]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
3.6-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 20 Nov 2012 00:18:15 +0000 (16:18 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 20 Nov 2012 00:18:15 +0000 (16:18 -0800)
added patches:
arm-dt-tegra-fix-length-of-pad-control-and-mux-registers.patch
arm-imx-ehci-fix-host-power-mask-bit.patch
bluetooth-fix-having-bogus-entries-in-mgmt_read_index_list-reply.patch
drm-i915-sdvo-clean-up-connectors-on-intel_sdvo_init-failures.patch
drm-radeon-fix-logic-error-in-atombios_encoders.c.patch
i2c-mux-pinctrl-fix-probe-error-path.patch
iwlwifi-handle-dma-mapping-failures.patch
kvm-x86-fix-invalid-secondary-exec-controls-in-vmx_cpuid_update.patch
m68k-fix-sigset_t-accessor-functions.patch
memcg-fix-hotplugged-memory-zone-oops.patch
memcg-oom-fix-totalpages-calculation-for-memory.swappiness-0.patch
pstore-fix-null-pointer-dereference-in-console-writes.patch
regulator-fix-voltage-check-in-regulator_is_supported_voltage.patch
revert-staging-android-alarm-ioctl-command-encoding-fix.patch
s390-gup-add-missing-task_size-check-to-get_user_pages_fast.patch
tmpfs-fix-shmem_getpage_gfp-vm_bug_on.patch
ttm-clear-the-ttm-page-allocated-from-high-memory-zone-correctly.patch
usb-keyspan-fix-typo-causing-gpf-on-open.patch
usb-option-add-alcatel-x220-x500d-usb-ids.patch
usb-option-add-novatel-e362-and-dell-wireless-5800-usb-ids.patch
usb-usb_wwan-fix-bulk-urb-allocation.patch
wireless-allow-40-mhz-on-world-roaming-channels-12-13.patch

23 files changed:
queue-3.6/arm-dt-tegra-fix-length-of-pad-control-and-mux-registers.patch [new file with mode: 0644]
queue-3.6/arm-imx-ehci-fix-host-power-mask-bit.patch [new file with mode: 0644]
queue-3.6/bluetooth-fix-having-bogus-entries-in-mgmt_read_index_list-reply.patch [new file with mode: 0644]
queue-3.6/drm-i915-sdvo-clean-up-connectors-on-intel_sdvo_init-failures.patch [new file with mode: 0644]
queue-3.6/drm-radeon-fix-logic-error-in-atombios_encoders.c.patch [new file with mode: 0644]
queue-3.6/i2c-mux-pinctrl-fix-probe-error-path.patch [new file with mode: 0644]
queue-3.6/iwlwifi-handle-dma-mapping-failures.patch [new file with mode: 0644]
queue-3.6/kvm-x86-fix-invalid-secondary-exec-controls-in-vmx_cpuid_update.patch [new file with mode: 0644]
queue-3.6/m68k-fix-sigset_t-accessor-functions.patch [new file with mode: 0644]
queue-3.6/memcg-fix-hotplugged-memory-zone-oops.patch [new file with mode: 0644]
queue-3.6/memcg-oom-fix-totalpages-calculation-for-memory.swappiness-0.patch [new file with mode: 0644]
queue-3.6/pstore-fix-null-pointer-dereference-in-console-writes.patch [new file with mode: 0644]
queue-3.6/regulator-fix-voltage-check-in-regulator_is_supported_voltage.patch [new file with mode: 0644]
queue-3.6/revert-staging-android-alarm-ioctl-command-encoding-fix.patch [new file with mode: 0644]
queue-3.6/s390-gup-add-missing-task_size-check-to-get_user_pages_fast.patch [new file with mode: 0644]
queue-3.6/series
queue-3.6/tmpfs-fix-shmem_getpage_gfp-vm_bug_on.patch [new file with mode: 0644]
queue-3.6/ttm-clear-the-ttm-page-allocated-from-high-memory-zone-correctly.patch [new file with mode: 0644]
queue-3.6/usb-keyspan-fix-typo-causing-gpf-on-open.patch [new file with mode: 0644]
queue-3.6/usb-option-add-alcatel-x220-x500d-usb-ids.patch [new file with mode: 0644]
queue-3.6/usb-option-add-novatel-e362-and-dell-wireless-5800-usb-ids.patch [new file with mode: 0644]
queue-3.6/usb-usb_wwan-fix-bulk-urb-allocation.patch [new file with mode: 0644]
queue-3.6/wireless-allow-40-mhz-on-world-roaming-channels-12-13.patch [new file with mode: 0644]

diff --git a/queue-3.6/arm-dt-tegra-fix-length-of-pad-control-and-mux-registers.patch b/queue-3.6/arm-dt-tegra-fix-length-of-pad-control-and-mux-registers.patch
new file mode 100644 (file)
index 0000000..59081e0
--- /dev/null
@@ -0,0 +1,33 @@
+From 322337b8fbd8c392246529d5db924820fc0c7381 Mon Sep 17 00:00:00 2001
+From: Pritesh Raithatha <praithatha@nvidia.com>
+Date: Tue, 30 Oct 2012 15:37:09 +0530
+Subject: ARM: dt: tegra: fix length of pad control and mux registers
+
+From: Pritesh Raithatha <praithatha@nvidia.com>
+
+commit 322337b8fbd8c392246529d5db924820fc0c7381 upstream.
+
+The reg property contains <base length> not <base last_offset>. Fix
+the length values to be length not last_offset.
+
+Signed-off-by: Pritesh Raithatha <praithatha@nvidia.com>
+Signed-off-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/tegra30.dtsi |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/tegra30.dtsi
++++ b/arch/arm/boot/dts/tegra30.dtsi
+@@ -73,8 +73,8 @@
+       pinmux: pinmux {
+               compatible = "nvidia,tegra30-pinmux";
+-              reg = <0x70000868 0xd0    /* Pad control registers */
+-                     0x70003000 0x3e0>; /* Mux registers */
++              reg = <0x70000868 0xd4    /* Pad control registers */
++                     0x70003000 0x3e4>; /* Mux registers */
+       };
+       serial@70006000 {
diff --git a/queue-3.6/arm-imx-ehci-fix-host-power-mask-bit.patch b/queue-3.6/arm-imx-ehci-fix-host-power-mask-bit.patch
new file mode 100644 (file)
index 0000000..54966f5
--- /dev/null
@@ -0,0 +1,46 @@
+From 3d5e2abe6e265acc5e1fda810301243e9bac92b2 Mon Sep 17 00:00:00 2001
+From: Christoph Fritz <chf.fritz@googlemail.com>
+Date: Fri, 16 Nov 2012 15:39:24 +0100
+Subject: ARM: imx: ehci: fix host power mask bit
+
+From: Christoph Fritz <chf.fritz@googlemail.com>
+
+commit 3d5e2abe6e265acc5e1fda810301243e9bac92b2 upstream.
+
+This patch sets HPM (Host power mask bit) to bit 16 according to i.MX
+Reference Manual. Falsely it was set to bit 8, but this controls pull-up
+Impedance.
+
+Reported-by: Michael Burkey <mdburkey@gmail.com>
+Signed-off-by: Christoph Fritz <chf.fritz@googlemail.com>
+Acked-by: Eric Bénard <eric@eukrea.com>
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-imx/ehci-imx25.c |    2 +-
+ arch/arm/mach-imx/ehci-imx35.c |    2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mach-imx/ehci-imx25.c
++++ b/arch/arm/mach-imx/ehci-imx25.c
+@@ -30,7 +30,7 @@
+ #define MX25_H1_SIC_SHIFT     21
+ #define MX25_H1_SIC_MASK      (0x3 << MX25_H1_SIC_SHIFT)
+ #define MX25_H1_PP_BIT                (1 << 18)
+-#define MX25_H1_PM_BIT                (1 << 8)
++#define MX25_H1_PM_BIT                (1 << 16)
+ #define MX25_H1_IPPUE_UP_BIT  (1 << 7)
+ #define MX25_H1_IPPUE_DOWN_BIT        (1 << 6)
+ #define MX25_H1_TLL_BIT               (1 << 5)
+--- a/arch/arm/mach-imx/ehci-imx35.c
++++ b/arch/arm/mach-imx/ehci-imx35.c
+@@ -30,7 +30,7 @@
+ #define MX35_H1_SIC_SHIFT     21
+ #define MX35_H1_SIC_MASK      (0x3 << MX35_H1_SIC_SHIFT)
+ #define MX35_H1_PP_BIT                (1 << 18)
+-#define MX35_H1_PM_BIT                (1 << 8)
++#define MX35_H1_PM_BIT                (1 << 16)
+ #define MX35_H1_IPPUE_UP_BIT  (1 << 7)
+ #define MX35_H1_IPPUE_DOWN_BIT        (1 << 6)
+ #define MX35_H1_TLL_BIT               (1 << 5)
diff --git a/queue-3.6/bluetooth-fix-having-bogus-entries-in-mgmt_read_index_list-reply.patch b/queue-3.6/bluetooth-fix-having-bogus-entries-in-mgmt_read_index_list-reply.patch
new file mode 100644 (file)
index 0000000..7246004
--- /dev/null
@@ -0,0 +1,59 @@
+From 476e44cb19f1fbf2d5883dddcc0ce31b33b45915 Mon Sep 17 00:00:00 2001
+From: Johan Hedberg <johan.hedberg@intel.com>
+Date: Fri, 19 Oct 2012 20:10:46 +0300
+Subject: Bluetooth: Fix having bogus entries in mgmt_read_index_list reply
+
+From: Johan Hedberg <johan.hedberg@intel.com>
+
+commit 476e44cb19f1fbf2d5883dddcc0ce31b33b45915 upstream.
+
+The mgmt_read_index_list uses one loop to calculate the max needed size
+of its response with the help of an upper-bound of the controller count.
+The second loop is more strict as it checks for HCI_SETUP (which might
+have gotten set after the first loop) and could result in some indexes
+being skipped. Because of this the function needs to readjust the event
+length and index count after filling in the response array.
+
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Acked-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/mgmt.c |   11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/net/bluetooth/mgmt.c
++++ b/net/bluetooth/mgmt.c
+@@ -321,7 +321,7 @@ static int read_index_list(struct sock *
+       struct hci_dev *d;
+       size_t rp_len;
+       u16 count;
+-      int i, err;
++      int err;
+       BT_DBG("sock %p", sk);
+@@ -339,17 +339,18 @@ static int read_index_list(struct sock *
+               return -ENOMEM;
+       }
+-      rp->num_controllers = cpu_to_le16(count);
+-
+-      i = 0;
++      count = 0;
+       list_for_each_entry(d, &hci_dev_list, list) {
+               if (test_bit(HCI_SETUP, &d->dev_flags))
+                       continue;
+-              rp->index[i++] = cpu_to_le16(d->id);
++              rp->index[count++] = cpu_to_le16(d->id);
+               BT_DBG("Added hci%u", d->id);
+       }
++      rp->num_controllers = cpu_to_le16(count);
++      rp_len = sizeof(*rp) + (2 * count);
++
+       read_unlock(&hci_dev_list_lock);
+       err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
diff --git a/queue-3.6/drm-i915-sdvo-clean-up-connectors-on-intel_sdvo_init-failures.patch b/queue-3.6/drm-i915-sdvo-clean-up-connectors-on-intel_sdvo_init-failures.patch
new file mode 100644 (file)
index 0000000..c7270f7
--- /dev/null
@@ -0,0 +1,83 @@
+From d0ddfbd3d1346c1f481ec2289eef350cdba64b42 Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Mon, 12 Nov 2012 18:31:35 +0200
+Subject: drm/i915/sdvo: clean up connectors on intel_sdvo_init() failures
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+commit d0ddfbd3d1346c1f481ec2289eef350cdba64b42 upstream.
+
+Any failures in intel_sdvo_init() after the intel_sdvo_setup_output() call
+left behind ghost connectors, attached (with a dangling pointer) to the
+sdvo that has been cleaned up and freed. Properly destroy any connectors
+attached to the encoder.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=46381
+CC: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Tested-by: bjo@nord-west.org
+[danvet: added a comment to explain why we need to clean up connectors
+even when sdvo_output_setup fails.]
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_sdvo.c |   22 +++++++++++++++++++---
+ 1 file changed, 19 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_sdvo.c
++++ b/drivers/gpu/drm/i915/intel_sdvo.c
+@@ -2287,6 +2287,18 @@ intel_sdvo_output_setup(struct intel_sdv
+       return true;
+ }
++static void intel_sdvo_output_cleanup(struct intel_sdvo *intel_sdvo)
++{
++      struct drm_device *dev = intel_sdvo->base.base.dev;
++      struct drm_connector *connector, *tmp;
++
++      list_for_each_entry_safe(connector, tmp,
++                               &dev->mode_config.connector_list, head) {
++              if (intel_attached_encoder(connector) == &intel_sdvo->base)
++                      intel_sdvo_destroy(connector);
++      }
++}
++
+ static bool intel_sdvo_tv_create_property(struct intel_sdvo *intel_sdvo,
+                                         struct intel_sdvo_connector *intel_sdvo_connector,
+                                         int type)
+@@ -2606,7 +2618,8 @@ bool intel_sdvo_init(struct drm_device *
+                                   intel_sdvo->caps.output_flags) != true) {
+               DRM_DEBUG_KMS("SDVO output failed to setup on %s\n",
+                             SDVO_NAME(intel_sdvo));
+-              goto err;
++              /* Output_setup can leave behind connectors! */
++              goto err_output;
+       }
+       /* Only enable the hotplug irq if we need it, to work around noisy
+@@ -2619,12 +2632,12 @@ bool intel_sdvo_init(struct drm_device *
+       /* Set the input timing to the screen. Assume always input 0. */
+       if (!intel_sdvo_set_target_input(intel_sdvo))
+-              goto err;
++              goto err_output;
+       if (!intel_sdvo_get_input_pixel_clock_range(intel_sdvo,
+                                                   &intel_sdvo->pixel_clock_min,
+                                                   &intel_sdvo->pixel_clock_max))
+-              goto err;
++              goto err_output;
+       DRM_DEBUG_KMS("%s device VID/DID: %02X:%02X.%02X, "
+                       "clock range %dMHz - %dMHz, "
+@@ -2644,6 +2657,9 @@ bool intel_sdvo_init(struct drm_device *
+                       (SDVO_OUTPUT_TMDS1 | SDVO_OUTPUT_RGB1) ? 'Y' : 'N');
+       return true;
++err_output:
++      intel_sdvo_output_cleanup(intel_sdvo);
++
+ err:
+       drm_encoder_cleanup(&intel_encoder->base);
+       i2c_del_adapter(&intel_sdvo->ddc);
diff --git a/queue-3.6/drm-radeon-fix-logic-error-in-atombios_encoders.c.patch b/queue-3.6/drm-radeon-fix-logic-error-in-atombios_encoders.c.patch
new file mode 100644 (file)
index 0000000..0a97d54
--- /dev/null
@@ -0,0 +1,32 @@
+From b9196395c905edec512dfd6690428084228c16ec Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 14 Nov 2012 09:10:39 -0500
+Subject: drm/radeon: fix logic error in atombios_encoders.c
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit b9196395c905edec512dfd6690428084228c16ec upstream.
+
+Fixes:
+https://bugzilla.kernel.org/show_bug.cgi?id=50431
+
+Reported-by: David Binderman <dcb314@hotmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/atombios_encoders.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -1421,7 +1421,7 @@ radeon_atom_encoder_dpms_dig(struct drm_
+                       atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_SETUP, 0, 0);
+                       atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
+                       /* some early dce3.2 boards have a bug in their transmitter control table */
+-                      if ((rdev->family != CHIP_RV710) || (rdev->family != CHIP_RV730))
++                      if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730))
+                               atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
+               }
+               if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
diff --git a/queue-3.6/i2c-mux-pinctrl-fix-probe-error-path.patch b/queue-3.6/i2c-mux-pinctrl-fix-probe-error-path.patch
new file mode 100644 (file)
index 0000000..58cf2b4
--- /dev/null
@@ -0,0 +1,31 @@
+From aa1e3e81e75ceb3d977c3292cefafcd5179eb8b8 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Tue, 13 Nov 2012 22:27:19 +0100
+Subject: i2c-mux-pinctrl: Fix probe error path
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit aa1e3e81e75ceb3d977c3292cefafcd5179eb8b8 upstream.
+
+When allocating the memory for i2c busses, the code checked the wrong
+variable and thus never detected if there was a memory error.
+
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Jean Delvare <khali@linux-fr.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/muxes/i2c-mux-pinctrl.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/muxes/i2c-mux-pinctrl.c
++++ b/drivers/i2c/muxes/i2c-mux-pinctrl.c
+@@ -169,7 +169,7 @@ static int __devinit i2c_mux_pinctrl_pro
+       mux->busses = devm_kzalloc(&pdev->dev,
+                                  sizeof(mux->busses) * mux->pdata->bus_count,
+                                  GFP_KERNEL);
+-      if (!mux->states) {
++      if (!mux->busses) {
+               dev_err(&pdev->dev, "Cannot allocate busses\n");
+               ret = -ENOMEM;
+               goto err;
diff --git a/queue-3.6/iwlwifi-handle-dma-mapping-failures.patch b/queue-3.6/iwlwifi-handle-dma-mapping-failures.patch
new file mode 100644 (file)
index 0000000..d4e8bf4
--- /dev/null
@@ -0,0 +1,62 @@
+From 7c34158231b2eda8dcbd297be2bb1559e69cb433 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Sun, 4 Nov 2012 09:29:17 +0100
+Subject: iwlwifi: handle DMA mapping failures
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 7c34158231b2eda8dcbd297be2bb1559e69cb433 upstream.
+
+The RX replenish code doesn't handle DMA mapping failures,
+which will cause issues if there actually is a failure. This
+was reported by Shuah Khan who found a DMA mapping framework
+warning ("device driver failed to check map error").
+
+Reported-by: Shuah Khan <shuah.khan@hp.com>
+Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/pcie/rx.c |   23 +++++++++++++++++++++--
+ 1 file changed, 21 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
+@@ -314,6 +314,14 @@ static void iwlagn_rx_allocate(struct iw
+                       dma_map_page(trans->dev, page, 0,
+                                    PAGE_SIZE << trans_pcie->rx_page_order,
+                                    DMA_FROM_DEVICE);
++              if (dma_mapping_error(trans->dev, rxb->page_dma)) {
++                      rxb->page = NULL;
++                      spin_lock_irqsave(&rxq->lock, flags);
++                      list_add(&rxb->list, &rxq->rx_used);
++                      spin_unlock_irqrestore(&rxq->lock, flags);
++                      __free_pages(page, trans_pcie->rx_page_order);
++                      return;
++              }
+               /* dma address must be no more than 36 bits */
+               BUG_ON(rxb->page_dma & ~DMA_BIT_MASK(36));
+               /* and also 256 byte aligned! */
+@@ -463,8 +471,19 @@ static void iwl_rx_handle_rxbuf(struct i
+                       dma_map_page(trans->dev, rxb->page, 0,
+                                    PAGE_SIZE << trans_pcie->rx_page_order,
+                                    DMA_FROM_DEVICE);
+-              list_add_tail(&rxb->list, &rxq->rx_free);
+-              rxq->free_count++;
++              if (dma_mapping_error(trans->dev, rxb->page_dma)) {
++                      /*
++                       * free the page(s) as well to not break
++                       * the invariant that the items on the used
++                       * list have no page(s)
++                       */
++                      __free_pages(rxb->page, trans_pcie->rx_page_order);
++                      rxb->page = NULL;
++                      list_add_tail(&rxb->list, &rxq->rx_used);
++              } else {
++                      list_add_tail(&rxb->list, &rxq->rx_free);
++                      rxq->free_count++;
++              }
+       } else
+               list_add_tail(&rxb->list, &rxq->rx_used);
+       spin_unlock_irqrestore(&rxq->lock, flags);
diff --git a/queue-3.6/kvm-x86-fix-invalid-secondary-exec-controls-in-vmx_cpuid_update.patch b/queue-3.6/kvm-x86-fix-invalid-secondary-exec-controls-in-vmx_cpuid_update.patch
new file mode 100644 (file)
index 0000000..eef804b
--- /dev/null
@@ -0,0 +1,74 @@
+From 29282fde80d44e587f8c152b10049a56e61659f0 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 9 Nov 2012 15:20:17 +0100
+Subject: KVM: x86: Fix invalid secondary exec controls in vmx_cpuid_update()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 29282fde80d44e587f8c152b10049a56e61659f0 upstream.
+
+The commit [ad756a16: KVM: VMX: Implement PCID/INVPCID for guests with
+EPT] introduced the unconditional access to SECONDARY_VM_EXEC_CONTROL,
+and this triggers kernel warnings like below on old CPUs:
+
+    vmwrite error: reg 401e value a0568000 (err 12)
+    Pid: 13649, comm: qemu-kvm Not tainted 3.7.0-rc4-test2+ #154
+    Call Trace:
+     [<ffffffffa0558d86>] vmwrite_error+0x27/0x29 [kvm_intel]
+     [<ffffffffa054e8cb>] vmcs_writel+0x1b/0x20 [kvm_intel]
+     [<ffffffffa054f114>] vmx_cpuid_update+0x74/0x170 [kvm_intel]
+     [<ffffffffa03629b6>] kvm_vcpu_ioctl_set_cpuid2+0x76/0x90 [kvm]
+     [<ffffffffa0341c67>] kvm_arch_vcpu_ioctl+0xc37/0xed0 [kvm]
+     [<ffffffff81143f7c>] ? __vunmap+0x9c/0x110
+     [<ffffffffa0551489>] ? vmx_vcpu_load+0x39/0x1a0 [kvm_intel]
+     [<ffffffffa0340ee2>] ? kvm_arch_vcpu_load+0x52/0x1a0 [kvm]
+     [<ffffffffa032dcd4>] ? vcpu_load+0x74/0xd0 [kvm]
+     [<ffffffffa032deb0>] kvm_vcpu_ioctl+0x110/0x5e0 [kvm]
+     [<ffffffffa032e93d>] ? kvm_dev_ioctl+0x4d/0x4a0 [kvm]
+     [<ffffffff8117dc6f>] do_vfs_ioctl+0x8f/0x530
+     [<ffffffff81139d76>] ? remove_vma+0x56/0x60
+     [<ffffffff8113b708>] ? do_munmap+0x328/0x400
+     [<ffffffff81187c8c>] ? fget_light+0x4c/0x100
+     [<ffffffff8117e1a1>] sys_ioctl+0x91/0xb0
+     [<ffffffff815a942d>] system_call_fastpath+0x1a/0x1f
+
+This patch adds a check for the availability of secondary exec
+control to avoid these warnings.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/vmx.c |   11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -6584,19 +6584,22 @@ static void vmx_cpuid_update(struct kvm_
+               }
+       }
+-      exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
+       /* Exposing INVPCID only when PCID is exposed */
+       best = kvm_find_cpuid_entry(vcpu, 0x7, 0);
+       if (vmx_invpcid_supported() &&
+           best && (best->ebx & bit(X86_FEATURE_INVPCID)) &&
+           guest_cpuid_has_pcid(vcpu)) {
++              exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
+               exec_control |= SECONDARY_EXEC_ENABLE_INVPCID;
+               vmcs_write32(SECONDARY_VM_EXEC_CONTROL,
+                            exec_control);
+       } else {
+-              exec_control &= ~SECONDARY_EXEC_ENABLE_INVPCID;
+-              vmcs_write32(SECONDARY_VM_EXEC_CONTROL,
+-                           exec_control);
++              if (cpu_has_secondary_exec_ctrls()) {
++                      exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
++                      exec_control &= ~SECONDARY_EXEC_ENABLE_INVPCID;
++                      vmcs_write32(SECONDARY_VM_EXEC_CONTROL,
++                                   exec_control);
++              }
+               if (best)
+                       best->ebx &= ~bit(X86_FEATURE_INVPCID);
+       }
diff --git a/queue-3.6/m68k-fix-sigset_t-accessor-functions.patch b/queue-3.6/m68k-fix-sigset_t-accessor-functions.patch
new file mode 100644 (file)
index 0000000..7312549
--- /dev/null
@@ -0,0 +1,54 @@
+From 34fa78b59c52d1db3513db4c1a999db26b2e9ac2 Mon Sep 17 00:00:00 2001
+From: Andreas Schwab <schwab@linux-m68k.org>
+Date: Sat, 17 Nov 2012 22:27:04 +0100
+Subject: m68k: fix sigset_t accessor functions
+
+From: Andreas Schwab <schwab@linux-m68k.org>
+
+commit 34fa78b59c52d1db3513db4c1a999db26b2e9ac2 upstream.
+
+The sigaddset/sigdelset/sigismember functions that are implemented with
+bitfield insn cannot allow the sigset argument to be placed in a data
+register since the sigset is wider than 32 bits.  Remove the "d"
+constraint from the asm statements.
+
+The effect of the bug is that sending RT signals does not work, the signal
+number is truncated modulo 32.
+
+Signed-off-by: Andreas Schwab <schwab@linux-m68k.org>
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/m68k/include/asm/signal.h |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/m68k/include/asm/signal.h
++++ b/arch/m68k/include/asm/signal.h
+@@ -156,7 +156,7 @@ typedef struct sigaltstack {
+ static inline void sigaddset(sigset_t *set, int _sig)
+ {
+       asm ("bfset %0{%1,#1}"
+-              : "+od" (*set)
++              : "+o" (*set)
+               : "id" ((_sig - 1) ^ 31)
+               : "cc");
+ }
+@@ -164,7 +164,7 @@ static inline void sigaddset(sigset_t *s
+ static inline void sigdelset(sigset_t *set, int _sig)
+ {
+       asm ("bfclr %0{%1,#1}"
+-              : "+od" (*set)
++              : "+o" (*set)
+               : "id" ((_sig - 1) ^ 31)
+               : "cc");
+ }
+@@ -180,7 +180,7 @@ static inline int __gen_sigismember(sigs
+       int ret;
+       asm ("bfextu %1{%2,#1},%0"
+               : "=d" (ret)
+-              : "od" (*set), "id" ((_sig-1) ^ 31)
++              : "o" (*set), "id" ((_sig-1) ^ 31)
+               : "cc");
+       return ret;
+ }
diff --git a/queue-3.6/memcg-fix-hotplugged-memory-zone-oops.patch b/queue-3.6/memcg-fix-hotplugged-memory-zone-oops.patch
new file mode 100644 (file)
index 0000000..61d9544
--- /dev/null
@@ -0,0 +1,205 @@
+From bea8c150a7efbc0f204e709b7274fe273f55e0d3 Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Fri, 16 Nov 2012 14:14:54 -0800
+Subject: memcg: fix hotplugged memory zone oops
+
+From: Hugh Dickins <hughd@google.com>
+
+commit bea8c150a7efbc0f204e709b7274fe273f55e0d3 upstream.
+
+When MEMCG is configured on (even when it's disabled by boot option),
+when adding or removing a page to/from its lru list, the zone pointer
+used for stats updates is nowadays taken from the struct lruvec.  (On
+many configurations, calculating zone from page is slower.)
+
+But we have no code to update all the lruvecs (per zone, per memcg) when
+a memory node is hotadded.  Here's an extract from the oops which
+results when running numactl to bind a program to a newly onlined node:
+
+  BUG: unable to handle kernel NULL pointer dereference at 0000000000000f60
+  IP:  __mod_zone_page_state+0x9/0x60
+  Pid: 1219, comm: numactl Not tainted 3.6.0-rc5+ #180 Bochs Bochs
+  Process numactl (pid: 1219, threadinfo ffff880039abc000, task ffff8800383c4ce0)
+  Call Trace:
+    __pagevec_lru_add_fn+0xdf/0x140
+    pagevec_lru_move_fn+0xb1/0x100
+    __pagevec_lru_add+0x1c/0x30
+    lru_add_drain_cpu+0xa3/0x130
+    lru_add_drain+0x2f/0x40
+   ...
+
+The natural solution might be to use a memcg callback whenever memory is
+hotadded; but that solution has not been scoped out, and it happens that
+we do have an easy location at which to update lruvec->zone.  The lruvec
+pointer is discovered either by mem_cgroup_zone_lruvec() or by
+mem_cgroup_page_lruvec(), and both of those do know the right zone.
+
+So check and set lruvec->zone in those; and remove the inadequate
+attempt to set lruvec->zone from lruvec_init(), which is called before
+NODE_DATA(node) has been allocated in such cases.
+
+Ah, there was one exceptionr.  For no particularly good reason,
+mem_cgroup_force_empty_list() has its own code for deciding lruvec.
+Change it to use the standard mem_cgroup_zone_lruvec() and
+mem_cgroup_get_lru_size() too.  In fact it was already safe against such
+an oops (the lru lists in danger could only be empty), but we're better
+proofed against future changes this way.
+
+I've marked this for stable (3.6) since we introduced the problem in 3.5
+(now closed to stable); but I have no idea if this is the only fix
+needed to get memory hotadd working with memcg in 3.6, and received no
+answer when I enquired twice before.
+
+Reported-by: Tang Chen <tangchen@cn.fujitsu.com>
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Konstantin Khlebnikov <khlebnikov@openvz.org>
+Cc: Wen Congyang <wency@cn.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/mmzone.h |    2 +-
+ mm/memcontrol.c        |   46 +++++++++++++++++++++++++++++++++++-----------
+ mm/mmzone.c            |    6 +-----
+ mm/page_alloc.c        |    2 +-
+ 4 files changed, 38 insertions(+), 18 deletions(-)
+
+--- a/include/linux/mmzone.h
++++ b/include/linux/mmzone.h
+@@ -744,7 +744,7 @@ extern int init_currently_empty_zone(str
+                                    unsigned long size,
+                                    enum memmap_context context);
+-extern void lruvec_init(struct lruvec *lruvec, struct zone *zone);
++extern void lruvec_init(struct lruvec *lruvec);
+ static inline struct zone *lruvec_zone(struct lruvec *lruvec)
+ {
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -1061,12 +1061,24 @@ struct lruvec *mem_cgroup_zone_lruvec(st
+                                     struct mem_cgroup *memcg)
+ {
+       struct mem_cgroup_per_zone *mz;
++      struct lruvec *lruvec;
+-      if (mem_cgroup_disabled())
+-              return &zone->lruvec;
++      if (mem_cgroup_disabled()) {
++              lruvec = &zone->lruvec;
++              goto out;
++      }
+       mz = mem_cgroup_zoneinfo(memcg, zone_to_nid(zone), zone_idx(zone));
+-      return &mz->lruvec;
++      lruvec = &mz->lruvec;
++out:
++      /*
++       * Since a node can be onlined after the mem_cgroup was created,
++       * we have to be prepared to initialize lruvec->zone here;
++       * and if offlined then reonlined, we need to reinitialize it.
++       */
++      if (unlikely(lruvec->zone != zone))
++              lruvec->zone = zone;
++      return lruvec;
+ }
+ /*
+@@ -1093,9 +1105,12 @@ struct lruvec *mem_cgroup_page_lruvec(st
+       struct mem_cgroup_per_zone *mz;
+       struct mem_cgroup *memcg;
+       struct page_cgroup *pc;
++      struct lruvec *lruvec;
+-      if (mem_cgroup_disabled())
+-              return &zone->lruvec;
++      if (mem_cgroup_disabled()) {
++              lruvec = &zone->lruvec;
++              goto out;
++      }
+       pc = lookup_page_cgroup(page);
+       memcg = pc->mem_cgroup;
+@@ -1113,7 +1128,16 @@ struct lruvec *mem_cgroup_page_lruvec(st
+               pc->mem_cgroup = memcg = root_mem_cgroup;
+       mz = page_cgroup_zoneinfo(memcg, page);
+-      return &mz->lruvec;
++      lruvec = &mz->lruvec;
++out:
++      /*
++       * Since a node can be onlined after the mem_cgroup was created,
++       * we have to be prepared to initialize lruvec->zone here;
++       * and if offlined then reonlined, we need to reinitialize it.
++       */
++      if (unlikely(lruvec->zone != zone))
++              lruvec->zone = zone;
++      return lruvec;
+ }
+ /**
+@@ -3703,17 +3727,17 @@ unsigned long mem_cgroup_soft_limit_recl
+ static bool mem_cgroup_force_empty_list(struct mem_cgroup *memcg,
+                               int node, int zid, enum lru_list lru)
+ {
+-      struct mem_cgroup_per_zone *mz;
++      struct lruvec *lruvec;
+       unsigned long flags, loop;
+       struct list_head *list;
+       struct page *busy;
+       struct zone *zone;
+       zone = &NODE_DATA(node)->node_zones[zid];
+-      mz = mem_cgroup_zoneinfo(memcg, node, zid);
+-      list = &mz->lruvec.lists[lru];
++      lruvec = mem_cgroup_zone_lruvec(zone, memcg);
++      list = &lruvec->lists[lru];
+-      loop = mz->lru_size[lru];
++      loop = mem_cgroup_get_lru_size(lruvec, lru);
+       /* give some margin against EBUSY etc...*/
+       loop += 256;
+       busy = NULL;
+@@ -4751,7 +4775,7 @@ static int alloc_mem_cgroup_per_zone_inf
+       for (zone = 0; zone < MAX_NR_ZONES; zone++) {
+               mz = &pn->zoneinfo[zone];
+-              lruvec_init(&mz->lruvec, &NODE_DATA(node)->node_zones[zone]);
++              lruvec_init(&mz->lruvec);
+               mz->usage_in_excess = 0;
+               mz->on_tree = false;
+               mz->memcg = memcg;
+--- a/mm/mmzone.c
++++ b/mm/mmzone.c
+@@ -87,7 +87,7 @@ int memmap_valid_within(unsigned long pf
+ }
+ #endif /* CONFIG_ARCH_HAS_HOLES_MEMORYMODEL */
+-void lruvec_init(struct lruvec *lruvec, struct zone *zone)
++void lruvec_init(struct lruvec *lruvec)
+ {
+       enum lru_list lru;
+@@ -95,8 +95,4 @@ void lruvec_init(struct lruvec *lruvec,
+       for_each_lru(lru)
+               INIT_LIST_HEAD(&lruvec->lists[lru]);
+-
+-#ifdef CONFIG_MEMCG
+-      lruvec->zone = zone;
+-#endif
+ }
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -4456,7 +4456,7 @@ static void __paginginit free_area_init_
+               zone->zone_pgdat = pgdat;
+               zone_pcp_init(zone);
+-              lruvec_init(&zone->lruvec, zone);
++              lruvec_init(&zone->lruvec);
+               if (!size)
+                       continue;
diff --git a/queue-3.6/memcg-oom-fix-totalpages-calculation-for-memory.swappiness-0.patch b/queue-3.6/memcg-oom-fix-totalpages-calculation-for-memory.swappiness-0.patch
new file mode 100644 (file)
index 0000000..5ebf53c
--- /dev/null
@@ -0,0 +1,88 @@
+From 9a5a8f19b43430752067ecaee62fc59e11e88fa6 Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko@suse.cz>
+Date: Fri, 16 Nov 2012 14:14:49 -0800
+Subject: memcg: oom: fix totalpages calculation for memory.swappiness==0
+
+From: Michal Hocko <mhocko@suse.cz>
+
+commit 9a5a8f19b43430752067ecaee62fc59e11e88fa6 upstream.
+
+oom_badness() takes a totalpages argument which says how many pages are
+available and it uses it as a base for the score calculation.  The value
+is calculated by mem_cgroup_get_limit which considers both limit and
+total_swap_pages (resp.  memsw portion of it).
+
+This is usually correct but since fe35004fbf9e ("mm: avoid swapping out
+with swappiness==0") we do not swap when swappiness is 0 which means
+that we cannot really use up all the totalpages pages.  This in turn
+confuses oom score calculation if the memcg limit is much smaller than
+the available swap because the used memory (capped by the limit) is
+negligible comparing to totalpages so the resulting score is too small
+if adj!=0 (typically task with CAP_SYS_ADMIN or non zero oom_score_adj).
+A wrong process might be selected as result.
+
+The problem can be worked around by checking mem_cgroup_swappiness==0
+and not considering swap at all in such a case.
+
+Signed-off-by: Michal Hocko <mhocko@suse.cz>
+Acked-by: David Rientjes <rientjes@google.com>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/cgroups/memory.txt |    4 ++++
+ mm/memcontrol.c                  |   21 +++++++++++++++------
+ 2 files changed, 19 insertions(+), 6 deletions(-)
+
+--- a/Documentation/cgroups/memory.txt
++++ b/Documentation/cgroups/memory.txt
+@@ -466,6 +466,10 @@ Note:
+ 5.3 swappiness
+ Similar to /proc/sys/vm/swappiness, but affecting a hierarchy of groups only.
++Please note that unlike the global swappiness, memcg knob set to 0
++really prevents from any swapping even if there is a swap storage
++available. This might lead to memcg OOM killer if there are no file
++pages to reclaim.
+ Following cgroups' swappiness can't be changed.
+ - root cgroup (uses /proc/sys/vm/swappiness).
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -1458,17 +1458,26 @@ static int mem_cgroup_count_children(str
+ static u64 mem_cgroup_get_limit(struct mem_cgroup *memcg)
+ {
+       u64 limit;
+-      u64 memsw;
+       limit = res_counter_read_u64(&memcg->res, RES_LIMIT);
+-      limit += total_swap_pages << PAGE_SHIFT;
+-      memsw = res_counter_read_u64(&memcg->memsw, RES_LIMIT);
+       /*
+-       * If memsw is finite and limits the amount of swap space available
+-       * to this memcg, return that limit.
++       * Do not consider swap space if we cannot swap due to swappiness
+        */
+-      return min(limit, memsw);
++      if (mem_cgroup_swappiness(memcg)) {
++              u64 memsw;
++
++              limit += total_swap_pages << PAGE_SHIFT;
++              memsw = res_counter_read_u64(&memcg->memsw, RES_LIMIT);
++
++              /*
++               * If memsw is finite and limits the amount of swap space
++               * available to this memcg, return that limit.
++               */
++              limit = min(limit, memsw);
++      }
++
++      return limit;
+ }
+ void mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask,
diff --git a/queue-3.6/pstore-fix-null-pointer-dereference-in-console-writes.patch b/queue-3.6/pstore-fix-null-pointer-dereference-in-console-writes.patch
new file mode 100644 (file)
index 0000000..2db6eaf
--- /dev/null
@@ -0,0 +1,43 @@
+From 70a6f46d7b0ec03653b9ab3f8063a9717a4a53ef Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Wed, 14 Nov 2012 11:49:53 +0000
+Subject: pstore: Fix NULL pointer dereference in console writes
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit 70a6f46d7b0ec03653b9ab3f8063a9717a4a53ef upstream.
+
+Passing a NULL id causes a NULL pointer deference in writers such as
+erst_writer and efi_pstore_write because they expect to update this id.
+Pass a dummy id instead.
+
+This avoids a cascade of oopses caused when the initial
+pstore_console_write passes a null which in turn causes writes to the
+console causing further oopses in subsequent pstore_console_write calls.
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Anton Vorontsov <anton.vorontsov@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/pstore/platform.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/pstore/platform.c
++++ b/fs/pstore/platform.c
+@@ -161,12 +161,13 @@ static void pstore_console_write(struct
+       while (s < e) {
+               unsigned long flags;
++              u64 id;
+               if (c > psinfo->bufsize)
+                       c = psinfo->bufsize;
+               spin_lock_irqsave(&psinfo->buf_lock, flags);
+               memcpy(psinfo->buf, s, c);
+-              psinfo->write(PSTORE_TYPE_CONSOLE, 0, NULL, 0, c, psinfo);
++              psinfo->write(PSTORE_TYPE_CONSOLE, 0, &id, 0, c, psinfo);
+               spin_unlock_irqrestore(&psinfo->buf_lock, flags);
+               s += c;
+               c = e - s;
diff --git a/queue-3.6/regulator-fix-voltage-check-in-regulator_is_supported_voltage.patch b/queue-3.6/regulator-fix-voltage-check-in-regulator_is_supported_voltage.patch
new file mode 100644 (file)
index 0000000..ecd7691
--- /dev/null
@@ -0,0 +1,31 @@
+From f0f98b19e23d4426ca185e3d4ca80e6aff5ef51b Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Tue, 13 Nov 2012 09:48:51 +0100
+Subject: regulator: fix voltage check in regulator_is_supported_voltage()
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+commit f0f98b19e23d4426ca185e3d4ca80e6aff5ef51b upstream.
+
+regulator_is_supported_voltage() should return true only if the voltage
+of fixed/constant regulator is between min_uV and max_uV.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/core.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1942,7 +1942,7 @@ int regulator_is_supported_voltage(struc
+       if (!(rdev->constraints->valid_ops_mask & REGULATOR_CHANGE_VOLTAGE)) {
+               ret = regulator_get_voltage(regulator);
+               if (ret >= 0)
+-                      return (min_uV >= ret && ret <= max_uV);
++                      return (min_uV <= ret && ret <= max_uV);
+               else
+                       return ret;
+       }
diff --git a/queue-3.6/revert-staging-android-alarm-ioctl-command-encoding-fix.patch b/queue-3.6/revert-staging-android-alarm-ioctl-command-encoding-fix.patch
new file mode 100644 (file)
index 0000000..9e9a19e
--- /dev/null
@@ -0,0 +1,39 @@
+From d38e0e3fed4f58bcddef4dc93a591dfe2f651cb0 Mon Sep 17 00:00:00 2001
+From: Colin Cross <ccross@android.com>
+Date: Wed, 7 Nov 2012 18:21:51 -0800
+Subject: Revert "Staging: Android alarm: IOCTL command encoding fix"
+
+From: Colin Cross <ccross@android.com>
+
+commit d38e0e3fed4f58bcddef4dc93a591dfe2f651cb0 upstream.
+
+Commit 6bd4a5d96c08dc2380f8053b1bd4f879f55cd3c9 changed the
+ANDROID_ALARM_GET_TIME ioctls from IOW to IOR.  While technically
+correct, the _IOC_DIR bits are ignored by alarm_ioctl, so the
+commit breaks a userspace ABI used by all existing Android devices
+for a purely cosmetic reason.  Revert it.
+
+Cc: Dae S. Kim <dae@velatum.com>
+Signed-off-by: Colin Cross <ccross@android.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/android/android_alarm.h |    4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/staging/android/android_alarm.h
++++ b/drivers/staging/android/android_alarm.h
+@@ -51,12 +51,10 @@ enum android_alarm_return_flags {
+ #define ANDROID_ALARM_WAIT                  _IO('a', 1)
+ #define ALARM_IOW(c, type, size)            _IOW('a', (c) | ((type) << 4), size)
+-#define ALARM_IOR(c, type, size)            _IOR('a', (c) | ((type) << 4), size)
+-
+ /* Set alarm */
+ #define ANDROID_ALARM_SET(type)             ALARM_IOW(2, type, struct timespec)
+ #define ANDROID_ALARM_SET_AND_WAIT(type)    ALARM_IOW(3, type, struct timespec)
+-#define ANDROID_ALARM_GET_TIME(type)        ALARM_IOR(4, type, struct timespec)
++#define ANDROID_ALARM_GET_TIME(type)        ALARM_IOW(4, type, struct timespec)
+ #define ANDROID_ALARM_SET_RTC               _IOW('a', 5, struct timespec)
+ #define ANDROID_ALARM_BASE_CMD(cmd)         (cmd & ~(_IOC(0, 0, 0xf0, 0)))
+ #define ANDROID_ALARM_IOCTL_TO_TYPE(cmd)    (_IOC_NR(cmd) >> 4)
diff --git a/queue-3.6/s390-gup-add-missing-task_size-check-to-get_user_pages_fast.patch b/queue-3.6/s390-gup-add-missing-task_size-check-to-get_user_pages_fast.patch
new file mode 100644 (file)
index 0000000..fabcfc7
--- /dev/null
@@ -0,0 +1,36 @@
+From d55c4c613fc4d4ad2ba0fc6fa2b57176d420f7e4 Mon Sep 17 00:00:00 2001
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+Date: Mon, 22 Oct 2012 15:49:02 +0200
+Subject: s390/gup: add missing TASK_SIZE check to get_user_pages_fast()
+
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+
+commit d55c4c613fc4d4ad2ba0fc6fa2b57176d420f7e4 upstream.
+
+When walking page tables we need to make sure that everything
+is within bounds of the ASCE limit of the task's address space.
+Otherwise we might calculate e.g. a pud pointer which is not
+within a pud and dereference it.
+So check against TASK_SIZE (which is the ASCE limit) before
+walking page tables.
+
+Reviewed-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/mm/gup.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/mm/gup.c
++++ b/arch/s390/mm/gup.c
+@@ -183,7 +183,7 @@ int get_user_pages_fast(unsigned long st
+       addr = start;
+       len = (unsigned long) nr_pages << PAGE_SHIFT;
+       end = start + len;
+-      if (end < start)
++      if ((end < start) || (end > TASK_SIZE))
+               goto slow_irqon;
+       /*
index 135519fc1c8a92a21b795508878bb712e1def77f..f66bbe953c4a4e02b3693b58b55d3570c325e0c7 100644 (file)
@@ -29,3 +29,25 @@ asoc-dapm-use-card_list-during-dapm-shutdown.patch
 asoc-core-double-control-update-err-for-snd_soc_put_volsw_sx.patch
 ubifs-fix-mounting-problems-after-power-cuts.patch
 ubifs-introduce-categorized-lprops-counter.patch
+pstore-fix-null-pointer-dereference-in-console-writes.patch
+regulator-fix-voltage-check-in-regulator_is_supported_voltage.patch
+i2c-mux-pinctrl-fix-probe-error-path.patch
+arm-imx-ehci-fix-host-power-mask-bit.patch
+arm-dt-tegra-fix-length-of-pad-control-and-mux-registers.patch
+revert-staging-android-alarm-ioctl-command-encoding-fix.patch
+s390-gup-add-missing-task_size-check-to-get_user_pages_fast.patch
+usb-keyspan-fix-typo-causing-gpf-on-open.patch
+usb-usb_wwan-fix-bulk-urb-allocation.patch
+usb-option-add-novatel-e362-and-dell-wireless-5800-usb-ids.patch
+usb-option-add-alcatel-x220-x500d-usb-ids.patch
+drm-i915-sdvo-clean-up-connectors-on-intel_sdvo_init-failures.patch
+drm-radeon-fix-logic-error-in-atombios_encoders.c.patch
+tmpfs-fix-shmem_getpage_gfp-vm_bug_on.patch
+kvm-x86-fix-invalid-secondary-exec-controls-in-vmx_cpuid_update.patch
+ttm-clear-the-ttm-page-allocated-from-high-memory-zone-correctly.patch
+memcg-oom-fix-totalpages-calculation-for-memory.swappiness-0.patch
+memcg-fix-hotplugged-memory-zone-oops.patch
+iwlwifi-handle-dma-mapping-failures.patch
+wireless-allow-40-mhz-on-world-roaming-channels-12-13.patch
+bluetooth-fix-having-bogus-entries-in-mgmt_read_index_list-reply.patch
+m68k-fix-sigset_t-accessor-functions.patch
diff --git a/queue-3.6/tmpfs-fix-shmem_getpage_gfp-vm_bug_on.patch b/queue-3.6/tmpfs-fix-shmem_getpage_gfp-vm_bug_on.patch
new file mode 100644 (file)
index 0000000..722ac12
--- /dev/null
@@ -0,0 +1,70 @@
+From 215c02bc33bbd5ff4d7379a909462d11f0103218 Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Fri, 16 Nov 2012 14:15:03 -0800
+Subject: tmpfs: fix shmem_getpage_gfp() VM_BUG_ON
+
+From: Hugh Dickins <hughd@google.com>
+
+commit 215c02bc33bbd5ff4d7379a909462d11f0103218 upstream.
+
+Fuzzing with trinity hit the "impossible" VM_BUG_ON(error) (which Fedora
+has converted to WARNING) in shmem_getpage_gfp():
+
+  WARNING: at mm/shmem.c:1151 shmem_getpage_gfp+0xa5c/0xa70()
+  Pid: 29795, comm: trinity-child4 Not tainted 3.7.0-rc2+ #49
+  Call Trace:
+    warn_slowpath_common+0x7f/0xc0
+    warn_slowpath_null+0x1a/0x20
+    shmem_getpage_gfp+0xa5c/0xa70
+    shmem_fault+0x4f/0xa0
+    __do_fault+0x71/0x5c0
+    handle_pte_fault+0x97/0xae0
+    handle_mm_fault+0x289/0x350
+    __do_page_fault+0x18e/0x530
+    do_page_fault+0x2b/0x50
+    page_fault+0x28/0x30
+    tracesys+0xe1/0xe6
+
+Thanks to Johannes for pointing to truncation: free_swap_and_cache()
+only does a trylock on the page, so the page lock we've held since
+before confirming swap is not enough to protect against truncation.
+
+What cleanup is needed in this case? Just delete_from_swap_cache(),
+which takes care of the memcg uncharge.
+
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Reported-by: Dave Jones <davej@redhat.com>
+Cc: Johannes Weiner <hannes@cmpxchg.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/shmem.c |   16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -1156,8 +1156,20 @@ repeat:
+               if (!error) {
+                       error = shmem_add_to_page_cache(page, mapping, index,
+                                               gfp, swp_to_radix_entry(swap));
+-                      /* We already confirmed swap, and make no allocation */
+-                      VM_BUG_ON(error);
++                      /*
++                       * We already confirmed swap under page lock, and make
++                       * no memory allocation here, so usually no possibility
++                       * of error; but free_swap_and_cache() only trylocks a
++                       * page, so it is just possible that the entry has been
++                       * truncated or holepunched since swap was confirmed.
++                       * shmem_undo_range() will have done some of the
++                       * unaccounting, now delete_from_swap_cache() will do
++                       * the rest (including mem_cgroup_uncharge_swapcache).
++                       * Reset swap.val? No, leave it so "failed" goes back to
++                       * "repeat": reading a hole and writing should succeed.
++                       */
++                      if (error)
++                              delete_from_swap_cache(page);
+               }
+               if (error)
+                       goto failed;
diff --git a/queue-3.6/ttm-clear-the-ttm-page-allocated-from-high-memory-zone-correctly.patch b/queue-3.6/ttm-clear-the-ttm-page-allocated-from-high-memory-zone-correctly.patch
new file mode 100644 (file)
index 0000000..0c968c1
--- /dev/null
@@ -0,0 +1,38 @@
+From ac207ed2471150e06af0afc76e4becc701fa2733 Mon Sep 17 00:00:00 2001
+From: Zhao Yakui <yakui.zhao@intel.com>
+Date: Tue, 13 Nov 2012 18:31:55 +0000
+Subject: ttm: Clear the ttm page allocated from high memory zone correctly
+
+From: Zhao Yakui <yakui.zhao@intel.com>
+
+commit ac207ed2471150e06af0afc76e4becc701fa2733 upstream.
+
+The TTM page can be allocated from high memory. In such case it is
+wrong to use the page_address(page) as the virtual address for the high memory
+page.
+
+bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=50241
+
+Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
+Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/ttm/ttm_page_alloc.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+@@ -749,7 +749,10 @@ static int ttm_get_pages(struct page **p
+       /* clear the pages coming from the pool if requested */
+       if (flags & TTM_PAGE_FLAG_ZERO_ALLOC) {
+               list_for_each_entry(p, &plist, lru) {
+-                      clear_page(page_address(p));
++                      if (PageHighMem(p))
++                              clear_highpage(p);
++                      else
++                              clear_page(page_address(p));
+               }
+       }
diff --git a/queue-3.6/usb-keyspan-fix-typo-causing-gpf-on-open.patch b/queue-3.6/usb-keyspan-fix-typo-causing-gpf-on-open.patch
new file mode 100644 (file)
index 0000000..e9f3773
--- /dev/null
@@ -0,0 +1,42 @@
+From f0e3e35c9049087172c65302b42da8fe7ebb63a8 Mon Sep 17 00:00:00 2001
+From: Bjørn Mork <bjorn@mork.no>
+Date: Sat, 10 Nov 2012 10:13:42 +0100
+Subject: USB: keyspan: fix typo causing GPF on open
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit f0e3e35c9049087172c65302b42da8fe7ebb63a8 upstream.
+
+Commit f79b2d0f (USB: keyspan: fix NULL-pointer dereferences and
+memory leaks) had a small typo which made the driver use wrong
+offsets when mapping serial port private data.  This results in
+in a GPF when the port is opened.
+
+Reported-by: Richard <richjunk@pacbell.net>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Acked-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/keyspan.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/keyspan.c
++++ b/drivers/usb/serial/keyspan.c
+@@ -2448,7 +2448,7 @@ static void keyspan_release(struct usb_s
+ static int keyspan_port_probe(struct usb_serial_port *port)
+ {
+       struct usb_serial *serial = port->serial;
+-      struct keyspan_port_private *s_priv;
++      struct keyspan_serial_private *s_priv;
+       struct keyspan_port_private *p_priv;
+       const struct keyspan_device_details *d_details;
+       struct callbacks *cback;
+@@ -2463,7 +2463,6 @@ static int keyspan_port_probe(struct usb
+       if (!p_priv)
+               return -ENOMEM;
+-      s_priv = usb_get_serial_data(port->serial);
+       p_priv->device_details = d_details;
+       /* Setup values for the various callback routines */
diff --git a/queue-3.6/usb-option-add-alcatel-x220-x500d-usb-ids.patch b/queue-3.6/usb-option-add-alcatel-x220-x500d-usb-ids.patch
new file mode 100644 (file)
index 0000000..7a17a36
--- /dev/null
@@ -0,0 +1,34 @@
+From c0bc3098871dd9b964f6b45ec1e4d70d87811744 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dcbw@redhat.com>
+Date: Thu, 8 Nov 2012 11:56:53 -0600
+Subject: USB: option: add Alcatel X220/X500D USB IDs
+
+From: Dan Williams <dcbw@redhat.com>
+
+commit c0bc3098871dd9b964f6b45ec1e4d70d87811744 upstream.
+
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -287,6 +287,7 @@ static void option_instat_callback(struc
+ /* ALCATEL PRODUCTS */
+ #define ALCATEL_VENDOR_ID                     0x1bbb
+ #define ALCATEL_PRODUCT_X060S_X200            0x0000
++#define ALCATEL_PRODUCT_X220_X500D            0x0017
+ #define PIRELLI_VENDOR_ID                     0x1266
+ #define PIRELLI_PRODUCT_C100_1                        0x1002
+@@ -1164,6 +1165,7 @@ static const struct usb_device_id option
+       { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
+         .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist
+       },
++      { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D) },
+       { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
+       { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
+       { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
diff --git a/queue-3.6/usb-option-add-novatel-e362-and-dell-wireless-5800-usb-ids.patch b/queue-3.6/usb-option-add-novatel-e362-and-dell-wireless-5800-usb-ids.patch
new file mode 100644 (file)
index 0000000..461a1ee
--- /dev/null
@@ -0,0 +1,55 @@
+From fcb21645f1bd86d2be29baf48aa1b298de52ccc7 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dcbw@redhat.com>
+Date: Thu, 8 Nov 2012 11:56:42 -0600
+Subject: USB: option: add Novatel E362 and Dell Wireless 5800 USB IDs
+
+From: Dan Williams <dcbw@redhat.com>
+
+commit fcb21645f1bd86d2be29baf48aa1b298de52ccc7 upstream.
+
+The Dell 5800 appears to be a simple rebrand of the Novatel E362.
+
+Signed-off-by: Dan Williams <dcbw@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -158,6 +158,7 @@ static void option_instat_callback(struc
+ #define NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_HIGHSPEED       0x8001
+ #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED       0x9000
+ #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED       0x9001
++#define NOVATELWIRELESS_PRODUCT_E362          0x9010
+ #define NOVATELWIRELESS_PRODUCT_G1            0xA001
+ #define NOVATELWIRELESS_PRODUCT_G1_M          0xA002
+ #define NOVATELWIRELESS_PRODUCT_G2            0xA010
+@@ -193,6 +194,9 @@ static void option_instat_callback(struc
+ #define DELL_PRODUCT_5730_MINICARD_TELUS      0x8181
+ #define DELL_PRODUCT_5730_MINICARD_VZW                0x8182
++#define DELL_PRODUCT_5800_MINICARD_VZW                0x8195  /* Novatel E362 */
++#define DELL_PRODUCT_5800_V2_MINICARD_VZW     0x8196  /* Novatel E362 */
++
+ #define KYOCERA_VENDOR_ID                     0x0c88
+ #define KYOCERA_PRODUCT_KPC650                        0x17da
+ #define KYOCERA_PRODUCT_KPC680                        0x180a
+@@ -706,6 +710,7 @@ static const struct usb_device_id option
+       { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G2) },
+       /* Novatel Ovation MC551 a.k.a. Verizon USB551L */
+       { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) },
++      { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E362, 0xff, 0xff, 0xff) },
+       { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) },
+       { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) },
+@@ -728,6 +733,8 @@ static const struct usb_device_id option
+       { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_SPRINT) },      /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */
+       { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_TELUS) },       /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */
+       { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_VZW) },         /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */
++      { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5800_MINICARD_VZW, 0xff, 0xff, 0xff) },
++      { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5800_V2_MINICARD_VZW, 0xff, 0xff, 0xff) },
+       { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) },   /* ADU-E100, ADU-310 */
+       { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
+       { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) },
diff --git a/queue-3.6/usb-usb_wwan-fix-bulk-urb-allocation.patch b/queue-3.6/usb-usb_wwan-fix-bulk-urb-allocation.patch
new file mode 100644 (file)
index 0000000..397c37d
--- /dev/null
@@ -0,0 +1,54 @@
+From 8e493ca1767d4951ed1322abaa74d6edbca29918 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Fri, 26 Oct 2012 18:44:20 +0200
+Subject: USB: usb_wwan: fix bulk-urb allocation
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 8e493ca1767d4951ed1322abaa74d6edbca29918 upstream.
+
+Make sure we do not allocate urbs if we do not have a bulk endpoint.
+
+Legacy code used incorrect assumption to test for bulk endpoints.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/usb_wwan.c |   10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/serial/usb_wwan.c
++++ b/drivers/usb/serial/usb_wwan.c
+@@ -455,9 +455,6 @@ static struct urb *usb_wwan_setup_urb(st
+       struct usb_serial *serial = port->serial;
+       struct urb *urb;
+-      if (endpoint == -1)
+-              return NULL;    /* endpoint not needed */
+-
+       urb = usb_alloc_urb(0, GFP_KERNEL);     /* No ISO */
+       if (urb == NULL) {
+               dbg("%s: alloc for endpoint %d failed.", __func__, endpoint);
+@@ -487,6 +484,9 @@ int usb_wwan_port_probe(struct usb_seria
+       init_usb_anchor(&portdata->delayed);
+       for (i = 0; i < N_IN_URB; i++) {
++              if (!port->bulk_in_size)
++                      break;
++
+               buffer = (u8 *)__get_free_page(GFP_KERNEL);
+               if (!buffer)
+                       goto bail_out_error;
+@@ -499,8 +499,8 @@ int usb_wwan_port_probe(struct usb_seria
+               portdata->in_urbs[i] = urb;
+       }
+       for (i = 0; i < N_OUT_URB; i++) {
+-              if (port->bulk_out_endpointAddress == -1)
+-                      continue;
++              if (!port->bulk_out_size)
++                      break;
+               buffer = kmalloc(OUT_BUFLEN, GFP_KERNEL);
+               if (!buffer)
diff --git a/queue-3.6/wireless-allow-40-mhz-on-world-roaming-channels-12-13.patch b/queue-3.6/wireless-allow-40-mhz-on-world-roaming-channels-12-13.patch
new file mode 100644 (file)
index 0000000..d607706
--- /dev/null
@@ -0,0 +1,37 @@
+From 43c771a1963ab461a2f194e3c97fded1d5fe262f Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 12 Nov 2012 10:51:34 +0100
+Subject: wireless: allow 40 MHz on world roaming channels 12/13
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 43c771a1963ab461a2f194e3c97fded1d5fe262f upstream.
+
+When in world roaming mode, allow 40 MHz to be used
+on channels 12 and 13 so that an AP that is, e.g.,
+using HT40+ on channel 9 (in the UK) can be used.
+
+Reported-by: Eddie Chapman <eddie@ehuk.net>
+Tested-by: Eddie Chapman <eddie@ehuk.net>
+Acked-by: Luis R. Rodriguez <mcgrof@qca.qualcomm.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/reg.c |    5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -141,9 +141,8 @@ static const struct ieee80211_regdomain
+       .reg_rules = {
+               /* IEEE 802.11b/g, channels 1..11 */
+               REG_RULE(2412-10, 2462+10, 40, 6, 20, 0),
+-              /* IEEE 802.11b/g, channels 12..13. No HT40
+-               * channel fits here. */
+-              REG_RULE(2467-10, 2472+10, 20, 6, 20,
++              /* IEEE 802.11b/g, channels 12..13. */
++              REG_RULE(2467-10, 2472+10, 40, 6, 20,
+                       NL80211_RRF_PASSIVE_SCAN |
+                       NL80211_RRF_NO_IBSS),
+               /* IEEE 802.11 channel 14 - Only JP enables