--- /dev/null
+From 684524d35fe8d13be1f2649633e43bd02c96c695 Mon Sep 17 00:00:00 2001
+From: AceLan Kao <acelan.kao@canonical.com>
+Date: Wed, 2 Oct 2013 17:35:27 +0800
+Subject: HID: usbhid: quirk for SiS Touchscreen
+
+From: AceLan Kao <acelan.kao@canonical.com>
+
+commit 684524d35fe8d13be1f2649633e43bd02c96c695 upstream.
+
+BugLink: http://bugs.launchpad.net/bugs/1180881
+
+This device needs to be added to the quirks list with HID_QUIRK_NO_INIT_REPORTS,
+otherwise it causes 10 seconds timeout during report initialization.
+
+[12431.828467] hid-multitouch 0003:0457:1013.0475: usb_submit_urb(ctrl) failed: -1
+[12431.828507] hid-multitouch 0003:0457:1013.0475: timeout initializing reports
+
+Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/usbhid/hid-quirks.c | 1 +
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -915,4 +915,7 @@
+ #define USB_VENDOR_ID_PRIMAX 0x0461
+ #define USB_DEVICE_ID_PRIMAX_KEYBOARD 0x4e05
+
++#define USB_VENDOR_ID_SIS 0x0457
++#define USB_DEVICE_ID_SIS_TS 0x1013
++
+ #endif
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -114,6 +114,7 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS1, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, HID_QUIRK_NO_INIT_REPORTS },
++ { USB_VENDOR_ID_SIS, USB_DEVICE_ID_SIS_TS, HID_QUIRK_NO_INIT_REPORTS },
+
+ { 0, 0 }
+ };
--- /dev/null
+From 8171a67d587a09e14a4949a81e070345fedcf410 Mon Sep 17 00:00:00 2001
+From: AceLan Kao <acelan.kao@canonical.com>
+Date: Wed, 2 Oct 2013 17:35:26 +0800
+Subject: HID: usbhid: quirk for Synaptics Large Touchccreen
+
+From: AceLan Kao <acelan.kao@canonical.com>
+
+commit 8171a67d587a09e14a4949a81e070345fedcf410 upstream.
+
+BugLink: http://bugs.launchpad.net/bugs/1180881
+
+Synaptics large touchscreen doesn't support some of the report request
+while initializing. The unspoorted request will make the device unreachable,
+and will lead to the following usb_submit_urb() function call timeout.
+So, add the IDs into HID_QUIRK_NO_INIT_REPORTS quirk.
+
+Signed-off-by: AceLan Kao <acelan.kao@canonical.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-ids.h | 2 ++
+ drivers/hid/usbhid/hid-quirks.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -786,6 +786,8 @@
+ #define USB_DEVICE_ID_SYNAPTICS_COMP_TP 0x0009
+ #define USB_DEVICE_ID_SYNAPTICS_WTP 0x0010
+ #define USB_DEVICE_ID_SYNAPTICS_DPAD 0x0013
++#define USB_DEVICE_ID_SYNAPTICS_LTS1 0x0af8
++#define USB_DEVICE_ID_SYNAPTICS_LTS2 0x1d10
+
+ #define USB_VENDOR_ID_THINGM 0x27b8
+ #define USB_DEVICE_ID_BLINK1 0x01ed
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -112,6 +112,8 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
++ { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS1, HID_QUIRK_NO_INIT_REPORTS },
++ { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, HID_QUIRK_NO_INIT_REPORTS },
+
+ { 0, 0 }
+ };
--- /dev/null
+From bcd2623073e98f69f84720308db0b142c4da0bd6 Mon Sep 17 00:00:00 2001
+From: Tom Gundersen <teg@jklm.no>
+Date: Thu, 31 Oct 2013 00:38:30 -0700
+Subject: Input: allow deselecting serio drivers even without CONFIG_EXPERT
+
+From: Tom Gundersen <teg@jklm.no>
+
+commit bcd2623073e98f69f84720308db0b142c4da0bd6 upstream.
+
+There is plenty of consumer hardware (e.g., mac books) that does not use AT
+keyboards or PS/2 mice. It therefore makes sense for distro kernels to
+build the related drivers as modules to avoid loading them on hardware that
+does not need them. As such, these options should no longer be protected by
+EXPERT.
+
+Moreover, building these drivers as modules gets rid of the following ugly
+error during boot:
+
+[ 2.337745] i8042: PNP: No PS/2 controller found. Probing ports directly.
+[ 3.439537] i8042: No controller found
+
+Signed-off-by: Tom Gundersen <teg@jklm.no>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/keyboard/Kconfig | 4 ++--
+ drivers/input/serio/Kconfig | 6 +++---
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/input/keyboard/Kconfig
++++ b/drivers/input/keyboard/Kconfig
+@@ -2,7 +2,7 @@
+ # Input core configuration
+ #
+ menuconfig INPUT_KEYBOARD
+- bool "Keyboards" if EXPERT || !X86
++ bool "Keyboards"
+ default y
+ help
+ Say Y here, and a list of supported keyboards will be displayed.
+@@ -67,7 +67,7 @@ config KEYBOARD_ATARI
+ module will be called atakbd.
+
+ config KEYBOARD_ATKBD
+- tristate "AT keyboard" if EXPERT || !X86
++ tristate "AT keyboard"
+ default y
+ select SERIO
+ select SERIO_LIBPS2
+--- a/drivers/input/serio/Kconfig
++++ b/drivers/input/serio/Kconfig
+@@ -2,7 +2,7 @@
+ # Input core configuration
+ #
+ config SERIO
+- tristate "Serial I/O support" if EXPERT || !X86
++ tristate "Serial I/O support"
+ default y
+ help
+ Say Yes here if you have any input device that uses serial I/O to
+@@ -19,7 +19,7 @@ config SERIO
+ if SERIO
+
+ config SERIO_I8042
+- tristate "i8042 PC Keyboard controller" if EXPERT || !X86
++ tristate "i8042 PC Keyboard controller"
+ default y
+ depends on !PARISC && (!ARM || ARCH_SHARK || FOOTBRIDGE_HOST) && \
+ (!SUPERH || SH_CAYMAN) && !M68K && !BLACKFIN && !S390
+@@ -169,7 +169,7 @@ config SERIO_MACEPS2
+ module will be called maceps2.
+
+ config SERIO_LIBPS2
+- tristate "PS/2 driver library" if EXPERT
++ tristate "PS/2 driver library"
+ depends on SERIO_I8042 || SERIO_I8042=n
+ help
+ Say Y here if you are using a driver for device connected
--- /dev/null
+From dfaaed08ecc01bd513248ba7999daf50ce028352 Mon Sep 17 00:00:00 2001
+From: Tom Gundersen <teg@jklm.no>
+Date: Thu, 31 Oct 2013 00:44:49 -0700
+Subject: Input: mousedev - allow disabling even without CONFIG_EXPERT
+
+From: Tom Gundersen <teg@jklm.no>
+
+commit dfaaed08ecc01bd513248ba7999daf50ce028352 upstream.
+
+Moust (if not all) modern software, including X, uses /dev/eventX rather than
+the legacy /dev/mouseX devices. It therefore makes sense for general-purpose
+(distro) kernels to use MOUSEDV=m (or even n), so let's drop the EXPERT=y
+requirement.
+
+Signed-off-by: Tom Gundersen <teg@jklm.no>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/Kconfig
++++ b/drivers/input/Kconfig
+@@ -80,7 +80,7 @@ config INPUT_MATRIXKMAP
+ comment "Userland interfaces"
+
+ config INPUT_MOUSEDEV
+- tristate "Mouse interface" if EXPERT
++ tristate "Mouse interface"
+ default y
+ help
+ Say Y here if you want your mouse to be accessible as char devices
--- /dev/null
+From f6b129527ca15bae29ffb9417ddaa1c9d99ffc5d Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Tue, 15 Oct 2013 22:04:54 +0300
+Subject: iwlwifi: dvm: don't override mac80211's queue setting
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+commit f6b129527ca15bae29ffb9417ddaa1c9d99ffc5d upstream.
+
+Since we set IEEE80211_HW_QUEUE_CONTROL, we can let
+mac80211 do the queue assignement and don't need to
+override its decisions.
+While reassiging the same values is harmless of course,
+it triggered a WARNING when iwlwifi and mac80211 came
+to different conclusions. This happened when mac80211 set
+IEEE80211_TX_CTL_SEND_AFTER_DTIM, but didn't route the
+packet to the cab_queue because no stations were asleep.
+
+iwlwifi should not override mac80211's decicions for
+offchannel packets and packets to be sent after DTIM,
+but it should override mac80211's decision for AMPDUs
+since we have a special queue for them. So for AMPDU,
+we still override info->hw_queue by the AMPDU queue.
+
+This avoids:
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 2531 at drivers/net/wireless/iwlwifi/dvm/tx.c:456 iwlagn_tx_skb+0x6c5/0x883()
+Modules linked in:
+CPU: 0 PID: 2531 Comm: hostapd Not tainted 3.12.0-rc5+ #1
+Hardware name: /D53427RKE, BIOS RKPPT10H.86A.0017.2013.0425.1251 04/25/2013
+ 0000000000000000 0000000000000009 ffffffff8189aa62 0000000000000000
+ ffffffff8105a4f2 ffff880058339a48 ffffffff815f8a04 0000000000000000
+ ffff8800560097b0 0000000000000208 0000000000000000 ffff8800561a9e5e
+Call Trace:
+ [<ffffffff8189aa62>] ? dump_stack+0x41/0x51
+ [<ffffffff8105a4f2>] ? warn_slowpath_common+0x78/0x90
+ [<ffffffff815f8a04>] ? iwlagn_tx_skb+0x6c5/0x883
+ [<ffffffff815f8a04>] ? iwlagn_tx_skb+0x6c5/0x883
+ [<ffffffff818a0040>] ? put_cred+0x15/0x15
+ [<ffffffff815f6db4>] ? iwlagn_mac_tx+0x19/0x2f
+ [<ffffffff8186cc45>] ? __ieee80211_tx+0x226/0x29b
+ [<ffffffff8186e6bd>] ? ieee80211_tx+0xa6/0xb5
+ [<ffffffff8186e98b>] ? ieee80211_monitor_start_xmit+0x1e9/0x204
+ [<ffffffff8171ce5f>] ? dev_hard_start_xmit+0x271/0x3ec
+ [<ffffffff817351ac>] ? sch_direct_xmit+0x66/0x164
+ [<ffffffff8171d1bf>] ? dev_queue_xmit+0x1e5/0x3c8
+ [<ffffffff817fac5a>] ? packet_sendmsg+0xac5/0xb3d
+ [<ffffffff81709a09>] ? sock_sendmsg+0x37/0x52
+ [<ffffffff810f9e0c>] ? __do_fault+0x338/0x36b
+ [<ffffffff81713820>] ? verify_iovec+0x44/0x94
+ [<ffffffff81709e63>] ? ___sys_sendmsg+0x1f1/0x283
+ [<ffffffff81140a73>] ? __inode_wait_for_writeback+0x67/0xae
+ [<ffffffff8111735e>] ? __cache_free.isra.46+0x178/0x187
+ [<ffffffff811173b1>] ? kmem_cache_free+0x44/0x84
+ [<ffffffff81132c22>] ? dentry_kill+0x13d/0x149
+ [<ffffffff81132f6f>] ? dput+0xe5/0xef
+ [<ffffffff81136e04>] ? fget_light+0x2e/0x7c
+ [<ffffffff8170ae62>] ? __sys_sendmsg+0x39/0x57
+ [<ffffffff818a7e39>] ? system_call_fastpath+0x16/0x1b
+---[ end trace 1b3eb79359c1d1e6 ]---
+
+Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
+Reviewed-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/dvm/tx.c | 14 +++-----------
+ 1 file changed, 3 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
++++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
+@@ -445,27 +445,19 @@ int iwlagn_tx_skb(struct iwl_priv *priv,
+ /* Copy MAC header from skb into command buffer */
+ memcpy(tx_cmd->hdr, hdr, hdr_len);
+
++ txq_id = info->hw_queue;
++
+ if (is_agg)
+ txq_id = priv->tid_data[sta_id][tid].agg.txq_id;
+ else if (info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM) {
+ /*
+- * Send this frame after DTIM -- there's a special queue
+- * reserved for this for contexts that support AP mode.
+- */
+- txq_id = ctx->mcast_queue;
+-
+- /*
+ * The microcode will clear the more data
+ * bit in the last frame it transmits.
+ */
+ hdr->frame_control |=
+ cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+- } else if (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN)
+- txq_id = IWL_AUX_QUEUE;
+- else
+- txq_id = ctx->ac_to_queue[skb_get_queue_mapping(skb)];
++ }
+
+- WARN_ON_ONCE(!is_agg && txq_id != info->hw_queue);
+ WARN_ON_ONCE(is_agg &&
+ priv->queue_to_mac80211[txq_id] != info->hw_queue);
+
--- /dev/null
+From 674470d97958a0ec72f72caf7f6451da40159cc7 Mon Sep 17 00:00:00 2001
+From: Joonyoung Shim <jy0922.shim@samsung.com>
+Date: Wed, 11 Sep 2013 14:21:43 -0700
+Subject: lib/genalloc.c: fix overflow of ending address of memory chunk
+
+From: Joonyoung Shim <jy0922.shim@samsung.com>
+
+commit 674470d97958a0ec72f72caf7f6451da40159cc7 upstream.
+
+In struct gen_pool_chunk, end_addr means the end address of memory chunk
+(inclusive), but in the implementation it is treated as address + size of
+memory chunk (exclusive), so it points to the address plus one instead of
+correct ending address.
+
+The ending address of memory chunk plus one will cause overflow on the
+memory chunk including the last address of memory map, e.g. when starting
+address is 0xFFF00000 and size is 0x100000 on 32bit machine, ending
+address will be 0x100000000.
+
+Use correct ending address like starting address + size - 1.
+
+[akpm@linux-foundation.org: add comment to struct gen_pool_chunk:end_addr]
+Signed-off-by: Joonyoung Shim <jy0922.shim@samsung.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Jonghwan Choi <jhbird.choi@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/genalloc.h | 4 ++--
+ lib/genalloc.c | 19 ++++++++++++-------
+ 2 files changed, 14 insertions(+), 9 deletions(-)
+
+--- a/include/linux/genalloc.h
++++ b/include/linux/genalloc.h
+@@ -66,8 +66,8 @@ struct gen_pool_chunk {
+ struct list_head next_chunk; /* next chunk in pool */
+ atomic_t avail;
+ phys_addr_t phys_addr; /* physical starting address of memory chunk */
+- unsigned long start_addr; /* starting address of memory chunk */
+- unsigned long end_addr; /* ending address of memory chunk */
++ unsigned long start_addr; /* start address of memory chunk */
++ unsigned long end_addr; /* end address of memory chunk (inclusive) */
+ unsigned long bits[0]; /* bitmap for allocating memory chunk */
+ };
+
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -37,6 +37,11 @@
+ #include <linux/of_address.h>
+ #include <linux/of_device.h>
+
++static inline size_t chunk_size(const struct gen_pool_chunk *chunk)
++{
++ return chunk->end_addr - chunk->start_addr + 1;
++}
++
+ static int set_bits_ll(unsigned long *addr, unsigned long mask_to_set)
+ {
+ unsigned long val, nval;
+@@ -188,7 +193,7 @@ int gen_pool_add_virt(struct gen_pool *p
+
+ chunk->phys_addr = phys;
+ chunk->start_addr = virt;
+- chunk->end_addr = virt + size;
++ chunk->end_addr = virt + size - 1;
+ atomic_set(&chunk->avail, size);
+
+ spin_lock(&pool->lock);
+@@ -213,7 +218,7 @@ phys_addr_t gen_pool_virt_to_phys(struct
+
+ rcu_read_lock();
+ list_for_each_entry_rcu(chunk, &pool->chunks, next_chunk) {
+- if (addr >= chunk->start_addr && addr < chunk->end_addr) {
++ if (addr >= chunk->start_addr && addr <= chunk->end_addr) {
+ paddr = chunk->phys_addr + (addr - chunk->start_addr);
+ break;
+ }
+@@ -242,7 +247,7 @@ void gen_pool_destroy(struct gen_pool *p
+ chunk = list_entry(_chunk, struct gen_pool_chunk, next_chunk);
+ list_del(&chunk->next_chunk);
+
+- end_bit = (chunk->end_addr - chunk->start_addr) >> order;
++ end_bit = chunk_size(chunk) >> order;
+ bit = find_next_bit(chunk->bits, end_bit, 0);
+ BUG_ON(bit < end_bit);
+
+@@ -283,7 +288,7 @@ unsigned long gen_pool_alloc(struct gen_
+ if (size > atomic_read(&chunk->avail))
+ continue;
+
+- end_bit = (chunk->end_addr - chunk->start_addr) >> order;
++ end_bit = chunk_size(chunk) >> order;
+ retry:
+ start_bit = pool->algo(chunk->bits, end_bit, start_bit, nbits,
+ pool->data);
+@@ -330,8 +335,8 @@ void gen_pool_free(struct gen_pool *pool
+ nbits = (size + (1UL << order) - 1) >> order;
+ rcu_read_lock();
+ list_for_each_entry_rcu(chunk, &pool->chunks, next_chunk) {
+- if (addr >= chunk->start_addr && addr < chunk->end_addr) {
+- BUG_ON(addr + size > chunk->end_addr);
++ if (addr >= chunk->start_addr && addr <= chunk->end_addr) {
++ BUG_ON(addr + size - 1 > chunk->end_addr);
+ start_bit = (addr - chunk->start_addr) >> order;
+ remain = bitmap_clear_ll(chunk->bits, start_bit, nbits);
+ BUG_ON(remain);
+@@ -400,7 +405,7 @@ size_t gen_pool_size(struct gen_pool *po
+
+ rcu_read_lock();
+ list_for_each_entry_rcu(chunk, &pool->chunks, next_chunk)
+- size += chunk->end_addr - chunk->start_addr;
++ size += chunk_size(chunk);
+ rcu_read_unlock();
+ return size;
+ }
net-update-consumers-of-msg_more-to-recognize-msg_sendpage_notlast.patch
x86-64-build-always-pass-in-mno-sse.patch
scsi-disable-write-same-for-raid-and-virtual-host-adapter-drivers.patch
+iwlwifi-dvm-don-t-override-mac80211-s-queue-setting.patch
+tg3-avoid-double-freeing-of-rx-data-memory.patch
+hid-usbhid-quirk-for-synaptics-large-touchccreen.patch
+hid-usbhid-quirk-for-sis-touchscreen.patch
+lib-genalloc.c-fix-overflow-of-ending-address-of-memory-chunk.patch
+input-allow-deselecting-serio-drivers-even-without-config_expert.patch
+input-mousedev-allow-disabling-even-without-config_expert.patch
--- /dev/null
+From 85aec73d595b8847f9c4ea571deb127913f0d508 Mon Sep 17 00:00:00 2001
+From: Ivan Vecera <ivecera@redhat.com>
+Date: Wed, 6 Nov 2013 14:02:36 +0100
+Subject: tg3: avoid double-freeing of rx data memory
+
+From: Ivan Vecera <ivecera@redhat.com>
+
+commit 85aec73d595b8847f9c4ea571deb127913f0d508 upstream.
+
+If build_skb fails the memory associated with the ring buffer is freed but
+the ri->data member is not zeroed in this case. This causes a double-free
+of this memory in tg3_free_rings->... path. The patch moves this block after
+setting ri->data to NULL.
+It would be nice to fix this bug also in stable >= v3.4 trees.
+
+Cc: Nithin Nayak Sujir <nsujir@broadcom.com>
+Cc: Michael Chan <mchan@broadcom.com>
+Signed-off-by: Ivan Vecera <ivecera@redhat.com>
+Acked-by: Michael Chan <mchan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/broadcom/tg3.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -6722,12 +6722,6 @@ static int tg3_rx(struct tg3_napi *tnapi
+ pci_unmap_single(tp->pdev, dma_addr, skb_size,
+ PCI_DMA_FROMDEVICE);
+
+- skb = build_skb(data, frag_size);
+- if (!skb) {
+- tg3_frag_free(frag_size != 0, data);
+- goto drop_it_no_recycle;
+- }
+- skb_reserve(skb, TG3_RX_OFFSET(tp));
+ /* Ensure that the update to the data happens
+ * after the usage of the old DMA mapping.
+ */
+@@ -6735,6 +6729,12 @@ static int tg3_rx(struct tg3_napi *tnapi
+
+ ri->data = NULL;
+
++ skb = build_skb(data, frag_size);
++ if (!skb) {
++ tg3_frag_free(frag_size != 0, data);
++ goto drop_it_no_recycle;
++ }
++ skb_reserve(skb, TG3_RX_OFFSET(tp));
+ } else {
+ tg3_recycle_rx(tnapi, tpr, opaque_key,
+ desc_idx, *post_ptr);