diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/gpio/gpiolib-acpi.c linux-libre-4.19.96-gnu/drivers/gpio/gpiolib-acpi.c
--- linux-libre-4.19.95-gnu/drivers/gpio/gpiolib-acpi.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/gpio/gpiolib-acpi.c	2020-01-14 14:07:09.000000000 -0500
@@ -24,11 +24,19 @@
 
 #include "gpiolib.h"
 
+#define QUIRK_NO_EDGE_EVENTS_ON_BOOT		0x01l
+#define QUIRK_NO_WAKEUP				0x02l
+
 static int run_edge_events_on_boot = -1;
 module_param(run_edge_events_on_boot, int, 0444);
 MODULE_PARM_DESC(run_edge_events_on_boot,
 		 "Run edge _AEI event-handlers at boot: 0=no, 1=yes, -1=auto");
 
+static int honor_wakeup = -1;
+module_param(honor_wakeup, int, 0444);
+MODULE_PARM_DESC(honor_wakeup,
+		 "Honor the ACPI wake-capable flag: 0=no, 1=yes, -1=auto");
+
 /**
  * struct acpi_gpio_event - ACPI GPIO event handler data
  *
@@ -278,7 +286,7 @@ static acpi_status acpi_gpiochip_alloc_e
 	event->handle = evt_handle;
 	event->handler = handler;
 	event->irq = irq;
-	event->irq_is_wake = agpio->wake_capable == ACPI_WAKE_CAPABLE;
+	event->irq_is_wake = honor_wakeup && agpio->wake_capable == ACPI_WAKE_CAPABLE;
 	event->pin = pin;
 	event->desc = desc;
 
@@ -1263,7 +1271,7 @@ static int acpi_gpio_handle_deferred_req
 /* We must use _sync so that this runs after the first deferred_probe run */
 late_initcall_sync(acpi_gpio_handle_deferred_request_irqs);
 
-static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = {
+static const struct dmi_system_id gpiolib_acpi_quirks[] = {
 	{
 		/*
 		 * The Minix Neo Z83-4 has a micro-USB-B id-pin handler for
@@ -1273,7 +1281,8 @@ static const struct dmi_system_id run_ed
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "MINIX"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "Z83-4"),
-		}
+		},
+		.driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT,
 	},
 	{
 		/*
@@ -1285,20 +1294,52 @@ static const struct dmi_system_id run_ed
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "Wortmann_AG"),
 			DMI_MATCH(DMI_PRODUCT_NAME, "TERRA_PAD_1061"),
-		}
+		},
+		.driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT,
+	},
+	{
+		/*
+		 * Various HP X2 10 Cherry Trail models use an external
+		 * embedded-controller connected via I2C + an ACPI GPIO
+		 * event handler. The embedded controller generates various
+		 * spurious wakeup events when suspended. So disable wakeup
+		 * for its handler (it uses the only ACPI GPIO event handler).
+		 * This breaks wakeup when opening the lid, the user needs
+		 * to press the power-button to wakeup the system. The
+		 * alternative is suspend simply not working, which is worse.
+		 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "HP"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "HP x2 Detachable 10-p0XX"),
+		},
+		.driver_data = (void *)QUIRK_NO_WAKEUP,
 	},
 	{} /* Terminating entry */
 };
 
 static int acpi_gpio_setup_params(void)
 {
+	const struct dmi_system_id *id;
+	long quirks = 0;
+
+	id = dmi_first_match(gpiolib_acpi_quirks);
+	if (id)
+		quirks = (long)id->driver_data;
+
 	if (run_edge_events_on_boot < 0) {
-		if (dmi_check_system(run_edge_events_on_boot_blacklist))
+		if (quirks & QUIRK_NO_EDGE_EVENTS_ON_BOOT)
 			run_edge_events_on_boot = 0;
 		else
 			run_edge_events_on_boot = 1;
 	}
 
+	if (honor_wakeup < 0) {
+		if (quirks & QUIRK_NO_WAKEUP)
+			honor_wakeup = 0;
+		else
+			honor_wakeup = 1;
+	}
+
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/gpu/drm/drm_dp_mst_topology.c linux-libre-4.19.96-gnu/drivers/gpu/drm/drm_dp_mst_topology.c
--- linux-libre-4.19.95-gnu/drivers/gpu/drm/drm_dp_mst_topology.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/gpu/drm/drm_dp_mst_topology.c	2020-01-14 14:07:09.000000000 -0500
@@ -274,7 +274,7 @@ static void drm_dp_encode_sideband_req(s
 			memcpy(&buf[idx], req->u.i2c_read.transactions[i].bytes, req->u.i2c_read.transactions[i].num_bytes);
 			idx += req->u.i2c_read.transactions[i].num_bytes;
 
-			buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 5;
+			buf[idx] = (req->u.i2c_read.transactions[i].no_stop_bit & 0x1) << 4;
 			buf[idx] |= (req->u.i2c_read.transactions[i].i2c_transaction_delay & 0xf);
 			idx++;
 		}
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/gpu/drm/drm_fb_helper.c linux-libre-4.19.96-gnu/drivers/gpu/drm/drm_fb_helper.c
--- linux-libre-4.19.95-gnu/drivers/gpu/drm/drm_fb_helper.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/gpu/drm/drm_fb_helper.c	2020-01-14 14:07:09.000000000 -0500
@@ -1702,7 +1702,7 @@ int drm_fb_helper_check_var(struct fb_va
 	 * Changes struct fb_var_screeninfo are currently not pushed back
 	 * to KMS, hence fail if different settings are requested.
 	 */
-	if (var->bits_per_pixel != fb->format->cpp[0] * 8 ||
+	if (var->bits_per_pixel > fb->format->cpp[0] * 8 ||
 	    var->xres > fb->width || var->yres > fb->height ||
 	    var->xres_virtual > fb->width || var->yres_virtual > fb->height) {
 		DRM_DEBUG("fb requested width/height/bpp can't fit in current fb "
@@ -1728,6 +1728,11 @@ int drm_fb_helper_check_var(struct fb_va
 	}
 
 	/*
+	 * Likewise, bits_per_pixel should be rounded up to a supported value.
+	 */
+	var->bits_per_pixel = fb->format->cpp[0] * 8;
+
+	/*
 	 * drm fbdev emulation doesn't support changing the pixel format at all,
 	 * so reject all pixel format changing requests.
 	 */
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/gpu/drm/i915/intel_lrc.c linux-libre-4.19.96-gnu/drivers/gpu/drm/i915/intel_lrc.c
--- linux-libre-4.19.95-gnu/drivers/gpu/drm/i915/intel_lrc.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/gpu/drm/i915/intel_lrc.c	2020-01-14 14:07:09.000000000 -0500
@@ -1562,6 +1562,15 @@ static u32 *gen9_init_indirectctx_bb(str
 	/* WaFlushCoherentL3CacheLinesAtContextSwitch:skl,bxt,glk */
 	batch = gen8_emit_flush_coherentl3_wa(engine, batch);
 
+	/* WaClearSlmSpaceAtContextSwitch:skl,bxt,kbl,glk,cfl */
+	batch = gen8_emit_pipe_control(batch,
+				       PIPE_CONTROL_FLUSH_L3 |
+				       PIPE_CONTROL_GLOBAL_GTT_IVB |
+				       PIPE_CONTROL_CS_STALL |
+				       PIPE_CONTROL_QW_WRITE,
+				       i915_ggtt_offset(engine->scratch) +
+				       2 * CACHELINE_BYTES);
+
 	batch = emit_lri(batch, lri, ARRAY_SIZE(lri));
 
 	/* WaClearSlmSpaceAtContextSwitch:kbl */
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/gpu/drm/sun4i/sun4i_tcon.c linux-libre-4.19.96-gnu/drivers/gpu/drm/sun4i/sun4i_tcon.c
--- linux-libre-4.19.95-gnu/drivers/gpu/drm/sun4i/sun4i_tcon.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/gpu/drm/sun4i/sun4i_tcon.c	2020-01-14 14:07:09.000000000 -0500
@@ -423,7 +423,7 @@ static void sun4i_tcon0_mode_set_rgb(str
 
 	WARN_ON(!tcon->quirks->has_channel_0);
 
-	tcon->dclk_min_div = 1;
+	tcon->dclk_min_div = tcon->quirks->dclk_min_div;
 	tcon->dclk_max_div = 127;
 	sun4i_tcon0_mode_set_common(tcon, mode);
 
@@ -1249,12 +1249,14 @@ static int sun6i_tcon_set_mux(struct sun
 static const struct sun4i_tcon_quirks sun4i_a10_quirks = {
 	.has_channel_0		= true,
 	.has_channel_1		= true,
+	.dclk_min_div		= 4,
 	.set_mux		= sun4i_a10_tcon_set_mux,
 };
 
 static const struct sun4i_tcon_quirks sun5i_a13_quirks = {
 	.has_channel_0		= true,
 	.has_channel_1		= true,
+	.dclk_min_div		= 4,
 	.set_mux		= sun5i_a13_tcon_set_mux,
 };
 
@@ -1263,6 +1265,7 @@ static const struct sun4i_tcon_quirks su
 	.has_channel_1		= true,
 	.has_lvds_alt		= true,
 	.needs_de_be_mux	= true,
+	.dclk_min_div		= 1,
 	.set_mux		= sun6i_tcon_set_mux,
 };
 
@@ -1270,11 +1273,13 @@ static const struct sun4i_tcon_quirks su
 	.has_channel_0		= true,
 	.has_channel_1		= true,
 	.needs_de_be_mux	= true,
+	.dclk_min_div		= 1,
 };
 
 static const struct sun4i_tcon_quirks sun7i_a20_quirks = {
 	.has_channel_0		= true,
 	.has_channel_1		= true,
+	.dclk_min_div		= 4,
 	/* Same display pipeline structure as A10 */
 	.set_mux		= sun4i_a10_tcon_set_mux,
 };
@@ -1282,11 +1287,13 @@ static const struct sun4i_tcon_quirks su
 static const struct sun4i_tcon_quirks sun8i_a33_quirks = {
 	.has_channel_0		= true,
 	.has_lvds_alt		= true,
+	.dclk_min_div		= 1,
 };
 
 static const struct sun4i_tcon_quirks sun8i_a83t_lcd_quirks = {
 	.supports_lvds		= true,
 	.has_channel_0		= true,
+	.dclk_min_div		= 1,
 };
 
 static const struct sun4i_tcon_quirks sun8i_a83t_tv_quirks = {
@@ -1295,11 +1302,13 @@ static const struct sun4i_tcon_quirks su
 
 static const struct sun4i_tcon_quirks sun8i_v3s_quirks = {
 	.has_channel_0		= true,
+	.dclk_min_div		= 1,
 };
 
 static const struct sun4i_tcon_quirks sun9i_a80_tcon_lcd_quirks = {
-	.has_channel_0	= true,
-	.needs_edp_reset = true,
+	.has_channel_0		= true,
+	.needs_edp_reset	= true,
+	.dclk_min_div		= 1,
 };
 
 static const struct sun4i_tcon_quirks sun9i_a80_tcon_tv_quirks = {
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/gpu/drm/sun4i/sun4i_tcon.h linux-libre-4.19.96-gnu/drivers/gpu/drm/sun4i/sun4i_tcon.h
--- linux-libre-4.19.95-gnu/drivers/gpu/drm/sun4i/sun4i_tcon.h	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/gpu/drm/sun4i/sun4i_tcon.h	2020-01-14 14:07:09.000000000 -0500
@@ -224,6 +224,7 @@ struct sun4i_tcon_quirks {
 	bool	needs_de_be_mux; /* sun6i needs mux to select backend */
 	bool    needs_edp_reset; /* a80 edp reset needed for tcon0 access */
 	bool	supports_lvds;   /* Does the TCON support an LVDS output? */
+	u8	dclk_min_div;	/* minimum divider for TCON0 DCLK */
 
 	/* callback to handle tcon muxing options */
 	int	(*set_mux)(struct sun4i_tcon *, const struct drm_encoder *);
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/hid/hid-core.c linux-libre-4.19.96-gnu/drivers/hid/hid-core.c
--- linux-libre-4.19.95-gnu/drivers/hid/hid-core.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/hid/hid-core.c	2020-01-14 14:07:09.000000000 -0500
@@ -288,6 +288,12 @@ static int hid_add_field(struct hid_pars
 	offset = report->size;
 	report->size += parser->global.report_size * parser->global.report_count;
 
+	/* Total size check: Allow for possible report index byte */
+	if (report->size > (HID_MAX_BUFFER_SIZE - 1) << 3) {
+		hid_err(parser->device, "report is too long\n");
+		return -1;
+	}
+
 	if (!parser->local.usage_index) /* Ignore padding fields */
 		return 0;
 
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/hid/hid-input.c linux-libre-4.19.96-gnu/drivers/hid/hid-input.c
--- linux-libre-4.19.95-gnu/drivers/hid/hid-input.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/hid/hid-input.c	2020-01-14 14:07:09.000000000 -0500
@@ -1125,9 +1125,15 @@ static void hidinput_configure_usage(str
 	}
 
 mapped:
-	if (device->driver->input_mapped && device->driver->input_mapped(device,
-				hidinput, field, usage, &bit, &max) < 0)
-		goto ignore;
+	if (device->driver->input_mapped &&
+	    device->driver->input_mapped(device, hidinput, field, usage,
+					 &bit, &max) < 0) {
+		/*
+		 * The driver indicated that no further generic handling
+		 * of the usage is desired.
+		 */
+		return;
+	}
 
 	set_bit(usage->type, input->evbit);
 
@@ -1208,9 +1214,11 @@ mapped:
 		set_bit(MSC_SCAN, input->mscbit);
 	}
 
-ignore:
 	return;
 
+ignore:
+	usage->type = 0;
+	usage->code = 0;
 }
 
 void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct hid_usage *usage, __s32 value)
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/hid/uhid.c linux-libre-4.19.96-gnu/drivers/hid/uhid.c
--- linux-libre-4.19.95-gnu/drivers/hid/uhid.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/hid/uhid.c	2020-01-14 14:07:09.000000000 -0500
@@ -775,7 +775,7 @@ static __poll_t uhid_char_poll(struct fi
 	if (uhid->head != uhid->tail)
 		return EPOLLIN | EPOLLRDNORM;
 
-	return 0;
+	return EPOLLOUT | EPOLLWRNORM;
 }
 
 static const struct file_operations uhid_fops = {
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/hid/usbhid/hiddev.c linux-libre-4.19.96-gnu/drivers/hid/usbhid/hiddev.c
--- linux-libre-4.19.95-gnu/drivers/hid/usbhid/hiddev.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/hid/usbhid/hiddev.c	2020-01-14 14:07:09.000000000 -0500
@@ -254,12 +254,51 @@ static int hiddev_release(struct inode *
 	return 0;
 }
 
+static int __hiddev_open(struct hiddev *hiddev, struct file *file)
+{
+	struct hiddev_list *list;
+	int error;
+
+	lockdep_assert_held(&hiddev->existancelock);
+
+	list = vzalloc(sizeof(*list));
+	if (!list)
+		return -ENOMEM;
+
+	mutex_init(&list->thread_lock);
+	list->hiddev = hiddev;
+
+	if (!hiddev->open++) {
+		error = hid_hw_power(hiddev->hid, PM_HINT_FULLON);
+		if (error < 0)
+			goto err_drop_count;
+
+		error = hid_hw_open(hiddev->hid);
+		if (error < 0)
+			goto err_normal_power;
+	}
+
+	spin_lock_irq(&hiddev->list_lock);
+	list_add_tail(&list->node, &hiddev->list);
+	spin_unlock_irq(&hiddev->list_lock);
+
+	file->private_data = list;
+
+	return 0;
+
+err_normal_power:
+	hid_hw_power(hiddev->hid, PM_HINT_NORMAL);
+err_drop_count:
+	hiddev->open--;
+	vfree(list);
+	return error;
+}
+
 /*
  * open file op
  */
 static int hiddev_open(struct inode *inode, struct file *file)
 {
-	struct hiddev_list *list;
 	struct usb_interface *intf;
 	struct hid_device *hid;
 	struct hiddev *hiddev;
@@ -268,66 +307,14 @@ static int hiddev_open(struct inode *ino
 	intf = usbhid_find_interface(iminor(inode));
 	if (!intf)
 		return -ENODEV;
+
 	hid = usb_get_intfdata(intf);
 	hiddev = hid->hiddev;
 
-	if (!(list = vzalloc(sizeof(struct hiddev_list))))
-		return -ENOMEM;
-	mutex_init(&list->thread_lock);
-	list->hiddev = hiddev;
-	file->private_data = list;
-
-	/*
-	 * no need for locking because the USB major number
-	 * is shared which usbcore guards against disconnect
-	 */
-	if (list->hiddev->exist) {
-		if (!list->hiddev->open++) {
-			res = hid_hw_open(hiddev->hid);
-			if (res < 0)
-				goto bail;
-		}
-	} else {
-		res = -ENODEV;
-		goto bail;
-	}
-
-	spin_lock_irq(&list->hiddev->list_lock);
-	list_add_tail(&list->node, &hiddev->list);
-	spin_unlock_irq(&list->hiddev->list_lock);
-
 	mutex_lock(&hiddev->existancelock);
-	/*
-	 * recheck exist with existance lock held to
-	 * avoid opening a disconnected device
-	 */
-	if (!list->hiddev->exist) {
-		res = -ENODEV;
-		goto bail_unlock;
-	}
-	if (!list->hiddev->open++)
-		if (list->hiddev->exist) {
-			struct hid_device *hid = hiddev->hid;
-			res = hid_hw_power(hid, PM_HINT_FULLON);
-			if (res < 0)
-				goto bail_unlock;
-			res = hid_hw_open(hid);
-			if (res < 0)
-				goto bail_normal_power;
-		}
-	mutex_unlock(&hiddev->existancelock);
-	return 0;
-bail_normal_power:
-	hid_hw_power(hid, PM_HINT_NORMAL);
-bail_unlock:
+	res = hiddev->exist ? __hiddev_open(hiddev, file) : -ENODEV;
 	mutex_unlock(&hiddev->existancelock);
 
-	spin_lock_irq(&list->hiddev->list_lock);
-	list_del(&list->node);
-	spin_unlock_irq(&list->hiddev->list_lock);
-bail:
-	file->private_data = NULL;
-	vfree(list);
 	return res;
 }
 
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/i2c/i2c-core-base.c linux-libre-4.19.96-gnu/drivers/i2c/i2c-core-base.c
--- linux-libre-4.19.95-gnu/drivers/i2c/i2c-core-base.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/i2c/i2c-core-base.c	2020-01-14 14:07:09.000000000 -0500
@@ -194,10 +194,11 @@ int i2c_generic_scl_recovery(struct i2c_
 	 * If we can set SDA, we will always create a STOP to ensure additional
 	 * pulses will do no harm. This is achieved by letting SDA follow SCL
 	 * half a cycle later. Check the 'incomplete_write_byte' fault injector
-	 * for details.
+	 * for details. Note that we must honour tsu:sto, 4us, but lets use 5us
+	 * here for simplicity.
 	 */
 	bri->set_scl(adap, scl);
-	ndelay(RECOVERY_NDELAY / 2);
+	ndelay(RECOVERY_NDELAY);
 	if (bri->set_sda)
 		bri->set_sda(adap, scl);
 	ndelay(RECOVERY_NDELAY / 2);
@@ -219,7 +220,13 @@ int i2c_generic_scl_recovery(struct i2c_
 		scl = !scl;
 		bri->set_scl(adap, scl);
 		/* Creating STOP again, see above */
-		ndelay(RECOVERY_NDELAY / 2);
+		if (scl)  {
+			/* Honour minimum tsu:sto */
+			ndelay(RECOVERY_NDELAY);
+		} else {
+			/* Honour minimum tf and thd:dat */
+			ndelay(RECOVERY_NDELAY / 2);
+		}
 		if (bri->set_sda)
 			bri->set_sda(adap, scl);
 		ndelay(RECOVERY_NDELAY / 2);
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/input/evdev.c linux-libre-4.19.96-gnu/drivers/input/evdev.c
--- linux-libre-4.19.95-gnu/drivers/input/evdev.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/input/evdev.c	2020-01-14 14:07:09.000000000 -0500
@@ -241,13 +241,13 @@ static void __pass_event(struct evdev_cl
 		 */
 		client->tail = (client->head - 2) & (client->bufsize - 1);
 
-		client->buffer[client->tail].input_event_sec =
-						event->input_event_sec;
-		client->buffer[client->tail].input_event_usec =
-						event->input_event_usec;
-		client->buffer[client->tail].type = EV_SYN;
-		client->buffer[client->tail].code = SYN_DROPPED;
-		client->buffer[client->tail].value = 0;
+		client->buffer[client->tail] = (struct input_event) {
+			.input_event_sec = event->input_event_sec,
+			.input_event_usec = event->input_event_usec,
+			.type = EV_SYN,
+			.code = SYN_DROPPED,
+			.value = 0,
+		};
 
 		client->packet_head = client->tail;
 	}
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/input/input.c linux-libre-4.19.96-gnu/drivers/input/input.c
--- linux-libre-4.19.95-gnu/drivers/input/input.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/input/input.c	2020-01-14 14:07:09.000000000 -0500
@@ -858,16 +858,18 @@ static int input_default_setkeycode(stru
 		}
 	}
 
-	__clear_bit(*old_keycode, dev->keybit);
-	__set_bit(ke->keycode, dev->keybit);
-
-	for (i = 0; i < dev->keycodemax; i++) {
-		if (input_fetch_keycode(dev, i) == *old_keycode) {
-			__set_bit(*old_keycode, dev->keybit);
-			break; /* Setting the bit twice is useless, so break */
+	if (*old_keycode <= KEY_MAX) {
+		__clear_bit(*old_keycode, dev->keybit);
+		for (i = 0; i < dev->keycodemax; i++) {
+			if (input_fetch_keycode(dev, i) == *old_keycode) {
+				__set_bit(*old_keycode, dev->keybit);
+				/* Setting the bit twice is useless, so break */
+				break;
+			}
 		}
 	}
 
+	__set_bit(ke->keycode, dev->keybit);
 	return 0;
 }
 
@@ -923,9 +925,13 @@ int input_set_keycode(struct input_dev *
 	 * Simulate keyup event if keycode is not present
 	 * in the keymap anymore
 	 */
-	if (test_bit(EV_KEY, dev->evbit) &&
-	    !is_event_supported(old_keycode, dev->keybit, KEY_MAX) &&
-	    __test_and_clear_bit(old_keycode, dev->key)) {
+	if (old_keycode > KEY_MAX) {
+		dev_warn(dev->dev.parent ?: &dev->dev,
+			 "%s: got too big old keycode %#x\n",
+			 __func__, old_keycode);
+	} else if (test_bit(EV_KEY, dev->evbit) &&
+		   !is_event_supported(old_keycode, dev->keybit, KEY_MAX) &&
+		   __test_and_clear_bit(old_keycode, dev->key)) {
 		struct input_value vals[] =  {
 			{ EV_KEY, old_keycode, 0 },
 			input_value_sync
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/input/misc/uinput.c linux-libre-4.19.96-gnu/drivers/input/misc/uinput.c
--- linux-libre-4.19.95-gnu/drivers/input/misc/uinput.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/input/misc/uinput.c	2020-01-14 14:07:09.000000000 -0500
@@ -87,12 +87,16 @@ static int uinput_dev_event(struct input
 	struct uinput_device	*udev = input_get_drvdata(dev);
 	struct timespec64	ts;
 
-	udev->buff[udev->head].type = type;
-	udev->buff[udev->head].code = code;
-	udev->buff[udev->head].value = value;
 	ktime_get_ts64(&ts);
-	udev->buff[udev->head].input_event_sec = ts.tv_sec;
-	udev->buff[udev->head].input_event_usec = ts.tv_nsec / NSEC_PER_USEC;
+
+	udev->buff[udev->head] = (struct input_event) {
+		.input_event_sec = ts.tv_sec,
+		.input_event_usec = ts.tv_nsec / NSEC_PER_USEC,
+		.type = type,
+		.code = code,
+		.value = value,
+	};
+
 	udev->head = (udev->head + 1) % UINPUT_BUFFER_SIZE;
 
 	wake_up_interruptible(&udev->waitq);
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/net/can/mscan/mscan.c linux-libre-4.19.96-gnu/drivers/net/can/mscan/mscan.c
--- linux-libre-4.19.95-gnu/drivers/net/can/mscan/mscan.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/net/can/mscan/mscan.c	2020-01-14 14:07:09.000000000 -0500
@@ -392,13 +392,12 @@ static int mscan_rx_poll(struct napi_str
 	struct net_device *dev = napi->dev;
 	struct mscan_regs __iomem *regs = priv->reg_base;
 	struct net_device_stats *stats = &dev->stats;
-	int npackets = 0;
-	int ret = 1;
+	int work_done = 0;
 	struct sk_buff *skb;
 	struct can_frame *frame;
 	u8 canrflg;
 
-	while (npackets < quota) {
+	while (work_done < quota) {
 		canrflg = in_8(&regs->canrflg);
 		if (!(canrflg & (MSCAN_RXF | MSCAN_ERR_IF)))
 			break;
@@ -419,18 +418,18 @@ static int mscan_rx_poll(struct napi_str
 
 		stats->rx_packets++;
 		stats->rx_bytes += frame->can_dlc;
-		npackets++;
+		work_done++;
 		netif_receive_skb(skb);
 	}
 
-	if (!(in_8(&regs->canrflg) & (MSCAN_RXF | MSCAN_ERR_IF))) {
-		napi_complete(&priv->napi);
-		clear_bit(F_RX_PROGRESS, &priv->flags);
-		if (priv->can.state < CAN_STATE_BUS_OFF)
-			out_8(&regs->canrier, priv->shadow_canrier);
-		ret = 0;
+	if (work_done < quota) {
+		if (likely(napi_complete_done(&priv->napi, work_done))) {
+			clear_bit(F_RX_PROGRESS, &priv->flags);
+			if (priv->can.state < CAN_STATE_BUS_OFF)
+				out_8(&regs->canrier, priv->shadow_canrier);
+		}
 	}
-	return ret;
+	return work_done;
 }
 
 static irqreturn_t mscan_isr(int irq, void *dev_id)
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/net/can/usb/gs_usb.c linux-libre-4.19.96-gnu/drivers/net/can/usb/gs_usb.c
--- linux-libre-4.19.95-gnu/drivers/net/can/usb/gs_usb.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/net/can/usb/gs_usb.c	2020-01-14 14:07:09.000000000 -0500
@@ -926,7 +926,7 @@ static int gs_usb_probe(struct usb_inter
 			     GS_USB_BREQ_HOST_FORMAT,
 			     USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
 			     1,
-			     intf->altsetting[0].desc.bInterfaceNumber,
+			     intf->cur_altsetting->desc.bInterfaceNumber,
 			     hconf,
 			     sizeof(*hconf),
 			     1000);
@@ -949,7 +949,7 @@ static int gs_usb_probe(struct usb_inter
 			     GS_USB_BREQ_DEVICE_CONFIG,
 			     USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
 			     1,
-			     intf->altsetting[0].desc.bInterfaceNumber,
+			     intf->cur_altsetting->desc.bInterfaceNumber,
 			     dconf,
 			     sizeof(*dconf),
 			     1000);
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c linux-libre-4.19.96-gnu/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
--- linux-libre-4.19.95-gnu/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c	2020-01-14 14:07:09.000000000 -0500
@@ -1590,7 +1590,7 @@ static int kvaser_usb_hydra_setup_endpoi
 	struct usb_endpoint_descriptor *ep;
 	int i;
 
-	iface_desc = &dev->intf->altsetting[0];
+	iface_desc = dev->intf->cur_altsetting;
 
 	for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
 		ep = &iface_desc->endpoint[i].desc;
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c linux-libre-4.19.96-gnu/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
--- linux-libre-4.19.95-gnu/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c	2020-01-14 14:07:09.000000000 -0500
@@ -1310,7 +1310,7 @@ static int kvaser_usb_leaf_setup_endpoin
 	struct usb_endpoint_descriptor *endpoint;
 	int i;
 
-	iface_desc = &dev->intf->altsetting[0];
+	iface_desc = dev->intf->cur_altsetting;
 
 	for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
 		endpoint = &iface_desc->endpoint[i].desc;
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/net/wireless/ath/ath10k/usb.c linux-libre-4.19.96-gnu/drivers/net/wireless/ath/ath10k/usb.c
--- linux-libre-4.19.95-gnu/drivers/net/wireless/ath/ath10k/usb.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/net/wireless/ath/ath10k/usb.c	2020-01-14 14:07:09.000000000 -0500
@@ -454,6 +454,7 @@ static int ath10k_usb_hif_tx_sg(struct a
 			ath10k_dbg(ar, ATH10K_DBG_USB_BULK,
 				   "usb bulk transmit failed: %d\n", ret);
 			usb_unanchor_urb(urb);
+			usb_free_urb(urb);
 			ret = -EINVAL;
 			goto err_free_urb_to_pipe;
 		}
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/net/wireless/marvell/mwifiex/pcie.c linux-libre-4.19.96-gnu/drivers/net/wireless/marvell/mwifiex/pcie.c
--- linux-libre-4.19.95-gnu/drivers/net/wireless/marvell/mwifiex/pcie.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/net/wireless/marvell/mwifiex/pcie.c	2020-01-14 14:07:09.000000000 -0500
@@ -1036,8 +1036,10 @@ static int mwifiex_pcie_alloc_cmdrsp_buf
 	}
 	skb_put(skb, MWIFIEX_UPLD_SIZE);
 	if (mwifiex_map_pci_memory(adapter, skb, MWIFIEX_UPLD_SIZE,
-				   PCI_DMA_FROMDEVICE))
+				   PCI_DMA_FROMDEVICE)) {
+		kfree_skb(skb);
 		return -1;
+	}
 
 	card->cmdrsp_buf = skb;
 
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c linux-libre-4.19.96-gnu/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
--- linux-libre-4.19.95-gnu/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c	2020-01-14 14:07:09.000000000 -0500
@@ -229,6 +229,14 @@ static int mwifiex_process_country_ie(st
 			    "11D: skip setting domain info in FW\n");
 		return 0;
 	}
+
+	if (country_ie_len >
+	    (IEEE80211_COUNTRY_STRING_LEN + MWIFIEX_MAX_TRIPLET_802_11D)) {
+		mwifiex_dbg(priv->adapter, ERROR,
+			    "11D: country_ie_len overflow!, deauth AP\n");
+		return -EINVAL;
+	}
+
 	memcpy(priv->adapter->country_code, &country_ie[2], 2);
 
 	domain_info->country_code[0] = country_ie[2];
@@ -272,8 +280,9 @@ int mwifiex_bss_start(struct mwifiex_pri
 	priv->scan_block = false;
 
 	if (bss) {
-		if (adapter->region_code == 0x00)
-			mwifiex_process_country_ie(priv, bss);
+		if (adapter->region_code == 0x00 &&
+		    mwifiex_process_country_ie(priv, bss))
+			return -EINVAL;
 
 		/* Allocate and fill new bss descriptor */
 		bss_desc = kzalloc(sizeof(struct mwifiex_bssdescriptor),
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c linux-libre-4.19.96-gnu/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
--- linux-libre-4.19.95-gnu/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c	2020-01-12 09:51:51.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c	2020-01-14 17:15:37.000000000 -0500
@@ -5445,6 +5445,7 @@ static int rtl8xxxu_submit_int_urb(struc
 	ret = usb_submit_urb(urb, GFP_KERNEL);
 	if (ret) {
 		usb_unanchor_urb(urb);
+		usb_free_urb(urb);
 		goto error;
 	}
 
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/phy/motorola/phy-cpcap-usb.c linux-libre-4.19.96-gnu/drivers/phy/motorola/phy-cpcap-usb.c
--- linux-libre-4.19.95-gnu/drivers/phy/motorola/phy-cpcap-usb.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/phy/motorola/phy-cpcap-usb.c	2020-01-14 14:07:09.000000000 -0500
@@ -207,6 +207,19 @@ static int cpcap_phy_get_ints_state(stru
 static int cpcap_usb_set_uart_mode(struct cpcap_phy_ddata *ddata);
 static int cpcap_usb_set_usb_mode(struct cpcap_phy_ddata *ddata);
 
+static void cpcap_usb_try_musb_mailbox(struct cpcap_phy_ddata *ddata,
+				       enum musb_vbus_id_status status)
+{
+	int error;
+
+	error = musb_mailbox(status);
+	if (!error)
+		return;
+
+	dev_dbg(ddata->dev, "%s: musb_mailbox failed: %i\n",
+		__func__, error);
+}
+
 static void cpcap_usb_detect(struct work_struct *work)
 {
 	struct cpcap_phy_ddata *ddata;
@@ -226,9 +239,7 @@ static void cpcap_usb_detect(struct work
 		if (error)
 			goto out_err;
 
-		error = musb_mailbox(MUSB_ID_GROUND);
-		if (error)
-			goto out_err;
+		cpcap_usb_try_musb_mailbox(ddata, MUSB_ID_GROUND);
 
 		error = regmap_update_bits(ddata->reg, CPCAP_REG_USBC3,
 					   CPCAP_BIT_VBUSSTBY_EN,
@@ -255,9 +266,7 @@ static void cpcap_usb_detect(struct work
 			error = cpcap_usb_set_usb_mode(ddata);
 			if (error)
 				goto out_err;
-			error = musb_mailbox(MUSB_ID_GROUND);
-			if (error)
-				goto out_err;
+			cpcap_usb_try_musb_mailbox(ddata, MUSB_ID_GROUND);
 
 			return;
 		}
@@ -267,22 +276,18 @@ static void cpcap_usb_detect(struct work
 		error = cpcap_usb_set_usb_mode(ddata);
 		if (error)
 			goto out_err;
-		error = musb_mailbox(MUSB_VBUS_VALID);
-		if (error)
-			goto out_err;
+		cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_VALID);
 
 		return;
 	}
 
+	cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_OFF);
+
 	/* Default to debug UART mode */
 	error = cpcap_usb_set_uart_mode(ddata);
 	if (error)
 		goto out_err;
 
-	error = musb_mailbox(MUSB_VBUS_OFF);
-	if (error)
-		goto out_err;
-
 	dev_dbg(ddata->dev, "set UART mode\n");
 
 	return;
@@ -647,9 +652,7 @@ static int cpcap_usb_phy_remove(struct p
 	if (error)
 		dev_err(ddata->dev, "could not set UART mode\n");
 
-	error = musb_mailbox(MUSB_VBUS_OFF);
-	if (error)
-		dev_err(ddata->dev, "could not set mailbox\n");
+	cpcap_usb_try_musb_mailbox(ddata, MUSB_VBUS_OFF);
 
 	usb_remove_phy(&ddata->phy);
 	cancel_delayed_work_sync(&ddata->detect_work);
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/scsi/bfa/bfad_attr.c linux-libre-4.19.96-gnu/drivers/scsi/bfa/bfad_attr.c
--- linux-libre-4.19.95-gnu/drivers/scsi/bfa/bfad_attr.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/scsi/bfa/bfad_attr.c	2020-01-14 14:07:09.000000000 -0500
@@ -283,8 +283,10 @@ bfad_im_get_stats(struct Scsi_Host *shos
 	rc = bfa_port_get_stats(BFA_FCPORT(&bfad->bfa),
 				fcstats, bfad_hcb_comp, &fcomp);
 	spin_unlock_irqrestore(&bfad->bfad_lock, flags);
-	if (rc != BFA_STATUS_OK)
+	if (rc != BFA_STATUS_OK) {
+		kfree(fcstats);
 		return NULL;
+	}
 
 	wait_for_completion(&fcomp.comp);
 
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/staging/comedi/drivers/adv_pci1710.c linux-libre-4.19.96-gnu/drivers/staging/comedi/drivers/adv_pci1710.c
--- linux-libre-4.19.95-gnu/drivers/staging/comedi/drivers/adv_pci1710.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/staging/comedi/drivers/adv_pci1710.c	2020-01-14 14:07:09.000000000 -0500
@@ -46,8 +46,8 @@
 #define PCI171X_RANGE_UNI	BIT(4)
 #define PCI171X_RANGE_GAIN(x)	(((x) & 0x7) << 0)
 #define PCI171X_MUX_REG		0x04	/* W:   A/D multiplexor control */
-#define PCI171X_MUX_CHANH(x)	(((x) & 0xf) << 8)
-#define PCI171X_MUX_CHANL(x)	(((x) & 0xf) << 0)
+#define PCI171X_MUX_CHANH(x)	(((x) & 0xff) << 8)
+#define PCI171X_MUX_CHANL(x)	(((x) & 0xff) << 0)
 #define PCI171X_MUX_CHAN(x)	(PCI171X_MUX_CHANH(x) | PCI171X_MUX_CHANL(x))
 #define PCI171X_STATUS_REG	0x06	/* R:   status register */
 #define PCI171X_STATUS_IRQ	BIT(11)	/* 1=IRQ occurred */
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/staging/rtl8188eu/os_dep/usb_intf.c linux-libre-4.19.96-gnu/drivers/staging/rtl8188eu/os_dep/usb_intf.c
--- linux-libre-4.19.95-gnu/drivers/staging/rtl8188eu/os_dep/usb_intf.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/staging/rtl8188eu/os_dep/usb_intf.c	2020-01-14 14:07:09.000000000 -0500
@@ -37,6 +37,7 @@ static const struct usb_device_id rtw_us
 	{USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
 	{USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */
 	{USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */
+	{USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */
 	{USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
 	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
 	{}	/* Terminating entry */
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/staging/vt6656/device.h linux-libre-4.19.96-gnu/drivers/staging/vt6656/device.h
--- linux-libre-4.19.95-gnu/drivers/staging/vt6656/device.h	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/staging/vt6656/device.h	2020-01-14 14:07:09.000000000 -0500
@@ -259,6 +259,7 @@ struct vnt_private {
 	u8 mac_hw;
 	/* netdev */
 	struct usb_device *usb;
+	struct usb_interface *intf;
 
 	u64 tsf_time;
 	u8 rx_rate;
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/staging/vt6656/main_usb.c linux-libre-4.19.96-gnu/drivers/staging/vt6656/main_usb.c
--- linux-libre-4.19.95-gnu/drivers/staging/vt6656/main_usb.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/staging/vt6656/main_usb.c	2020-01-14 14:07:09.000000000 -0500
@@ -955,6 +955,7 @@ vt6656_probe(struct usb_interface *intf,
 	priv = hw->priv;
 	priv->hw = hw;
 	priv->usb = udev;
+	priv->intf = intf;
 
 	vnt_set_options(priv);
 
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/staging/vt6656/wcmd.c linux-libre-4.19.96-gnu/drivers/staging/vt6656/wcmd.c
--- linux-libre-4.19.95-gnu/drivers/staging/vt6656/wcmd.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/staging/vt6656/wcmd.c	2020-01-14 14:07:09.000000000 -0500
@@ -99,6 +99,7 @@ void vnt_run_command(struct work_struct
 		if (vnt_init(priv)) {
 			/* If fail all ends TODO retry */
 			dev_err(&priv->usb->dev, "failed to start\n");
+			usb_set_intfdata(priv->intf, NULL);
 			ieee80211_free_hw(priv->hw);
 			return;
 		}
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/tty/serdev/core.c linux-libre-4.19.96-gnu/drivers/tty/serdev/core.c
--- linux-libre-4.19.95-gnu/drivers/tty/serdev/core.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/tty/serdev/core.c	2020-01-14 14:07:09.000000000 -0500
@@ -526,6 +526,12 @@ static acpi_status acpi_serdev_register_
 	return AE_OK;
 }
 
+static const struct acpi_device_id serdev_acpi_devices_blacklist[] = {
+	{ "INT3511", 0 },
+	{ "INT3512", 0 },
+	{ },
+};
+
 static acpi_status acpi_serdev_add_device(acpi_handle handle, u32 level,
 				       void *data, void **return_value)
 {
@@ -535,6 +541,10 @@ static acpi_status acpi_serdev_add_devic
 	if (acpi_bus_get_device(handle, &adev))
 		return AE_OK;
 
+	/* Skip if black listed */
+	if (!acpi_match_device_ids(adev, serdev_acpi_devices_blacklist))
+		return AE_OK;
+
 	return acpi_serdev_register_device(ctrl, adev);
 }
 
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/tty/serial/serial_core.c linux-libre-4.19.96-gnu/drivers/tty/serial/serial_core.c
--- linux-libre-4.19.95-gnu/drivers/tty/serial/serial_core.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/tty/serial/serial_core.c	2020-01-14 14:07:09.000000000 -0500
@@ -2786,6 +2786,7 @@ int uart_add_one_port(struct uart_driver
 	if (uport->cons && uport->dev)
 		of_console_check(uport->dev->of_node, uport->cons->name, uport->line);
 
+	tty_port_link_device(port, drv->tty_driver, uport->line);
 	uart_configure_port(drv, state, uport);
 
 	port->console = uart_console(uport);
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/usb/chipidea/host.c linux-libre-4.19.96-gnu/drivers/usb/chipidea/host.c
--- linux-libre-4.19.95-gnu/drivers/usb/chipidea/host.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/usb/chipidea/host.c	2020-01-14 14:07:09.000000000 -0500
@@ -25,6 +25,7 @@ static int (*orig_bus_suspend)(struct us
 
 struct ehci_ci_priv {
 	struct regulator *reg_vbus;
+	bool enabled;
 };
 
 static int ehci_ci_portpower(struct usb_hcd *hcd, int portnum, bool enable)
@@ -36,7 +37,7 @@ static int ehci_ci_portpower(struct usb_
 	int ret = 0;
 	int port = HCS_N_PORTS(ehci->hcs_params);
 
-	if (priv->reg_vbus) {
+	if (priv->reg_vbus && enable != priv->enabled) {
 		if (port > 1) {
 			dev_warn(dev,
 				"Not support multi-port regulator control\n");
@@ -52,6 +53,7 @@ static int ehci_ci_portpower(struct usb_
 				enable ? "enable" : "disable", ret);
 			return ret;
 		}
+		priv->enabled = enable;
 	}
 
 	if (enable && (ci->platdata->phy_mode == USBPHY_INTERFACE_MODE_HSIC)) {
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/usb/core/config.c linux-libre-4.19.96-gnu/drivers/usb/core/config.c
--- linux-libre-4.19.95-gnu/drivers/usb/core/config.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/usb/core/config.c	2020-01-14 14:07:09.000000000 -0500
@@ -392,12 +392,16 @@ static int usb_parse_endpoint(struct dev
 			endpoint->desc.wMaxPacketSize = cpu_to_le16(8);
 	}
 
-	/* Validate the wMaxPacketSize field */
+	/*
+	 * Validate the wMaxPacketSize field.
+	 * Some devices have isochronous endpoints in altsetting 0;
+	 * the USB-2 spec requires such endpoints to have wMaxPacketSize = 0
+	 * (see the end of section 5.6.3), so don't warn about them.
+	 */
 	maxp = usb_endpoint_maxp(&endpoint->desc);
-	if (maxp == 0) {
-		dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has wMaxPacketSize 0, skipping\n",
+	if (maxp == 0 && !(usb_endpoint_xfer_isoc(d) && asnum == 0)) {
+		dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid wMaxPacketSize 0\n",
 		    cfgno, inum, asnum, d->bEndpointAddress);
-		goto skip_to_next_endpoint_or_interface_descriptor;
 	}
 
 	/* Find the highest legal maxpacket size for this endpoint */
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/usb/musb/musb_core.c linux-libre-4.19.96-gnu/drivers/usb/musb/musb_core.c
--- linux-libre-4.19.95-gnu/drivers/usb/musb/musb_core.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/usb/musb/musb_core.c	2020-01-14 14:07:09.000000000 -0500
@@ -1842,6 +1842,9 @@ static const struct attribute_group musb
 #define MUSB_QUIRK_B_INVALID_VBUS_91	(MUSB_DEVCTL_BDEVICE | \
 					 (2 << MUSB_DEVCTL_VBUS_SHIFT) | \
 					 MUSB_DEVCTL_SESSION)
+#define MUSB_QUIRK_B_DISCONNECT_99	(MUSB_DEVCTL_BDEVICE | \
+					 (3 << MUSB_DEVCTL_VBUS_SHIFT) | \
+					 MUSB_DEVCTL_SESSION)
 #define MUSB_QUIRK_A_DISCONNECT_19	((3 << MUSB_DEVCTL_VBUS_SHIFT) | \
 					 MUSB_DEVCTL_SESSION)
 
@@ -1864,6 +1867,11 @@ static void musb_pm_runtime_check_sessio
 	s = MUSB_DEVCTL_FSDEV | MUSB_DEVCTL_LSDEV |
 		MUSB_DEVCTL_HR;
 	switch (devctl & ~s) {
+	case MUSB_QUIRK_B_DISCONNECT_99:
+		musb_dbg(musb, "Poll devctl in case of suspend after disconnect\n");
+		schedule_delayed_work(&musb->irq_work,
+				      msecs_to_jiffies(1000));
+		break;
 	case MUSB_QUIRK_B_INVALID_VBUS_91:
 		if (musb->quirk_retries && !musb->flush_irq_work) {
 			musb_dbg(musb,
@@ -2316,6 +2324,9 @@ musb_init_controller(struct device *dev,
 	musb_disable_interrupts(musb);
 	musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
 
+	/* MUSB_POWER_SOFTCONN might be already set, JZ4740 does this. */
+	musb_writeb(musb->mregs, MUSB_POWER, 0);
+
 	/* Init IRQ workqueue before request_irq */
 	INIT_DELAYED_WORK(&musb->irq_work, musb_irq_work);
 	INIT_DELAYED_WORK(&musb->deassert_reset_work, musb_deassert_reset);
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/usb/musb/musbhsdma.c linux-libre-4.19.96-gnu/drivers/usb/musb/musbhsdma.c
--- linux-libre-4.19.95-gnu/drivers/usb/musb/musbhsdma.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/usb/musb/musbhsdma.c	2020-01-14 14:07:09.000000000 -0500
@@ -425,7 +425,7 @@ struct dma_controller *musbhs_dma_contro
 	controller->controller.channel_abort = dma_channel_abort;
 
 	if (request_irq(irq, dma_controller_irq, 0,
-			dev_name(musb->controller), &controller->controller)) {
+			dev_name(musb->controller), controller)) {
 		dev_err(dev, "request_irq %d failed!\n", irq);
 		musb_dma_controller_destroy(&controller->controller);
 
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/usb/serial/option.c linux-libre-4.19.96-gnu/drivers/usb/serial/option.c
--- linux-libre-4.19.95-gnu/drivers/usb/serial/option.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/usb/serial/option.c	2020-01-14 14:07:09.000000000 -0500
@@ -567,6 +567,9 @@ static void option_instat_callback(struc
 /* Interface must have two endpoints */
 #define NUMEP2		BIT(16)
 
+/* Device needs ZLP */
+#define ZLP		BIT(17)
+
 
 static const struct usb_device_id option_ids[] = {
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
@@ -1198,6 +1201,8 @@ static const struct usb_device_id option
 	  .driver_info = NCTRL(0) | RSVD(1) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff),	/* Telit LN940 (MBIM) */
 	  .driver_info = NCTRL(0) },
+	{ USB_DEVICE(TELIT_VENDOR_ID, 0x9010),				/* Telit SBL FN980 flashing device */
+	  .driver_info = NCTRL(0) | ZLP },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
 	  .driver_info = RSVD(1) },
@@ -2098,6 +2103,9 @@ static int option_attach(struct usb_seri
 	if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber)))
 		data->use_send_setup = 1;
 
+	if (device_flags & ZLP)
+		data->use_zlp = 1;
+
 	spin_lock_init(&data->susp_lock);
 
 	usb_set_serial_data(serial, data);
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/usb/serial/usb_wwan.c linux-libre-4.19.96-gnu/drivers/usb/serial/usb_wwan.c
--- linux-libre-4.19.95-gnu/drivers/usb/serial/usb_wwan.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/usb/serial/usb_wwan.c	2020-01-14 14:07:09.000000000 -0500
@@ -490,6 +490,7 @@ static struct urb *usb_wwan_setup_urb(st
 				      void (*callback) (struct urb *))
 {
 	struct usb_serial *serial = port->serial;
+	struct usb_wwan_intf_private *intfdata = usb_get_serial_data(serial);
 	struct urb *urb;
 
 	urb = usb_alloc_urb(0, GFP_KERNEL);	/* No ISO */
@@ -500,6 +501,9 @@ static struct urb *usb_wwan_setup_urb(st
 			  usb_sndbulkpipe(serial->dev, endpoint) | dir,
 			  buf, len, callback, ctx);
 
+	if (intfdata->use_zlp && dir == USB_DIR_OUT)
+		urb->transfer_flags |= URB_ZERO_PACKET;
+
 	return urb;
 }
 
diff -druNp --no-dereference linux-libre-4.19.95-gnu/drivers/usb/serial/usb-wwan.h linux-libre-4.19.96-gnu/drivers/usb/serial/usb-wwan.h
--- linux-libre-4.19.95-gnu/drivers/usb/serial/usb-wwan.h	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/drivers/usb/serial/usb-wwan.h	2020-01-14 14:07:09.000000000 -0500
@@ -36,6 +36,7 @@ struct usb_wwan_intf_private {
 	spinlock_t susp_lock;
 	unsigned int suspended:1;
 	unsigned int use_send_setup:1;
+	unsigned int use_zlp:1;
 	int in_flight;
 	unsigned int open_ports;
 	void *private;
diff -druNp --no-dereference linux-libre-4.19.95-gnu/fs/char_dev.c linux-libre-4.19.96-gnu/fs/char_dev.c
--- linux-libre-4.19.95-gnu/fs/char_dev.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/fs/char_dev.c	2020-01-14 14:07:09.000000000 -0500
@@ -361,7 +361,7 @@ static struct kobject *cdev_get(struct c
 
 	if (owner && !try_module_get(owner))
 		return NULL;
-	kobj = kobject_get(&p->kobj);
+	kobj = kobject_get_unless_zero(&p->kobj);
 	if (!kobj)
 		module_put(owner);
 	return kobj;
diff -druNp --no-dereference linux-libre-4.19.95-gnu/include/linux/can/dev.h linux-libre-4.19.96-gnu/include/linux/can/dev.h
--- linux-libre-4.19.95-gnu/include/linux/can/dev.h	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/include/linux/can/dev.h	2020-01-14 14:07:09.000000000 -0500
@@ -18,6 +18,7 @@
 #include <linux/can/error.h>
 #include <linux/can/led.h>
 #include <linux/can/netlink.h>
+#include <linux/can/skb.h>
 #include <linux/netdevice.h>
 
 /*
@@ -91,6 +92,36 @@ struct can_priv {
 #define get_can_dlc(i)		(min_t(__u8, (i), CAN_MAX_DLC))
 #define get_canfd_dlc(i)	(min_t(__u8, (i), CANFD_MAX_DLC))
 
+/* Check for outgoing skbs that have not been created by the CAN subsystem */
+static inline bool can_skb_headroom_valid(struct net_device *dev,
+					  struct sk_buff *skb)
+{
+	/* af_packet creates a headroom of HH_DATA_MOD bytes which is fine */
+	if (WARN_ON_ONCE(skb_headroom(skb) < sizeof(struct can_skb_priv)))
+		return false;
+
+	/* af_packet does not apply CAN skb specific settings */
+	if (skb->ip_summed == CHECKSUM_NONE) {
+		/* init headroom */
+		can_skb_prv(skb)->ifindex = dev->ifindex;
+		can_skb_prv(skb)->skbcnt = 0;
+
+		skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+		/* preform proper loopback on capable devices */
+		if (dev->flags & IFF_ECHO)
+			skb->pkt_type = PACKET_LOOPBACK;
+		else
+			skb->pkt_type = PACKET_HOST;
+
+		skb_reset_mac_header(skb);
+		skb_reset_network_header(skb);
+		skb_reset_transport_header(skb);
+	}
+
+	return true;
+}
+
 /* Drop a given socketbuffer if it does not contain a valid CAN frame. */
 static inline bool can_dropped_invalid_skb(struct net_device *dev,
 					  struct sk_buff *skb)
@@ -108,6 +139,9 @@ static inline bool can_dropped_invalid_s
 	} else
 		goto inval_skb;
 
+	if (!can_skb_headroom_valid(dev, skb))
+		goto inval_skb;
+
 	return false;
 
 inval_skb:
diff -druNp --no-dereference linux-libre-4.19.95-gnu/include/trace/events/preemptirq.h linux-libre-4.19.96-gnu/include/trace/events/preemptirq.h
--- linux-libre-4.19.95-gnu/include/trace/events/preemptirq.h	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/include/trace/events/preemptirq.h	2020-01-14 14:07:09.000000000 -0500
@@ -18,13 +18,13 @@ DECLARE_EVENT_CLASS(preemptirq_template,
 	TP_ARGS(ip, parent_ip),
 
 	TP_STRUCT__entry(
-		__field(u32, caller_offs)
-		__field(u32, parent_offs)
+		__field(s32, caller_offs)
+		__field(s32, parent_offs)
 	),
 
 	TP_fast_assign(
-		__entry->caller_offs = (u32)(ip - (unsigned long)_stext);
-		__entry->parent_offs = (u32)(parent_ip - (unsigned long)_stext);
+		__entry->caller_offs = (s32)(ip - (unsigned long)_stext);
+		__entry->parent_offs = (s32)(parent_ip - (unsigned long)_stext);
 	),
 
 	TP_printk("caller=%pF parent=%pF",
diff -druNp --no-dereference linux-libre-4.19.95-gnu/include/uapi/linux/input.h linux-libre-4.19.96-gnu/include/uapi/linux/input.h
--- linux-libre-4.19.95-gnu/include/uapi/linux/input.h	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/include/uapi/linux/input.h	2020-01-14 14:07:09.000000000 -0500
@@ -34,6 +34,7 @@ struct input_event {
 	__kernel_ulong_t __sec;
 #if defined(__sparc__) && defined(__arch64__)
 	unsigned int __usec;
+	unsigned int __pad;
 #else
 	__kernel_ulong_t __usec;
 #endif
diff -druNp --no-dereference linux-libre-4.19.95-gnu/kernel/trace/trace_sched_wakeup.c linux-libre-4.19.96-gnu/kernel/trace/trace_sched_wakeup.c
--- linux-libre-4.19.95-gnu/kernel/trace/trace_sched_wakeup.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/kernel/trace/trace_sched_wakeup.c	2020-01-14 14:07:09.000000000 -0500
@@ -640,7 +640,7 @@ static void start_wakeup_tracer(struct t
 	if (ret) {
 		pr_info("wakeup trace: Couldn't activate tracepoint"
 			" probe to kernel_sched_migrate_task\n");
-		return;
+		goto fail_deprobe_sched_switch;
 	}
 
 	wakeup_reset(tr);
@@ -658,6 +658,8 @@ static void start_wakeup_tracer(struct t
 		printk(KERN_ERR "failed to start wakeup tracer\n");
 
 	return;
+fail_deprobe_sched_switch:
+	unregister_trace_sched_switch(probe_wakeup_sched_switch, NULL);
 fail_deprobe_wake_new:
 	unregister_trace_sched_wakeup_new(probe_wakeup, NULL);
 fail_deprobe:
diff -druNp --no-dereference linux-libre-4.19.95-gnu/kernel/trace/trace_stack.c linux-libre-4.19.96-gnu/kernel/trace/trace_stack.c
--- linux-libre-4.19.95-gnu/kernel/trace/trace_stack.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/kernel/trace/trace_stack.c	2020-01-14 14:07:09.000000000 -0500
@@ -196,6 +196,11 @@ check_stack(unsigned long ip, unsigned l
 	local_irq_restore(flags);
 }
 
+/* Some archs may not define MCOUNT_INSN_SIZE */
+#ifndef MCOUNT_INSN_SIZE
+# define MCOUNT_INSN_SIZE 0
+#endif
+
 static void
 stack_trace_call(unsigned long ip, unsigned long parent_ip,
 		 struct ftrace_ops *op, struct pt_regs *pt_regs)
diff -druNp --no-dereference linux-libre-4.19.95-gnu/Makefile linux-libre-4.19.96-gnu/Makefile
--- linux-libre-4.19.95-gnu/Makefile	2020-01-12 09:21:57.000000000 -0500
+++ linux-libre-4.19.96-gnu/Makefile	2020-01-14 16:47:23.000000000 -0500
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 19
-SUBLEVEL = 95
+SUBLEVEL = 96
 EXTRAVERSION = -gnu
 NAME = "People's Front"
 
diff -druNp --no-dereference linux-libre-4.19.95-gnu/net/ipv4/netfilter/arp_tables.c linux-libre-4.19.96-gnu/net/ipv4/netfilter/arp_tables.c
--- linux-libre-4.19.95-gnu/net/ipv4/netfilter/arp_tables.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/net/ipv4/netfilter/arp_tables.c	2020-01-14 14:07:09.000000000 -0500
@@ -383,10 +383,11 @@ next:		;
 	return 1;
 }
 
-static inline int check_target(struct arpt_entry *e, const char *name)
+static int check_target(struct arpt_entry *e, struct net *net, const char *name)
 {
 	struct xt_entry_target *t = arpt_get_target(e);
 	struct xt_tgchk_param par = {
+		.net       = net,
 		.table     = name,
 		.entryinfo = e,
 		.target    = t->u.kernel.target,
@@ -398,8 +399,9 @@ static inline int check_target(struct ar
 	return xt_check_target(&par, t->u.target_size - sizeof(*t), 0, false);
 }
 
-static inline int
-find_check_entry(struct arpt_entry *e, const char *name, unsigned int size,
+static int
+find_check_entry(struct arpt_entry *e, struct net *net, const char *name,
+		 unsigned int size,
 		 struct xt_percpu_counter_alloc_state *alloc_state)
 {
 	struct xt_entry_target *t;
@@ -418,7 +420,7 @@ find_check_entry(struct arpt_entry *e, c
 	}
 	t->u.kernel.target = target;
 
-	ret = check_target(e, name);
+	ret = check_target(e, net, name);
 	if (ret)
 		goto err;
 	return 0;
@@ -511,7 +513,9 @@ static inline void cleanup_entry(struct
 /* Checks and translates the user-supplied table segment (held in
  * newinfo).
  */
-static int translate_table(struct xt_table_info *newinfo, void *entry0,
+static int translate_table(struct net *net,
+			   struct xt_table_info *newinfo,
+			   void *entry0,
 			   const struct arpt_replace *repl)
 {
 	struct xt_percpu_counter_alloc_state alloc_state = { 0 };
@@ -568,7 +572,7 @@ static int translate_table(struct xt_tab
 	/* Finally, each sanity check must pass */
 	i = 0;
 	xt_entry_foreach(iter, entry0, newinfo->size) {
-		ret = find_check_entry(iter, repl->name, repl->size,
+		ret = find_check_entry(iter, net, repl->name, repl->size,
 				       &alloc_state);
 		if (ret != 0)
 			break;
@@ -973,7 +977,7 @@ static int do_replace(struct net *net, c
 		goto free_newinfo;
 	}
 
-	ret = translate_table(newinfo, loc_cpu_entry, &tmp);
+	ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
 	if (ret != 0)
 		goto free_newinfo;
 
@@ -1148,7 +1152,8 @@ compat_copy_entry_from_user(struct compa
 	}
 }
 
-static int translate_compat_table(struct xt_table_info **pinfo,
+static int translate_compat_table(struct net *net,
+				  struct xt_table_info **pinfo,
 				  void **pentry0,
 				  const struct compat_arpt_replace *compatr)
 {
@@ -1216,7 +1221,7 @@ static int translate_compat_table(struct
 	repl.num_counters = 0;
 	repl.counters = NULL;
 	repl.size = newinfo->size;
-	ret = translate_table(newinfo, entry1, &repl);
+	ret = translate_table(net, newinfo, entry1, &repl);
 	if (ret)
 		goto free_newinfo;
 
@@ -1269,7 +1274,7 @@ static int compat_do_replace(struct net
 		goto free_newinfo;
 	}
 
-	ret = translate_compat_table(&newinfo, &loc_cpu_entry, &tmp);
+	ret = translate_compat_table(net, &newinfo, &loc_cpu_entry, &tmp);
 	if (ret != 0)
 		goto free_newinfo;
 
@@ -1545,7 +1550,7 @@ int arpt_register_table(struct net *net,
 	loc_cpu_entry = newinfo->entries;
 	memcpy(loc_cpu_entry, repl->entries, repl->size);
 
-	ret = translate_table(newinfo, loc_cpu_entry, repl);
+	ret = translate_table(net, newinfo, loc_cpu_entry, repl);
 	if (ret != 0)
 		goto out_free;
 
diff -druNp --no-dereference linux-libre-4.19.95-gnu/net/netfilter/ipset/ip_set_core.c linux-libre-4.19.96-gnu/net/netfilter/ipset/ip_set_core.c
--- linux-libre-4.19.95-gnu/net/netfilter/ipset/ip_set_core.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/net/netfilter/ipset/ip_set_core.c	2020-01-14 14:07:09.000000000 -0500
@@ -1666,6 +1666,7 @@ static int ip_set_utest(struct net *net,
 	struct ip_set *set;
 	struct nlattr *tb[IPSET_ATTR_ADT_MAX + 1] = {};
 	int ret = 0;
+	u32 lineno;
 
 	if (unlikely(protocol_failed(attr) ||
 		     !attr[IPSET_ATTR_SETNAME] ||
@@ -1682,7 +1683,7 @@ static int ip_set_utest(struct net *net,
 		return -IPSET_ERR_PROTOCOL;
 
 	rcu_read_lock_bh();
-	ret = set->variant->uadt(set, tb, IPSET_TEST, NULL, 0, 0);
+	ret = set->variant->uadt(set, tb, IPSET_TEST, &lineno, 0, 0);
 	rcu_read_unlock_bh();
 	/* Userspace can't trigger element to be re-added */
 	if (ret == -EAGAIN)
diff -druNp --no-dereference linux-libre-4.19.95-gnu/net/netfilter/nf_conntrack_proto_dccp.c linux-libre-4.19.96-gnu/net/netfilter/nf_conntrack_proto_dccp.c
--- linux-libre-4.19.95-gnu/net/netfilter/nf_conntrack_proto_dccp.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/net/netfilter/nf_conntrack_proto_dccp.c	2020-01-14 14:07:09.000000000 -0500
@@ -687,6 +687,9 @@ static int dccp_timeout_nlattr_to_obj(st
 	unsigned int *timeouts = data;
 	int i;
 
+	if (!timeouts)
+		 timeouts = dn->dccp_timeout;
+
 	/* set default DCCP timeouts. */
 	for (i=0; i<CT_DCCP_MAX; i++)
 		timeouts[i] = dn->dccp_timeout[i];
diff -druNp --no-dereference linux-libre-4.19.95-gnu/net/netfilter/nf_conntrack_proto_sctp.c linux-libre-4.19.96-gnu/net/netfilter/nf_conntrack_proto_sctp.c
--- linux-libre-4.19.95-gnu/net/netfilter/nf_conntrack_proto_sctp.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/net/netfilter/nf_conntrack_proto_sctp.c	2020-01-14 14:07:09.000000000 -0500
@@ -603,6 +603,9 @@ static int sctp_timeout_nlattr_to_obj(st
 	struct nf_sctp_net *sn = sctp_pernet(net);
 	int i;
 
+	if (!timeouts)
+		timeouts = sn->timeouts;
+
 	/* set default SCTP timeouts. */
 	for (i=0; i<SCTP_CONNTRACK_MAX; i++)
 		timeouts[i] = sn->timeouts[i];
diff -druNp --no-dereference linux-libre-4.19.95-gnu/sound/pci/hda/patch_realtek.c linux-libre-4.19.96-gnu/sound/pci/hda/patch_realtek.c
--- linux-libre-4.19.95-gnu/sound/pci/hda/patch_realtek.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/sound/pci/hda/patch_realtek.c	2020-01-14 14:07:09.000000000 -0500
@@ -424,6 +424,7 @@ static void alc_fill_eapd_coef(struct hd
 	case 0x10ec0672:
 		alc_update_coef_idx(codec, 0xd, 0, 1<<14); /* EAPD Ctrl */
 		break;
+	case 0x10ec0222:
 	case 0x10ec0623:
 		alc_update_coef_idx(codec, 0x19, 1<<13, 0);
 		break;
@@ -442,6 +443,7 @@ static void alc_fill_eapd_coef(struct hd
 		break;
 	case 0x10ec0899:
 	case 0x10ec0900:
+	case 0x10ec0b00:
 	case 0x10ec1168:
 	case 0x10ec1220:
 		alc_update_coef_idx(codec, 0x7, 1<<1, 0);
@@ -2521,6 +2523,7 @@ static int patch_alc882(struct hda_codec
 	case 0x10ec0882:
 	case 0x10ec0885:
 	case 0x10ec0900:
+	case 0x10ec0b00:
 	case 0x10ec1220:
 		break;
 	default:
@@ -7039,6 +7042,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
 	SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+	SND_PCI_QUIRK(0x17aa, 0x2292, "Thinkpad X1 Yoga 7th", ALC285_FIXUP_SPEAKER2_TO_DAC1),
 	SND_PCI_QUIRK(0x17aa, 0x2293, "Thinkpad X1 Carbon 7th", ALC285_FIXUP_SPEAKER2_TO_DAC1),
 	SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
 	SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
@@ -8989,6 +8993,7 @@ static const struct hda_device_id snd_hd
 	HDA_CODEC_ENTRY(0x10ec0892, "ALC892", patch_alc662),
 	HDA_CODEC_ENTRY(0x10ec0899, "ALC898", patch_alc882),
 	HDA_CODEC_ENTRY(0x10ec0900, "ALC1150", patch_alc882),
+	HDA_CODEC_ENTRY(0x10ec0b00, "ALCS1200A", patch_alc882),
 	HDA_CODEC_ENTRY(0x10ec1168, "ALC1220", patch_alc882),
 	HDA_CODEC_ENTRY(0x10ec1220, "ALC1220", patch_alc882),
 	{} /* terminator */
diff -druNp --no-dereference linux-libre-4.19.95-gnu/sound/usb/quirks.c linux-libre-4.19.96-gnu/sound/usb/quirks.c
--- linux-libre-4.19.95-gnu/sound/usb/quirks.c	2020-01-12 06:17:30.000000000 -0500
+++ linux-libre-4.19.96-gnu/sound/usb/quirks.c	2020-01-14 14:07:09.000000000 -0500
@@ -1177,6 +1177,7 @@ bool snd_usb_get_sample_rate_quirk(struc
 	case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
 	case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
 	case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */
+	case USB_ID(0x05a7, 0x1020): /* Bose Companion 5 */
 	case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
 	case USB_ID(0x1395, 0x740a): /* Sennheiser DECT */
 	case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */
