--- /dev/null
+From 18c4078489fe064cc0ed08be3381cf2f26657f5f Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 1 Oct 2009 07:46:33 +0200
+Subject: ALSA: Don't assume i2c device probing always succeeds
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 18c4078489fe064cc0ed08be3381cf2f26657f5f upstream.
+
+The client->driver pointer can be NULL when i2c-device probing fails
+in i2c_new_device(). This patch adds the NULL checks for client->driver
+and return the error instead of blind assumption of driver availability.
+
+Reported-by: Tim Shepard <shep@alum.mit.edu>
+Cc: Jean Delvare <khali@linux-fr.org>
+Cc: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/sound/aoa/codecs/tas.c
++++ b/sound/aoa/codecs/tas.c
+@@ -897,6 +897,15 @@ static int tas_create(struct i2c_adapter *adapter,
+ client = i2c_new_device(adapter, &info);
+ if (!client)
+ return -ENODEV;
++ /*
++ * We know the driver is already loaded, so the device should be
++ * already bound. If not it means binding failed, and then there
++ * is no point in keeping the device instantiated.
++ */
++ if (!client->driver) {
++ i2c_unregister_device(client);
++ return -ENODEV;
++ }
+
+ /*
+ * Let i2c-core delete that device on driver removal.
+diff --git a/sound/ppc/keywest.c b/sound/ppc/keywest.c
+index 835fa19..bb6819a 100644
+--- a/sound/ppc/keywest.c
++++ b/sound/ppc/keywest.c
+@@ -59,6 +59,18 @@ static int keywest_attach_adapter(struct i2c_adapter *adapter)
+ strlcpy(info.type, "keywest", I2C_NAME_SIZE);
+ info.addr = keywest_ctx->addr;
+ keywest_ctx->client = i2c_new_device(adapter, &info);
++ if (!keywest_ctx->client)
++ return -ENODEV;
++ /*
++ * We know the driver is already loaded, so the device should be
++ * already bound. If not it means binding failed, and then there
++ * is no point in keeping the device instantiated.
++ */
++ if (!keywest_ctx->client->driver) {
++ i2c_unregister_device(keywest_ctx->client);
++ keywest_ctx->client = NULL;
++ return -ENODEV;
++ }
+
+ /*
+ * Let i2c-core delete that device on driver removal.
--- /dev/null
+From 9eba32b86d17ef87131fa0bce43c614904ab5781 Mon Sep 17 00:00:00 2001
+From: Marcel Holtmann <marcel@holtmann.org>
+Date: Sat, 22 Aug 2009 14:19:26 -0700
+Subject: Bluetooth: Add extra device reference counting for connections
+
+From: Marcel Holtmann <marcel@holtmann.org>
+
+commit 9eba32b86d17ef87131fa0bce43c614904ab5781 upstream.
+
+The device model itself has no real usable reference counting at the
+moment and this causes problems if parents are deleted before their
+children. The device model itself handles the memory details of this
+correctly, but the uevent order is not consistent. This causes various
+problems for systems like HAL or even X.
+
+So until device_put() does a proper cleanup, the device for Bluetooth
+connection will be protected with an extra reference counting to ensure
+the correct order of uevents when connections are terminated.
+
+This is not an automatic feature. Higher Bluetooth layers like HIDP or
+BNEP should grab this new reference to ensure that their uevents are
+send before the ones from the parent device.
+
+Based on a report by Brian Rogers <brian@xyzw.org>
+
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ include/net/bluetooth/hci_core.h | 4 ++++
+ net/bluetooth/hci_conn.c | 17 ++++++++++++++++-
+ net/bluetooth/hci_event.c | 2 ++
+ 3 files changed, 22 insertions(+), 1 deletion(-)
+
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -187,6 +187,7 @@ struct hci_conn {
+ struct work_struct work_del;
+
+ struct device dev;
++ atomic_t devref;
+
+ struct hci_dev *hdev;
+ void *l2cap_data;
+@@ -339,6 +340,9 @@ int hci_conn_switch_role(struct hci_conn
+ void hci_conn_enter_active_mode(struct hci_conn *conn);
+ void hci_conn_enter_sniff_mode(struct hci_conn *conn);
+
++void hci_conn_hold_device(struct hci_conn *conn);
++void hci_conn_put_device(struct hci_conn *conn);
++
+ static inline void hci_conn_hold(struct hci_conn *conn)
+ {
+ atomic_inc(&conn->refcnt);
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -246,6 +246,8 @@ struct hci_conn *hci_conn_add(struct hci
+ if (hdev->notify)
+ hdev->notify(hdev, HCI_NOTIFY_CONN_ADD);
+
++ atomic_set(&conn->devref, 0);
++
+ hci_conn_init_sysfs(conn);
+
+ tasklet_enable(&hdev->tx_task);
+@@ -288,7 +290,7 @@ int hci_conn_del(struct hci_conn *conn)
+
+ skb_queue_purge(&conn->data_q);
+
+- hci_conn_del_sysfs(conn);
++ hci_conn_put_device(conn);
+
+ hci_dev_put(hdev);
+
+@@ -583,6 +585,19 @@ void hci_conn_check_pending(struct hci_d
+ hci_dev_unlock(hdev);
+ }
+
++void hci_conn_hold_device(struct hci_conn *conn)
++{
++ atomic_inc(&conn->devref);
++}
++EXPORT_SYMBOL(hci_conn_hold_device);
++
++void hci_conn_put_device(struct hci_conn *conn)
++{
++ if (atomic_dec_and_test(&conn->devref))
++ hci_conn_del_sysfs(conn);
++}
++EXPORT_SYMBOL(hci_conn_put_device);
++
+ int hci_get_conn_list(void __user *arg)
+ {
+ struct hci_conn_list_req req, *cl;
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -887,6 +887,7 @@ static inline void hci_conn_complete_evt
+ } else
+ conn->state = BT_CONNECTED;
+
++ hci_conn_hold_device(conn);
+ hci_conn_add_sysfs(conn);
+
+ if (test_bit(HCI_AUTH, &hdev->flags))
+@@ -1693,6 +1694,7 @@ static inline void hci_sync_conn_complet
+ conn->handle = __le16_to_cpu(ev->handle);
+ conn->state = BT_CONNECTED;
+
++ hci_conn_hold_device(conn);
+ hci_conn_add_sysfs(conn);
+ break;
+
--- /dev/null
+From 364f63519d94442ed373ac7da79033c8282df46a Mon Sep 17 00:00:00 2001
+From: Marcel Holtmann <marcel@holtmann.org>
+Date: Sat, 22 Aug 2009 14:15:53 -0700
+Subject: Bluetooth: Disconnect HIDRAW devices on disconnect
+
+From: Marcel Holtmann <marcel@holtmann.org>
+
+commit 364f63519d94442ed373ac7da79033c8282df46a upstream.
+
+Currently the HID subsystem will create HIDRAW devices for the transport
+driver, but it will not disconnect them. Until the HID subsytem gets
+fixed, ensure that HIDRAW and HIDDEV devices are disconnected when the
+Bluetooth HID device gets removed.
+
+Based on a patch from Brian Rogers <brian@xyzw.org>
+
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/bluetooth/hidp/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/bluetooth/hidp/core.c
++++ b/net/bluetooth/hidp/core.c
+@@ -40,6 +40,7 @@
+
+ #include <linux/input.h>
+ #include <linux/hid.h>
++#include <linux/hidraw.h>
+
+ #include <net/bluetooth/bluetooth.h>
+ #include <net/bluetooth/hci_core.h>
+@@ -573,6 +574,8 @@ static int hidp_session(void *arg)
+ if (session->hid) {
+ if (session->hid->claimed & HID_CLAIMED_INPUT)
+ hidinput_disconnect(session->hid);
++ if (session->hid->claimed & HID_CLAIMED_HIDRAW)
++ hidraw_disconnect(session->hid);
+ hid_destroy_device(session->hid);
+ }
+
--- /dev/null
+From edad63886993d18ab800c49f6587a93432ef8b35 Mon Sep 17 00:00:00 2001
+From: Marcel Holtmann <marcel@holtmann.org>
+Date: Sat, 22 Aug 2009 14:22:15 -0700
+Subject: Bluetooth: Let HIDP grab the device reference for connections
+
+From: Marcel Holtmann <marcel@holtmann.org>
+
+commit edad63886993d18ab800c49f6587a93432ef8b35 upstream.
+
+The core exports the hci_conn_hold_device() and hci_conn_put_device()
+functions for device reference of connections. Use this to ensure that
+the uevents from the parent are send after the child ones.
+
+Based on a report by Brian Rogers <brian@xyzw.org>
+
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/bluetooth/hidp/core.c | 62 ++++++++++++++++++++++++++++++----------------
+ net/bluetooth/hidp/hidp.h | 2 +
+ 2 files changed, 43 insertions(+), 21 deletions(-)
+
+--- a/net/bluetooth/hidp/core.c
++++ b/net/bluetooth/hidp/core.c
+@@ -93,10 +93,14 @@ static void __hidp_link_session(struct h
+ {
+ __module_get(THIS_MODULE);
+ list_add(&session->list, &hidp_session_list);
++
++ hci_conn_hold_device(session->conn);
+ }
+
+ static void __hidp_unlink_session(struct hidp_session *session)
+ {
++ hci_conn_put_device(session->conn);
++
+ list_del(&session->list);
+ module_put(THIS_MODULE);
+ }
+@@ -576,7 +580,9 @@ static int hidp_session(void *arg)
+ hidinput_disconnect(session->hid);
+ if (session->hid->claimed & HID_CLAIMED_HIDRAW)
+ hidraw_disconnect(session->hid);
++
+ hid_destroy_device(session->hid);
++ session->hid = NULL;
+ }
+
+ /* Wakeup user-space polling for socket errors */
+@@ -604,25 +610,27 @@ static struct device *hidp_get_device(st
+ {
+ bdaddr_t *src = &bt_sk(session->ctrl_sock->sk)->src;
+ bdaddr_t *dst = &bt_sk(session->ctrl_sock->sk)->dst;
++ struct device *device = NULL;
+ struct hci_dev *hdev;
+- struct hci_conn *conn;
+
+ hdev = hci_get_route(dst, src);
+ if (!hdev)
+ return NULL;
+
+- conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
++ session->conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
++ if (session->conn)
++ device = &session->conn->dev;
+
+ hci_dev_put(hdev);
+
+- return conn ? &conn->dev : NULL;
++ return device;
+ }
+
+ static int hidp_setup_input(struct hidp_session *session,
+ struct hidp_connadd_req *req)
+ {
+ struct input_dev *input;
+- int i;
++ int err, i;
+
+ input = input_allocate_device();
+ if (!input)
+@@ -669,7 +677,13 @@ static int hidp_setup_input(struct hidp_
+
+ input->event = hidp_input_event;
+
+- return input_register_device(input);
++ err = input_register_device(input);
++ if (err < 0) {
++ hci_conn_put_device(session->conn);
++ return err;
++ }
++
++ return 0;
+ }
+
+ static int hidp_open(struct hid_device *hid)
+@@ -751,13 +765,11 @@ static int hidp_setup_hid(struct hidp_se
+ {
+ struct hid_device *hid;
+ bdaddr_t src, dst;
+- int ret;
++ int err;
+
+ hid = hid_allocate_device();
+- if (IS_ERR(hid)) {
+- ret = PTR_ERR(session->hid);
+- goto err;
+- }
++ if (IS_ERR(hid))
++ return PTR_ERR(session->hid);
+
+ session->hid = hid;
+ session->req = req;
+@@ -779,16 +791,17 @@ static int hidp_setup_hid(struct hidp_se
+ hid->dev.parent = hidp_get_device(session);
+ hid->ll_driver = &hidp_hid_driver;
+
+- ret = hid_add_device(hid);
+- if (ret)
+- goto err_hid;
++ err = hid_add_device(hid);
++ if (err < 0)
++ goto failed;
+
+ return 0;
+-err_hid:
++
++failed:
+ hid_destroy_device(hid);
+ session->hid = NULL;
+-err:
+- return ret;
++
++ return err;
+ }
+
+ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock, struct socket *intr_sock)
+@@ -838,13 +851,13 @@ int hidp_add_connection(struct hidp_conn
+ if (req->rd_size > 0) {
+ err = hidp_setup_hid(session, req);
+ if (err && err != -ENODEV)
+- goto err_skb;
++ goto purge;
+ }
+
+ if (!session->hid) {
+ err = hidp_setup_input(session, req);
+ if (err < 0)
+- goto err_skb;
++ goto purge;
+ }
+
+ __hidp_link_session(session);
+@@ -872,13 +885,20 @@ unlink:
+
+ __hidp_unlink_session(session);
+
+- if (session->input)
++ if (session->input) {
+ input_unregister_device(session->input);
+- if (session->hid)
++ session->input = NULL;
++ }
++
++ if (session->hid) {
+ hid_destroy_device(session->hid);
+-err_skb:
++ session->hid = NULL;
++ }
++
++purge:
+ skb_queue_purge(&session->ctrl_transmit);
+ skb_queue_purge(&session->intr_transmit);
++
+ failed:
+ up_write(&hidp_session_sem);
+
+--- a/net/bluetooth/hidp/hidp.h
++++ b/net/bluetooth/hidp/hidp.h
+@@ -126,6 +126,8 @@ int hidp_get_conninfo(struct hidp_connin
+ struct hidp_session {
+ struct list_head list;
+
++ struct hci_conn *conn;
++
+ struct socket *ctrl_sock;
+ struct socket *intr_sock;
+
--- /dev/null
+From philipp.reisner@linbit.com Thu Oct 15 11:23:04 2009
+From: Philipp Reisner <philipp.reisner@linbit.com>
+Date: Tue, 13 Oct 2009 11:28:12 +0200
+Subject: connector: Keep the skb in cn_callback_data
+To: Greg KH <greg@kroah.com>
+Cc: linux-kernel@vger.kernel.org, serue@us.ibm.com, Philipp Reisner <philipp.reisner@linbit.com>, Lars Ellenberg <lars.ellenberg@linbit.com>
+Message-ID: <1255426098-9411-2-git-send-email-philipp.reisner@linbit.com>
+
+From: Philipp Reisner <philipp.reisner@linbit.com>
+
+(cherry picked from commit 5491c43845dae6c68cb4edbcf2e2dde9a32a863d)
+
+Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/connector/cn_queue.c | 3 ++-
+ drivers/connector/connector.c | 11 +++++------
+ include/linux/connector.h | 6 +++---
+ 3 files changed, 10 insertions(+), 10 deletions(-)
+
+--- a/drivers/connector/cn_queue.c
++++ b/drivers/connector/cn_queue.c
+@@ -78,8 +78,9 @@ void cn_queue_wrapper(struct work_struct
+ struct cn_callback_entry *cbq =
+ container_of(work, struct cn_callback_entry, work);
+ struct cn_callback_data *d = &cbq->data;
++ struct cn_msg *msg = NLMSG_DATA(nlmsg_hdr(d->skb));
+
+- d->callback(d->callback_priv);
++ d->callback(msg);
+
+ d->destruct_data(d->ddata);
+ d->ddata = NULL;
+--- a/drivers/connector/connector.c
++++ b/drivers/connector/connector.c
+@@ -129,10 +129,11 @@ EXPORT_SYMBOL_GPL(cn_netlink_send);
+ /*
+ * Callback helper - queues work and setup destructor for given data.
+ */
+-static int cn_call_callback(struct cn_msg *msg, void (*destruct_data)(void *), void *data)
++static int cn_call_callback(struct sk_buff *skb, void (*destruct_data)(void *), void *data)
+ {
+ struct cn_callback_entry *__cbq, *__new_cbq;
+ struct cn_dev *dev = &cdev;
++ struct cn_msg *msg = NLMSG_DATA(nlmsg_hdr(skb));
+ int err = -ENODEV;
+
+ spin_lock_bh(&dev->cbdev->queue_lock);
+@@ -140,7 +141,7 @@ static int cn_call_callback(struct cn_ms
+ if (cn_cb_equal(&__cbq->id.id, &msg->id)) {
+ if (likely(!work_pending(&__cbq->work) &&
+ __cbq->data.ddata == NULL)) {
+- __cbq->data.callback_priv = msg;
++ __cbq->data.skb = skb;
+
+ __cbq->data.ddata = data;
+ __cbq->data.destruct_data = destruct_data;
+@@ -156,7 +157,7 @@ static int cn_call_callback(struct cn_ms
+ __new_cbq = kzalloc(sizeof(struct cn_callback_entry), GFP_ATOMIC);
+ if (__new_cbq) {
+ d = &__new_cbq->data;
+- d->callback_priv = msg;
++ d->skb = skb;
+ d->callback = __cbq->data.callback;
+ d->ddata = data;
+ d->destruct_data = destruct_data;
+@@ -191,7 +192,6 @@ static int cn_call_callback(struct cn_ms
+ */
+ static void cn_rx_skb(struct sk_buff *__skb)
+ {
+- struct cn_msg *msg;
+ struct nlmsghdr *nlh;
+ int err;
+ struct sk_buff *skb;
+@@ -208,8 +208,7 @@ static void cn_rx_skb(struct sk_buff *__
+ return;
+ }
+
+- msg = NLMSG_DATA(nlh);
+- err = cn_call_callback(msg, (void (*)(void *))kfree_skb, skb);
++ err = cn_call_callback(skb, (void (*)(void *))kfree_skb, skb);
+ if (err < 0)
+ kfree_skb(skb);
+ }
+--- a/include/linux/connector.h
++++ b/include/linux/connector.h
+@@ -134,9 +134,9 @@ struct cn_callback_id {
+ struct cn_callback_data {
+ void (*destruct_data) (void *);
+ void *ddata;
+-
+- void *callback_priv;
+- void (*callback) (void *);
++
++ struct sk_buff *skb;
++ void (*callback) (struct cn_msg *);
+
+ void *free;
+ };
--- /dev/null
+From philipp.reisner@linbit.com Thu Oct 15 11:23:27 2009
+From: Philipp Reisner <philipp.reisner@linbit.com>
+Date: Tue, 13 Oct 2009 11:28:13 +0200
+Subject: connector: Provide the sender's credentials to the callback
+To: Greg KH <greg@kroah.com>
+Cc: linux-kernel@vger.kernel.org, serue@us.ibm.com, Philipp Reisner <philipp.reisner@linbit.com>, Lars Ellenberg <lars.ellenberg@linbit.com>
+Message-ID: <1255426098-9411-3-git-send-email-philipp.reisner@linbit.com>
+
+From: Philipp Reisner <philipp.reisner@linbit.com>
+
+commit 7069331dbe7155f23966f5944109f909fea0c7e4 upstream
+
+Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/connector/cn_test.c | 4 +---
+ Documentation/connector/connector.txt | 8 ++++----
+ drivers/connector/cn_proc.c | 3 +--
+ drivers/connector/cn_queue.c | 10 +++++++---
+ drivers/connector/connector.c | 6 +++---
+ drivers/md/dm-log-userspace-transfer.c | 3 +--
+ drivers/staging/dst/dcore.c | 3 +--
+ drivers/staging/pohmelfs/config.c | 3 +--
+ drivers/video/uvesafb.c | 3 +--
+ drivers/w1/w1_netlink.c | 3 +--
+ include/linux/connector.h | 6 +++---
+ 11 files changed, 24 insertions(+), 28 deletions(-)
+
+--- a/Documentation/connector/cn_test.c
++++ b/Documentation/connector/cn_test.c
+@@ -32,10 +32,8 @@ static char cn_test_name[] = "cn_test";
+ static struct sock *nls;
+ static struct timer_list cn_test_timer;
+
+-void cn_test_callback(void *data)
++static void cn_test_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
+ {
+- struct cn_msg *msg = (struct cn_msg *)data;
+-
+ printk("%s: %lu: idx=%x, val=%x, seq=%u, ack=%u, len=%d: %s.\n",
+ __func__, jiffies, msg->id.idx, msg->id.val,
+ msg->seq, msg->ack, msg->len, (char *)msg->data);
+--- a/Documentation/connector/connector.txt
++++ b/Documentation/connector/connector.txt
+@@ -23,7 +23,7 @@ handling... Connector allows any kernel
+ based networking for inter-process communication in a significantly
+ easier way:
+
+-int cn_add_callback(struct cb_id *id, char *name, void (*callback) (void *));
++int cn_add_callback(struct cb_id *id, char *name, void (*callback) (struct cn_msg *, struct netlink_skb_parms *));
+ void cn_netlink_send(struct cn_msg *msg, u32 __group, int gfp_mask);
+
+ struct cb_id
+@@ -53,15 +53,15 @@ struct cn_msg
+ Connector interfaces.
+ /*****************************************/
+
+-int cn_add_callback(struct cb_id *id, char *name, void (*callback) (void *));
++int cn_add_callback(struct cb_id *id, char *name, void (*callback) (struct cn_msg *, struct netlink_skb_parms *));
+
+ Registers new callback with connector core.
+
+ struct cb_id *id - unique connector's user identifier.
+ It must be registered in connector.h for legal in-kernel users.
+ char *name - connector's callback symbolic name.
+-void (*callback) (void *) - connector's callback.
+- Argument must be dereferenced to struct cn_msg *.
++void (*callback) (struct cn..) - connector's callback.
++ cn_msg and the sender's credentials
+
+ void cn_del_callback(struct cb_id *id);
+
+--- a/drivers/connector/cn_proc.c
++++ b/drivers/connector/cn_proc.c
+@@ -202,9 +202,8 @@ static void cn_proc_ack(int err, int rcv
+ * cn_proc_mcast_ctl
+ * @data: message sent from userspace via the connector
+ */
+-static void cn_proc_mcast_ctl(void *data)
++static void cn_proc_mcast_ctl(struct cn_msg *msg, struct netlink_skb_parms *nsp)
+ {
+- struct cn_msg *msg = data;
+ enum proc_cn_mcast_op *mc_op = NULL;
+ int err = 0;
+
+--- a/drivers/connector/cn_queue.c
++++ b/drivers/connector/cn_queue.c
+@@ -79,8 +79,9 @@ void cn_queue_wrapper(struct work_struct
+ container_of(work, struct cn_callback_entry, work);
+ struct cn_callback_data *d = &cbq->data;
+ struct cn_msg *msg = NLMSG_DATA(nlmsg_hdr(d->skb));
++ struct netlink_skb_parms *nsp = &NETLINK_CB(d->skb);
+
+- d->callback(msg);
++ d->callback(msg, nsp);
+
+ d->destruct_data(d->ddata);
+ d->ddata = NULL;
+@@ -88,7 +89,9 @@ void cn_queue_wrapper(struct work_struct
+ kfree(d->free);
+ }
+
+-static struct cn_callback_entry *cn_queue_alloc_callback_entry(char *name, struct cb_id *id, void (*callback)(void *))
++static struct cn_callback_entry *
++cn_queue_alloc_callback_entry(char *name, struct cb_id *id,
++ void (*callback)(struct cn_msg *, struct netlink_skb_parms *))
+ {
+ struct cn_callback_entry *cbq;
+
+@@ -121,7 +124,8 @@ int cn_cb_equal(struct cb_id *i1, struct
+ return ((i1->idx == i2->idx) && (i1->val == i2->val));
+ }
+
+-int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, void (*callback)(void *))
++int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id,
++ void (*callback)(struct cn_msg *, struct netlink_skb_parms *))
+ {
+ struct cn_callback_entry *cbq, *__cbq;
+ int found = 0;
+--- a/drivers/connector/connector.c
++++ b/drivers/connector/connector.c
+@@ -268,7 +268,8 @@ static void cn_notify(struct cb_id *id,
+ *
+ * May sleep.
+ */
+-int cn_add_callback(struct cb_id *id, char *name, void (*callback)(void *))
++int cn_add_callback(struct cb_id *id, char *name,
++ void (*callback)(struct cn_msg *, struct netlink_skb_parms *))
+ {
+ int err;
+ struct cn_dev *dev = &cdev;
+@@ -350,9 +351,8 @@ static int cn_ctl_msg_equals(struct cn_c
+ *
+ * Used for notification of a request's processing.
+ */
+-static void cn_callback(void *data)
++static void cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
+ {
+- struct cn_msg *msg = data;
+ struct cn_ctl_msg *ctl;
+ struct cn_ctl_entry *ent;
+ u32 size;
+--- a/drivers/md/dm-log-userspace-transfer.c
++++ b/drivers/md/dm-log-userspace-transfer.c
+@@ -129,9 +129,8 @@ static int fill_pkg(struct cn_msg *msg,
+ * This is the connector callback that delivers data
+ * that was sent from userspace.
+ */
+-static void cn_ulog_callback(void *data)
++static void cn_ulog_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
+ {
+- struct cn_msg *msg = (struct cn_msg *)data;
+ struct dm_ulog_request *tfr = (struct dm_ulog_request *)(msg + 1);
+
+ spin_lock(&receiving_list_lock);
+--- a/drivers/staging/dst/dcore.c
++++ b/drivers/staging/dst/dcore.c
+@@ -846,10 +846,9 @@ static dst_command_func dst_commands[] =
+ /*
+ * Configuration parser.
+ */
+-static void cn_dst_callback(void *data)
++static void cn_dst_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
+ {
+ struct dst_ctl *ctl;
+- struct cn_msg *msg = data;
+ int err;
+ struct dst_ctl_ack ack;
+ struct dst_node *n = NULL, *tmp;
+--- a/drivers/staging/pohmelfs/config.c
++++ b/drivers/staging/pohmelfs/config.c
+@@ -446,9 +446,8 @@ out_unlock:
+ return err;
+ }
+
+-static void pohmelfs_cn_callback(void *data)
++static void pohmelfs_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
+ {
+- struct cn_msg *msg = data;
+ int err;
+
+ switch (msg->flags) {
+--- a/drivers/video/uvesafb.c
++++ b/drivers/video/uvesafb.c
+@@ -67,9 +67,8 @@ static DEFINE_MUTEX(uvfb_lock);
+ * find the kernel part of the task struct, copy the registers and
+ * the buffer contents and then complete the task.
+ */
+-static void uvesafb_cn_callback(void *data)
++static void uvesafb_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
+ {
+- struct cn_msg *msg = data;
+ struct uvesafb_task *utask;
+ struct uvesafb_ktask *task;
+
+--- a/drivers/w1/w1_netlink.c
++++ b/drivers/w1/w1_netlink.c
+@@ -306,9 +306,8 @@ static int w1_netlink_send_error(struct
+ return error;
+ }
+
+-static void w1_cn_callback(void *data)
++static void w1_cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
+ {
+- struct cn_msg *msg = data;
+ struct w1_netlink_msg *m = (struct w1_netlink_msg *)(msg + 1);
+ struct w1_netlink_cmd *cmd;
+ struct w1_slave *sl;
+--- a/include/linux/connector.h
++++ b/include/linux/connector.h
+@@ -136,7 +136,7 @@ struct cn_callback_data {
+ void *ddata;
+
+ struct sk_buff *skb;
+- void (*callback) (struct cn_msg *);
++ void (*callback) (struct cn_msg *, struct netlink_skb_parms *);
+
+ void *free;
+ };
+@@ -167,11 +167,11 @@ struct cn_dev {
+ struct cn_queue_dev *cbdev;
+ };
+
+-int cn_add_callback(struct cb_id *, char *, void (*callback) (void *));
++int cn_add_callback(struct cb_id *, char *, void (*callback) (struct cn_msg *, struct netlink_skb_parms *));
+ void cn_del_callback(struct cb_id *);
+ int cn_netlink_send(struct cn_msg *, u32, gfp_t);
+
+-int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, void (*callback)(void *));
++int cn_queue_add_callback(struct cn_queue_dev *dev, char *name, struct cb_id *id, void (*callback)(struct cn_msg *, struct netlink_skb_parms *));
+ void cn_queue_del_callback(struct cn_queue_dev *dev, struct cb_id *id);
+
+ int queue_cn_work(struct cn_callback_entry *cbq, struct work_struct *work);
--- /dev/null
+From philipp.reisner@linbit.com Thu Oct 15 11:24:27 2009
+From: Philipp Reisner <philipp.reisner@linbit.com>
+Date: Tue, 13 Oct 2009 11:28:14 +0200
+Subject: connector: Removed the destruct_data callback since it is always kfree_skb()
+To: Greg KH <greg@kroah.com>
+Cc: linux-kernel@vger.kernel.org, serue@us.ibm.com, Philipp Reisner <philipp.reisner@linbit.com>
+Message-ID: <1255426098-9411-4-git-send-email-philipp.reisner@linbit.com>
+
+(cherry picked from commit f4b5129f5e838942f759c2637967441cf4a98c20)
+
+Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
+Acked-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Acked-by: Evgeniy Polyakov <zbr@ioremap.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/connector/cn_queue.c | 4 ++--
+ drivers/connector/connector.c | 11 +++--------
+ include/linux/connector.h | 3 ---
+ 3 files changed, 5 insertions(+), 13 deletions(-)
+
+--- a/drivers/connector/cn_queue.c
++++ b/drivers/connector/cn_queue.c
+@@ -83,8 +83,8 @@ void cn_queue_wrapper(struct work_struct
+
+ d->callback(msg, nsp);
+
+- d->destruct_data(d->ddata);
+- d->ddata = NULL;
++ kfree_skb(d->skb);
++ d->skb = NULL;
+
+ kfree(d->free);
+ }
+--- a/drivers/connector/connector.c
++++ b/drivers/connector/connector.c
+@@ -129,7 +129,7 @@ EXPORT_SYMBOL_GPL(cn_netlink_send);
+ /*
+ * Callback helper - queues work and setup destructor for given data.
+ */
+-static int cn_call_callback(struct sk_buff *skb, void (*destruct_data)(void *), void *data)
++static int cn_call_callback(struct sk_buff *skb)
+ {
+ struct cn_callback_entry *__cbq, *__new_cbq;
+ struct cn_dev *dev = &cdev;
+@@ -140,12 +140,9 @@ static int cn_call_callback(struct sk_bu
+ list_for_each_entry(__cbq, &dev->cbdev->queue_list, callback_entry) {
+ if (cn_cb_equal(&__cbq->id.id, &msg->id)) {
+ if (likely(!work_pending(&__cbq->work) &&
+- __cbq->data.ddata == NULL)) {
++ __cbq->data.skb == NULL)) {
+ __cbq->data.skb = skb;
+
+- __cbq->data.ddata = data;
+- __cbq->data.destruct_data = destruct_data;
+-
+ if (queue_cn_work(__cbq, &__cbq->work))
+ err = 0;
+ else
+@@ -159,8 +156,6 @@ static int cn_call_callback(struct sk_bu
+ d = &__new_cbq->data;
+ d->skb = skb;
+ d->callback = __cbq->data.callback;
+- d->ddata = data;
+- d->destruct_data = destruct_data;
+ d->free = __new_cbq;
+
+ __new_cbq->pdev = __cbq->pdev;
+@@ -208,7 +203,7 @@ static void cn_rx_skb(struct sk_buff *__
+ return;
+ }
+
+- err = cn_call_callback(skb, (void (*)(void *))kfree_skb, skb);
++ err = cn_call_callback(skb);
+ if (err < 0)
+ kfree_skb(skb);
+ }
+--- a/include/linux/connector.h
++++ b/include/linux/connector.h
+@@ -132,9 +132,6 @@ struct cn_callback_id {
+ };
+
+ struct cn_callback_data {
+- void (*destruct_data) (void *);
+- void *ddata;
+-
+ struct sk_buff *skb;
+ void (*callback) (struct cn_msg *, struct netlink_skb_parms *);
+
--- /dev/null
+From philipp.reisner@linbit.com Thu Oct 15 11:25:31 2009
+From: Philipp Reisner <philipp.reisner@linbit.com>
+Date: Tue, 13 Oct 2009 11:28:15 +0200
+Subject: dm/connector: Only process connector packages from privileged processes
+To: Greg KH <greg@kroah.com>
+Cc: linux-kernel@vger.kernel.org, serue@us.ibm.com, Philipp Reisner <philipp.reisner@linbit.com>
+Message-ID: <1255426098-9411-5-git-send-email-philipp.reisner@linbit.com>
+
+From: Philipp Reisner <philipp.reisner@linbit.com>
+
+(cherry picked from commit 93136335f9ad7a98b92eacda1b43dccbf063cd07)
+
+Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-log-userspace-transfer.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/md/dm-log-userspace-transfer.c
++++ b/drivers/md/dm-log-userspace-transfer.c
+@@ -133,6 +133,9 @@ static void cn_ulog_callback(struct cn_m
+ {
+ struct dm_ulog_request *tfr = (struct dm_ulog_request *)(msg + 1);
+
++ if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))
++ return;
++
+ spin_lock(&receiving_list_lock);
+ if (msg->len == 0)
+ fill_pkg(msg, NULL);
--- /dev/null
+From philipp.reisner@linbit.com Thu Oct 15 11:26:00 2009
+From: Philipp Reisner <philipp.reisner@linbit.com>
+Date: Tue, 13 Oct 2009 11:28:16 +0200
+Subject: dst/connector: Disallow unpliviged users to configure dst
+To: Greg KH <greg@kroah.com>
+Cc: linux-kernel@vger.kernel.org, serue@us.ibm.com, Philipp Reisner <philipp.reisner@linbit.com>
+Message-ID: <1255426098-9411-6-git-send-email-philipp.reisner@linbit.com>
+
+From: Philipp Reisner <philipp.reisner@linbit.com>
+
+(cherry picked from commit dbbb3431228784612848a1ec6061c78b4b708b5c)
+
+Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/dst/dcore.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/staging/dst/dcore.c
++++ b/drivers/staging/dst/dcore.c
+@@ -854,6 +854,11 @@ static void cn_dst_callback(struct cn_ms
+ struct dst_node *n = NULL, *tmp;
+ unsigned int hash;
+
++ if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN)) {
++ err = -EPERM;
++ goto out;
++ }
++
+ if (msg->len < sizeof(struct dst_ctl)) {
+ err = -EBADMSG;
+ goto out;
--- /dev/null
+From a825e00c98a2ee37eb2a0ad93b352e79d2bc1593 Mon Sep 17 00:00:00 2001
+From: Alexander Duyck <alexander.h.duyck@intel.com>
+Date: Fri, 2 Oct 2009 12:30:42 +0000
+Subject: e1000e: swap max hw supported frame size between 82574 and 82583
+
+From: Alexander Duyck <alexander.h.duyck@intel.com>
+
+commit a825e00c98a2ee37eb2a0ad93b352e79d2bc1593 upstream.
+
+There appears to have been a mixup in the max supported jumbo frame size
+between 82574 and 82583 which ended up disabling jumbo frames on the 82574
+as a result. This patch swaps the two so that this issue is resolved.
+
+This patch fixes http://bugzilla.kernel.org/show_bug.cgi?id=14261
+
+Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Tim Gardner <tim.gardner@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+--- a/drivers/net/e1000e/82571.c
++++ b/drivers/net/e1000e/82571.c
+@@ -1803,7 +1803,7 @@ struct e1000_info e1000_82574_info = {
+ | FLAG_HAS_AMT
+ | FLAG_HAS_CTRLEXT_ON_LOAD,
+ .pba = 20,
+- .max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN,
++ .max_hw_frame_size = DEFAULT_JUMBO,
+ .get_variants = e1000_get_variants_82571,
+ .mac_ops = &e82571_mac_ops,
+ .phy_ops = &e82_phy_ops_bm,
+@@ -1820,7 +1820,7 @@ struct e1000_info e1000_82583_info = {
+ | FLAG_HAS_AMT
+ | FLAG_HAS_CTRLEXT_ON_LOAD,
+ .pba = 20,
+- .max_hw_frame_size = DEFAULT_JUMBO,
++ .max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN,
+ .get_variants = e1000_get_variants_82571,
+ .mac_ops = &e82571_mac_ops,
+ .phy_ops = &e82_phy_ops_bm,
--- /dev/null
+From 84bc4af59081ee974dd80210e694ab59ebe51ce8 Mon Sep 17 00:00:00 2001
+From: Darren Hart <dvhltc@us.ibm.com>
+Date: Thu, 13 Aug 2009 17:36:53 -0700
+Subject: futex: Detect mismatched requeue targets
+
+From: Darren Hart <dvhltc@us.ibm.com>
+
+commit 84bc4af59081ee974dd80210e694ab59ebe51ce8 upstream.
+
+There is currently no check to ensure that userspace uses the same
+futex requeue target (uaddr2) in futex_requeue() that the waiter used
+in futex_wait_requeue_pi(). A mismatch here could very unexpected
+results as the waiter assumes it either wakes on uaddr1 or uaddr2. We
+could detect this on wakeup in the waiter, but the cleanup is more
+intense after the improper requeue has occured.
+
+This patch stores the waiter's expected requeue target in a new
+requeue_pi_key pointer in the futex_q which futex_requeue() checks
+prior to attempting to do a proxy lock acquistion or a requeue when
+requeue_pi=1. If they don't match, return -EINVAL from futex_requeue,
+aborting the requeue of any remaining waiters.
+
+Signed-off-by: Darren Hart <dvhltc@us.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: John Kacur <jkacur@redhat.com>
+Cc: Dinakar Guniguntala <dino@in.ibm.com>
+Cc: John Stultz <johnstul@us.ibm.com>
+LKML-Reference: <20090814003650.14634.63916.stgit@Aeon>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/futex.c | 24 ++++++++++++++++++++----
+ 1 file changed, 20 insertions(+), 4 deletions(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -115,6 +115,9 @@ struct futex_q {
+ /* rt_waiter storage for requeue_pi: */
+ struct rt_mutex_waiter *rt_waiter;
+
++ /* The expected requeue pi target futex key: */
++ union futex_key *requeue_pi_key;
++
+ /* Bitset for the optional bitmasked wakeup */
+ u32 bitset;
+ };
+@@ -1089,6 +1092,10 @@ static int futex_proxy_trylock_atomic(u3
+ if (!top_waiter)
+ return 0;
+
++ /* Ensure we requeue to the expected futex. */
++ if (!match_futex(top_waiter->requeue_pi_key, key2))
++ return -EINVAL;
++
+ /*
+ * Try to take the lock for top_waiter. Set the FUTEX_WAITERS bit in
+ * the contended case or if set_waiters is 1. The pi_state is returned
+@@ -1276,6 +1283,12 @@ retry_private:
+ continue;
+ }
+
++ /* Ensure we requeue to the expected futex for requeue_pi. */
++ if (requeue_pi && !match_futex(this->requeue_pi_key, &key2)) {
++ ret = -EINVAL;
++ break;
++ }
++
+ /*
+ * Requeue nr_requeue waiters and possibly one more in the case
+ * of requeue_pi if we couldn't acquire the lock atomically.
+@@ -1751,6 +1764,7 @@ static int futex_wait(u32 __user *uaddr,
+ q.pi_state = NULL;
+ q.bitset = bitset;
+ q.rt_waiter = NULL;
++ q.requeue_pi_key = NULL;
+
+ if (abs_time) {
+ to = &timeout;
+@@ -1858,6 +1872,7 @@ static int futex_lock_pi(u32 __user *uad
+
+ q.pi_state = NULL;
+ q.rt_waiter = NULL;
++ q.requeue_pi_key = NULL;
+ retry:
+ q.key = FUTEX_KEY_INIT;
+ ret = get_futex_key(uaddr, fshared, &q.key, VERIFY_WRITE);
+@@ -2168,15 +2183,16 @@ static int futex_wait_requeue_pi(u32 __u
+ debug_rt_mutex_init_waiter(&rt_waiter);
+ rt_waiter.task = NULL;
+
+- q.pi_state = NULL;
+- q.bitset = bitset;
+- q.rt_waiter = &rt_waiter;
+-
+ key2 = FUTEX_KEY_INIT;
+ ret = get_futex_key(uaddr2, fshared, &key2, VERIFY_WRITE);
+ if (unlikely(ret != 0))
+ goto out;
+
++ q.pi_state = NULL;
++ q.bitset = bitset;
++ q.rt_waiter = &rt_waiter;
++ q.requeue_pi_key = &key2;
++
+ /* Prepare to wait on uaddr. */
+ ret = futex_wait_setup(uaddr, val, fshared, &q, &hb);
+ if (ret)
--- /dev/null
+From 0729e196147692d84d4c099fcff056eba2ed61d8 Mon Sep 17 00:00:00 2001
+From: Darren Hart <dvhltc@us.ibm.com>
+Date: Mon, 21 Sep 2009 22:30:38 -0700
+Subject: futex: Fix wakeup race by setting TASK_INTERRUPTIBLE before queue_me()
+
+From: Darren Hart <dvhltc@us.ibm.com>
+
+commit 0729e196147692d84d4c099fcff056eba2ed61d8 upstream.
+
+PI futexes do not use the same plist_node_empty() test for wakeup.
+It was possible for the waiter (in futex_wait_requeue_pi()) to set
+TASK_INTERRUPTIBLE after the waker assigned the rtmutex to the
+waiter. The waiter would then note the plist was not empty and call
+schedule(). The task would not be found by any subsequeuent futex
+wakeups, resulting in a userspace hang.
+
+By moving the setting of TASK_INTERRUPTIBLE to before the call to
+queue_me(), the race with the waker is eliminated. Since we no
+longer call get_user() from within queue_me(), there is no need to
+delay the setting of TASK_INTERRUPTIBLE until after the call to
+queue_me().
+
+The FUTEX_LOCK_PI operation is not affected as futex_lock_pi()
+relies entirely on the rtmutex code to handle schedule() and
+wakeup. The requeue PI code is affected because the waiter starts
+as a non-PI waiter and is woken on a PI futex.
+
+Remove the crusty old comment about holding spinlocks() across
+get_user() as we no longer do that. Correct the locking statement
+with a description of why the test is performed.
+
+Signed-off-by: Darren Hart <dvhltc@us.ibm.com>
+Acked-by: Peter Zijlstra <peterz@infradead.org>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Dinakar Guniguntala <dino@in.ibm.com>
+Cc: John Stultz <johnstul@us.ibm.com>
+LKML-Reference: <20090922053038.8717.97838.stgit@Aeon>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/futex.c | 15 +++------------
+ 1 file changed, 3 insertions(+), 12 deletions(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1638,17 +1638,8 @@ out:
+ static void futex_wait_queue_me(struct futex_hash_bucket *hb, struct futex_q *q,
+ struct hrtimer_sleeper *timeout)
+ {
+- queue_me(q, hb);
+-
+- /*
+- * There might have been scheduling since the queue_me(), as we
+- * cannot hold a spinlock across the get_user() in case it
+- * faults, and we cannot just set TASK_INTERRUPTIBLE state when
+- * queueing ourselves into the futex hash. This code thus has to
+- * rely on the futex_wake() code removing us from hash when it
+- * wakes us up.
+- */
+ set_current_state(TASK_INTERRUPTIBLE);
++ queue_me(q, hb);
+
+ /* Arm the timer */
+ if (timeout) {
+@@ -1658,8 +1649,8 @@ static void futex_wait_queue_me(struct f
+ }
+
+ /*
+- * !plist_node_empty() is safe here without any lock.
+- * q.lock_ptr != 0 is not safe, because of ordering against wakeup.
++ * If we have been removed from the hash list, then another task
++ * has tried to wake us, and we can skip the call to schedule().
+ */
+ if (likely(!plist_node_empty(&q->list))) {
+ /*
--- /dev/null
+From 18669eabde2ff5fc446e72e043f0539059763438 Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Sun, 4 Oct 2009 22:53:45 +0200
+Subject: i2c: Hide probe errors caused by ACPI resource conflicts
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 18669eabde2ff5fc446e72e043f0539059763438 upstream.
+
+When an ACPI resource conflict is detected, error messages are already
+printed by ACPI. There's no point in causing the driver core to print
+more error messages, so return one of the error codes for which no
+message is printed.
+
+This fixes bug #14293:
+http://bugzilla.kernel.org/show_bug.cgi?id=14293
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/i2c/busses/i2c-amd756.c | 2 +-
+ drivers/i2c/busses/i2c-amd8111.c | 4 +++-
+ drivers/i2c/busses/i2c-i801.c | 4 +++-
+ drivers/i2c/busses/i2c-isch.c | 2 +-
+ drivers/i2c/busses/i2c-piix4.c | 4 ++--
+ drivers/i2c/busses/i2c-sis96x.c | 2 +-
+ drivers/i2c/busses/i2c-viapro.c | 2 +-
+ 7 files changed, 12 insertions(+), 8 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-amd756.c
++++ b/drivers/i2c/busses/i2c-amd756.c
+@@ -364,7 +364,7 @@ static int __devinit amd756_probe(struct
+ error = acpi_check_region(amd756_ioport, SMB_IOSIZE,
+ amd756_driver.name);
+ if (error)
+- return error;
++ return -ENODEV;
+
+ if (!request_region(amd756_ioport, SMB_IOSIZE, amd756_driver.name)) {
+ dev_err(&pdev->dev, "SMB region 0x%x already in use!\n",
+--- a/drivers/i2c/busses/i2c-amd8111.c
++++ b/drivers/i2c/busses/i2c-amd8111.c
+@@ -376,8 +376,10 @@ static int __devinit amd8111_probe(struc
+ smbus->size = pci_resource_len(dev, 0);
+
+ error = acpi_check_resource_conflict(&dev->resource[0]);
+- if (error)
++ if (error) {
++ error = -ENODEV;
+ goto out_kfree;
++ }
+
+ if (!request_region(smbus->base, smbus->size, amd8111_driver.name)) {
+ error = -EBUSY;
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -732,8 +732,10 @@ static int __devinit i801_probe(struct p
+ }
+
+ err = acpi_check_resource_conflict(&dev->resource[SMBBAR]);
+- if (err)
++ if (err) {
++ err = -ENODEV;
+ goto exit;
++ }
+
+ err = pci_request_region(dev, SMBBAR, i801_driver.name);
+ if (err) {
+--- a/drivers/i2c/busses/i2c-isch.c
++++ b/drivers/i2c/busses/i2c-isch.c
+@@ -281,7 +281,7 @@ static int __devinit sch_probe(struct pc
+ return -ENODEV;
+ }
+ if (acpi_check_region(sch_smba, SMBIOSIZE, sch_driver.name))
+- return -EBUSY;
++ return -ENODEV;
+ if (!request_region(sch_smba, SMBIOSIZE, sch_driver.name)) {
+ dev_err(&dev->dev, "SMBus region 0x%x already in use!\n",
+ sch_smba);
+--- a/drivers/i2c/busses/i2c-piix4.c
++++ b/drivers/i2c/busses/i2c-piix4.c
+@@ -168,7 +168,7 @@ static int __devinit piix4_setup(struct
+ }
+
+ if (acpi_check_region(piix4_smba, SMBIOSIZE, piix4_driver.name))
+- return -EBUSY;
++ return -ENODEV;
+
+ if (!request_region(piix4_smba, SMBIOSIZE, piix4_driver.name)) {
+ dev_err(&PIIX4_dev->dev, "SMBus region 0x%x already in use!\n",
+@@ -259,7 +259,7 @@ static int __devinit piix4_setup_sb800(s
+
+ piix4_smba = ((smba_en_hi << 8) | smba_en_lo) & 0xffe0;
+ if (acpi_check_region(piix4_smba, SMBIOSIZE, piix4_driver.name))
+- return -EBUSY;
++ return -ENODEV;
+
+ if (!request_region(piix4_smba, SMBIOSIZE, piix4_driver.name)) {
+ dev_err(&PIIX4_dev->dev, "SMBus region 0x%x already in use!\n",
+--- a/drivers/i2c/busses/i2c-sis96x.c
++++ b/drivers/i2c/busses/i2c-sis96x.c
+@@ -280,7 +280,7 @@ static int __devinit sis96x_probe(struct
+
+ retval = acpi_check_resource_conflict(&dev->resource[SIS96x_BAR]);
+ if (retval)
+- return retval;
++ return -ENODEV;
+
+ /* Everything is happy, let's grab the memory and set things up. */
+ if (!request_region(sis96x_smbus_base, SMB_IOSIZE,
+--- a/drivers/i2c/busses/i2c-viapro.c
++++ b/drivers/i2c/busses/i2c-viapro.c
+@@ -365,7 +365,7 @@ static int __devinit vt596_probe(struct
+ found:
+ error = acpi_check_region(vt596_smba, 8, vt596_driver.name);
+ if (error)
+- return error;
++ return -ENODEV;
+
+ if (!request_region(vt596_smba, 8, vt596_driver.name)) {
+ dev_err(&pdev->dev, "SMBus region 0x%x already in use!\n",
--- /dev/null
+From 6f6b35e133fe4313277b30fc1a7ea313875ea6c9 Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Sun, 4 Oct 2009 22:53:46 +0200
+Subject: macintosh: Don't assume i2c device probing always succeeds
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 6f6b35e133fe4313277b30fc1a7ea313875ea6c9 upstream.
+
+If i2c device probing fails, then there is no driver to dereference
+after calling i2c_new_device(). Stop assuming that probing will always
+succeed, to avoid NULL pointer dereferences. We have an easier access
+to the driver anyway.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Tested-by: Tim Shepard <shep@alum.mit.edu>
+Cc: Colin Leroy <colin@colino.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/macintosh/therm_adt746x.c | 4 +++-
+ drivers/macintosh/therm_pm72.c | 4 +++-
+ drivers/macintosh/windfarm_lm75_sensor.c | 4 +++-
+ drivers/macintosh/windfarm_max6690_sensor.c | 4 +++-
+ drivers/macintosh/windfarm_smu_sat.c | 4 +++-
+ 5 files changed, 15 insertions(+), 5 deletions(-)
+
+--- a/drivers/macintosh/therm_adt746x.c
++++ b/drivers/macintosh/therm_adt746x.c
+@@ -124,6 +124,8 @@ read_reg(struct thermostat* th, int reg)
+ return data;
+ }
+
++static struct i2c_driver thermostat_driver;
++
+ static int
+ attach_thermostat(struct i2c_adapter *adapter)
+ {
+@@ -148,7 +150,7 @@ attach_thermostat(struct i2c_adapter *ad
+ * Let i2c-core delete that device on driver removal.
+ * This is safe because i2c-core holds the core_lock mutex for us.
+ */
+- list_add_tail(&client->detected, &client->driver->clients);
++ list_add_tail(&client->detected, &thermostat_driver.clients);
+ return 0;
+ }
+
+--- a/drivers/macintosh/therm_pm72.c
++++ b/drivers/macintosh/therm_pm72.c
+@@ -286,6 +286,8 @@ struct fcu_fan_table fcu_fans[] = {
+ },
+ };
+
++static struct i2c_driver therm_pm72_driver;
++
+ /*
+ * Utility function to create an i2c_client structure and
+ * attach it to one of u3 adapters
+@@ -318,7 +320,7 @@ static struct i2c_client *attach_i2c_chi
+ * Let i2c-core delete that device on driver removal.
+ * This is safe because i2c-core holds the core_lock mutex for us.
+ */
+- list_add_tail(&clt->detected, &clt->driver->clients);
++ list_add_tail(&clt->detected, &therm_pm72_driver.clients);
+ return clt;
+ }
+
+--- a/drivers/macintosh/windfarm_lm75_sensor.c
++++ b/drivers/macintosh/windfarm_lm75_sensor.c
+@@ -115,6 +115,8 @@ static int wf_lm75_probe(struct i2c_clie
+ return rc;
+ }
+
++static struct i2c_driver wf_lm75_driver;
++
+ static struct i2c_client *wf_lm75_create(struct i2c_adapter *adapter,
+ u8 addr, int ds1775,
+ const char *loc)
+@@ -157,7 +159,7 @@ static struct i2c_client *wf_lm75_create
+ * Let i2c-core delete that device on driver removal.
+ * This is safe because i2c-core holds the core_lock mutex for us.
+ */
+- list_add_tail(&client->detected, &client->driver->clients);
++ list_add_tail(&client->detected, &wf_lm75_driver.clients);
+ return client;
+ fail:
+ return NULL;
+--- a/drivers/macintosh/windfarm_max6690_sensor.c
++++ b/drivers/macintosh/windfarm_max6690_sensor.c
+@@ -88,6 +88,8 @@ static int wf_max6690_probe(struct i2c_c
+ return rc;
+ }
+
++static struct i2c_driver wf_max6690_driver;
++
+ static struct i2c_client *wf_max6690_create(struct i2c_adapter *adapter,
+ u8 addr, const char *loc)
+ {
+@@ -119,7 +121,7 @@ static struct i2c_client *wf_max6690_cre
+ * Let i2c-core delete that device on driver removal.
+ * This is safe because i2c-core holds the core_lock mutex for us.
+ */
+- list_add_tail(&client->detected, &client->driver->clients);
++ list_add_tail(&client->detected, &wf_max6690_driver.clients);
+ return client;
+
+ fail:
+--- a/drivers/macintosh/windfarm_smu_sat.c
++++ b/drivers/macintosh/windfarm_smu_sat.c
+@@ -194,6 +194,8 @@ static struct wf_sensor_ops wf_sat_ops =
+ .owner = THIS_MODULE,
+ };
+
++static struct i2c_driver wf_sat_driver;
++
+ static void wf_sat_create(struct i2c_adapter *adapter, struct device_node *dev)
+ {
+ struct i2c_board_info info;
+@@ -222,7 +224,7 @@ static void wf_sat_create(struct i2c_ada
+ * Let i2c-core delete that device on driver removal.
+ * This is safe because i2c-core holds the core_lock mutex for us.
+ */
+- list_add_tail(&client->detected, &client->driver->clients);
++ list_add_tail(&client->detected, &wf_sat_driver.clients);
+ }
+
+ static int wf_sat_probe(struct i2c_client *client,
--- /dev/null
+From 05576a1e38e2d06dece32974c5218528d3fbc6e2 Mon Sep 17 00:00:00 2001
+From: Jean Delvare <khali@linux-fr.org>
+Date: Fri, 9 Oct 2009 20:35:19 +0200
+Subject: MAINTAINERS: Fix Riku Voipio's address
+
+From: Jean Delvare <khali@linux-fr.org>
+
+commit 05576a1e38e2d06dece32974c5218528d3fbc6e2 upstream.
+
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Acked-by: Riku Voipio <riku.voipio@iki.fi>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ MAINTAINERS | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -1992,7 +1992,7 @@ S: Maintained
+ F: fs/*
+
+ FINTEK F75375S HARDWARE MONITOR AND FAN CONTROLLER DRIVER
+-M: Riku Voipio <riku.vipio@iki.fi>
++M: Riku Voipio <riku.voipio@iki.fi>
+ L: lm-sensors@lm-sensors.org
+ S: Maintained
+ F: drivers/hwmon/f75375s.c
--- /dev/null
+From philipp.reisner@linbit.com Thu Oct 15 11:26:30 2009
+From: Philipp Reisner <philipp.reisner@linbit.com>
+Date: Tue, 13 Oct 2009 11:28:17 +0200
+Subject: pohmelfs/connector: Disallow unpliviged users to configure pohmelfs
+To: Greg KH <greg@kroah.com>
+Cc: linux-kernel@vger.kernel.org, serue@us.ibm.com, Philipp Reisner <philipp.reisner@linbit.com>
+Message-ID: <1255426098-9411-7-git-send-email-philipp.reisner@linbit.com>
+
+From: Philipp Reisner <philipp.reisner@linbit.com>
+
+(cherry picked from commit 0179065b13b354cc0b940e7a632a65ec0448beff)
+
+Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/staging/pohmelfs/config.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/pohmelfs/config.c
++++ b/drivers/staging/pohmelfs/config.c
+@@ -450,6 +450,9 @@ static void pohmelfs_cn_callback(struct
+ {
+ int err;
+
++ if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))
++ return;
++
+ switch (msg->flags) {
+ case POHMELFS_FLAGS_ADD:
+ case POHMELFS_FLAGS_DEL:
--- /dev/null
+From 3a54297478e6578f96fd54bf4daa1751130aca86 Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan@linux.intel.com>
+Date: Mon, 27 Jul 2009 22:17:51 +0100
+Subject: pty: quickfix for the pty ENXIO timing problems
+
+From: Alan Cox <alan@linux.intel.com>
+
+commit 3a54297478e6578f96fd54bf4daa1751130aca86 upstream.
+
+This also makes close stall in the normal case which is apparently
+needed to fix emacs
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/pty.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/char/pty.c
++++ b/drivers/char/pty.c
+@@ -52,6 +52,7 @@ static void pty_close(struct tty_struct
+ return;
+ tty->link->packet = 0;
+ set_bit(TTY_OTHER_CLOSED, &tty->link->flags);
++ tty_flip_buffer_push(tty->link);
+ wake_up_interruptible(&tty->link->read_wait);
+ wake_up_interruptible(&tty->link->write_wait);
+ if (tty->driver->subtype == PTY_TYPE_MASTER) {
+@@ -203,6 +204,7 @@ static int pty_open(struct tty_struct *t
+ clear_bit(TTY_OTHER_CLOSED, &tty->link->flags);
+ set_bit(TTY_THROTTLED, &tty->flags);
+ retval = 0;
++ tty->low_latency = 1;
+ out:
+ return retval;
+ }
usb-storage-when-a-device-returns-no-sense-data-call-it-a-hardware-error.patch
arm-cris-mips-sparc-powerpc-um-xtensa-fix-build-with-bash-4.0.patch
intel-iommu-cope-with-broken-hp-dc7900-bios.patch
+futex-detect-mismatched-requeue-targets.patch
+futex-fix-wakeup-race-by-setting-task_interruptible-before-queue_me.patch
+tpm-fixup-pcrs-sysfs-file-update.patch
+tpm-fix-pcrread.patch
+bluetooth-disconnect-hidraw-devices-on-disconnect.patch
+bluetooth-add-extra-device-reference-counting-for-connections.patch
+bluetooth-let-hidp-grab-the-device-reference-for-connections.patch
+connector-keep-the-skb-in-cn_callback_data.patch
+connector-provide-the-sender-s-credentials-to-the-callback.patch
+connector-removed-the-destruct_data-callback-since-it-is-always-kfree_skb.patch
+dm-connector-only-process-connector-packages-from-privileged-processes.patch
+dst-connector-disallow-unpliviged-users-to-configure-dst.patch
+pohmelfs-connector-disallow-unpliviged-users-to-configure-pohmelfs.patch
+uvesafb-connector-disallow-unpliviged-users-to-send-netlink-packets.patch
+pty-quickfix-for-the-pty-enxio-timing-problems.patch
+e1000e-swap-max-hw-supported-frame-size-between-82574-and-82583.patch
+maintainers-fix-riku-voipio-s-address.patch
+macintosh-don-t-assume-i2c-device-probing-always-succeeds.patch
+i2c-hide-probe-errors-caused-by-acpi-resource-conflicts.patch
+alsa-don-t-assume-i2c-device-probing-always-succeeds.patch
--- /dev/null
+From 15d031c394e7bef9da4ec764e6b0330d701a0126 Mon Sep 17 00:00:00 2001
+From: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
+Date: Wed, 30 Sep 2009 12:26:55 -0300
+Subject: TPM: fix pcrread
+
+From: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
+
+commit 15d031c394e7bef9da4ec764e6b0330d701a0126 upstream.
+
+The previously sent patch:
+
+http://marc.info/?l=tpmdd-devel&m=125208945007834&w=2
+
+Had its first hunk cropped when merged, submitting only this first hunk
+again.
+
+Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Cc: Debora Velarde <debora@linux.vnet.ibm.com>
+Cc: Marcel Selhorst <m.selhorst@sirrix.com>
+Cc: James Morris <jmorris@namei.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
+Acked-by: Mimi Zohar <zohar@us.ibm.com>
+Tested-by: Mimi Zohar <zohar@us.ibm.com>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tpm/tpm.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/char/tpm/tpm.c
++++ b/drivers/char/tpm/tpm.c
+@@ -696,8 +696,7 @@ int __tpm_pcr_read(struct tpm_chip *chip
+
+ cmd.header.in = pcrread_header;
+ cmd.params.pcrread_in.pcr_idx = cpu_to_be32(pcr_idx);
+- BUILD_BUG_ON(cmd.header.in.length > READ_PCR_RESULT_SIZE);
+- rc = transmit_cmd(chip, &cmd, cmd.header.in.length,
++ rc = transmit_cmd(chip, &cmd, READ_PCR_RESULT_SIZE,
+ "attempting to read a pcr value");
+
+ if (rc == 0)
--- /dev/null
+From 0afd9056f1b43c9fcbfdf933b263d72023d382fe Mon Sep 17 00:00:00 2001
+From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Date: Fri, 18 Sep 2009 12:54:24 -0700
+Subject: tpm-fixup-pcrs-sysfs-file-update
+
+From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+
+commit 0afd9056f1b43c9fcbfdf933b263d72023d382fe upstream.
+
+Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Cc: Debora Velarde <debora@linux.vnet.ibm.com>
+Cc: Rajiv Andrade <srajiv@linux.vnet.ibm.com>
+Cc: Marcel Selhorst <m.selhorst@sirrix.com>
+Cc: James Morris <jmorris@namei.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: James Morris <jmorris@namei.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/tpm/tpm.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/char/tpm/tpm.c
++++ b/drivers/char/tpm/tpm.c
+@@ -742,7 +742,7 @@ EXPORT_SYMBOL_GPL(tpm_pcr_read);
+ * the module usage count.
+ */
+ #define TPM_ORD_PCR_EXTEND cpu_to_be32(20)
+-#define EXTEND_PCR_SIZE 34
++#define EXTEND_PCR_RESULT_SIZE 34
+ static struct tpm_input_header pcrextend_header = {
+ .tag = TPM_TAG_RQU_COMMAND,
+ .length = cpu_to_be32(34),
+@@ -760,10 +760,9 @@ int tpm_pcr_extend(u32 chip_num, int pcr
+ return -ENODEV;
+
+ cmd.header.in = pcrextend_header;
+- BUILD_BUG_ON(be32_to_cpu(cmd.header.in.length) > EXTEND_PCR_SIZE);
+ cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(pcr_idx);
+ memcpy(cmd.params.pcrextend_in.hash, hash, TPM_DIGEST_SIZE);
+- rc = transmit_cmd(chip, &cmd, cmd.header.in.length,
++ rc = transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE,
+ "attempting extend a PCR value");
+
+ module_put(chip->dev->driver->owner);
--- /dev/null
+From philipp.reisner@linbit.com Thu Oct 15 11:26:51 2009
+From: Philipp Reisner <philipp.reisner@linbit.com>
+Date: Tue, 13 Oct 2009 11:28:18 +0200
+Subject: uvesafb/connector: Disallow unpliviged users to send netlink packets
+To: Greg KH <greg@kroah.com>
+Cc: linux-kernel@vger.kernel.org, serue@us.ibm.com, Philipp Reisner <philipp.reisner@linbit.com>
+Message-ID: <1255426098-9411-8-git-send-email-philipp.reisner@linbit.com>
+
+From: Philipp Reisner <philipp.reisner@linbit.com>
+
+(cherry picked from commit 30efa3f76813b17445bc5a2e443ae9731518566b)
+
+Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/uvesafb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/video/uvesafb.c
++++ b/drivers/video/uvesafb.c
+@@ -72,6 +72,9 @@ static void uvesafb_cn_callback(struct c
+ struct uvesafb_task *utask;
+ struct uvesafb_ktask *task;
+
++ if (!cap_raised(nsp->eff_cap, CAP_SYS_ADMIN))
++ return;
++
+ if (msg->seq >= UVESAFB_TASKS_MAX)
+ return;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
