Linux v5.2.6

5 files changed, 345 insertions, 190 deletions

diff --git a/0001-Revert-for-bz-1737046.patch b/0001-Revert-for-bz-1737046.patch
new file mode 100644
index 000000000..1e49ab425
--- /dev/null
+++ b/0001-Revert-for-bz-1737046.patch
@@ -0,0 +1,192 @@
+From d3d7658459c214edc622022b0e1f1cfcabda5763 Mon Sep 17 00:00:00 2001
+From: Fedora Kernel Team <kernel-team@fedoraproject.org>
+Date: Mon, 5 Aug 2019 07:51:10 -0500
+Subject: [PATCH] Revert for bz 1737046
+
+---
+ drivers/pci/pci.c               | 29 +++++----------
+ drivers/pci/pci.h               |  1 -
+ drivers/pci/pcie/portdrv_core.c | 66 ---------------------------------
+ 3 files changed, 10 insertions(+), 86 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 720da09..088fcdc 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1004,10 +1004,15 @@ static void __pci_start_power_transition(struct pci_dev *dev, pci_power_t state)
+ 	if (state == PCI_D0) {
+ 		pci_platform_power_transition(dev, PCI_D0);
+ 		/*
+-		 * Mandatory power management transition delays are
+-		 * handled in the PCIe portdrv resume hooks.
++		 * Mandatory power management transition delays, see
++		 * PCI Express Base Specification Revision 2.0 Section
++		 * 6.6.1: Conventional Reset.  Do not delay for
++		 * devices powered on/off by corresponding bridge,
++		 * because have already delayed for the bridge.
+ 		 */
+ 		if (dev->runtime_d3cold) {
++			if (dev->d3cold_delay && !dev->imm_ready)
++				msleep(dev->d3cold_delay);
+ 			/*
+ 			 * When powering on a bridge from D3cold, the
+ 			 * whole hierarchy may be powered on into
+@@ -4570,16 +4575,14 @@ static int pci_pm_reset(struct pci_dev *dev, int probe)
+
+ 	return pci_dev_wait(dev, "PM D3->D0", PCIE_RESET_READY_POLL_MS);
+ }
+-
+ /**
+- * pcie_wait_for_link_delay - Wait until link is active or inactive
++ * pcie_wait_for_link - Wait until link is active or inactive
+  * @pdev: Bridge device
+  * @active: waiting for active or inactive?
+- * @delay: Delay to wait after link has become active (in ms)
+  *
+  * Use this to wait till link becomes active or inactive.
+  */
+-bool pcie_wait_for_link_delay(struct pci_dev *pdev, bool active, int delay)
++bool pcie_wait_for_link(struct pci_dev *pdev, bool active)
+ {
+ 	int timeout = 1000;
+ 	bool ret;
+@@ -4616,25 +4619,13 @@ bool pcie_wait_for_link_delay(struct pci_dev *pdev, bool active, int delay)
+ 		timeout -= 10;
+ 	}
+ 	if (active && ret)
+-		msleep(delay);
++		msleep(100);
+ 	else if (ret != active)
+ 		pci_info(pdev, "Data Link Layer Link Active not %s in 1000 msec\n",
+ 			active ? "set" : "cleared");
+ 	return ret == active;
+ }
+
+-/**
+- * pcie_wait_for_link - Wait until link is active or inactive
+- * @pdev: Bridge device
+- * @active: waiting for active or inactive?
+- *
+- * Use this to wait till link becomes active or inactive.
+- */
+-bool pcie_wait_for_link(struct pci_dev *pdev, bool active)
+-{
+-	return pcie_wait_for_link_delay(pdev, active, 100);
+-}
+-
+ void pci_reset_secondary_bus(struct pci_dev *dev)
+ {
+ 	u16 ctrl;
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index 59802b3..9cb9938 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -493,7 +493,6 @@ static inline int pci_dev_specific_disable_acs_redir(struct pci_dev *dev)
+ void pcie_do_recovery(struct pci_dev *dev, enum pci_channel_state state,
+ 		      u32 service);
+
+-bool pcie_wait_for_link_delay(struct pci_dev *pdev, bool active, int delay);
+ bool pcie_wait_for_link(struct pci_dev *pdev, bool active);
+ #ifdef CONFIG_PCIEASPM
+ void pcie_aspm_init_link_state(struct pci_dev *pdev);
+diff --git a/drivers/pci/pcie/portdrv_core.c b/drivers/pci/pcie/portdrv_core.c
+index 308c3e0..1b33012 100644
+--- a/drivers/pci/pcie/portdrv_core.c
++++ b/drivers/pci/pcie/portdrv_core.c
+@@ -9,7 +9,6 @@
+ #include <linux/module.h>
+ #include <linux/pci.h>
+ #include <linux/kernel.h>
+-#include <linux/delay.h>
+ #include <linux/errno.h>
+ #include <linux/pm.h>
+ #include <linux/pm_runtime.h>
+@@ -379,67 +378,6 @@ static int pm_iter(struct device *dev, void *data)
+ 	return 0;
+ }
+
+-static int get_downstream_delay(struct pci_bus *bus)
+-{
+-	struct pci_dev *pdev;
+-	int min_delay = 100;
+-	int max_delay = 0;
+-
+-	list_for_each_entry(pdev, &bus->devices, bus_list) {
+-		if (!pdev->imm_ready)
+-			min_delay = 0;
+-		else if (pdev->d3cold_delay < min_delay)
+-			min_delay = pdev->d3cold_delay;
+-		if (pdev->d3cold_delay > max_delay)
+-			max_delay = pdev->d3cold_delay;
+-	}
+-
+-	return max(min_delay, max_delay);
+-}
+-
+-/*
+- * wait_for_downstream_link - Wait for downstream link to establish
+- * @pdev: PCIe port whose downstream link is waited
+- *
+- * Handle delays according to PCIe 4.0 section 6.6.1 before configuration
+- * access to the downstream component is permitted.
+- *
+- * This blocks PCI core resume of the hierarchy below this port until the
+- * link is trained. Should be called before resuming port services to
+- * prevent pciehp from starting to tear-down the hierarchy too soon.
+- */
+-static void wait_for_downstream_link(struct pci_dev *pdev)
+-{
+-	int delay;
+-
+-	if (pci_pcie_type(pdev) != PCI_EXP_TYPE_ROOT_PORT &&
+-	    pci_pcie_type(pdev) != PCI_EXP_TYPE_DOWNSTREAM)
+-		return;
+-
+-	if (pci_dev_is_disconnected(pdev))
+-		return;
+-
+-	if (!pdev->subordinate || list_empty(&pdev->subordinate->devices) ||
+-	    !pdev->bridge_d3)
+-		return;
+-
+-	delay = get_downstream_delay(pdev->subordinate);
+-	if (!delay)
+-		return;
+-
+-	dev_dbg(&pdev->dev, "waiting downstream link for %d ms\n", delay);
+-
+-	/*
+-	 * If downstream port does not support speeds greater than 5 GT/s
+-	 * need to wait 100ms. For higher speeds (gen3) we need to wait
+-	 * first for the data link layer to become active.
+-	 */
+-	if (pcie_get_speed_cap(pdev) <= PCIE_SPEED_5_0GT)
+-		msleep(delay);
+-	else
+-		pcie_wait_for_link_delay(pdev, true, delay);
+-}
+-
+ /**
+  * pcie_port_device_suspend - suspend port services associated with a PCIe port
+  * @dev: PCI Express port to handle
+@@ -453,8 +391,6 @@ int pcie_port_device_suspend(struct device *dev)
+ int pcie_port_device_resume_noirq(struct device *dev)
+ {
+ 	size_t off = offsetof(struct pcie_port_service_driver, resume_noirq);
+-
+-	wait_for_downstream_link(to_pci_dev(dev));
+ 	return device_for_each_child(dev, &off, pm_iter);
+ }
+
+@@ -485,8 +421,6 @@ int pcie_port_device_runtime_suspend(struct device *dev)
+ int pcie_port_device_runtime_resume(struct device *dev)
+ {
+ 	size_t off = offsetof(struct pcie_port_service_driver, runtime_resume);
+-
+-	wait_for_downstream_link(to_pci_dev(dev));
+ 	return device_for_each_child(dev, &off, pm_iter);
+ }
+ #endif /* PM */
+-- 
+2.21.0
+
diff --git a/HID-input-fix-a4tech-horizontal-wheel-custom-usage.patch b/HID-input-fix-a4tech-horizontal-wheel-custom-usage.patch
new file mode 100644
index 000000000..df6a45999
--- /dev/null
+++ b/HID-input-fix-a4tech-horizontal-wheel-custom-usage.patch
@@ -0,0 +1,142 @@
+From mboxrd@z Thu Jan  1 00:00:00 1970
+Return-Path: <SRS0=TvG7=UK=vger.kernel.org=linux-kernel-owner@kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+X-Spam-Level: 
+X-Spam-Status: No, score=-8.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS,
+	INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,
+	USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0
+Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id 25464C4321A
+	for <linux-kernel@archiver.kernel.org>; Tue, 11 Jun 2019 12:13:29 +0000 (UTC)
+Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
+	by mail.kernel.org (Postfix) with ESMTP id 0217A206E0
+	for <linux-kernel@archiver.kernel.org>; Tue, 11 Jun 2019 12:13:29 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S2387819AbfFKMN1 (ORCPT
+        <rfc822;linux-kernel@archiver.kernel.org>);
+        Tue, 11 Jun 2019 08:13:27 -0400
+Received: from mx2.suse.de ([195.135.220.15]:44798 "EHLO mx1.suse.de"
+        rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP
+        id S2387538AbfFKMN1 (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
+        Tue, 11 Jun 2019 08:13:27 -0400
+X-Virus-Scanned: by amavisd-new at test-mx.suse.de
+Received: from relay2.suse.de (unknown [195.135.220.254])
+        by mx1.suse.de (Postfix) with ESMTP id 5E5D7B00C;
+        Tue, 11 Jun 2019 12:13:25 +0000 (UTC)
+From:   Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+To:     Jiri Kosina <jikos@kernel.org>,
+        Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Cc:     dmitry.torokhov@gmail.com, wbauer@tmo.at,
+        Nicolas Saenz Julienne <nsaenzjulienne@suse.de>,
+        linux-input@vger.kernel.org, linux-kernel@vger.kernel.org
+Subject: [PATCH v2] HID: input: fix a4tech horizontal wheel custom usage
+Date:   Tue, 11 Jun 2019 14:13:20 +0200
+Message-Id: <20190611121320.30267-1-nsaenzjulienne@suse.de>
+X-Mailer: git-send-email 2.21.0
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+Sender: linux-kernel-owner@vger.kernel.org
+Precedence: bulk
+List-ID: <linux-kernel.vger.kernel.org>
+X-Mailing-List: linux-kernel@vger.kernel.org
+Archived-At: <https://lore.kernel.org/lkml/20190611121320.30267-1-nsaenzjulienne@suse.de/>
+List-Archive: <https://lore.kernel.org/lkml/>
+List-Post: <mailto:linux-kernel@vger.kernel.org>
+
+Some a4tech mice use the 'GenericDesktop.00b8' usage to inform whether
+the previous wheel report was horizontal or vertical. Before
+c01908a14bf73 ("HID: input: add mapping for "Toggle Display" key") this
+usage was being mapped to 'Relative.Misc'. After the patch it's simply
+ignored (usage->type == 0 & usage->code == 0). Which ultimately makes
+hid-a4tech ignore the WHEEL/HWHEEL selection event, as it has no
+usage->type.
+
+We shouldn't rely on a mapping for that usage as it's nonstandard and
+doesn't really map to an input event. So we bypass the mapping and make
+sure the custom event handling properly handles both reports.
+
+Fixes: c01908a14bf73 ("HID: input: add mapping for "Toggle Display" key")
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+---
+
+NOTE: I CC'd Wolfgang as he's the one who can test this.
+
+Changes since v1:
+  - new approach, moved fix into hid-a4tech
+
+ drivers/hid/hid-a4tech.c | 30 +++++++++++++++++++++++++++---
+ 1 file changed, 27 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hid/hid-a4tech.c b/drivers/hid/hid-a4tech.c
+index 98bf694626f7..3a8c4a5971f7 100644
+--- a/drivers/hid/hid-a4tech.c
++++ b/drivers/hid/hid-a4tech.c
+@@ -23,12 +23,36 @@
+ #define A4_2WHEEL_MOUSE_HACK_7	0x01
+ #define A4_2WHEEL_MOUSE_HACK_B8	0x02
+ 
++#define A4_WHEEL_ORIENTATION	(HID_UP_GENDESK | 0x000000b8)
++
+ struct a4tech_sc {
+ 	unsigned long quirks;
+ 	unsigned int hw_wheel;
+ 	__s32 delayed_value;
+ };
+ 
++static int a4_input_mapping(struct hid_device *hdev, struct hid_input *hi,
++			    struct hid_field *field, struct hid_usage *usage,
++			    unsigned long **bit, int *max)
++{
++	struct a4tech_sc *a4 = hid_get_drvdata(hdev);
++
++	if (a4->quirks & A4_2WHEEL_MOUSE_HACK_B8 &&
++	    usage->hid == A4_WHEEL_ORIENTATION) {
++		/*
++		 * We do not want to have this usage mapped to anything as it's
++		 * nonstandard and doesn't really behave like an HID report.
++		 * It's only selecting the orientation (vertical/horizontal) of
++		 * the previous mouse wheel report. The input_events will be
++		 * generated once both reports are recorded in a4_event().
++		 */
++		return -1;
++	}
++
++	return 0;
++
++}
++
+ static int a4_input_mapped(struct hid_device *hdev, struct hid_input *hi,
+ 		struct hid_field *field, struct hid_usage *usage,
+ 		unsigned long **bit, int *max)
+@@ -52,8 +76,7 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field,
+ 	struct a4tech_sc *a4 = hid_get_drvdata(hdev);
+ 	struct input_dev *input;
+ 
+-	if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput ||
+-			!usage->type)
++	if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput)
+ 		return 0;
+ 
+ 	input = field->hidinput->input;
+@@ -64,7 +87,7 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field,
+ 			return 1;
+ 		}
+ 
+-		if (usage->hid == 0x000100b8) {
++		if (usage->hid == A4_WHEEL_ORIENTATION) {
+ 			input_event(input, EV_REL, value ? REL_HWHEEL :
+ 					REL_WHEEL, a4->delayed_value);
+ 			input_event(input, EV_REL, value ? REL_HWHEEL_HI_RES :
+@@ -131,6 +154,7 @@ MODULE_DEVICE_TABLE(hid, a4_devices);
+ static struct hid_driver a4_driver = {
+ 	.name = "a4tech",
+ 	.id_table = a4_devices,
++	.input_mapping = a4_input_mapping,
+ 	.input_mapped = a4_input_mapped,
+ 	.event = a4_event,
+ 	.probe = a4_probe,
+-- 
+2.21.0
+
+
diff --git a/bluetooth-hci_uart-check-for-missing-tty-operations.patch b/bluetooth-hci_uart-check-for-missing-tty-operations.patch
deleted file mode 100644
index 3250d7cb3..000000000
--- a/bluetooth-hci_uart-check-for-missing-tty-operations.patch
+++ /dev/null
@@ -1,186 +0,0 @@
-From mboxrd@z Thu Jan  1 00:00:00 1970
-Return-Path: <SRS0=cftP=V3=vger.kernel.org=linux-bluetooth-owner@kernel.org>
-X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
-	aws-us-west-2-korg-lkml-1.web.codeaurora.org
-X-Spam-Level: 
-X-Spam-Status: No, score=-9.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS,
-	INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,
-	USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0
-Received: from mail.kernel.org (mail.kernel.org [198.145.29.99])
-	by smtp.lore.kernel.org (Postfix) with ESMTP id 4E526C0650F
-	for <linux-bluetooth@archiver.kernel.org>; Tue, 30 Jul 2019 09:33:54 +0000 (UTC)
-Received: from vger.kernel.org (vger.kernel.org [209.132.180.67])
-	by mail.kernel.org (Postfix) with ESMTP id 2952A20665
-	for <linux-bluetooth@archiver.kernel.org>; Tue, 30 Jul 2019 09:33:54 +0000 (UTC)
-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
-        id S1731274AbfG3Jdt (ORCPT
-        <rfc822;linux-bluetooth@archiver.kernel.org>);
-        Tue, 30 Jul 2019 05:33:49 -0400
-Received: from coyote.holtmann.net ([212.227.132.17]:38637 "EHLO
-        mail.holtmann.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
-        with ESMTP id S1730931AbfG3Jdt (ORCPT
-        <rfc822;linux-bluetooth@vger.kernel.org>);
-        Tue, 30 Jul 2019 05:33:49 -0400
-Received: from localhost.localdomain (p5B3D2BA7.dip0.t-ipconnect.de [91.61.43.167])
-        by mail.holtmann.org (Postfix) with ESMTPSA id 75099CECFD;
-        Tue, 30 Jul 2019 11:42:25 +0200 (CEST)
-From:   Marcel Holtmann <marcel@holtmann.org>
-To:     torvalds@linux-foundation.org
-Cc:     linux-kernel@vger.kernel.org, linux-bluetooth@vger.kernel.org
-Subject: [PATCH v5.3-rc2] Bluetooth: hci_uart: check for missing tty operations
-Date:   Tue, 30 Jul 2019 11:33:45 +0200
-Message-Id: <20190730093345.25573-1-marcel@holtmann.org>
-X-Mailer: git-send-email 2.21.0
-MIME-Version: 1.0
-Content-Transfer-Encoding: 8bit
-Sender: linux-bluetooth-owner@vger.kernel.org
-Precedence: bulk
-List-ID: <linux-bluetooth.vger.kernel.org>
-X-Mailing-List: linux-bluetooth@vger.kernel.org
-Archived-At: <https://lore.kernel.org/linux-bluetooth/20190730093345.25573-1-marcel@holtmann.org/>
-List-Archive: <https://lore.kernel.org/linux-bluetooth/>
-List-Post: <mailto:linux-bluetooth@vger.kernel.org>
-
-From: Vladis Dronov <vdronov@redhat.com>
-
-Certain ttys operations (pty_unix98_ops) lack tiocmget() and tiocmset()
-functions which are called by the certain HCI UART protocols (hci_ath,
-hci_bcm, hci_intel, hci_mrvl, hci_qca) via hci_uart_set_flow_control()
-or directly. This leads to an execution at NULL and can be triggered by
-an unprivileged user. Fix this by adding a helper function and a check
-for the missing tty operations in the protocols code.
-
-This fixes CVE-2019-10207. The Fixes: lines list commits where calls to
-tiocm[gs]et() or hci_uart_set_flow_control() were added to the HCI UART
-protocols.
-
-Link: https://syzkaller.appspot.com/bug?id=1b42faa2848963564a5b1b7f8c837ea7b55ffa50
-Reported-by: syzbot+79337b501d6aa974d0f6@syzkaller.appspotmail.com
-Cc: stable@vger.kernel.org # v2.6.36+
-Fixes: b3190df62861 ("Bluetooth: Support for Atheros AR300x serial chip")
-Fixes: 118612fb9165 ("Bluetooth: hci_bcm: Add suspend/resume PM functions")
-Fixes: ff2895592f0f ("Bluetooth: hci_intel: Add Intel baudrate configuration support")
-Fixes: 162f812f23ba ("Bluetooth: hci_uart: Add Marvell support")
-Fixes: fa9ad876b8e0 ("Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990")
-Signed-off-by: Vladis Dronov <vdronov@redhat.com>
-Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
----
- drivers/bluetooth/hci_ath.c   |  3 +++
- drivers/bluetooth/hci_bcm.c   |  3 +++
- drivers/bluetooth/hci_intel.c |  3 +++
- drivers/bluetooth/hci_ldisc.c | 13 +++++++++++++
- drivers/bluetooth/hci_mrvl.c  |  3 +++
- drivers/bluetooth/hci_qca.c   |  3 +++
- drivers/bluetooth/hci_uart.h  |  1 +
- 7 files changed, 29 insertions(+)
-
-diff --git a/drivers/bluetooth/hci_ath.c b/drivers/bluetooth/hci_ath.c
-index a55be205b91a..dbfe34664633 100644
---- a/drivers/bluetooth/hci_ath.c
-+++ b/drivers/bluetooth/hci_ath.c
-@@ -98,6 +98,9 @@ static int ath_open(struct hci_uart *hu)
- 
- 	BT_DBG("hu %p", hu);
- 
-+	if (!hci_uart_has_flow_control(hu))
-+		return -EOPNOTSUPP;
-+
- 	ath = kzalloc(sizeof(*ath), GFP_KERNEL);
- 	if (!ath)
- 		return -ENOMEM;
-diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
-index 8905ad2edde7..ae2624fce913 100644
---- a/drivers/bluetooth/hci_bcm.c
-+++ b/drivers/bluetooth/hci_bcm.c
-@@ -406,6 +406,9 @@ static int bcm_open(struct hci_uart *hu)
- 
- 	bt_dev_dbg(hu->hdev, "hu %p", hu);
- 
-+	if (!hci_uart_has_flow_control(hu))
-+		return -EOPNOTSUPP;
-+
- 	bcm = kzalloc(sizeof(*bcm), GFP_KERNEL);
- 	if (!bcm)
- 		return -ENOMEM;
-diff --git a/drivers/bluetooth/hci_intel.c b/drivers/bluetooth/hci_intel.c
-index 207bae5e0d46..31f25153087d 100644
---- a/drivers/bluetooth/hci_intel.c
-+++ b/drivers/bluetooth/hci_intel.c
-@@ -391,6 +391,9 @@ static int intel_open(struct hci_uart *hu)
- 
- 	BT_DBG("hu %p", hu);
- 
-+	if (!hci_uart_has_flow_control(hu))
-+		return -EOPNOTSUPP;
-+
- 	intel = kzalloc(sizeof(*intel), GFP_KERNEL);
- 	if (!intel)
- 		return -ENOMEM;
-diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
-index 8950e07889fe..85a30fb9177b 100644
---- a/drivers/bluetooth/hci_ldisc.c
-+++ b/drivers/bluetooth/hci_ldisc.c
-@@ -292,6 +292,19 @@ static int hci_uart_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
- 	return 0;
- }
- 
-+/* Check the underlying device or tty has flow control support */
-+bool hci_uart_has_flow_control(struct hci_uart *hu)
-+{
-+	/* serdev nodes check if the needed operations are present */
-+	if (hu->serdev)
-+		return true;
-+
-+	if (hu->tty->driver->ops->tiocmget && hu->tty->driver->ops->tiocmset)
-+		return true;
-+
-+	return false;
-+}
-+
- /* Flow control or un-flow control the device */
- void hci_uart_set_flow_control(struct hci_uart *hu, bool enable)
- {
-diff --git a/drivers/bluetooth/hci_mrvl.c b/drivers/bluetooth/hci_mrvl.c
-index f98e5cc343b2..fbc3f7c3a5c7 100644
---- a/drivers/bluetooth/hci_mrvl.c
-+++ b/drivers/bluetooth/hci_mrvl.c
-@@ -59,6 +59,9 @@ static int mrvl_open(struct hci_uart *hu)
- 
- 	BT_DBG("hu %p", hu);
- 
-+	if (!hci_uart_has_flow_control(hu))
-+		return -EOPNOTSUPP;
-+
- 	mrvl = kzalloc(sizeof(*mrvl), GFP_KERNEL);
- 	if (!mrvl)
- 		return -ENOMEM;
-diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
-index 9a5c9c1f9484..82a0a3691a63 100644
---- a/drivers/bluetooth/hci_qca.c
-+++ b/drivers/bluetooth/hci_qca.c
-@@ -473,6 +473,9 @@ static int qca_open(struct hci_uart *hu)
- 
- 	BT_DBG("hu %p qca_open", hu);
- 
-+	if (!hci_uart_has_flow_control(hu))
-+		return -EOPNOTSUPP;
-+
- 	qca = kzalloc(sizeof(struct qca_data), GFP_KERNEL);
- 	if (!qca)
- 		return -ENOMEM;
-diff --git a/drivers/bluetooth/hci_uart.h b/drivers/bluetooth/hci_uart.h
-index f11af3912ce6..6ab631101019 100644
---- a/drivers/bluetooth/hci_uart.h
-+++ b/drivers/bluetooth/hci_uart.h
-@@ -104,6 +104,7 @@ int hci_uart_wait_until_sent(struct hci_uart *hu);
- int hci_uart_init_ready(struct hci_uart *hu);
- void hci_uart_init_work(struct work_struct *work);
- void hci_uart_set_baudrate(struct hci_uart *hu, unsigned int speed);
-+bool hci_uart_has_flow_control(struct hci_uart *hu);
- void hci_uart_set_flow_control(struct hci_uart *hu, bool enable);
- void hci_uart_set_speeds(struct hci_uart *hu, unsigned int init_speed,
- 			 unsigned int oper_speed);
--- 
-2.21.0
-
-
diff --git a/kernel.spec b/kernel.spec
index 05b037475..b4cd03ef3 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -56,7 +56,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 5
+%define stable_update 6
 # Set rpm version accordingly
 %if 0%{?stable_update}
 %define stablerev %{stable_update}
@@ -592,8 +592,11 @@ Patch532: 0001-dma-direct-correct-the-physical-addr-in-dma_direct_s.patch
 Patch533: for-v5.2-iwlwifi-mvm-disable-TX-AMSDU-on-older-NICs.patch
 Patch534: stable-v5.2-drm-i915-vbt-Fix-VBT-parsing-for-the-PSR-section.patch
 
-# CVE-2019-10207 rhbz 1733874 1734242
-Patch535: bluetooth-hci_uart-check-for-missing-tty-operations.patch
+# rhbz 1737046 temporary revert until issue is fixed upstream
+Patch535: 0001-Revert-for-bz-1737046.patch
+
+# rhbz 1730762
+Patch526: HID-input-fix-a4tech-horizontal-wheel-custom-usage.patch
 
 # END OF PATCH DEFINITIONS
 
@@ -1833,6 +1836,10 @@ fi
 #
 #
 %changelog
+* Mon Aug 05 2019 Justin M. Forbes <jforbes@fedoraproject.org> - 5.2.6-200
+- Linux v5.2.6
+- Temporary fixes for (rhbz 1737046 1730762)
+
 * Wed Jul 31 2019 Justin M. Forbes <jforbes@fedoraproject.org> - 5.2.5-200
 - Linux v5.2.5
 - Fix CVE-2019-10207 (rhbz 1733874 1734242)
diff --git a/sources b/sources
index 259209ef8..e1f422cc0 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 SHA512 (linux-5.2.tar.xz) = 5a28f8a34c4e0470617f5638b7112e6252109b78f23b1eed484a228530970c7ef5c130d6e5a09cf25ea2f6a0329602dcc1ec66ce893182e15b27d99bd228789c
-SHA512 (patch-5.2.5.xz) = 595336d715d2e22323caff20924e1a561c66c9dc2b88500008164a4d156a05d10757a17985a6f0bf47fe8a810608301bf705e66bd4e78f79d5d6afe3b3482e67
+SHA512 (patch-5.2.6.xz) = d3da691d721a0edf4f539ad991664234d4454b011b649534f28db2fcad489268eced46ebe697b2a350336ced8e0de6cd8ceed5e43361e3b0d4cc794caf3c62e4