3.16.6-200.fc20.gnu

17 files changed, 658 insertions, 198 deletions

diff --git a/freed-ora/current/f20/0001-acpi-video-Add-4-new-models-to-the-use_native_backli.patch b/freed-ora/current/f20/0001-acpi-video-Add-4-new-models-to-the-use_native_backli.patch
deleted file mode 100644
index 29da90b39..000000000
--- a/freed-ora/current/f20/0001-acpi-video-Add-4-new-models-to-the-use_native_backli.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-From 5d5ef0e96f03a975feb67f70d57e55cd502885fe Mon Sep 17 00:00:00 2001
-From: Hans de Goede <hdegoede@redhat.com>
-Date: Wed, 30 Apr 2014 15:24:19 +0200
-Subject: [PATCH] acpi-video: Add 4 new models to the use_native_backlight dmi
- list
-
-Acer Aspire V5-171
-https://bugzilla.redhat.com/show_bug.cgi?id=983342
-
-Acer Aspire V5-471G
-Lenovo Yoga 2 11
-Reported-and-tested-by: Vincent Gerris <vgerris@gmail.com>
-
-HP EliteBook 8470p
-https://bugzilla.redhat.com/show_bug.cgi?id=1093120
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
-
-Backport to 3.14, Conflicts: drivers/acpi/video.c, 3.14 is missing the
-Thinkpad Helix entry from master add that while at it.
----
- drivers/acpi/video.c | 40 ++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 40 insertions(+)
-
-diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
-index b6ba88e..083c89f 100644
---- a/drivers/acpi/video.c
-+++ b/drivers/acpi/video.c
-@@ -491,6 +491,22 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
- 	},
- 	{
- 	 .callback = video_set_use_native_backlight,
-+	 .ident = "Lenovo Yoga 2 11",
-+	 .matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+		DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Yoga 2 11"),
-+		},
-+	},
-+	{
-+	.callback = video_set_use_native_backlight,
-+	.ident = "Thinkpad Helix",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Helix"),
-+		},
-+	},
-+	{
-+	 .callback = video_set_use_native_backlight,
- 	 .ident = "Dell Inspiron 7520",
- 	 .matches = {
- 		DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-@@ -507,6 +523,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
- 	},
- 	{
- 	 .callback = video_set_use_native_backlight,
-+	 .ident = "Acer Aspire V5-171",
-+	 .matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
-+		DMI_MATCH(DMI_PRODUCT_NAME, "V5-171"),
-+		},
-+	},
-+	{
-+	 .callback = video_set_use_native_backlight,
- 	 .ident = "Acer Aspire V5-431",
- 	 .matches = {
- 		DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
-@@ -514,6 +538,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
- 		},
- 	},
- 	{
-+	 .callback = video_set_use_native_backlight,
-+	 .ident = "Acer Aspire V5-471G",
-+	 .matches = {
-+		DMI_MATCH(DMI_BOARD_VENDOR, "Acer"),
-+		DMI_MATCH(DMI_PRODUCT_NAME, "Aspire V5-471G"),
-+		},
-+	},
-+	{
- 	.callback = video_set_use_native_backlight,
- 	.ident = "HP ProBook 4340s",
- 	.matches = {
-@@ -565,6 +597,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
- 	},
- 	{
- 	.callback = video_set_use_native_backlight,
-+	.ident = "HP EliteBook 8470p",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-+		DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook 8470p"),
-+		},
-+	},
-+	{
-+	.callback = video_set_use_native_backlight,
- 	.ident = "HP EliteBook 8780w",
- 	.matches = {
- 		DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
--- 
-1.9.0
-
diff --git a/freed-ora/current/f20/HID-rmi-check-sanity-of-the-incoming-report.patch b/freed-ora/current/f20/HID-rmi-check-sanity-of-the-incoming-report.patch
new file mode 100644
index 000000000..82c316a63
--- /dev/null
+++ b/freed-ora/current/f20/HID-rmi-check-sanity-of-the-incoming-report.patch
@@ -0,0 +1,107 @@
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Wed, 10 Sep 2014 18:02:37 -0700
+Subject: [PATCH] HID: rmi: check sanity of the incoming report
+
+In the Dell XPS 13 9333, it appears that sometimes the bus get confused
+and corrupts the incoming data. It fills the input report with the
+sentinel value "ff". Synaptics told us that such behavior does not comes
+from the touchpad itself, so we filter out such reports here.
+
+Unfortunately, we can not simply discard the incoming data because they
+may contain useful information. Most of the time, the misbehavior is
+quite near the end of the report, so we can still use the valid part of
+it.
+
+Fixes:
+https://bugzilla.redhat.com/show_bug.cgi?id=1123584
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+---
+ drivers/hid/hid-rmi.c | 44 ++++++++++++++++++++++++++++++++++++++------
+ 1 file changed, 38 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c
+index 8389e8109218..3cccff73b9b9 100644
+--- a/drivers/hid/hid-rmi.c
++++ b/drivers/hid/hid-rmi.c
+@@ -320,10 +320,7 @@ static int rmi_f11_input_event(struct hid_device *hdev, u8 irq, u8 *data,
+ 	int offset;
+ 	int i;
+ 
+-	if (size < hdata->f11.report_size)
+-		return 0;
+-
+-	if (!(irq & hdata->f11.irq_mask))
++	if (!(irq & hdata->f11.irq_mask) || size <= 0)
+ 		return 0;
+ 
+ 	offset = (hdata->max_fingers >> 2) + 1;
+@@ -332,9 +329,19 @@ static int rmi_f11_input_event(struct hid_device *hdev, u8 irq, u8 *data,
+ 		int fs_bit_position = (i & 0x3) << 1;
+ 		int finger_state = (data[fs_byte_position] >> fs_bit_position) &
+ 					0x03;
++		int position = offset + 5 * i;
++
++		if (position + 5 > size) {
++			/* partial report, go on with what we received */
++			printk_once(KERN_WARNING
++				"%s %s: Detected incomplete finger report. Finger reports may occasionally get dropped on this platform.\n",
++				 dev_driver_string(&hdev->dev),
++				 dev_name(&hdev->dev));
++			hid_dbg(hdev, "Incomplete finger report\n");
++			break;
++		}
+ 
+-		rmi_f11_process_touch(hdata, i, finger_state,
+-				&data[offset + 5 * i]);
++		rmi_f11_process_touch(hdata, i, finger_state, &data[position]);
+ 	}
+ 	input_mt_sync_frame(hdata->input);
+ 	input_sync(hdata->input);
+@@ -352,6 +359,11 @@ static int rmi_f30_input_event(struct hid_device *hdev, u8 irq, u8 *data,
+ 	if (!(irq & hdata->f30.irq_mask))
+ 		return 0;
+ 
++	if (size < (int)hdata->f30.report_size) {
++		hid_warn(hdev, "Click Button pressed, but the click data is missing\n");
++		return 0;
++	}
++
+ 	for (i = 0; i < hdata->gpio_led_count; i++) {
+ 		if (test_bit(i, &hdata->button_mask)) {
+ 			value = (data[i / 8] >> (i & 0x07)) & BIT(0);
+@@ -412,9 +424,29 @@ static int rmi_read_data_event(struct hid_device *hdev, u8 *data, int size)
+ 	return 1;
+ }
+ 
++static int rmi_check_sanity(struct hid_device *hdev, u8 *data, int size)
++{
++	int valid_size = size;
++	/*
++	 * On the Dell XPS 13 9333, the bus sometimes get confused and fills
++	 * the report with a sentinel value "ff". Synaptics told us that such
++	 * behavior does not comes from the touchpad itself, so we filter out
++	 * such reports here.
++	 */
++
++	while ((data[valid_size - 1] == 0xff) && valid_size > 0)
++		valid_size--;
++
++	return valid_size;
++}
++
+ static int rmi_raw_event(struct hid_device *hdev,
+ 		struct hid_report *report, u8 *data, int size)
+ {
++	size = rmi_check_sanity(hdev, data, size);
++	if (size < 2)
++		return 0;
++
+ 	switch (data[0]) {
+ 	case RMI_READ_DATA_REPORT_ID:
+ 		return rmi_read_data_event(hdev, data, size);
+-- 
+1.9.3
+
diff --git a/freed-ora/current/f20/HID-usbhid-add-always-poll-quirk.patch b/freed-ora/current/f20/HID-usbhid-add-always-poll-quirk.patch
new file mode 100644
index 000000000..240619761
--- /dev/null
+++ b/freed-ora/current/f20/HID-usbhid-add-always-poll-quirk.patch
@@ -0,0 +1,98 @@
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 5 Sep 2014 18:08:47 +0200
+Subject: [PATCH] HID: usbhid: add always-poll quirk
+
+Add quirk to make sure that a device is always polled for input events
+even if it hasn't been opened.
+
+This is needed for devices that disconnects from the bus unless the
+interrupt endpoint has been polled at least once or when not responding
+to an input event (e.g. after having shut down X).
+
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+---
+ drivers/hid/usbhid/hid-core.c | 26 +++++++++++++++++++++++---
+ include/linux/hid.h           |  1 +
+ 2 files changed, 24 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
+index 79cf503e37bf..ddd547ad6d7e 100644
+--- a/drivers/hid/usbhid/hid-core.c
++++ b/drivers/hid/usbhid/hid-core.c
+@@ -82,7 +82,7 @@ static int hid_start_in(struct hid_device *hid)
+ 	struct usbhid_device *usbhid = hid->driver_data;
+ 
+ 	spin_lock_irqsave(&usbhid->lock, flags);
+-	if (hid->open > 0 &&
++	if ((hid->open > 0 || hid->quirks & HID_QUIRK_ALWAYS_POLL) &&
+ 			!test_bit(HID_DISCONNECTED, &usbhid->iofl) &&
+ 			!test_bit(HID_SUSPENDED, &usbhid->iofl) &&
+ 			!test_and_set_bit(HID_IN_RUNNING, &usbhid->iofl)) {
+@@ -292,6 +292,8 @@ static void hid_irq_in(struct urb *urb)
+ 	case 0:			/* success */
+ 		usbhid_mark_busy(usbhid);
+ 		usbhid->retry_delay = 0;
++		if ((hid->quirks & HID_QUIRK_ALWAYS_POLL) && !hid->open)
++			break;
+ 		hid_input_report(urb->context, HID_INPUT_REPORT,
+ 				 urb->transfer_buffer,
+ 				 urb->actual_length, 1);
+@@ -735,8 +737,10 @@ void usbhid_close(struct hid_device *hid)
+ 	if (!--hid->open) {
+ 		spin_unlock_irq(&usbhid->lock);
+ 		hid_cancel_delayed_stuff(usbhid);
+-		usb_kill_urb(usbhid->urbin);
+-		usbhid->intf->needs_remote_wakeup = 0;
++		if (!(hid->quirks & HID_QUIRK_ALWAYS_POLL)) {
++			usb_kill_urb(usbhid->urbin);
++			usbhid->intf->needs_remote_wakeup = 0;
++		}
+ 	} else {
+ 		spin_unlock_irq(&usbhid->lock);
+ 	}
+@@ -1134,6 +1138,19 @@ static int usbhid_start(struct hid_device *hid)
+ 
+ 	set_bit(HID_STARTED, &usbhid->iofl);
+ 
++	if (hid->quirks & HID_QUIRK_ALWAYS_POLL) {
++		ret = usb_autopm_get_interface(usbhid->intf);
++		if (ret)
++			goto fail;
++		usbhid->intf->needs_remote_wakeup = 1;
++		ret = hid_start_in(hid);
++		if (ret) {
++			dev_err(&hid->dev,
++				"failed to start in urb: %d\n", ret);
++		}
++		usb_autopm_put_interface(usbhid->intf);
++	}
++
+ 	/* Some keyboards don't work until their LEDs have been set.
+ 	 * Since BIOSes do set the LEDs, it must be safe for any device
+ 	 * that supports the keyboard boot protocol.
+@@ -1166,6 +1183,9 @@ static void usbhid_stop(struct hid_device *hid)
+ 	if (WARN_ON(!usbhid))
+ 		return;
+ 
++	if (hid->quirks & HID_QUIRK_ALWAYS_POLL)
++		usbhid->intf->needs_remote_wakeup = 0;
++
+ 	clear_bit(HID_STARTED, &usbhid->iofl);
+ 	spin_lock_irq(&usbhid->lock);	/* Sync with error and led handlers */
+ 	set_bit(HID_DISCONNECTED, &usbhid->iofl);
+diff --git a/include/linux/hid.h b/include/linux/hid.h
+index f53c4a9cca1d..26ee25fced27 100644
+--- a/include/linux/hid.h
++++ b/include/linux/hid.h
+@@ -287,6 +287,7 @@ struct hid_item {
+ #define HID_QUIRK_HIDINPUT_FORCE		0x00000080
+ #define HID_QUIRK_NO_EMPTY_INPUT		0x00000100
+ #define HID_QUIRK_NO_INIT_INPUT_REPORTS		0x00000200
++#define HID_QUIRK_ALWAYS_POLL			0x00000400
+ #define HID_QUIRK_SKIP_OUTPUT_REPORTS		0x00010000
+ #define HID_QUIRK_SKIP_OUTPUT_REPORT_ID		0x00020000
+ #define HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP	0x00040000
+-- 
+1.9.3
+
diff --git a/freed-ora/current/f20/HID-usbhid-always-poll-quirk-for-Elan-Touchscreen-00.patch b/freed-ora/current/f20/HID-usbhid-always-poll-quirk-for-Elan-Touchscreen-00.patch
new file mode 100644
index 000000000..1ead40b42
--- /dev/null
+++ b/freed-ora/current/f20/HID-usbhid-always-poll-quirk-for-Elan-Touchscreen-00.patch
@@ -0,0 +1,37 @@
+From: Adel Gadllah <adel.gadllah@gmail.com>
+Date: Mon, 6 Oct 2014 15:32:01 +0200
+Subject: [PATCH] HID: usbhid: always-poll quirk for Elan Touchscreen 009b
+
+This device needs the quirk as well.
+---
+ drivers/hid/hid-ids.h           | 1 +
+ drivers/hid/usbhid/hid-quirks.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 0d2e07dd71d8..c293747f8c72 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -298,6 +298,7 @@
+ 
+ #define USB_VENDOR_ID_ELAN		0x04f3
+ #define USB_DEVICE_ID_ELAN_TOUCHSCREEN	0x0089
++#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B	0x009b
+ 
+ #define USB_VENDOR_ID_ELECOM		0x056e
+ #define USB_DEVICE_ID_ELECOM_BM084	0x0061
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index ca18136ead15..2cdc1ecbf8e4 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -71,6 +71,7 @@ static const struct hid_blacklist {
+ 	{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET },
+ 	{ USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
+ 	{ USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN, HID_QUIRK_ALWAYS_POLL },
++	{ USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B, HID_QUIRK_ALWAYS_POLL },
+ 	{ USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
+ 	{ USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
+ 	{ USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
+-- 
+1.9.3
+
diff --git a/freed-ora/current/f20/HID-usbhid-always-poll-quirk-for-Elan-Touchscreen-01.patch b/freed-ora/current/f20/HID-usbhid-always-poll-quirk-for-Elan-Touchscreen-01.patch
new file mode 100644
index 000000000..1f780726e
--- /dev/null
+++ b/freed-ora/current/f20/HID-usbhid-always-poll-quirk-for-Elan-Touchscreen-01.patch
@@ -0,0 +1,39 @@
+From: Adel Gadllah <adel.gadllah@gmail.com>
+Date: Tue, 7 Oct 2014 18:45:09 +0200
+Subject: [PATCH] HID: usbhid: always-poll quirk for Elan Touchscreen 016f
+
+This device needs the quirk as well.
+
+Signed-off-by: Adel Gadllah <adel.gadllah@gmail.com>
+---
+ drivers/hid/hid-ids.h           | 1 +
+ drivers/hid/usbhid/hid-quirks.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index c293747f8c72..81bc10e0bba2 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -299,6 +299,7 @@
+ #define USB_VENDOR_ID_ELAN		0x04f3
+ #define USB_DEVICE_ID_ELAN_TOUCHSCREEN	0x0089
+ #define USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B	0x009b
++#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F	0x016f
+ 
+ #define USB_VENDOR_ID_ELECOM		0x056e
+ #define USB_DEVICE_ID_ELECOM_BM084	0x0061
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index 2cdc1ecbf8e4..39a265df2909 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -72,6 +72,7 @@ static const struct hid_blacklist {
+ 	{ USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
+ 	{ USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN, HID_QUIRK_ALWAYS_POLL },
+ 	{ USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B, HID_QUIRK_ALWAYS_POLL },
++	{ USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F, HID_QUIRK_ALWAYS_POLL },
+ 	{ USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
+ 	{ USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
+ 	{ USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
+-- 
+1.9.3
+
diff --git a/freed-ora/current/f20/HID-usbhid-enable-always-poll-quirk-for-Elan-Touchsc.patch b/freed-ora/current/f20/HID-usbhid-enable-always-poll-quirk-for-Elan-Touchsc.patch
new file mode 100644
index 000000000..ff2d25b00
--- /dev/null
+++ b/freed-ora/current/f20/HID-usbhid-enable-always-poll-quirk-for-Elan-Touchsc.patch
@@ -0,0 +1,52 @@
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 5 Sep 2014 18:08:48 +0200
+Subject: [PATCH] HID: usbhid: enable always-poll quirk for Elan Touchscreen
+
+Enable the always-poll quirk for Elan Touchscreens found on some recent
+Samsung laptops.
+
+Without this quirk the device keeps disconnecting from the bus (and is
+re-enumerated) unless opened (and kept open, should an input event
+occur).
+
+Note that while the device can be run-time suspended, the autosuspend
+timeout must be high enough to allow the device to be polled at least
+once before being suspended. Specifically, using autosuspend_delay_ms=0
+will still cause the device to disconnect on input events.
+
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+---
+ drivers/hid/hid-ids.h           | 3 +++
+ drivers/hid/usbhid/hid-quirks.c | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 25cd674d6064..0d2e07dd71d8 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -296,6 +296,9 @@
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7	0x73f7
+ #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001	0xa001
+ 
++#define USB_VENDOR_ID_ELAN		0x04f3
++#define USB_DEVICE_ID_ELAN_TOUCHSCREEN	0x0089
++
+ #define USB_VENDOR_ID_ELECOM		0x056e
+ #define USB_DEVICE_ID_ELECOM_BM084	0x0061
+ 
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index 15225f3eaed1..ca18136ead15 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -70,6 +70,7 @@ static const struct hid_blacklist {
+ 	{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_3AXIS_5BUTTON_STICK, HID_QUIRK_NOGET },
+ 	{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET },
+ 	{ USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
++	{ USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN, HID_QUIRK_ALWAYS_POLL },
+ 	{ USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
+ 	{ USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
+ 	{ USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
+-- 
+1.9.3
+
diff --git a/freed-ora/current/f20/USB-core-add-device-qualifier-quirk.patch b/freed-ora/current/f20/USB-core-add-device-qualifier-quirk.patch
new file mode 100644
index 000000000..e5a58fa17
--- /dev/null
+++ b/freed-ora/current/f20/USB-core-add-device-qualifier-quirk.patch
@@ -0,0 +1,52 @@
+From d3641b4838204c1257bd575f12ba9dc24a4bc707 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 25 Aug 2014 17:51:26 +0200
+Subject: [PATCH] USB: core: add device-qualifier quirk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Add new quirk for devices that cannot handle requests for the
+device_qualifier descriptor.
+
+A USB-2.0 compliant device must respond to requests for the
+device_qualifier descriptor (even if it's with a request error), but at
+least one device is known to misbehave after such a request.
+
+Suggested-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/hub.c     | 3 +++
+ include/linux/usb/quirks.h | 3 +++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 50e854509f55..8f9d142aaf4a 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -4524,6 +4524,9 @@ check_highspeed (struct usb_hub *hub, struct usb_device *udev, int port1)
+ 	struct usb_qualifier_descriptor	*qual;
+ 	int				status;
+ 
++	if (udev->quirks & USB_QUIRK_DEVICE_QUALIFIER)
++		return;
++
+ 	qual = kmalloc (sizeof *qual, GFP_KERNEL);
+ 	if (qual == NULL)
+ 		return;
+diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
+index 52f944dfe2fd..4681e0fb1fac 100644
+--- a/include/linux/usb/quirks.h
++++ b/include/linux/usb/quirks.h
+@@ -33,4 +33,7 @@
+ /* device generates spurious wakeup, ignore remote wakeup capability */
+ #define USB_QUIRK_IGNORE_REMOTE_WAKEUP	0x00000200
+ 
++/* device can't handle device_qualifier descriptor requests */
++#define USB_QUIRK_DEVICE_QUALIFIER	0x00000100
++
+ #endif /* __LINUX_USB_QUIRKS_H */
+-- 
+1.9.3
+
diff --git a/freed-ora/current/f20/USB-quirks-device-qualifier-quirk-for-another-Elan-t.patch b/freed-ora/current/f20/USB-quirks-device-qualifier-quirk-for-another-Elan-t.patch
new file mode 100644
index 000000000..8bad31276
--- /dev/null
+++ b/freed-ora/current/f20/USB-quirks-device-qualifier-quirk-for-another-Elan-t.patch
@@ -0,0 +1,30 @@
+From: Adel Gadllah <adel.gadllah@gmail.com>
+Date: Tue, 7 Oct 2014 18:42:28 +0200
+Subject: [PATCH] USB: quirks: device-qualifier quirk for another Elan
+ touchscreen
+
+Yet another device affected by this.
+
+Signed-off-by: Adel Gadllah <adel.gadllah@gmail.com>
+---
+ drivers/usb/core/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index cac60d9b091b..e71bad25294c 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -98,6 +98,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 			USB_QUIRK_DEVICE_QUALIFIER },
+ 
+ 	/* Elan Touchscreen */
++	{ USB_DEVICE(0x04f3, 0x016f), .driver_info =
++			USB_QUIRK_DEVICE_QUALIFIER },
++
++	/* Elan Touchscreen */
+ 	{ USB_DEVICE(0x04f3, 0x009b), .driver_info =
+ 			USB_QUIRK_DEVICE_QUALIFIER },
+ 
+-- 
+1.9.3
+
diff --git a/freed-ora/current/f20/USB-quirks-enable-device-qualifier-quirk-for-Elan-To.patch b/freed-ora/current/f20/USB-quirks-enable-device-qualifier-quirk-for-Elan-To.patch
new file mode 100644
index 000000000..a344aba71
--- /dev/null
+++ b/freed-ora/current/f20/USB-quirks-enable-device-qualifier-quirk-for-Elan-To.patch
@@ -0,0 +1,46 @@
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 25 Aug 2014 17:51:27 +0200
+Subject: [PATCH] USB: quirks: enable device-qualifier quirk for Elan
+ Touchscreen
+
+Enable device-qualifier quirk for Elan Touchscreen, which often fails to
+handle requests for the device_descriptor.
+
+Note that the device sometimes do respond properly with a Request Error
+(three times as USB core retries), but usually fails to respond at all.
+When this happens any further descriptor requests also fails, for
+example:
+
+[ 1528.688934] usb 2-7: new full-speed USB device number 4 using xhci_hcd
+[ 1530.945588] usb 2-7: unable to read config index 0 descriptor/start: -71
+[ 1530.945592] usb 2-7: can't read configurations, error -71
+
+This has been observed repeating for over a minute before eventual
+successful enumeration.
+
+Reported-by: Drew Von Spreecken <drewvs@gmail.com>
+Reported-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/core/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index bae636e2a1a3..a342a783d496 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -93,6 +93,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	{ USB_DEVICE(0x04e8, 0x6601), .driver_info =
+ 			USB_QUIRK_CONFIG_INTF_STRINGS },
+ 
++	/* Elan Touchscreen */
++	{ USB_DEVICE(0x04f3, 0x0089), .driver_info =
++			USB_QUIRK_DEVICE_QUALIFIER },
++
+ 	/* Roland SC-8820 */
+ 	{ USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+-- 
+1.9.3
+
diff --git a/freed-ora/current/f20/USB-quirks-enable-device-qualifier-quirk-for-another.patch b/freed-ora/current/f20/USB-quirks-enable-device-qualifier-quirk-for-another.patch
new file mode 100644
index 000000000..febd6dacb
--- /dev/null
+++ b/freed-ora/current/f20/USB-quirks-enable-device-qualifier-quirk-for-another.patch
@@ -0,0 +1,32 @@
+From: Adel Gadllah <adel.gadllah-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
+Date: Sun, 5 Oct 2014 18:32:34 +0200
+Subject: [PATCH] USB: quirks: enable device-qualifier quirk for another Elan
+ touchscreen
+
+Currently this quirk is enabled for the model with the device id 0x0089, it
+is needed for the 0x009b model, which is found on the Fujitsu Lifebook u904
+as well.
+
+Signed-off-by: Adel Gadllah <adel.gadllah-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
+---
+ drivers/usb/core/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index a342a783d496..cac60d9b091b 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -97,6 +97,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	{ USB_DEVICE(0x04f3, 0x0089), .driver_info =
+ 			USB_QUIRK_DEVICE_QUALIFIER },
+ 
++	/* Elan Touchscreen */
++	{ USB_DEVICE(0x04f3, 0x009b), .driver_info =
++			USB_QUIRK_DEVICE_QUALIFIER },
++
+ 	/* Roland SC-8820 */
+ 	{ USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+-- 
+1.9.3
+
diff --git a/freed-ora/current/f20/acpi-video-Add-use-native-backlight-quirk-for-the-Th.patch b/freed-ora/current/f20/acpi-video-Add-use-native-backlight-quirk-for-the-Th.patch
deleted file mode 100644
index f3d36889f..000000000
--- a/freed-ora/current/f20/acpi-video-Add-use-native-backlight-quirk-for-the-Th.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-Bugzilla: 1093171
-Upstream-status: Queued for 3.16
-
-From 7ac976d0109433d1ad0812f4f6889a904d9a0c40 Mon Sep 17 00:00:00 2001
-From: Hans de Goede <hdegoede@redhat.com>
-Date: Mon, 2 Jun 2014 17:41:10 +0200
-Subject: [PATCH 13/14] acpi-video: Add use native backlight quirk for the
- ThinkPad W530
-
-Like all of the other *30 ThinkPad models, the W530 has a broken acpi-video
-backlight control. Note in order for this to actually fix things on the
-ThinkPad W530 the commit titled:
-"nouveau: Don't check acpi_video_backlight_support() before registering backlight"
-is also needed.
-
-https://bugzilla.redhat.com/show_bug.cgi?id=1093171
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
----
- drivers/acpi/video.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
-index ab7cd65ce21e..dcb0ef4c22f6 100644
---- a/drivers/acpi/video.c
-+++ b/drivers/acpi/video.c
-@@ -468,6 +468,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
- 	},
- 	{
- 	 .callback = video_set_use_native_backlight,
-+	 .ident = "ThinkPad W530",
-+	 .matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+		DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W530"),
-+		},
-+	},
-+	{
-+	 .callback = video_set_use_native_backlight,
- 	 .ident = "ThinkPad X230",
- 	 .matches = {
- 		DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
--- 
-1.9.0
-
diff --git a/freed-ora/current/f20/acpi-video-Add-use_native_backlight-quirk-for-HP-Pro.patch b/freed-ora/current/f20/acpi-video-Add-use_native_backlight-quirk-for-HP-Pro.patch
deleted file mode 100644
index c8c1f7aa2..000000000
--- a/freed-ora/current/f20/acpi-video-Add-use_native_backlight-quirk-for-HP-Pro.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-Bugzilla: 1025690
-Upstream-status: Waiting for feedback from reporter
-
-From dfe2c6722a6f6cb45f6b336b094b26a77acd8393 Mon Sep 17 00:00:00 2001
-From: Hans de Goede <hdegoede@redhat.com>
-Date: Mon, 2 Jun 2014 17:41:11 +0200
-Subject: [PATCH 14/14] acpi-video: Add use_native_backlight quirk for HP
- ProBook 4540s
-
-As reported here:
-https://bugzilla.redhat.com/show_bug.cgi?id=1025690
-This is yet another model which needs this quirk.
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Hans de Goede <hdegoede@redhat.com>
----
- drivers/acpi/video.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
-index dcb0ef4c22f6..3db16753f88a 100644
---- a/drivers/acpi/video.c
-+++ b/drivers/acpi/video.c
-@@ -548,6 +548,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
- 	},
- 	{
- 	.callback = video_set_use_native_backlight,
-+	.ident = "HP ProBook 4540s",
-+	.matches = {
-+		DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-+		DMI_MATCH(DMI_PRODUCT_VERSION, "HP ProBook 4540s"),
-+		},
-+	},
-+	{
-+	.callback = video_set_use_native_backlight,
- 	.ident = "HP ProBook 2013 models",
- 	.matches = {
- 		DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
--- 
-1.9.0
-
diff --git a/freed-ora/current/f20/bcache-Make-sure-to-pass-GFP_WAIT-to-mempool_alloc.patch b/freed-ora/current/f20/bcache-Make-sure-to-pass-GFP_WAIT-to-mempool_alloc.patch
new file mode 100644
index 000000000..149182b75
--- /dev/null
+++ b/freed-ora/current/f20/bcache-Make-sure-to-pass-GFP_WAIT-to-mempool_alloc.patch
@@ -0,0 +1,33 @@
+From bcf090e0040e30f8409e6a535a01e6473afb096f Mon Sep 17 00:00:00 2001
+From: Kent Overstreet <kmo@daterainc.com>
+Date: Mon, 19 May 2014 08:57:55 -0700
+Subject: [PATCH] bcache: Make sure to pass GFP_WAIT to mempool_alloc()
+
+this was very wrong - mempool_alloc() only guarantees success with GFP_WAIT.
+bcache uses GFP_NOWAIT in various other places where we have a fallback,
+circuits must've gotten crossed when writing this code or something.
+
+Upstream-status: 3.17
+Bugzilla: 1149414
+
+Signed-off-by: Kent Overstreet <kmo@daterainc.com>
+---
+ drivers/md/bcache/btree.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index 9dd9f1c4d0d9..e538d45fa65a 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -202,7 +202,7 @@ void bch_btree_node_read_done(struct btree *b)
+ 	struct bset *i = btree_bset_first(b);
+ 	struct btree_iter *iter;
+ 
+-	iter = mempool_alloc(b->c->fill_iter, GFP_NOWAIT);
++	iter = mempool_alloc(b->c->fill_iter, GFP_NOIO);
+ 	iter->size = b->c->sb.bucket_size / b->c->sb.block_size;
+ 	iter->used = 0;
+ 
+-- 
+1.9.3
+
diff --git a/freed-ora/current/f20/fs-Add-a-missing-permission-check-to-do_umount.patch b/freed-ora/current/f20/fs-Add-a-missing-permission-check-to-do_umount.patch
new file mode 100644
index 000000000..ce9de6641
--- /dev/null
+++ b/freed-ora/current/f20/fs-Add-a-missing-permission-check-to-do_umount.patch
@@ -0,0 +1,31 @@
+From: Andy Lutomirski <luto@amacapital.net>
+Date: Wed, 8 Oct 2014 12:37:46 -0700
+Subject: [PATCH] fs: Add a missing permission check to do_umount
+
+Accessing do_remount_sb should require global CAP_SYS_ADMIN, but
+only one of the two call sites was appropriately protected.
+
+Fixes CVE-2014-7975.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Andy Lutomirski <luto@amacapital.net>
+---
+ fs/namespace.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index c8e3034ff4b2..fbba8b17330d 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1439,6 +1439,8 @@ static int do_umount(struct mount *mnt, int flags)
+ 		 * Special case for "unmounting" root ...
+ 		 * we just try to remount it readonly.
+ 		 */
++		if (!capable(CAP_SYS_ADMIN))
++			return -EPERM;
+ 		down_write(&sb->s_umount);
+ 		if (!(sb->s_flags & MS_RDONLY))
+ 			retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
+-- 
+1.9.3
+
diff --git a/freed-ora/current/f20/kernel.spec b/freed-ora/current/f20/kernel.spec
index cf2e63f45..58b9d8ad8 100644
--- a/freed-ora/current/f20/kernel.spec
+++ b/freed-ora/current/f20/kernel.spec
@@ -112,7 +112,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 5
+%define stable_update 6
 # Is it a -stable RC?
 %define stable_rc 0
 # Set rpm version accordingly
@@ -753,17 +753,12 @@ Patch22000: weird-root-dentry-name-debug.patch
 #rhbz 1025603
 Patch25063: disable-libdw-unwind-on-non-x86.patch
 
-#rhbz 983342 1093120
-Patch25069: 0001-acpi-video-Add-4-new-models-to-the-use_native_backli.patch
-
 Patch26000: perf-lib64.patch
 
 # Patch series from Hans for various backlight and platform driver fixes
 Patch26002: samsung-laptop-Add-broken-acpi-video-quirk-for-NC210.patch
 Patch26004: asus-wmi-Add-a-no-backlight-quirk.patch
 Patch26005: eeepc-wmi-Add-no-backlight-quirk-for-Asus-H87I-PLUS-.patch
-Patch26013: acpi-video-Add-use-native-backlight-quirk-for-the-Th.patch
-Patch26014: acpi-video-Add-use_native_backlight-quirk-for-HP-Pro.patch
 
 Patch25109: revert-input-wacom-testing-result-shows-get_report-is-unnecessary.patch
 
@@ -786,6 +781,25 @@ Patch26028: HID-rmi-check-sanity-of-incoming-report.patch
 
 Patch26030: GFS2-Make-rename-not-save-dirent-location.patch
 
+#CVE-2014-7970 rhbz 1151095 1151484
+Patch26032: mnt-Prevent-pivot_root-from-creating-a-loop-in-the-m.patch
+
+#rhbz 1149414
+Patch26033: bcache-Make-sure-to-pass-GFP_WAIT-to-mempool_alloc.patch
+
+#rhbz 1149509
+Patch26034: USB-core-add-device-qualifier-quirk.patch
+Patch26035: USB-quirks-enable-device-qualifier-quirk-for-Elan-To.patch
+Patch26036: USB-quirks-enable-device-qualifier-quirk-for-another.patch
+Patch26037: HID-usbhid-add-always-poll-quirk.patch
+Patch26038: HID-usbhid-enable-always-poll-quirk-for-Elan-Touchsc.patch
+Patch26039: HID-usbhid-always-poll-quirk-for-Elan-Touchscreen-00.patch
+Patch26040: USB-quirks-device-qualifier-quirk-for-another-Elan-t.patch
+Patch26041: HID-usbhid-always-poll-quirk-for-Elan-Touchscreen-01.patch
+
+#CVE-2014-7975 rhbz 1151108 1152025
+Patch26042: fs-Add-a-missing-permission-check-to-do_umount.patch
+
 # git clone ssh://git.fedorahosted.org/git/kernel-arm64.git, git diff master...devel
 Patch30000: kernel-arm64.patch
 
@@ -1507,17 +1521,12 @@ ApplyPatch ath9k_rx_dma_stop_check.patch
 #rhbz 1025603
 ApplyPatch disable-libdw-unwind-on-non-x86.patch
 
-#rhbz 983342 1093120
-ApplyPatch 0001-acpi-video-Add-4-new-models-to-the-use_native_backli.patch
-
 ApplyPatch perf-lib64.patch
 
 # Patch series from Hans for various backlight and platform driver fixes
 ApplyPatch samsung-laptop-Add-broken-acpi-video-quirk-for-NC210.patch
 ApplyPatch asus-wmi-Add-a-no-backlight-quirk.patch
 ApplyPatch eeepc-wmi-Add-no-backlight-quirk-for-Asus-H87I-PLUS-.patch
-ApplyPatch acpi-video-Add-use-native-backlight-quirk-for-the-Th.patch
-ApplyPatch acpi-video-Add-use_native_backlight-quirk-for-HP-Pro.patch
 
 ApplyPatch revert-input-wacom-testing-result-shows-get_report-is-unnecessary.patch
 
@@ -1540,6 +1549,25 @@ ApplyPatch HID-rmi-check-sanity-of-incoming-report.patch
 
 ApplyPatch GFS2-Make-rename-not-save-dirent-location.patch
 
+#CVE-2014-7970 rhbz 1151095 1151484
+ApplyPatch mnt-Prevent-pivot_root-from-creating-a-loop-in-the-m.patch
+
+#rhbz 1149414
+ApplyPatch bcache-Make-sure-to-pass-GFP_WAIT-to-mempool_alloc.patch
+
+#rhbz 1149509
+ApplyPatch USB-core-add-device-qualifier-quirk.patch
+ApplyPatch USB-quirks-enable-device-qualifier-quirk-for-Elan-To.patch
+ApplyPatch USB-quirks-enable-device-qualifier-quirk-for-another.patch
+ApplyPatch HID-usbhid-add-always-poll-quirk.patch
+ApplyPatch HID-usbhid-enable-always-poll-quirk-for-Elan-Touchsc.patch
+ApplyPatch HID-usbhid-always-poll-quirk-for-Elan-Touchscreen-00.patch
+ApplyPatch USB-quirks-device-qualifier-quirk-for-another-Elan-t.patch
+ApplyPatch HID-usbhid-always-poll-quirk-for-Elan-Touchscreen-01.patch
+
+#CVE-2014-7975 rhbz 1151108 1152025
+ApplyPatch fs-Add-a-missing-permission-check-to-do_umount.patch
+
 %if 0%{?aarch64patches}
 ApplyPatch kernel-arm64.patch
 %ifnarch aarch64 # this is stupid, but i want to notice before secondary koji does.
@@ -2369,6 +2397,23 @@ fi
 #                 ||----w |
 #                 ||     ||
 %changelog
+* Thu Oct 16 2014 Alexandre Oliva <lxoliva@fsfla.org> -libre
+- GNU Linux-libre 3.16.6-gnu.
+
+* Wed Oct 15 2014 Justin M. Forbes <jforbes@fedoraproject.org> - 3.16.6-200
+- Linux v3.16.6
+
+* Mon Oct 13 2014 Josh Boyer <jwboyer@fedoraproject.org>
+- CVE-2014-7975 fs: umount DoS (rhbz 1151108 1152025)
+
+* Sat Oct 11 2014 Josh Boyer <jwboyer@fedoraproject.org>
+- Add patches to fix elantech touchscreens (rhbz 1149509)
+
+* Fri Oct 10 2014 Josh Boyer <jwboyer@fedoraproject.org>
+- Add patch to fix bcache NULL ptr deref (rhbz 1149414)
+- CVE-2014-7970 VFS: DoS with USER_NS (rhbz 1151095 1151484)
+- Drop doubly applied ACPI video quirk patches
+
 * Thu Oct  9 2014 Alexandre Oliva <lxoliva@fsfla.org> -libre
 - GNU Linux-libre 3.16.5-gnu.
 
diff --git a/freed-ora/current/f20/mnt-Prevent-pivot_root-from-creating-a-loop-in-the-m.patch b/freed-ora/current/f20/mnt-Prevent-pivot_root-from-creating-a-loop-in-the-m.patch
new file mode 100644
index 000000000..0faadaf55
--- /dev/null
+++ b/freed-ora/current/f20/mnt-Prevent-pivot_root-from-creating-a-loop-in-the-m.patch
@@ -0,0 +1,44 @@
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Wed, 8 Oct 2014 10:42:27 -0700
+Subject: [PATCH] mnt: Prevent pivot_root from creating a loop in the mount
+ tree
+
+Andy Lutomirski recently demonstrated that when chroot is used to set
+the root path below the path for the new ``root'' passed to pivot_root
+the pivot_root system call succeeds and leaks mounts.
+
+In examining the code I see that starting with a new root that is
+below the current root in the mount tree will result in a loop in the
+mount tree after the mounts are detached and then reattached to one
+another.  Resulting in all kinds of ugliness including a leak of that
+mounts involved in the leak of the mount loop.
+
+Prevent this problem by ensuring that the new mount is reachable from
+the current root of the mount tree.
+
+Upstream-status: Submitted for 3.18
+Bugzilla: 1151095,1151484
+
+Reported-by: Andy Lutomirski <luto@amacapital.net>
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+---
+ fs/namespace.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/namespace.c b/fs/namespace.c
+index ef42d9bee212..74647c2fe69c 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -2820,6 +2820,9 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
+ 	/* make sure we can reach put_old from new_root */
+ 	if (!is_path_reachable(old_mnt, old.dentry, &new))
+ 		goto out4;
++	/* make certain new is below the root */
++	if (!is_path_reachable(new_mnt, new.dentry, &root))
++		goto out4;
+ 	root_mp->m_count++; /* pin it so it won't go away */
+ 	lock_mount_hash();
+ 	detach_mnt(new_mnt, &parent_path);
+-- 
+1.9.3
+
diff --git a/freed-ora/current/f20/sources b/freed-ora/current/f20/sources
index c8a023765..9c74cb5aa 100644
--- a/freed-ora/current/f20/sources
+++ b/freed-ora/current/f20/sources
@@ -1,3 +1,3 @@
 71e2d15b48e14db5a464424878362b42  linux-libre-3.16-gnu.tar.xz
 49868ce6467b35cd9ffea1120d129462  perf-man-3.16.tar.gz
-e0f930caadf77bf95ea4c9569dfbfaed  patch-3.16.5.xz
+c83d2b26c8282e91b227f6810beb332e  patch-3.16.6.xz