--- /dev/null
+From 9d2b48f7304aafaefbf0794a556ab4e307929d24 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 24 Aug 2015 10:45:27 +0200
+Subject: ALSA: hda - Check all inputs for is_active_nid_for_any()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 9d2b48f7304aafaefbf0794a556ab4e307929d24 upstream.
+
+The is_active_nid_for_any() function in the generic parser is supposed
+to check all connections from/to the given widget, but the current
+code checks only the first input connection (index = 0).
+
+This patch corrects the code to check all inputs by passing -1 to
+index argument.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=102521
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_generic.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -671,7 +671,8 @@ static bool is_active_nid(struct hda_cod
+ }
+ for (i = 0; i < path->depth; i++) {
+ if (path->path[i] == nid) {
+- if (dir == HDA_OUTPUT || path->idx[i] == idx)
++ if (dir == HDA_OUTPUT || idx == -1 ||
++ path->idx[i] == idx)
+ return true;
+ break;
+ }
+@@ -682,7 +683,7 @@ static bool is_active_nid(struct hda_cod
+
+ /* check whether the NID is referred by any active paths */
+ #define is_active_nid_for_any(codec, nid) \
+- is_active_nid(codec, nid, HDA_OUTPUT, 0)
++ is_active_nid(codec, nid, HDA_OUTPUT, -1)
+
+ /* get the default amp value for the target state */
+ static int get_amp_val_to_activate(struct hda_codec *codec, hda_nid_t nid,
--- /dev/null
+From c7cd0ef66aade29e37ee08821a0e195ee776c6e6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 24 Aug 2015 10:52:06 +0200
+Subject: ALSA: hda - Fix path power activation
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit c7cd0ef66aade29e37ee08821a0e195ee776c6e6 upstream.
+
+The widget power-saving code tries to turn up/down the power of each
+widget in the I/O paths that are modified at each jack plug/unplug.
+The recent report revealed that the power activation leaves some
+widgets unpowered after plugging. This is because
+snd_hda_activate_path() turns on path->active flag at the end of the
+function while the path power management is done before that. Then
+it's regarded as if nothing is active, and the driver turns off the
+power.
+
+The fix is simply to set the flag at the beginning of the function,
+before trying to power up.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=102521
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_generic.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -884,8 +884,7 @@ void snd_hda_activate_path(struct hda_co
+ struct hda_gen_spec *spec = codec->spec;
+ int i;
+
+- if (!enable)
+- path->active = false;
++ path->active = enable;
+
+ /* make sure the widget is powered up */
+ if (enable && (spec->power_down_unused || codec->power_save_node))
+@@ -903,9 +902,6 @@ void snd_hda_activate_path(struct hda_co
+ if (has_amp_out(codec, path, i))
+ activate_amp_out(codec, path, i, enable);
+ }
+-
+- if (enable)
+- path->active = true;
+ }
+ EXPORT_SYMBOL_GPL(snd_hda_activate_path);
+
--- /dev/null
+From c7e69ae6b4ff49edf50180c0a32f3dd9d7967e31 Mon Sep 17 00:00:00 2001
+From: Markus Osterhoff <linux-kernel@k-raum.org>
+Date: Mon, 24 Aug 2015 14:11:39 +0200
+Subject: ALSA: hda: fix possible NULL dereference
+
+From: Markus Osterhoff <linux-kernel@k-raum.org>
+
+commit c7e69ae6b4ff49edf50180c0a32f3dd9d7967e31 upstream.
+
+After a for-loop was replaced by list_for_each_entry, see
+Commit bbbc7e8502c9 ("ALSA: hda - Allocate hda_pcm objects dynamically"),
+Commit 751e2216899c ("ALSA: hda: fix possible null dereference"),
+a possible NULL pointer dereference has been introduced; this patch adds
+the NULL check on pcm->pcm, while leaving a potentially superfluous
+check on pcm itself untouched.
+
+Signed-off-by: Markus Osterhoff <linux-kernel@k-raum.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/hda_codec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -3259,7 +3259,7 @@ static int add_std_chmaps(struct hda_cod
+ struct snd_pcm_chmap *chmap;
+ const struct snd_pcm_chmap_elem *elem;
+
+- if (!pcm || pcm->own_chmap ||
++ if (!pcm || !pcm->pcm || pcm->own_chmap ||
+ !hinfo->substreams)
+ continue;
+ elem = hinfo->chmap ? hinfo->chmap : snd_pcm_std_chmaps;
--- /dev/null
+From 7ccb0a9917a511de1d5f92980f26885484d9a914 Mon Sep 17 00:00:00 2001
+From: Woodrow Shen <woodrow.shen@canonical.com>
+Date: Thu, 13 Aug 2015 11:20:40 +0800
+Subject: ALSA: hda - Fix the white noise on Dell laptop
+
+From: Woodrow Shen <woodrow.shen@canonical.com>
+
+commit 7ccb0a9917a511de1d5f92980f26885484d9a914 upstream.
+
+Dell laptop causes the white noise by login screen and headphone,
+and the fixup function ALC292_FIXUP_DISABLE_AAMIX can eliminate this
+noise.
+
+Codec: Realtek ALC3235
+Vendor Id: 0x10ec0293
+Subsystem Id: 0x102806db
+
+BugLink: https://bugs.launchpad.net/bugs/1484334
+Signed-off-by: Woodrow Shen <woodrow.shen@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5119,6 +5119,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x06da, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x06de, "Dell", ALC292_FIXUP_DISABLE_AAMIX),
++ SND_PCI_QUIRK(0x1028, 0x06db, "Dell", ALC292_FIXUP_DISABLE_AAMIX),
+ SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
--- /dev/null
+From f6b28e4ded45bb91bc4cd115d55e35badedfce5f Mon Sep 17 00:00:00 2001
+From: David Henningsson <david.henningsson@canonical.com>
+Date: Fri, 21 Aug 2015 09:42:35 +0200
+Subject: ALSA: hda - Shutdown CX20722 on reboot/free to avoid spurious noises
+
+From: David Henningsson <david.henningsson@canonical.com>
+
+commit f6b28e4ded45bb91bc4cd115d55e35badedfce5f upstream.
+
+On shutdown/reboot of CX20722, first shut down all EAPDs, then
+shut down the afg node to D3.
+
+Failure to do so can lead to spurious noises from the internal speaker
+directly after reboot (and before the codec is reinitialized again, i e
+in BIOS setup or GRUB menus).
+
+BugLink: https://bugs.launchpad.net/bugs/1487345
+Signed-off-by: David Henningsson <david.henningsson@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_conexant.c | 23 ++++++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -200,12 +200,33 @@ static int cx_auto_init(struct hda_codec
+ return 0;
+ }
+
+-#define cx_auto_free snd_hda_gen_free
++static void cx_auto_reboot_notify(struct hda_codec *codec)
++{
++ struct conexant_spec *spec = codec->spec;
++
++ if (codec->core.vendor_id != 0x14f150f2)
++ return;
++
++ /* Turn the CX20722 codec into D3 to avoid spurious noises
++ from the internal speaker during (and after) reboot */
++ cx_auto_turn_eapd(codec, spec->num_eapds, spec->eapds, false);
++
++ snd_hda_codec_set_power_to_all(codec, codec->core.afg, AC_PWRST_D3);
++ snd_hda_codec_write(codec, codec->core.afg, 0,
++ AC_VERB_SET_POWER_STATE, AC_PWRST_D3);
++}
++
++static void cx_auto_free(struct hda_codec *codec)
++{
++ cx_auto_reboot_notify(codec);
++ snd_hda_gen_free(codec);
++}
+
+ static const struct hda_codec_ops cx_auto_patch_ops = {
+ .build_controls = cx_auto_build_controls,
+ .build_pcms = snd_hda_gen_build_pcms,
+ .init = cx_auto_init,
++ .reboot_notify = cx_auto_reboot_notify,
+ .free = cx_auto_free,
+ .unsol_event = snd_hda_jack_unsol_event,
+ #ifdef CONFIG_PM
--- /dev/null
+From 9544f8b6e2ee9ed02d2322ff018837b185f51d45 Mon Sep 17 00:00:00 2001
+From: Jurgen Kramer <gtmkramer@xs4all.nl>
+Date: Fri, 21 Aug 2015 09:48:35 +0200
+Subject: ALSA: usb: Add native DSD support for Gustard DAC-X20U
+
+From: Jurgen Kramer <gtmkramer@xs4all.nl>
+
+commit 9544f8b6e2ee9ed02d2322ff018837b185f51d45 upstream.
+
+This patch adds native DSD support for the Gustard DAC-X20U.
+
+Signed-off-by: Jurgen Kramer <gtmkramer@xs4all.nl>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1268,6 +1268,7 @@ u64 snd_usb_interface_dsd_format_quirks(
+ return SNDRV_PCM_FMTBIT_DSD_U32_BE;
+ break;
+
++ case USB_ID(0x20b1, 0x000a): /* Gustard DAC-X20U */
+ case USB_ID(0x20b1, 0x2009): /* DIYINHK DSD DXD 384kHz USB to I2S/DSD */
+ case USB_ID(0x20b1, 0x2023): /* JLsounds I2SoverUSB */
+ if (fp->altsetting == 3)
--- /dev/null
+From 9003ebb13f61e8c78a641e0dda7775183ada0625 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 19 Aug 2015 07:20:14 +0200
+Subject: ALSA: usb-audio: Fix runtime PM unbalance
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 9003ebb13f61e8c78a641e0dda7775183ada0625 upstream.
+
+The fix for deadlock in PM in commit [1ee23fe07ee8: ALSA: usb-audio:
+Fix deadlocks at resuming] introduced a new check of in_pm flag.
+However, the brainless patch author evaluated it in a wrong way
+(logical AND instead of logical OR), thus usb_autopm_get_interface()
+is wrongly called at probing, leading to unbalance of runtime PM
+refcount.
+
+This patch fixes it by correcting the logic.
+
+Reported-by: Hans Yang <hansy@nvidia.com>
+Fixes: 1ee23fe07ee8 ('ALSA: usb-audio: Fix deadlocks at resuming')
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/usb/card.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -638,7 +638,7 @@ int snd_usb_autoresume(struct snd_usb_au
+ int err = -ENODEV;
+
+ down_read(&chip->shutdown_rwsem);
+- if (chip->probing && chip->in_pm)
++ if (chip->probing || chip->in_pm)
+ err = 0;
+ else if (!chip->shutdown)
+ err = usb_autopm_get_interface(chip->pm_intf);
--- /dev/null
+From 24ee3cf89bef04e8bc23788aca4e029a3f0f06d9 Mon Sep 17 00:00:00 2001
+From: Alban Crequy <alban.crequy@gmail.com>
+Date: Thu, 6 Aug 2015 16:21:05 +0200
+Subject: cpuset: use trialcs->mems_allowed as a temp variable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alban Crequy <alban.crequy@gmail.com>
+
+commit 24ee3cf89bef04e8bc23788aca4e029a3f0f06d9 upstream.
+
+The comment says it's using trialcs->mems_allowed as a temp variable but
+it didn't match the code. Change the code to match the comment.
+
+This fixes an issue when writing in cpuset.mems when a sub-directory
+exists: we need to write several times for the information to persist:
+
+| root@alban:/sys/fs/cgroup/cpuset# mkdir footest9
+| root@alban:/sys/fs/cgroup/cpuset# cd footest9
+| root@alban:/sys/fs/cgroup/cpuset/footest9# mkdir aa
+| root@alban:/sys/fs/cgroup/cpuset/footest9# cat cpuset.mems
+|
+| root@alban:/sys/fs/cgroup/cpuset/footest9# echo 0 > cpuset.mems
+| root@alban:/sys/fs/cgroup/cpuset/footest9# cat cpuset.mems
+|
+| root@alban:/sys/fs/cgroup/cpuset/footest9# echo 0 > cpuset.mems
+| root@alban:/sys/fs/cgroup/cpuset/footest9# cat cpuset.mems
+| 0
+| root@alban:/sys/fs/cgroup/cpuset/footest9# cat aa/cpuset.mems
+|
+| root@alban:/sys/fs/cgroup/cpuset/footest9# echo 0 > aa/cpuset.mems
+| root@alban:/sys/fs/cgroup/cpuset/footest9# cat aa/cpuset.mems
+| 0
+| root@alban:/sys/fs/cgroup/cpuset/footest9#
+
+This should help to fix the following issue in Docker:
+https://github.com/opencontainers/runc/issues/133
+In some conditions, a Docker container needs to be started twice in
+order to work.
+
+Signed-off-by: Alban Crequy <alban@endocode.com>
+Tested-by: Iago López Galeiras <iago@endocode.com>
+Acked-by: Li Zefan <lizefan@huawei.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/cpuset.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/cpuset.c
++++ b/kernel/cpuset.c
+@@ -1223,7 +1223,7 @@ static int update_nodemask(struct cpuset
+ spin_unlock_irq(&callback_lock);
+
+ /* use trialcs->mems_allowed as a temp variable */
+- update_nodemasks_hier(cs, &cs->mems_allowed);
++ update_nodemasks_hier(cs, &trialcs->mems_allowed);
+ done:
+ return retval;
+ }
--- /dev/null
+From 1ae5ddb6f8837558928a1a694c7b8af7f09fdd21 Mon Sep 17 00:00:00 2001
+From: Vincent Pelletier <plr.vincent@gmail.com>
+Date: Thu, 20 Aug 2015 12:00:19 -0700
+Subject: Input: gpio_keys_polled - request GPIO pin as input.
+
+From: Vincent Pelletier <plr.vincent@gmail.com>
+
+commit 1ae5ddb6f8837558928a1a694c7b8af7f09fdd21 upstream.
+
+GPIOF_IN flag was lost in:
+Commit 633a21d80b4a("input: gpio_keys_polled: Add support for GPIO
+descriptors").
+
+Without this flag, legacy code path (for non-descriptor GPIO declarations)
+would configure GPIO as output (0 meaning GPIOF_DIR_OUT | GPIOF_INIT_LOW).
+
+Signed-off-by: Vincent Pelletier <plr.vincent@gmail.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/keyboard/gpio_keys_polled.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/keyboard/gpio_keys_polled.c
++++ b/drivers/input/keyboard/gpio_keys_polled.c
+@@ -246,7 +246,7 @@ static int gpio_keys_polled_probe(struct
+ * convert it to descriptor.
+ */
+ if (!button->gpiod && gpio_is_valid(button->gpio)) {
+- unsigned flags = 0;
++ unsigned flags = GPIOF_IN;
+
+ if (button->active_low)
+ flags |= GPIOF_ACTIVE_LOW;
--- /dev/null
+From f5eeb5fa191fd7b634cbc4883ac58f3b2184dbc5 Mon Sep 17 00:00:00 2001
+From: Adrien Schildknecht <adrien+dev@schischi.me>
+Date: Tue, 28 Jul 2015 10:30:16 +0200
+Subject: mac80211: fix invalid read in minstrel_sort_best_tp_rates()
+
+From: Adrien Schildknecht <adrien+dev@schischi.me>
+
+commit f5eeb5fa191fd7b634cbc4883ac58f3b2184dbc5 upstream.
+
+At the last iteration of the loop, j may equal zero and thus
+tp_list[j - 1] causes an invalid read.
+Change the logic of the loop so that j - 1 is always >= 0.
+
+Signed-off-by: Adrien Schildknecht <adrien+dev@schischi.me>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/rc80211_minstrel.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/net/mac80211/rc80211_minstrel.c
++++ b/net/mac80211/rc80211_minstrel.c
+@@ -92,14 +92,15 @@ int minstrel_get_tp_avg(struct minstrel_
+ static inline void
+ minstrel_sort_best_tp_rates(struct minstrel_sta_info *mi, int i, u8 *tp_list)
+ {
+- int j = MAX_THR_RATES;
+- struct minstrel_rate_stats *tmp_mrs = &mi->r[j - 1].stats;
++ int j;
++ struct minstrel_rate_stats *tmp_mrs;
+ struct minstrel_rate_stats *cur_mrs = &mi->r[i].stats;
+
+- while (j > 0 && (minstrel_get_tp_avg(&mi->r[i], cur_mrs->prob_ewma) >
+- minstrel_get_tp_avg(&mi->r[tp_list[j - 1]], tmp_mrs->prob_ewma))) {
+- j--;
++ for (j = MAX_THR_RATES; j > 0; --j) {
+ tmp_mrs = &mi->r[tp_list[j - 1]].stats;
++ if (minstrel_get_tp_avg(&mi->r[i], cur_mrs->prob_ewma) <=
++ minstrel_get_tp_avg(&mi->r[tp_list[j - 1]], tmp_mrs->prob_ewma))
++ break;
+ }
+
+ if (j < MAX_THR_RATES - 1)
--- /dev/null
+From 45ea2a5fed6dacb9bb0558d8b21eacc1c45d5bb4 Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Thu, 20 Aug 2015 00:08:15 -0500
+Subject: PCI: Don't use 64-bit bus addresses on PA-RISC
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+commit 45ea2a5fed6dacb9bb0558d8b21eacc1c45d5bb4 upstream.
+
+Meelis and Helge reported that 3a9ad0b4fdcd ("PCI: Add pci_bus_addr_t")
+caused HPMCs on A500 and hangs on rp5470.
+
+PA-RISC does not set ARCH_DMA_ADDR_T_64BIT, even for 64-bit kernels, so
+prior to 3a9ad0b4fdcd, we always used 32-bit PCI addresses. After
+3a9ad0b4fdcd, we do use 64-bit PCI addresses in 64-bit kernels, and
+apparently there's some PA-RISC problem related to them.
+
+Fixes: 3a9ad0b4fdcd ("PCI: Add pci_bus_addr_t")
+Link: http://lkml.kernel.org/r/alpine.LRH.2.11.1507260929000.30065@math.ut.ee
+Reported-by: Meelis Roos <mroos@linux.ee>
+Reported-by: Helge Deller <deller@gmx.de>
+Tested-by: Helge Deller <deller@gmx.de>
+Based-on-idea-by: Yinghai Lu <yinghai@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Yinghai Lu <yinghai@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/Kconfig
++++ b/drivers/pci/Kconfig
+@@ -2,7 +2,7 @@
+ # PCI configuration
+ #
+ config PCI_BUS_ADDR_T_64BIT
+- def_bool y if (ARCH_DMA_ADDR_T_64BIT || 64BIT)
++ def_bool y if (ARCH_DMA_ADDR_T_64BIT || (64BIT && !PARISC))
+ depends on PCI
+
+ config PCI_MSI
revert-libata-eh-set-information-field-for-autosense.patch
revert-libata-implement-support-for-sense-data-reporting.patch
revert-libata-implement-ncq-autosense.patch
+cpuset-use-trialcs-mems_allowed-as-a-temp-variable.patch
+alsa-usb-audio-fix-runtime-pm-unbalance.patch
+alsa-hda-fix-the-white-noise-on-dell-laptop.patch
+alsa-usb-add-native-dsd-support-for-gustard-dac-x20u.patch
+alsa-hda-shutdown-cx20722-on-reboot-free-to-avoid-spurious-noises.patch
+alsa-hda-check-all-inputs-for-is_active_nid_for_any.patch
+alsa-hda-fix-path-power-activation.patch
+alsa-hda-fix-possible-null-dereference.patch
+mac80211-fix-invalid-read-in-minstrel_sort_best_tp_rates.patch
+target-iscsi-fix-double-free-of-a-tur-followed-by-a-solicited-nopout.patch
+pci-don-t-use-64-bit-bus-addresses-on-pa-risc.patch
+input-gpio_keys_polled-request-gpio-pin-as-input.patch
--- /dev/null
+From 9547308bda296b6f69876c840a0291fcfbeddbb8 Mon Sep 17 00:00:00 2001
+From: Alexei Potashnik <alexei@purestorage.com>
+Date: Tue, 21 Jul 2015 15:07:56 -0700
+Subject: target/iscsi: Fix double free of a TUR followed by a solicited NOPOUT
+
+From: Alexei Potashnik <alexei@purestorage.com>
+
+commit 9547308bda296b6f69876c840a0291fcfbeddbb8 upstream.
+
+Make sure all non-READ SCSI commands get targ_xfer_tag initialized
+to 0xffffffff, not just WRITEs.
+
+Double-free of a TUR cmd object occurs under the following scenario:
+
+1. TUR received (targ_xfer_tag is uninitialized and left at 0)
+2. TUR status sent
+3. First unsolicited NOPIN is sent to initiator (gets targ_xfer_tag of 0)
+4. NOPOUT for NOPIN (with TTT=0) arrives
+ - its ExpStatSN acks TUR status, TUR is queued for removal
+ - LIO tries to find NOPIN with TTT=0, but finds the same TUR instead,
+ TUR is queued for removal for the 2nd time
+
+(Drop unbalanced conditional bracket usage - nab)
+
+Signed-off-by: Alexei Potashnik <alexei@purestorage.com>
+Signed-off-by: Spencer Baugh <sbaugh@catern.com>
+Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -968,9 +968,9 @@ int iscsit_setup_scsi_cmd(struct iscsi_c
+ cmd->cmd_flags |= ICF_NON_IMMEDIATE_UNSOLICITED_DATA;
+
+ conn->sess->init_task_tag = cmd->init_task_tag = hdr->itt;
+- if (hdr->flags & ISCSI_FLAG_CMD_READ) {
++ if (hdr->flags & ISCSI_FLAG_CMD_READ)
+ cmd->targ_xfer_tag = session_get_next_ttt(conn->sess);
+- } else if (hdr->flags & ISCSI_FLAG_CMD_WRITE)
++ else
+ cmd->targ_xfer_tag = 0xFFFFFFFF;
+ cmd->cmd_sn = be32_to_cpu(hdr->cmdsn);
+ cmd->exp_stat_sn = be32_to_cpu(hdr->exp_statsn);
projects / thirdparty / kernel / stable-queue.git / commitdiff
