--- /dev/null
+From b10d94f23fc52771d8f2ae3cdb5c0c4e548bf605 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2019 17:30:01 -0400
+Subject: net/ibmvnic: free reset work of removed device from queue
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Juliet Kim <julietk@linux.vnet.ibm.com>
+
+[ Upstream commit 1c2977c094998de032fee6e898c88b4a05483d08 ]
+
+Commit 36f1031c51a2 ("ibmvnic: Do not process reset during or after
+ device removal") made the change to exit reset if the driver has been
+removed, but does not free reset work items of the adapter from queue.
+
+Ensure all reset work items are freed when breaking out of the loop early.
+
+Fixes: 36f1031c51a2 ("ibmnvic: Do not process reset during or after device removal”)
+Signed-off-by: Juliet Kim <julietk@linux.vnet.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 5a57be66a4872..f232943c818bf 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2000,7 +2000,10 @@ static void __ibmvnic_reset(struct work_struct *work)
+ while (rwi) {
+ if (adapter->state == VNIC_REMOVING ||
+ adapter->state == VNIC_REMOVED)
+- goto out;
++ kfree(rwi);
++ rc = EBUSY;
++ break;
++ }
+
+ if (adapter->force_reset_recovery) {
+ adapter->force_reset_recovery = false;
+@@ -2026,7 +2029,7 @@ static void __ibmvnic_reset(struct work_struct *work)
+ netdev_dbg(adapter->netdev, "Reset failed\n");
+ free_all_rwi(adapter);
+ }
+-out:
++
+ adapter->resetting = false;
+ if (we_lock_rtnl)
+ rtnl_unlock();
+--
+2.20.1
+
--- /dev/null
+From 9212388b800f29d808d19bb547a5f1705a7573b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2019 20:13:08 +0200
+Subject: Revert "Bluetooth: validate BLE connection interval updates"
+
+From: Marcel Holtmann <marcel@holtmann.org>
+
+[ Upstream commit 68d19d7d995759b96169da5aac313363f92a9075 ]
+
+This reverts commit c49a8682fc5d298d44e8d911f4fa14690ea9485e.
+
+There are devices which require low connection intervals for usable operation
+including keyboards and mice. Forcing a static connection interval for
+these types of devices has an impact in latency and causes a regression.
+
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bluetooth/hci_event.c | 5 -----
+ net/bluetooth/l2cap_core.c | 9 +--------
+ 2 files changed, 1 insertion(+), 13 deletions(-)
+
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 0adcddb211fa5..3e7badb3ac2d5 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -5545,11 +5545,6 @@ static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
+ return send_conn_param_neg_reply(hdev, handle,
+ HCI_ERROR_UNKNOWN_CONN_ID);
+
+- if (min < hcon->le_conn_min_interval ||
+- max > hcon->le_conn_max_interval)
+- return send_conn_param_neg_reply(hdev, handle,
+- HCI_ERROR_INVALID_LL_PARAMS);
+-
+ if (hci_check_conn_params(min, max, latency, timeout))
+ return send_conn_param_neg_reply(hdev, handle,
+ HCI_ERROR_INVALID_LL_PARAMS);
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index a54dadf4a6ca0..260ef5426e0ca 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -5287,14 +5287,7 @@ static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
+
+ memset(&rsp, 0, sizeof(rsp));
+
+- if (min < hcon->le_conn_min_interval ||
+- max > hcon->le_conn_max_interval) {
+- BT_DBG("requested connection interval exceeds current bounds.");
+- err = -EINVAL;
+- } else {
+- err = hci_check_conn_params(min, max, latency, to_multiplier);
+- }
+-
++ err = hci_check_conn_params(min, max, latency, to_multiplier);
+ if (err)
+ rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
+ else
+--
+2.20.1
+