--- /dev/null
+From e12fb97222fc41e8442896934f76d39ef99b590a Mon Sep 17 00:00:00 2001
+From: Lukas Czerner <lczerner@redhat.com>
+Date: Fri, 3 Apr 2015 10:46:58 -0400
+Subject: ext4: make fsync to sync parent dir in no-journal for real this time
+
+From: Lukas Czerner <lczerner@redhat.com>
+
+commit e12fb97222fc41e8442896934f76d39ef99b590a upstream.
+
+Previously commit 14ece1028b3ed53ffec1b1213ffc6acaf79ad77c added a
+support for for syncing parent directory of newly created inodes to
+make sure that the inode is not lost after a power failure in
+no-journal mode.
+
+However this does not work in majority of cases, namely:
+ - if the directory has inline data
+ - if the directory is already indexed
+ - if the directory already has at least one block and:
+ - the new entry fits into it
+ - or we've successfully converted it to indexed
+
+So in those cases we might lose the inode entirely even after fsync in
+the no-journal mode. This also includes ext2 default mode obviously.
+
+I've noticed this while running xfstest generic/321 and even though the
+test should fail (we need to run fsck after a crash in no-journal mode)
+I could not find a newly created entries even when if it was fsynced
+before.
+
+Fix this by adjusting the ext4_add_entry() successful exit paths to set
+the inode EXT4_STATE_NEWENTRY so that fsync has the chance to fsync the
+parent directory as well.
+
+Signed-off-by: Lukas Czerner <lczerner@redhat.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Cc: Frank Mayhar <fmayhar@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/namei.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -1865,7 +1865,7 @@ static int ext4_add_entry(handle_t *hand
+ struct inode *inode)
+ {
+ struct inode *dir = dentry->d_parent->d_inode;
+- struct buffer_head *bh;
++ struct buffer_head *bh = NULL;
+ struct ext4_dir_entry_2 *de;
+ struct ext4_dir_entry_tail *t;
+ struct super_block *sb;
+@@ -1889,14 +1889,14 @@ static int ext4_add_entry(handle_t *hand
+ return retval;
+ if (retval == 1) {
+ retval = 0;
+- return retval;
++ goto out;
+ }
+ }
+
+ if (is_dx(dir)) {
+ retval = ext4_dx_add_entry(handle, dentry, inode);
+ if (!retval || (retval != ERR_BAD_DX_DIR))
+- return retval;
++ goto out;
+ ext4_clear_inode_flag(dir, EXT4_INODE_INDEX);
+ dx_fallback++;
+ ext4_mark_inode_dirty(handle, dir);
+@@ -1908,14 +1908,15 @@ static int ext4_add_entry(handle_t *hand
+ return PTR_ERR(bh);
+
+ retval = add_dirent_to_buf(handle, dentry, inode, NULL, bh);
+- if (retval != -ENOSPC) {
+- brelse(bh);
+- return retval;
+- }
++ if (retval != -ENOSPC)
++ goto out;
+
+ if (blocks == 1 && !dx_fallback &&
+- EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX))
+- return make_indexed_dir(handle, dentry, inode, bh);
++ EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) {
++ retval = make_indexed_dir(handle, dentry, inode, bh);
++ bh = NULL; /* make_indexed_dir releases bh */
++ goto out;
++ }
+ brelse(bh);
+ }
+ bh = ext4_append(handle, dir, &block);
+@@ -1931,6 +1932,7 @@ static int ext4_add_entry(handle_t *hand
+ }
+
+ retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
++out:
+ brelse(bh);
+ if (retval == 0)
+ ext4_set_inode_state(inode, EXT4_STATE_NEWENTRY);
--- /dev/null
+From a87938b2e246b81b4fb713edb371a9fa3c5c3c86 Mon Sep 17 00:00:00 2001
+From: Michael Davidson <md@google.com>
+Date: Tue, 14 Apr 2015 15:47:38 -0700
+Subject: fs/binfmt_elf.c: fix bug in loading of PIE binaries
+
+From: Michael Davidson <md@google.com>
+
+commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 upstream.
+
+With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down
+address allocation strategy, load_elf_binary() will attempt to map a PIE
+binary into an address range immediately below mm->mmap_base.
+
+Unfortunately, load_elf_ binary() does not take account of the need to
+allocate sufficient space for the entire binary which means that, while
+the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent
+PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are
+that is supposed to be the "gap" between the stack and the binary.
+
+Since the size of the "gap" on x86_64 is only guaranteed to be 128MB this
+means that binaries with large data segments > 128MB can end up mapping
+part of their data segment over their stack resulting in corruption of the
+stack (and the data segment once the binary starts to run).
+
+Any PIE binary with a data segment > 128MB is vulnerable to this although
+address randomization means that the actual gap between the stack and the
+end of the binary is normally greater than 128MB. The larger the data
+segment of the binary the higher the probability of failure.
+
+Fix this by calculating the total size of the binary in the same way as
+load_elf_interp().
+
+Signed-off-by: Michael Davidson <md@google.com>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Kees Cook <keescook@chromium.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/binfmt_elf.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -862,6 +862,7 @@ static int load_elf_binary(struct linux_
+ i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
+ int elf_prot = 0, elf_flags;
+ unsigned long k, vaddr;
++ unsigned long total_size = 0;
+
+ if (elf_ppnt->p_type != PT_LOAD)
+ continue;
+@@ -924,10 +925,16 @@ static int load_elf_binary(struct linux_
+ #else
+ load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+ #endif
++ total_size = total_mapping_size(elf_phdata,
++ loc->elf_ex.e_phnum);
++ if (!total_size) {
++ error = -EINVAL;
++ goto out_free_dentry;
++ }
+ }
+
+ error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
+- elf_prot, elf_flags, 0);
++ elf_prot, elf_flags, total_size);
+ if (BAD_ADDR(error)) {
+ retval = IS_ERR((void *)error) ?
+ PTR_ERR((void*)error) : -EINVAL;
--- /dev/null
+From 6bcca19f5dcedc3a006ca0bcc3699a437cadee74 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 8 Apr 2015 09:26:42 -0700
+Subject: Input: alps - fix touchpad buttons getting stuck when used with trackpoint
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 6bcca19f5dcedc3a006ca0bcc3699a437cadee74 upstream.
+
+When the left touchpad button gets pressed, and then the trackpoint is
+moved, and then the button is released, the following happens:
+
+1) touchpad packet is received, touchpad evdev node reports BTN_LEFT 1
+
+2) pointing stick packet is received, the hw will report a BTN_LEFT 1 in
+ this packet because when the trackstick is active it communicates the
+ combined touchpad + pointing stick buttons in the trackstick packet,
+ since alps_report_bare_ps2_packet passes NULL (*) for the dev2 parameter
+ to alps_report_buttons the combining is not detected and the
+ pointing stick evdev node will also report BTN_LEFT 1
+
+3) on release of the button a pointing stick packet with BTN_LEFT 0 is
+ received and the pointing stick evdev node will report BTN_LEFT 0
+
+Note how because of the passing as NULL for dev2 the touchpad evdev node
+will never send BTN_LEFT 0 in this scenario leading to a stuck mouse button.
+
+This is a regression in 4.0 introduced by commit 04aae283ba6a8
+("Input: ALPS - do not mix trackstick and external PS/2 mouse data")
+
+This commit fixes this by passing in the touchpad evdev as dev2 parameter
+when calling alps_report_buttons for the pointingstick on alps v2 devices,
+so that alps_report_buttons correctly detect that we're already reporting
+the button as pressed via the touchpad evdev node, and will also send the
+release event there.
+
+Reported-by: Hans de Bruin <jmdebruin@xmsnet.nl>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Pali Rohár <pali.rohar@gmail.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/alps.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/input/mouse/alps.c
++++ b/drivers/input/mouse/alps.c
+@@ -1159,13 +1159,14 @@ static void alps_report_bare_ps2_packet(
+ bool report_buttons)
+ {
+ struct alps_data *priv = psmouse->private;
+- struct input_dev *dev;
++ struct input_dev *dev, *dev2 = NULL;
+
+ /* Figure out which device to use to report the bare packet */
+ if (priv->proto_version == ALPS_PROTO_V2 &&
+ (priv->flags & ALPS_DUALPOINT)) {
+ /* On V2 devices the DualPoint Stick reports bare packets */
+ dev = priv->dev2;
++ dev2 = psmouse->dev;
+ } else if (unlikely(IS_ERR_OR_NULL(priv->dev3))) {
+ /* Register dev3 mouse if we received PS/2 packet first time */
+ if (!IS_ERR(priv->dev3))
+@@ -1177,7 +1178,7 @@ static void alps_report_bare_ps2_packet(
+ }
+
+ if (report_buttons)
+- alps_report_buttons(dev, NULL,
++ alps_report_buttons(dev, dev2,
+ packet[0] & 1, packet[0] & 2, packet[0] & 4);
+
+ input_report_rel(dev, REL_X,
--- /dev/null
+From bd884149aca61de269fd9bad83fe2a4232ffab21 Mon Sep 17 00:00:00 2001
+From: Ulrik De Bie <ulrik.debie-os@e2big.org>
+Date: Mon, 6 Apr 2015 15:35:38 -0700
+Subject: Input: elantech - fix absolute mode setting on some ASUS laptops
+
+From: Ulrik De Bie <ulrik.debie-os@e2big.org>
+
+commit bd884149aca61de269fd9bad83fe2a4232ffab21 upstream.
+
+On ASUS TP500LN and X750JN, the touchpad absolute mode is reset each
+time set_rate is done.
+
+In order to fix this, we will verify the firmware version, and if it
+matches the one in those laptops, the set_rate function is overloaded
+with a function elantech_set_rate_restore_reg_07 that performs the
+set_rate with the original function, followed by a restore of reg_07
+(the register that sets the absolute mode on elantech v4 hardware).
+
+Also the ASUS TP500LN and X750JN firmware version, capabilities, and
+button constellation is added to elantech.c
+
+Reported-and-tested-by: George Moutsopoulos <gmoutso@yahoo.co.uk>
+Signed-off-by: Ulrik De Bie <ulrik.debie-os@e2big.org>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/elantech.c | 22 ++++++++++++++++++++++
+ drivers/input/mouse/elantech.h | 1 +
+ 2 files changed, 23 insertions(+)
+
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -893,6 +893,21 @@ static psmouse_ret_t elantech_process_by
+ }
+
+ /*
++ * This writes the reg_07 value again to the hardware at the end of every
++ * set_rate call because the register loses its value. reg_07 allows setting
++ * absolute mode on v4 hardware
++ */
++static void elantech_set_rate_restore_reg_07(struct psmouse *psmouse,
++ unsigned int rate)
++{
++ struct elantech_data *etd = psmouse->private;
++
++ etd->original_set_rate(psmouse, rate);
++ if (elantech_write_reg(psmouse, 0x07, etd->reg_07))
++ psmouse_err(psmouse, "restoring reg_07 failed\n");
++}
++
++/*
+ * Put the touchpad into absolute mode
+ */
+ static int elantech_set_absolute_mode(struct psmouse *psmouse)
+@@ -1094,6 +1109,8 @@ static int elantech_get_resolution_v4(st
+ * Asus K53SV 0x450f01 78, 15, 0c 2 hw buttons
+ * Asus G46VW 0x460f02 00, 18, 0c 2 hw buttons
+ * Asus G750JX 0x360f00 00, 16, 0c 2 hw buttons
++ * Asus TP500LN 0x381f17 10, 14, 0e clickpad
++ * Asus X750JN 0x381f17 10, 14, 0e clickpad
+ * Asus UX31 0x361f00 20, 15, 0e clickpad
+ * Asus UX32VD 0x361f02 00, 15, 0e clickpad
+ * Avatar AVIU-145A2 0x361f00 ? clickpad
+@@ -1635,6 +1652,11 @@ int elantech_init(struct psmouse *psmous
+ goto init_fail;
+ }
+
++ if (etd->fw_version == 0x381f17) {
++ etd->original_set_rate = psmouse->set_rate;
++ psmouse->set_rate = elantech_set_rate_restore_reg_07;
++ }
++
+ if (elantech_set_input_params(psmouse)) {
+ psmouse_err(psmouse, "failed to query touchpad range.\n");
+ goto init_fail;
+--- a/drivers/input/mouse/elantech.h
++++ b/drivers/input/mouse/elantech.h
+@@ -142,6 +142,7 @@ struct elantech_data {
+ struct finger_pos mt[ETP_MAX_FINGERS];
+ unsigned char parity[256];
+ int (*send_cmd)(struct psmouse *psmouse, unsigned char c, unsigned char *param);
++ void (*original_set_rate)(struct psmouse *psmouse, unsigned int rate);
+ };
+
+ #ifdef CONFIG_MOUSE_PS2_ELANTECH
--- /dev/null
+From d7ef76717322c8e2df7d4360b33faa9466cb1a0d Mon Sep 17 00:00:00 2001
+From: Len Brown <len.brown@intel.com>
+Date: Tue, 24 Mar 2015 23:23:20 -0400
+Subject: intel_idle: Update support for Silvermont Core in Baytrail SOC
+
+From: Len Brown <len.brown@intel.com>
+
+commit d7ef76717322c8e2df7d4360b33faa9466cb1a0d upstream.
+
+On some Silvermont-Core/Baytrail-SOC systems,
+C1E latency is higher than original specifications.
+Although C1E is still enumerated in CPUID.MWAIT.EDX,
+we delete the state from intel_idle to avoid latency impact.
+
+Under some conditions, the latency of the C6N-BYT and C6S-BYT states
+may exceed the specified values of 40 and 140 usec, respectively.
+Increase those values to 300 and 500 usec; to assure
+that the hardware does not violate constraints that may be set
+by the Linux PM_QOS sub-system.
+
+Also increase the C7-BYT target residency to 4.0 ms from 1.5 ms.
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Cc: Kumar P Mahesh <mahesh.kumar.p@intel.com>
+Cc: Alan Cox <alan@linux.intel.com>
+Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/idle/intel_idle.c | 14 +++-----------
+ 1 file changed, 3 insertions(+), 11 deletions(-)
+
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -218,18 +218,10 @@ static struct cpuidle_state byt_cstates[
+ .enter = &intel_idle,
+ .enter_freeze = intel_idle_freeze, },
+ {
+- .name = "C1E-BYT",
+- .desc = "MWAIT 0x01",
+- .flags = MWAIT2flg(0x01),
+- .exit_latency = 15,
+- .target_residency = 30,
+- .enter = &intel_idle,
+- .enter_freeze = intel_idle_freeze, },
+- {
+ .name = "C6N-BYT",
+ .desc = "MWAIT 0x58",
+ .flags = MWAIT2flg(0x58) | CPUIDLE_FLAG_TLB_FLUSHED,
+- .exit_latency = 40,
++ .exit_latency = 300,
+ .target_residency = 275,
+ .enter = &intel_idle,
+ .enter_freeze = intel_idle_freeze, },
+@@ -237,7 +229,7 @@ static struct cpuidle_state byt_cstates[
+ .name = "C6S-BYT",
+ .desc = "MWAIT 0x52",
+ .flags = MWAIT2flg(0x52) | CPUIDLE_FLAG_TLB_FLUSHED,
+- .exit_latency = 140,
++ .exit_latency = 500,
+ .target_residency = 560,
+ .enter = &intel_idle,
+ .enter_freeze = intel_idle_freeze, },
+@@ -246,7 +238,7 @@ static struct cpuidle_state byt_cstates[
+ .desc = "MWAIT 0x60",
+ .flags = MWAIT2flg(0x60) | CPUIDLE_FLAG_TLB_FLUSHED,
+ .exit_latency = 1200,
+- .target_residency = 1500,
++ .target_residency = 4000,
+ .enter = &intel_idle,
+ .enter_freeze = intel_idle_freeze, },
+ {
--- /dev/null
+From a77c50b44cfb663ad03faba9800fec19bdf83577 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 25 Mar 2015 12:07:05 +0100
+Subject: mfd: core: Fix platform-device name collisions
+
+From: Johan Hovold <johan@kernel.org>
+
+commit a77c50b44cfb663ad03faba9800fec19bdf83577 upstream.
+
+Since commit 6e3f62f0793e ("mfd: core: Fix platform-device id
+generation") we honour PLATFORM_DEVID_AUTO and PLATFORM_DEVID_NONE when
+registering mfd-devices.
+
+Unfortunately, some mfd-drivers rely on the old behaviour of generating
+platform-device ids by adding the cell id also to the special value of
+PLATFORM_DEVID_NONE. The resulting platform ids are not only used to
+generate device-unique names, but are also used instead of the cell id
+to identify cells when probing subdevices.
+
+These drivers should be updated to use PLATFORM_DEVID_AUTO, which would
+also allow more than one device to be registered without resorting to
+hacks (see for example wm831x), but lets fix the regression first by
+partially reverting the above mentioned commit with respect to
+PLATFORM_DEVID_NONE.
+
+Fixes: 6e3f62f0793e ("mfd: core: Fix platform-device id generation")
+Reported-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/mfd-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mfd/mfd-core.c
++++ b/drivers/mfd/mfd-core.c
+@@ -128,7 +128,7 @@ static int mfd_add_device(struct device
+ int platform_id;
+ int r;
+
+- if (id < 0)
++ if (id == PLATFORM_DEVID_AUTO)
+ platform_id = id;
+ else
+ platform_id = id + cell->id;
--- /dev/null
+From 361918970b7426bba97a64678ef2b2679c37199b Mon Sep 17 00:00:00 2001
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+Date: Tue, 31 Mar 2015 15:02:05 +0200
+Subject: net/macb: fix the peripheral version test
+
+From: Nicolas Ferre <nicolas.ferre@atmel.com>
+
+commit 361918970b7426bba97a64678ef2b2679c37199b upstream.
+
+We currently need two checks of the peripheral version in MACB_MID register.
+One of them got out of sync after modification by 8a013a9c71b2 (net: macb:
+Include multi queue support for xilinx ZynqMP ethernet version).
+Fix this in macb_configure_caps() so that xilinx ZynqMP will be considered
+as a GEM flavor.
+
+Fixes: 8a013a9c71b2 ("net: macb: Include multi queue support for xilinx ZynqMP
+ethernet version")
+
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Cc: Michal Simek <michal.simek@xilinx.com>
+Cc: Punnaiah Choudary Kalluri <punnaia@xilinx.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/cadence/macb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/cadence/macb.c
++++ b/drivers/net/ethernet/cadence/macb.c
+@@ -2165,7 +2165,7 @@ static void macb_configure_caps(struct m
+ }
+ }
+
+- if (MACB_BFEXT(IDNUM, macb_readl(bp, MID)) == 0x2)
++ if (MACB_BFEXT(IDNUM, macb_readl(bp, MID)) >= 0x2)
+ bp->caps |= MACB_CAPS_MACB_IS_GEM;
+
+ if (macb_is_gem(bp)) {
--- /dev/null
+From d4a41d10b2cb5890aeda6b2912973b2a754b05b1 Mon Sep 17 00:00:00 2001
+From: Christophe Ricard <christophe.ricard@gmail.com>
+Date: Tue, 31 Mar 2015 08:02:15 +0200
+Subject: NFC: st21nfcb: Retry i2c_master_send if it returns a negative value
+
+From: Christophe Ricard <christophe.ricard@gmail.com>
+
+commit d4a41d10b2cb5890aeda6b2912973b2a754b05b1 upstream.
+
+i2c_master_send may return many negative values different than
+-EREMOTEIO.
+In case an i2c transaction is NACK'ed, on raspberry pi B+
+kernel 3.18, -EIO is generated instead.
+
+Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
+Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nfc/st21nfcb/i2c.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/nfc/st21nfcb/i2c.c
++++ b/drivers/nfc/st21nfcb/i2c.c
+@@ -109,7 +109,7 @@ static int st21nfcb_nci_i2c_write(void *
+ return phy->ndlc->hard_fault;
+
+ r = i2c_master_send(client, skb->data, skb->len);
+- if (r == -EREMOTEIO) { /* Retry, chip was in standby */
++ if (r < 0) { /* Retry, chip was in standby */
+ usleep_range(1000, 4000);
+ r = i2c_master_send(client, skb->data, skb->len);
+ }
+@@ -148,7 +148,7 @@ static int st21nfcb_nci_i2c_read(struct
+ struct i2c_client *client = phy->i2c_dev;
+
+ r = i2c_master_recv(client, buf, ST21NFCB_NCI_I2C_MIN_SIZE);
+- if (r == -EREMOTEIO) { /* Retry, chip was in standby */
++ if (r < 0) { /* Retry, chip was in standby */
+ usleep_range(1000, 4000);
+ r = i2c_master_recv(client, buf, ST21NFCB_NCI_I2C_MIN_SIZE);
+ }
--- /dev/null
+From b72c186999e689cb0b055ab1c7b3cd8fffbeb5ed Mon Sep 17 00:00:00 2001
+From: Oleg Nesterov <oleg@redhat.com>
+Date: Thu, 16 Apr 2015 12:47:29 -0700
+Subject: ptrace: fix race between ptrace_resume() and wait_task_stopped()
+
+From: Oleg Nesterov <oleg@redhat.com>
+
+commit b72c186999e689cb0b055ab1c7b3cd8fffbeb5ed upstream.
+
+ptrace_resume() is called when the tracee is still __TASK_TRACED. We set
+tracee->exit_code and then wake_up_state() changes tracee->state. If the
+tracer's sub-thread does wait() in between, task_stopped_code(ptrace => T)
+wrongly looks like another report from tracee.
+
+This confuses debugger, and since wait_task_stopped() clears ->exit_code
+the tracee can miss a signal.
+
+Test-case:
+
+ #include <stdio.h>
+ #include <unistd.h>
+ #include <sys/wait.h>
+ #include <sys/ptrace.h>
+ #include <pthread.h>
+ #include <assert.h>
+
+ int pid;
+
+ void *waiter(void *arg)
+ {
+ int stat;
+
+ for (;;) {
+ assert(pid == wait(&stat));
+ assert(WIFSTOPPED(stat));
+ if (WSTOPSIG(stat) == SIGHUP)
+ continue;
+
+ assert(WSTOPSIG(stat) == SIGCONT);
+ printf("ERR! extra/wrong report:%x\n", stat);
+ }
+ }
+
+ int main(void)
+ {
+ pthread_t thread;
+
+ pid = fork();
+ if (!pid) {
+ assert(ptrace(PTRACE_TRACEME, 0,0,0) == 0);
+ for (;;)
+ kill(getpid(), SIGHUP);
+ }
+
+ assert(pthread_create(&thread, NULL, waiter, NULL) == 0);
+
+ for (;;)
+ ptrace(PTRACE_CONT, pid, 0, SIGCONT);
+
+ return 0;
+ }
+
+Note for stable: the bug is very old, but without 9899d11f6544 "ptrace:
+ensure arch_ptrace/ptrace_request can never race with SIGKILL" the fix
+should use lock_task_sighand(child).
+
+Signed-off-by: Oleg Nesterov <oleg@redhat.com>
+Reported-by: Pavel Labath <labath@google.com>
+Tested-by: Pavel Labath <labath@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/ptrace.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -697,6 +697,8 @@ static int ptrace_peek_siginfo(struct ta
+ static int ptrace_resume(struct task_struct *child, long request,
+ unsigned long data)
+ {
++ bool need_siglock;
++
+ if (!valid_signal(data))
+ return -EIO;
+
+@@ -724,8 +726,26 @@ static int ptrace_resume(struct task_str
+ user_disable_single_step(child);
+ }
+
++ /*
++ * Change ->exit_code and ->state under siglock to avoid the race
++ * with wait_task_stopped() in between; a non-zero ->exit_code will
++ * wrongly look like another report from tracee.
++ *
++ * Note that we need siglock even if ->exit_code == data and/or this
++ * status was not reported yet, the new status must not be cleared by
++ * wait_task_stopped() after resume.
++ *
++ * If data == 0 we do not care if wait_task_stopped() reports the old
++ * status and clears the code too; this can't race with the tracee, it
++ * takes siglock after resume.
++ */
++ need_siglock = data && !thread_group_empty(current);
++ if (need_siglock)
++ spin_lock_irq(&child->sighand->siglock);
+ child->exit_code = data;
+ wake_up_state(child, __TASK_TRACED);
++ if (need_siglock)
++ spin_unlock_irq(&child->sighand->siglock);
+
+ return 0;
+ }
--- /dev/null
+From 9374e7d2fdcad3c36dafc8d3effd554bc702c4b6 Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Thu, 26 Mar 2015 02:16:06 +0100
+Subject: rtlwifi: rtl8192cu: Add new device ID
+
+From: Marek Vasut <marex@denx.de>
+
+commit 9374e7d2fdcad3c36dafc8d3effd554bc702c4b6 upstream.
+
+Add new ID for ASUS N10 WiFi dongle.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Tested-by: Marek Vasut <marex@denx.de>
+Cc: Larry Finger <Larry.Finger@lwfinger.net>
+Cc: John W. Linville <linville@tuxdriver.com>
+Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -321,6 +321,7 @@ static struct usb_device_id rtl8192c_usb
+ {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/
+ {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/
+ {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/
++ {RTL_USB_DEVICE(0x0b05, 0x17ba, rtl92cu_hal_cfg)}, /*ASUS-Edimax*/
+ {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
+ {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+ {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
--- /dev/null
+From 2f92b314f4daff2117847ac5343c54d3d041bf78 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 23 Mar 2015 18:14:10 -0500
+Subject: rtlwifi: rtl8192cu: Add new USB ID
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 2f92b314f4daff2117847ac5343c54d3d041bf78 upstream.
+
+USB ID 2001:330d is used for a D-Link DWA-131.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -377,6 +377,7 @@ static struct usb_device_id rtl8192c_usb
+ {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
+ {RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
+ {RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
++ {RTL_USB_DEVICE(0x2001, 0x330d, rtl92cu_hal_cfg)}, /*D-Link DWA-131 */
+ {RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/
+ {RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/
+ {RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/
alsa-hda-fix-num_steps-0-error-on-alc256.patch
alsa-hda-realtek-fix-headphone-mic-doesn-t-recording-for-alc256.patch
alsa-hda-fix-headset-mic-detection-problem-for-one-more-machine.patch
+input-elantech-fix-absolute-mode-setting-on-some-asus-laptops.patch
+input-alps-fix-touchpad-buttons-getting-stuck-when-used-with-trackpoint.patch
+mfd-core-fix-platform-device-name-collisions.patch
+fs-binfmt_elf.c-fix-bug-in-loading-of-pie-binaries.patch
+ptrace-fix-race-between-ptrace_resume-and-wait_task_stopped.patch
+intel_idle-update-support-for-silvermont-core-in-baytrail-soc.patch
+net-macb-fix-the-peripheral-version-test.patch
+nfc-st21nfcb-retry-i2c_master_send-if-it-returns-a-negative-value.patch
+rtlwifi-rtl8192cu-add-new-usb-id.patch
+rtlwifi-rtl8192cu-add-new-device-id.patch
+ext4-make-fsync-to-sync-parent-dir-in-no-journal-for-real-this-time.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
