8960-fix-rinput3-audio-route-error.patch
+asoc-wm8994-correct-bclk-div-348-to-384.patch
+rdma-core-fix-for-parsing-netlink-string-attribute.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
